You are on page 1of 524

M I C R O S O F T

20411B

L E A R N I N G

P R O D U C T

Administering Windows Server 2012

MCT USE ONLY. STUDENT USE PROHIBITED

O F F I C I A L

Administering Windows Server 2012

MCT USE ONLY. STUDENT USE PROHIBITED

ii

Information in this document, including URL and other Internet Web site references, is subject to change
without notice. Unless otherwise noted, the example companies, organizations, products, domain names,
e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with
any real company, organization, product, domain name, e-mail address, logo, person, place or event is
intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the
user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in
or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical,
photocopying, recording, or otherwise), or for any purpose, without the express written permission of
Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property
rights covering subject matter in this document. Except as expressly provided in any written license
agreement from Microsoft, the furnishing of this document does not give you any license to these
patents, trademarks, copyrights, or other intellectual property.

The names of manufacturers, products, or URLs are provided for informational purposes only and
Microsoft makes no representations and warranties, either expressed, implied, or statutory, regarding
these manufacturers or the use of the products with any Microsoft technologies. The inclusion of a
manufacturer or product does not imply endorsement of Microsoft of the manufacturer or product. Links
may be provided to third party sites. Such sites are not under the control of Microsoft and Microsoft is not
responsible for the contents of any linked site or any link contained in a linked site, or any changes or
updates to such sites. Microsoft is not responsible for webcasting or any other form of transmission
received from any linked site. Microsoft is providing these links to you only as a convenience, and the
inclusion of any link does not imply endorsement of Microsoft of the site or the products contained
therein.
2012 Microsoft Corporation. All rights reserved.
Microsoft and the trademarks listed at http://www.microsoft.com/about/legal/en/us/IntellectualProperty
/Trademarks/EN-US.aspx are trademarks of the Microsoft group of companies. All other trademarks are
property of their respective owners

Product Number: 20411B


Part Number: X18-77105
Released: 12/2012

MCT USE ONLY. STUDENT USE PROHIBITED

MICROSOFT LICENSE TERMS


OFFICIAL MICROSOFT LEARNING PRODUCTS
MICROSOFT OFFICIAL COURSE Pre-Release and Final Release Versions

These license terms are an agreement between Microsoft Corporation and you. Please read them. They apply to
the Licensed Content named above, which includes the media on which you received it, if any. These license
terms also apply to any updates, supplements, internet based services and support services for the Licensed
Content, unless other terms accompany those items. If so, those terms apply.
BY DOWNLOADING OR USING THE LICENSED CONTENT, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT
THEM, DO NOT DOWNLOAD OR USE THE LICENSED CONTENT.
If you comply with these license terms, you have the rights below.
1.

DEFINITIONS.

a. Authorized Learning Center means a Microsoft Learning Competency Member, Microsoft IT Academy
Program Member, or such other entity as Microsoft may designate from time to time.
b. Authorized Training Session means the Microsoft-authorized instructor-led training class using only
MOC Courses that are conducted by a MCT at or through an Authorized Learning Center.

c. Classroom Device means one (1) dedicated, secure computer that you own or control that meets or
exceeds the hardware level specified for the particular MOC Course located at your training facilities or
primary business location.
d. End User means an individual who is (i) duly enrolled for an Authorized Training Session or Private
Training Session, (ii) an employee of a MPN Member, or (iii) a Microsoft full-time employee.
e. Licensed Content means the MOC Course and any other content accompanying this agreement.
Licensed Content may include (i) Trainer Content, (ii) software, and (iii) associated media.
f.

Microsoft Certified Trainer or MCT means an individual who is (i) engaged to teach a training session
to End Users on behalf of an Authorized Learning Center or MPN Member, (ii) currently certified as a
Microsoft Certified Trainer under the Microsoft Certification Program, and (iii) holds a Microsoft
Certification in the technology that is the subject of the training session.

g. Microsoft IT Academy Member means a current, active member of the Microsoft IT Academy
Program.

h. Microsoft Learning Competency Member means a Microsoft Partner Network Program Member in
good standing that currently holds the Learning Competency status.
i.

Microsoft Official Course or MOC Course means the Official Microsoft Learning Product instructorled courseware that educates IT professionals or developers on Microsoft technologies.

MCT USE ONLY. STUDENT USE PROHIBITED

j.

Microsoft Partner Network Member or MPN Member means a silver or gold-level Microsoft Partner
Network program member in good standing.

k. Personal Device means one (1) device, workstation or other digital electronic device that you
personally own or control that meets or exceeds the hardware level specified for the particular MOC
Course.
l. Private Training Session means the instructor-led training classes provided by MPN Members for
corporate customers to teach a predefined learning objective. These classes are not advertised or
promoted to the general public and class attendance is restricted to individuals employed by or
contracted by the corporate customer.

m. Trainer Content means the trainer version of the MOC Course and additional content designated
solely for trainers to use to teach a training session using a MOC Course. Trainer Content may include
Microsoft PowerPoint presentations, instructor notes, lab setup guide, demonstration guides, beta
feedback form and trainer preparation guide for the MOC Course. To clarify, Trainer Content does not
include virtual hard disks or virtual machines.
2.

INSTALLATION AND USE RIGHTS. The Licensed Content is licensed not sold. The Licensed Content is
licensed on a one copy per user basis, such that you must acquire a license for each individual that
accesses or uses the Licensed Content.
2.1

Below are four separate sets of installation and use rights. Only one set of rights apply to you.

a. If you are a Authorized Learning Center:


i. If the Licensed Content is in digital format for each license you acquire you may either:
1. install one (1) copy of the Licensed Content in the form provided to you on a dedicated, secure
server located on your premises where the Authorized Training Session is held for access and
use by one (1) End User attending the Authorized Training Session, or by one (1) MCT teaching
the Authorized Training Session, or
2. install one (1) copy of the Licensed Content in the form provided to you on one (1) Classroom
Device for access and use by one (1) End User attending the Authorized Training Session, or by
one (1) MCT teaching the Authorized Training Session.
ii. You agree that:
1. you will acquire a license for each End User and MCT that accesses the Licensed Content,
2. each End User and MCT will be presented with a copy of this agreement and each individual
will agree that their use of the Licensed Content will be subject to these license terms prior to
their accessing the Licensed Content. Each individual will be required to denote their
acceptance of the EULA in a manner that is enforceable under local law prior to their accessing
the Licensed Content,
3. for all Authorized Training Sessions, you will only use qualified MCTs who hold the applicable
competency to teach the particular MOC Course that is the subject of the training session,
4. you will not alter or remove any copyright or other protective notices contained in the
Licensed Content,

MCT USE ONLY. STUDENT USE PROHIBITED

5. you will remove and irretrievably delete all Licensed Content from all Classroom Devices and
servers at the end of the Authorized Training Session,
6. you will only provide access to the Licensed Content to End Users and MCTs,
7. you will only provide access to the Trainer Content to MCTs, and
8. any Licensed Content installed for use during a training session will be done in accordance
with the applicable classroom set-up guide.

b. If you are a MPN Member.


i. If the Licensed Content is in digital format for each license you acquire you may either:
1. install one (1) copy of the Licensed Content in the form provided to you on (A) one (1)
Classroom Device, or (B) one (1) dedicated, secure server located at your premises where
the training session is held for use by one (1) of your employees attending a training session
provided by you, or by one (1) MCT that is teaching the training session, or
2. install one (1) copy of the Licensed Content in the form provided to you on one (1)
Classroom Device for use by one (1) End User attending a Private Training Session, or one (1)
MCT that is teaching the Private Training Session.
ii. You agree that:
1. you will acquire a license for each End User and MCT that accesses the Licensed Content,
2. each End User and MCT will be presented with a copy of this agreement and each individual
will agree that their use of the Licensed Content will be subject to these license terms prior
to their accessing the Licensed Content. Each individual will be required to denote their
acceptance of the EULA in a manner that is enforceable under local law prior to their
accessing the Licensed Content,
3. for all training sessions, you will only use qualified MCTs who hold the applicable
competency to teach the particular MOC Course that is the subject of the training session,
4. you will not alter or remove any copyright or other protective notices contained in the
Licensed Content,
5. you will remove and irretrievably delete all Licensed Content from all Classroom Devices and
servers at the end of each training session,
6. you will only provide access to the Licensed Content to End Users and MCTs,
7. you will only provide access to the Trainer Content to MCTs, and
8. any Licensed Content installed for use during a training session will be done in accordance
with the applicable classroom set-up guide.
c. If you are an End User:
You may use the Licensed Content solely for your personal training use. If the Licensed Content is in
digital format, for each license you acquire you may (i) install one (1) copy of the Licensed Content in
the form provided to you on one (1) Personal Device and install another copy on another Personal
Device as a backup copy, which may be used only to reinstall the Licensed Content; or (ii) print one (1)
copy of the Licensed Content. You may not install or use a copy of the Licensed Content on a device
you do not own or control.

MCT USE ONLY. STUDENT USE PROHIBITED

d. If you are a MCT.


i. For each license you acquire, you may use the Licensed Content solely to prepare and deliver an
Authorized Training Session or Private Training Session. For each license you acquire, you may
install and use one (1) copy of the Licensed Content in the form provided to you on one (1) Personal
Device and install one (1) additional copy on another Personal Device as a backup copy, which may
be used only to reinstall the Licensed Content. You may not install or use a copy of the Licensed
Content on a device you do not own or control.
ii.

Use of Instructional Components in Trainer Content. You may customize, in accordance with the
most recent version of the MCT Agreement, those portions of the Trainer Content that are logically
associated with instruction of a training session. If you elect to exercise the foregoing rights, you
agree: (a) that any of these customizations will only be used for providing a training session, (b) any
customizations will comply with the terms and conditions for Modified Training Sessions and
Supplemental Materials in the most recent version of the MCT agreement and with this agreement.
For clarity, any use of customize refers only to changing the order of slides and content, and/or
not using all the slides or content, it does not mean changing or modifying any slide or content.

2.2 Separation of Components. The Licensed Content components are licensed as a single unit and you
may not separate the components and install them on different devices.

2.3 Reproduction/Redistribution Licensed Content. Except as expressly provided in the applicable


installation and use rights above, you may not reproduce or distribute the Licensed Content or any portion
thereof (including any permitted modifications) to any third parties without the express written permission
of Microsoft.

2.4 Third Party Programs. The Licensed Content may contain third party programs or services. These
license terms will apply to your use of those third party programs or services, unless other terms accompany
those programs and services.
2.5 Additional Terms. Some Licensed Content may contain components with additional terms,
conditions, and licenses regarding its use. Any non-conflicting terms in those conditions and licenses also
apply to that respective component and supplements the terms described in this Agreement.
3.

PRE-RELEASE VERSIONS. If the Licensed Content is a pre-release (beta) version, in addition to the other
provisions in this agreement, then these terms also apply:
a. Pre-Release Licensed Content. This Licensed Content is a pre-release version. It may not contain the
same information and/or work the way a final version of the Licensed Content will. We may change it
for the final version. We also may not release a final version. Microsoft is under no obligation to
provide you with any further content, including the final release version of the Licensed Content.

b. Feedback. If you agree to give feedback about the Licensed Content to Microsoft, either directly or
through its third party designee, you give to Microsoft without charge, the right to use, share and
commercialize your feedback in any way and for any purpose. You also give to third parties, without
charge, any patent rights needed for their products, technologies and services to use or interface with
any specific parts of a Microsoft software, Microsoft product, or service that includes the feedback. You
will not give feedback that is subject to a license that requires Microsoft to license its software,
technologies, or products to third parties because we include your feedback in them. These rights

MCT USE ONLY. STUDENT USE PROHIBITED

survive this agreement.

c. Term. If you are an Authorized Training Center, MCT or MPN, you agree to cease using all copies of the
beta version of the Licensed Content upon (i) the date which Microsoft informs you is the end date for
using the beta version, or (ii) sixty (60) days after the commercial release of the Licensed Content,
whichever is earliest (beta term). Upon expiration or termination of the beta term, you will
irretrievably delete and destroy all copies of same in the possession or under your control.
4.

INTERNET-BASED SERVICES. Microsoft may provide Internet-based services with the Licensed Content,
which may change or be canceled at any time.

a. Consent for Internet-Based Services. The Licensed Content may connect to computer systems over an
Internet-based wireless network. In some cases, you will not receive a separate notice when they
connect. Using the Licensed Content operates as your consent to the transmission of standard device
information (including but not limited to technical information about your device, system and
application software, and peripherals) for internet-based services.

b. Misuse of Internet-based Services. You may not use any Internet-based service in any way that could
harm it or impair anyone elses use of it. You may not use the service to try to gain unauthorized access
to any service, data, account or network by any means.
5.

SCOPE OF LICENSE. The Licensed Content is licensed, not sold. This agreement only gives you some rights
to use the Licensed Content. Microsoft reserves all other rights. Unless applicable law gives you more
rights despite this limitation, you may use the Licensed Content only as expressly permitted in this
agreement. In doing so, you must comply with any technical limitations in the Licensed Content that only
allows you to use it in certain ways. Except as expressly permitted in this agreement, you may not:

install more copies of the Licensed Content on devices than the number of licenses you acquired;

allow more individuals to access the Licensed Content than the number of licenses you acquired;

publicly display, or make the Licensed Content available for others to access or use;

install, sell, publish, transmit, encumber, pledge, lend, copy, adapt, link to, post, rent, lease or lend,
make available or distribute the Licensed Content to any third party, except as expressly permitted
by this Agreement.

reverse engineer, decompile, remove or otherwise thwart any protections or disassemble the
Licensed Content except and only to the extent that applicable law expressly permits, despite this
limitation;

access or use any Licensed Content for which you are not providing a training session to End Users
using the Licensed Content;

access or use any Licensed Content that you have not been authorized by Microsoft to access and
use; or

transfer the Licensed Content, in whole or in part, or assign this agreement to any third party.

6.

RESERVATION OF RIGHTS AND OWNERSHIP. Microsoft reserves all rights not expressly granted to you in
this agreement. The Licensed Content is protected by copyright and other intellectual property laws and
treaties. Microsoft or its suppliers own the title, copyright, and other intellectual property rights in the
Licensed Content. You may not remove or obscure any copyright, trademark or patent notices that
appear on the Licensed Content or any components thereof, as delivered to you.

MCT USE ONLY. STUDENT USE PROHIBITED

7.

EXPORT RESTRICTIONS. The Licensed Content is subject to United States export laws and regulations. You
must comply with all domestic and international export laws and regulations that apply to the Licensed
Content. These laws include restrictions on destinations, End Users and end use. For additional
information, see www.microsoft.com/exporting.

8.

LIMITATIONS ON SALE, RENTAL, ETC. AND CERTAIN ASSIGNMENTS. You may not sell, rent, lease, lend or
sublicense the Licensed Content or any portion thereof, or transfer or assign this agreement.

9.

SUPPORT SERVICES. Because the Licensed Content is as is, we may not provide support services for it.

10.

TERMINATION. Without prejudice to any other rights, Microsoft may terminate this agreement if you fail
to comply with the terms and conditions of this agreement. Upon any termination of this agreement, you
agree to immediately stop all use of and to irretrievable delete and destroy all copies of the Licensed
Content in your possession or under your control.

11.

LINKS TO THIRD PARTY SITES. You may link to third party sites through the use of the Licensed Content.
The third party sites are not under the control of Microsoft, and Microsoft is not responsible for the
contents of any third party sites, any links contained in third party sites, or any changes or updates to third
party sites. Microsoft is not responsible for webcasting or any other form of transmission received from
any third party sites. Microsoft is providing these links to third party sites to you only as a convenience,
and the inclusion of any link does not imply an endorsement by Microsoft of the third party site.

12.

ENTIRE AGREEMENT. This agreement, and the terms for supplements, updates and support services are
the entire agreement for the Licensed Content.

13.

APPLICABLE LAW.
a. United States. If you acquired the Licensed Content in the United States, Washington state law governs
the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws
principles. The laws of the state where you live govern all other claims, including claims under state
consumer protection laws, unfair competition laws, and in tort.
b. Outside the United States. If you acquired the Licensed Content in any other country, the laws of that
country apply.

14.

LEGAL EFFECT. This agreement describes certain legal rights. You may have other rights under the laws of
your country. You may also have rights with respect to the party from whom you acquired the Licensed
Content. This agreement does not change your rights under the laws of your country if the laws of your
country do not permit it to do so.

15.

DISCLAIMER OF WARRANTY. THE LICENSED CONTENT IS LICENSED "AS-IS," "WITH ALL FAULTS," AND "AS
AVAILABLE." YOU BEAR THE RISK OF USING IT. MICROSOFT CORPORATION AND ITS RESPECTIVE
AFFILIATES GIVE NO EXPRESS WARRANTIES, GUARANTEES, OR CONDITIONS UNDER OR IN RELATION TO
THE LICENSED CONTENT. YOU MAY HAVE ADDITIONAL CONSUMER RIGHTS UNDER YOUR LOCAL LAWS
WHICH THIS AGREEMENT CANNOT CHANGE. TO THE EXTENT PERMITTED UNDER YOUR LOCAL LAWS,
MICROSOFT CORPORATION AND ITS RESPECTIVE AFFILIATES EXCLUDE ANY IMPLIED WARRANTIES OR
CONDITIONS, INCLUDING THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NON-INFRINGEMENT.

MCT USE ONLY. STUDENT USE PROHIBITED

16.

LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES. TO THE EXTENT NOT PROHIBITED BY
LAW, YOU CAN RECOVER FROM MICROSOFT CORPORATION AND ITS SUPPLIERS ONLY DIRECT
DAMAGES UP TO USD$5.00. YOU AGREE NOT TO SEEK TO RECOVER ANY OTHER DAMAGES, INCLUDING
CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR INCIDENTAL DAMAGES FROM MICROSOFT
CORPORATION AND ITS RESPECTIVE SUPPLIERS.

This limitation applies to


o
anything related to the Licensed Content, services made available through the Licensed Content, or
content (including code) on third party Internet sites or third-party programs; and
o
claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence,
or other tort to the extent permitted by applicable law.
It also applies even if Microsoft knew or should have known about the possibility of the damages. The
above limitation or exclusion may not apply to you because your country may not allow the exclusion or
limitation of incidental, consequential or other damages.

Please note: As this Licensed Content is distributed in Quebec, Canada, some of the clauses in this agreement
are provided below in French.
Remarque : Ce le contenu sous licence tant distribu au Qubec, Canada, certaines des clauses dans ce
contrat sont fournies ci-dessous en franais.

EXONRATION DE GARANTIE. Le contenu sous licence vis par une licence est offert tel quel . Toute
utilisation de ce contenu sous licence est votre seule risque et pril. Microsoft naccorde aucune autre garantie
expresse. Vous pouvez bnficier de droits additionnels en vertu du droit local sur la protection dues
consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties
implicites de qualit marchande, dadquation un usage particulier et dabsence de contrefaon sont exclues.
LIMITATION DES DOMMAGES-INTRTS ET EXCLUSION DE RESPONSABILIT POUR LES DOMMAGES. Vous
pouvez obtenir de Microsoft et de ses fournisseurs une indemnisation en cas de dommages directs uniquement
hauteur de 5,00 $ US. Vous ne pouvez prtendre aucune indemnisation pour les autres dommages, y
compris les dommages spciaux, indirects ou accessoires et pertes de bnfices.
Cette limitation concerne:
tout ce qui est reli au le contenu sous licence , aux services ou au contenu (y compris le code)
figurant sur des sites Internet tiers ou dans des programmes tiers ; et
les rclamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit
stricte, de ngligence ou dune autre faute dans la limite autorise par la loi en vigueur.

Elle sapplique galement, mme si Microsoft connaissait ou devrait connatre lventualit dun tel dommage.
Si votre pays nautorise pas lexclusion ou la limitation de responsabilit pour les dommages indirects,
accessoires ou de quelque nature que ce soit, il se peut que la limitation ou lexclusion ci-dessus ne sappliquera
pas votre gard.

EFFET JURIDIQUE. Le prsent contrat dcrit certains droits juridiques. Vous pourriez avoir dautres droits prvus
par les lois de votre pays. Le prsent contrat ne modifie pas les droits que vous confrent les lois de votre pays
si celles-ci ne le permettent pas.
Revised December 2011

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012


x

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server2012 xi

Acknowledgments

Microsoft Learning wants to acknowledge and thank the following for their contribution toward
developing this title. Their effort at various stages in the development has ensured that you have a good
classroom experience.

Andrew J. Warren Content Developer

Andrew Warren has more than 25 years of experience in the IT industry, many of which he has spent
teaching and writing. He has been involved as a subject matter expert for many of the Windows Server
2008 courses, and the technical lead on a number of other courses. He also has been involved in
developing TechNet sessions on Microsoft Exchange Server 2007. Based in the United Kingdom, Andrew
runs his own IT training and education consultancy.

Jason Kellington Content Developer

Jason Kellington (Microsoft Certified Trainer (MCT), Microsoft Certified IT Professional (MCITP), and
Microsoft Certified Solutions Expert (MCSE) is a consultant, trainer, and author. He has experience working
with a wide range of Microsoft technologies, focusing on enterprise network infrastructure. Jason works in
several capacities with Microsoft. He is a content developer for Microsoft Learning courseware titles, a
senior technical writer for Microsoft IT Showcase, and an author for Microsoft Press.

Brian Desmond Technical Reviewer

Brian Desmond is a Microsoft Most Valuable Professional (MVP) and consultant based out of Chicago,
Illinois. Brian focuses on Active Directory, Exchange Server, and Identity Management projects for global
enterprise customers. Brian is the author of Active Directory, 4th Edition (OReilly), and numerous articles
in industry leading publications such as Windows IT Pro magazine. A frequent traveler, you can usually
find Brian on the road speaking at conferences and visiting customers.

David Susemiehl Content Developer

David Susemiehl has worked as consultant, trainer, and courseware developer since 1996. David has
extensive experience consulting on Microsoft Systems Management Server and Microsoft System Center
Configuration Manager 2007, as well as Active Directory, Exchange Server, and Terminal Server/Citrix
deployments. David has developed courseware development for Microsoft and Hewlett-Packard, and
delivered those courses successfully in Europe, Central America, and across North America. For the last
several years, David has been writing courseware for Microsoft Learning, and consulting on infrastructure
transitions in Michigan.

Contents
Module 1: Deploying and Maintaining Server Images
Lesson 1: Overview of Windows Deployment Services

1-2

Lesson 2: Implementing Deployment with Windows


Deployment Services
Lesson 3: Administering Windows Deployment Services

1-8
1-14

Lab: Using Windows Deployment Services to Deploy


Windows Server 2012

1-20

Module 2: Configuring and Troubleshooting Domain Name System


Lesson 1: Installing the DNS Server Role

2-2

Lesson 2: Configuring the DNS Server Role

2-8

Lesson 3: Configuring DNS Zones

2-14

Lesson 4: Configuring DNS Zone Transfers

2-19

Lesson 5: Managing and Troubleshooting DNS

2-22

Lab: Configuring and Troubleshooting DNS

2-30

Module 3: Maintaining Active Directory Domain Services


Lesson 1: Overview of AD DS

3-2

Lesson 2: Implementing Virtualized Domain Controllers

3-7

Lesson 3: Implementing Read-Only Domain Controllers

3-11

Lesson 4: Administering AD DS

3-15

Lesson 5: Managing the AD DS Database

3-23

Lab: Maintaining AD DS

3-32

Module 4: Managing User and Service Accounts


Lesson 1: Automating User Account Management

4-2

Lesson 2: Configuring Password-Policy and User-Account


Lockout Settings

4-7

Lesson 3: Configuring Managed Service Accounts

4-14

Lab: Managing User and Service Accounts

4-20

Module 5: Implementing a Group Policy Infrastructure


Lesson 1: Introducing Group Policy

5-2

Lesson 2: Implementing and Administering GPOs

5-10

Lesson 3: Group Policy Scope and Group Policy Processing

5-16

Lesson 4: Troubleshooting the Application of GPOs

5-31

Lab: Implementing a Group Policy Infrastructure

5-38

MCT USE ONLY. STUDENT USE PROHIBITED

xii Administering Windows Server 2012

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server2012 xiii

Module 6: Managing User Desktops with Group Policy


Lesson 1: Implementing Administrative Templates
Lesson 2: Configuring Folder Redirection and Scripts

6-2
6-7

Lesson 3: Configuring Group Policy Preferences

6-12

Lesson 4: Managing Software with Group Policy

6-16

Lab: Managing User Desktops with Group Policy

6-19

Module 7: Configuring and Troubleshooting Remote Access


Lesson 1: Configuring Network Access
Lesson 2: Configuring VPN Access

7-2
7-19

Lesson 3: Overview of Network Policies

7-19

Lesson 4: Troubleshooting Routing and Remote Access

7-25

Lab A: Configuring Remote Access

7-30

Lesson 5: Configuring DirectAccess

7-34

Lab B: Configuring DirectAccess

7-47

Module 8: Installing, Configuring, and Troubleshooting the


Network Policy Server Role
Lesson 1: Installing and Configuring a Network Policy Server

8-2

Lesson 2: Configuring RADIUS Clients and Servers

8-6

Lesson 3: NPS Authentication Methods

8-12

Lesson 4: Monitoring and Troubleshooting a Network Policy Server

8-20

Lab: Installing and Configuring a Network Policy Server

8-25

Module 9: Implementing Network Access Protection


Lesson 1: Overview of Network Access Protection
Lesson 2: Overview of NAP Enforcement Processes

9-2
9-7

Lesson 3: Configuring NAP

9-14

Lesson 4: Monitoring and Troubleshooting NAP

9-19

Lab: Implementing NAP

9-23

Module 10: Optimizing File Services


Lesson 1: Overview of FSRM

10-2

Lesson 2: Using FSRM to Manage Quotas, File Screens, and


Storage Reports

10-7

Lesson 3: Implementing Classification and File Management Tasks

10-16

Lab A: Configuring Quotas and File Screening Using FSRM

10-22

Lesson 4: Overview of DFS

10-26

Lesson 5: Configuring DFS Namespaces

10-33

Lesson 6: Configuring and Troubleshooting DFS-R

10-37

Lab B: Implementing DFS

10-41

Module 11: Configuring Encryption and Advanced Auditing


Lesson 1: Encrypting Files by Using Encrypting File System
Lesson 2: Configuring Advanced Auditing
Lab: Configuring Encryption and Advanced Auditing

11-2
11-6
11-13

Module 12: Implementing Update Management


Lesson 1: Overview of WSUS

12-2

Lesson 2: Deploying Updates with WSUS

12-5

Lab: Implementing Update Management

12-9

Module 13: Monitoring Windows Server 2012


Lesson 1: Monitoring Tools

13-2

Lesson 2: Using Performance Monitor

13-8

Lesson 3: Monitoring Event Logs

13-16

Lab: Monitoring Windows Server 2012

13-19

Lab Answer Keys


Module 1 Lab: Using Windows Deployment Services to
Deploy Windows Server 2012

L1-1

Module 2 Lab: Configuring and Troubleshooting DNS

L2-7

Module 3 Lab: Maintaining AD DS

L3-13

Module 4 Lab: Managing User and Service Accounts

L4-21

Module 5 Lab: Implementing a Group Policy Infrastructure

L5-25

Module 6 Lab: Managing User Desktops with Group Policy

L6-33

Module 7 Lab A: Configuring Remote Access

L7-39

Module 7 Lab B: Configuring DirectAccess

L7-45

Module 8 Lab: Installing and Configuring a Network Policy Server

L8-59

Module 9 Lab: Implementing NAP

L9-63

Module 10 Lab A: Configuring Quotas and File Screening Using FSRM

L10-71

Module 10 Lab B: Implementing DFS

L10-75

Module 11 Lab: Configuring Encryption and Advanced Auditing

L11-79

Module 12 Lab: Implementing Update Management

L12-83

Module 13 Lab: Monitoring Windows Server 2012

L13-87

MCT USE ONLY. STUDENT USE PROHIBITED

xiv Administering Windows Server 2012

About This Course


This section provides you with a brief description of the course20411B: Administering Windows
Server 2012 audience, suggested prerequisites, and course objectives.

Course Description

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

xvii

The main objective for this course is to configure and maintain core infrastructure services in a Windows
Server 2012 enterprise environment. The primary audience for this course is Information Technology
(IT) Professionals who have successfully implemented a Microsoft Windows Server 2008 server, either in
an existing enterprise infrastructure or as a standalone installation, and wish to acquire the skills and
knowledge necessary to broaden that implementation to manage and maintain the core infrastructure
required for a Windows Server 2008 environment. Candidates must also have knowledge equivalent to
that already covered in Windows Server 2012 Enterprise Core 1 course, as this course will build upon that
knowledge.

Audience

This course is intended for students to broaden the initial deployment of services in Core 1, and
provide the skills necessary to manage and maintain domain-based Windows Server 2012 infrastructure.
Candidates would typically be System Administrators and must have at least one year experience working
in a Windows Server 2012 or Windows 8 environment. The secondary audience for this course will be
candidates aspiring to acquire the Microsoft Certified Solutions Associate (MCSA) credential either in its
own right, or to proceed in acquiring the Microsoft Certified Solutions Expert (MCSE) credentials, of which
this course is a prerequisite.

Student Prerequisites
This course requires that you have the ability to meet following prerequisites:

Install and Configure Windows Server 2012 into existing enterprise environments, or as standalone
installations.

Configure local storage.

Configure roles and features.

Configure file and print services.

Configure Windows Server 2012 servers for local and remote administration.

Configure IPv4 and IPv6 addresses.

Configure Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP) services.

Install domain controllers.

Create and configure users, groups, computers and organizational units (OUs).

Create and manage Group Policies.

Configure local security policies.

Course Objectives
After completing this course, students will be able to:

Deploy, manage, and maintain servers.

Configure file and print services.

Configure network services and access.

Configure a network policy server Infrastructure.

Configure and manage Active Directory Domain Services (AD DS).

Configure and manage Group Policy.

Course Outline
The course outline is as follows:
Module 1, Deploying and Maintaining Server Images
Module 2, Configuring and Troubleshooting Domain Name System
Module 3, Maintaining Active Directory Domain Services
Module 4, Managing User and Service Accounts
Module 5, Implementing a Group Policy Infrastructure
Module 6, Managing User Desktops with Group Policy
Module 7, Configuring and Troubleshooting Remote Access
Module 8, Installing, Configuring, and Troubleshooting the Network Policy Server Role
Module 9, Implementing Network Access Protection
Module 10, Optimizing File Services
Module 11, Configuring Encryption and Advanced Auditing
Module 12, Implementing Update Management
Module 13, Monitoring Windows Server 2012

Exam/Course Mapping
This course, 20411B: Administering Windows Server 2012, has a direct mapping of its content to the
objective domain for the Microsoft Exam 70-411: Administering Windows Server 2012.

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

xviii

The following table is provided as a study aid that will assist you in preparation for taking this exam, and
to show you how the exam objectives and the course content fit together. The course is not designed
exclusively to support the exam, but rather provides broader knowledge and skills to allow a real-world
implementation of the particular technology. The course will also contain content that is not directly
covered in the examination and will utilize the unique experience and skills of your qualified Microsoft
Certified Trainer.
Note: The exam objectives are available online at the following URL:
http://www.microsoft.com/learning/en/us/exam.aspx?ID=70-411#tab2.

Exam 70-411: Administering Windows Server 2012


Exam Objective Domain
Deploy, Manage, and Maintain Servers (17%)
This objective may include but is not limited to: Install
Deploy and
the Windows Deployment Services (WDS) role;
manage server
configure and manage boot, install, and discover
images.
images; update images with patches, hotfixes, and
drivers; install features for offline images
This objective may include but is not limited to: Install
Implement
and configure the Windows Server Update Services
patch
(WSUS) role; configure group policies for updates;
management.
configure client-side targeting; configure WSUS
synchronization; configure WSUS groups
This objective may include but is not limited to:
Configure Data Collector Sets (DCS); configure alerts;
Monitor
monitor real-time performance; monitor virtual
servers.
machines (VMs); monitor events; configure event
subscriptions; configure network monitoring
Configure File and Print Services (15%)
This objective may include but is not limited to: Install
Configure
and configure DFS namespaces; configure DFS
Distributed File Replication Targets; configure Replication Scheduling;
System (DFS).
configure Remote Differential Compression settings;
configure staging; configure fault tolerance
Configure File
This objective may include but is not limited to: Install
Server Resource
the FSRM role; configure quotas; configure file screens;
Manager
configure reports
(FSRM).
This objective may include but is not limited to:
Configure file
Configure Bitlocker encryption; configure the Network
and disk
Unlock feature; configure Bitlocker policies; configure
encryption.
the EFS recovery agent; manage EFS and Bitlocker
certificates including backup and restore
This objective may include but is not limited to:
Configure
Implement auditing using Group Policy and
advanced audit
AuditPol.exe; create expression-based audit policies;
policies.
create removable device audit policies

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

xix

Course Content
Module Lesson Lab
Mod 1
Lesson Mod 1
1/2/3
Ex
1/2/3/4
Mod 12

Lesson
1/2

Mod 12
Ex 1/2/3

Mod 13

Lesson
1/2/3

Mod 13
Ex 1/2/3

Mod 10

Lesson
4/5/6

Mod 10
Lab B
Ex 1/2/3

Mod 10

Lesson
1/2/3

Mod 10
Lab A
Ex 1/2

Mod 11

Lesson
1

Mod 11
Ex 1

Mod 11

Lesson
2

Mod 11
Ex 2

About This Course

Exam 70-411: Administering Windows Server 2012


Exam Objective Domain
Configure Network Services and Access (17%)
This objective may include but is not limited to:
Configure primary and secondary zones; configure stub
zones; configure conditional forwards; configure zone
Configure DNS
and conditional forward storage in Active Directory;
zones.
configure zone delegation; configure zone transfer
settings; configure notify settings
This objective may include but is not limited to: Create
and configure DNS Resource Records (RR) including A,
Configure DNS
AAAA, PTR, SOA, NS, SRV, CNAME, and MX records;
records.
configure zone scavenging; configure record options
including Time To Live (TTL) and weight; configure
round robin; configure secure dynamic updates
This objective may include but is not limited to: Install
and configure the Remote Access role; implement
Configure VPN
Network Address Translation (NAT); configure VPN
and routing.
settings; configure remote dial-in settings for users;
configure routing
This objective may include but is not limited to:
Configure
Implement server requirements; implement client
DirectAccess.
configuration; configure DNS for Direct Access;
configure certificates for Direct Access
Configure a Network Policy Server Infrastructure (14%)
This objective may include but is not limited to:
Configure
Configure multiple RADIUS server infrastructures;
Network Policy
configure RADIUS clients; manage RADIUS templates;
Server (NPS).
configure RADIUS accounting; configure certificates
This objective may include but is not limited to:
Configure connection request policies; configure
Configure NPS
network policies for VPN clients (multilink and
policies.
bandwidth allocation, IP filters, encryption, IP
addressing); manage NPS templates; import and export
NPS policies
This objective may include but is not limited to:
Configure
Configure System Health Validators (SHVs); configure
Network Access health policies; configure NAP enforcement using DHCP
Protection
and VPN; configure isolation and remediation of non(NAP).
compliant computers using DHCP and VPN; configure
NAP client settings

Course Content

MCT USE ONLY. STUDENT USE PROHIBITED

xx

Mod 2

Lesson
1/3/4

Mod 2
Ex 2/4

Mod 2

Lesson
2/5

Mod 2
Ex 1/3

Mod 7

Lesson
1/2/3/
4

Mod 7
Lab A Ex
1/2

Mod 7

Lesson
5

Mod 7
Lab B Ex
1/2/3

Mod 8

Lesson
3/4

Mod 8
Ex 2

Mod 6

Lesson
2
Lesson
1/2

Mod 8
Ex 1

Mod 8

Mod 9

Lesson
1/2/3/
4

Mod 9
Ex 1/2/3

xxi

Exam 70-411: Administering Windows Server 2012


Exam Objective Domain
Configure and Manage Active Directory (19%)
This objective may include but is not limited to: Create
Configure
and configure Service Accounts; create and configure
service
Group Managed Service Accounts; create and configure
authentication. Managed Service Accounts; configure Kerberos
delegation; manage Service Principal Names (SPNs)
This objective may include but is not limited to:
Configure
Configure Universal Group Membership Caching
Domain
(UGMC); transfer and seize operations masters; install
Controllers.
and configure a read-only domain controller (RODC);
configure Domain Controller cloning
This objective may include but is not limited to: Back up
Active Directory and SYSVOL; manage Active Directory
Maintain Active offline; optimize an Active Directory database; clean up
metadata; configure Active Directory snapshots;
Directory.
perform object- and container-level recovery; perform
Active Directory restore
This objective may include but is not limited to:
Configure
Configure domain user password policy; configure and
account
apply Password Settings Objects (PSOs); delegate
policies.
password settings management; configure local user
password policy; configure account lockout settings
Configure and Manage Group Policy (18%)
This objective may include but is not limited to:
Configure processing order and precedence; configure
Configure
blocking of inheritance; configure enforced policies;
Group Policy
configure security filtering and WMI filtering; configure
processing.
loopback processing; configure and manage slow-link
processing; configure client-side extension (CSE)
behavior
This objective may include but is not limited to:
Configure settings including software installation, folder
redirection, scripts, and administrative template
Configure
settings; import security templates; import custom
Group Policy
administrative template file; convert administrative
settings.
templates using ADMX Migrator; configure property
filters for administrative templates
This objective may include but is not limited to: Back up,
Manage Group
import, copy, and restore GPOs; create and configure
Policy objects
Migration Table; reset default GPOs; delegate Group
(GPOs).
Policy management

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

Course Content
Mod 4

Lesson
1/2/3

Mod 4
Ex 1/2

Mod 3

Lesson
1/2/3

Mod 3
Ex 1/2

Mod 3

Lesson
1/3/4/
5

Mod 3
Ex 2/3

Mod 4

Lesson
1/2/3

Mod 4
Ex 1

Mod 5

Lesson
1/3/4

Mod 5
Ex 1/2

Mod 6

Lesson
1/2/4

Mod 6
Ex 2

Mod 5

Lesson
2

Mod 5
Ex 4

Exam 70-411: Administering Windows Server 2012

Configure
Group Policy
preferences.

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

xxii

Exam Objective Domain


Course Content
This objective may include but is not limited to:
Mod 6
Lesson Mod 6
Configure Group Policy Preferences (GPP) settings
1/2/3
Ex 1
including printers, network drive mappings, power
options, custom registry settings, Control Panel settings,
Internet Explorer settings, file and folder deployment,
and shortcut deployment; configure item-level targeting

Important: Attending this course in itself will not successfully prepare you to pass any
associated certification exams.
The taking of this course does not guarantee that you will automatically pass any certification exam. In
addition to attendance at this course, you should also have the following:

Real-world, hands-on experience administering, managing and maintaining a Windows Server 2012
infrastructure.

Additional study outside of the content in this handbook.

There may also be additional study and preparation resources, such as practice tests, available for you to
prepare for this exam. Details of these are available at the following URL:
http://www.microsoft.com/learning/en/us/exam.aspx?ID=70-411#tab3
You should familiarize yourself with the audience profile and exam prerequisites to ensure you are
sufficiently prepared before taking the certification exam. The complete audience profile for this exam is
available at the following URL:
http://www.microsoft.com/learning/en/us/exam.aspx?ID=70-411#tab1
The exam/course mapping table outlined above is accurate at the time of printing, however it is subject
to change at any time and Microsoft bears no responsibility for any discrepancies between the version
published here and the version available online and will provide no notification of such changes.

Course Materials
The following materials are included with your kit:

Course Handbook A succinct classroom learning guide that provides all the critical technical
information in a crisp, tightly-focused format, which is just right for an effective in-class learning
experience.

Lessons: Guide you through the learning objectives and provide the key points that are critical to
the success of the in-class learning experience.

Labs: Provide a real-world, hands-on platform for you to apply the knowledge and skills learned
in the module.

Module Reviews and Takeaways: Provide improved on-the-job reference material to boost
knowledge and skills retention.

Lab Answer Keys: Provide step-by-step lab solution guidance at your fingertips when its
needed.

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

xxiii

Course Companion Content on the http://www.microsoft.com/learning/companionmoc Site:


Searchable, easy-to-navigate digital content with integrated premium on-line resources designed to
supplement the Course Handbook.

Modules: Include companion content, such as questions and answers, detailed demo steps and
additional reading links, for each lesson. Additionally, they include Lab Review questions and
answers and Module Reviews and Takeaways sections, which contain the review questions and
answers, best practices, common issues and troubleshooting tips with answers, and real-world
issues and scenarios with answers.

Resources: Include well-categorized additional resources that give you immediate access to the
most up-to-date premium content on TechNet, MSDN, and Microsoft Press.

Student Course files on the http://www.microsoft.com/learning/companionmoc Site: Includes


the Allfiles.exe, a self-extracting executable file that contains all the files required for the labs and
demonstrations.

Course evaluation At the end of the course, you will have the opportunity to complete an online
evaluation to provide feedback on the course, training facility, and instructor.

To provide additional comments or feedback on the course, send e-mail to


support@mscourseware.com. To inquire about the Microsoft Certification Program, send e-mail
to mcphelp@microsoft.com.

Virtual Machine Environment

This section provides the information for setting up the classroom environment to support the business
scenario of the course.

Virtual Machine Configuration


In this course, you will use Hyper-V to perform the labs.
Important At the end of each lab, you must close the virtual machine and must not save
any changes. To close a virtual machine without saving the changes, perform the following
steps:
1. On the virtual machine, on the Action menu, click Close.
2. In the Close dialog box, in the What do you want the virtual machine to do? list, click
Turn off and delete changes, and then click OK.
The following table shows the role of each virtual machine that is used in this course.
Virtual machine

Role

20411B-LON-DC1

Windows Server 2012 domain controller for the Adatum.com domain

20411B-LON-CL1

Windows 8 client computer and in the Adatum.com domain

20411B-LON-CL2

Windows 8 client computer and in the Adatum.com domain

20411B-LON-SVR1

Windows Server 2012 in the Adatum.com domain

20411B-LON-SVR3

No operating system installed

20411B-LON-SVR4

A Windows Server 2012 server computer in the Adatum.com domain

20411B-LON-RTR

A Windows Server 2012 server computer in the Adatum.com domain

Software Configuration
The following software is installed on each virtual machine:

Network Monitor 3.4 is installed on LON-SVR2.

Course Files
There are lab files associated with the labs in this course. The lab files are located in the folder
E:\Labfiles\LabXX on NYC-DC1.

Classroom Setup
Each classroom computer will have the same virtual machine configured in the same way.

Course Hardware Level

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

xxiv

To ensure a satisfactory student experience, Microsoft Learning requires a minimum equipment


configuration for trainer and student computers in all Microsoft Certified Partner for Learning Solutions
(CPLS) classrooms in which Official Microsoft Learning Product courseware are taught.

Hardware level 6 with 8 gigabytes (GB) of random access memory (RAM)

Navigation in Windows Server 2012


If you are not familiar with the user interface in Windows Server 2012 or Windows 8 then the following
information will help orient you to the new interface.

Sign in and Sign out replace Log in and Log out.

Administrative tools are found in the Tools menu of Server Manager.

Move your mouse to the lower right corner of the desktop to open a menu with:

Settings: This includes Control Panel and Power

Start menu: This provides access to some applications

Search: This allows you to search applications, settings, and files

You may also find the following shortcut keys useful:

Windows: Opens the Start menu

Windows+C: Opens the same menu as moving the mouse to the lower right corner

Windows+I: Opens Settings

Windows+R: Opens the Run window

MCT USE ONLY. STUDENT USE PROHIBITED


1-1

Module 1
Deploying and Maintaining Server Images
Contents:
Module Overview

1-1

Lesson 1: Overview of Windows Deployment Services

1-2

Lesson 2: Implementing Deployment with Windows Deployment Services

1-8

Lesson 3: Administering Windows Deployment Services

1-14

Lab: Using Windows Deployment Services to Deploy Windows Server 2012

1-20

Module Review and Takeaways

1-26

Module Overview

Larger organizations need deployment technologies that can reduce or eliminate user interaction during
the deployment process. You can use the Deployment Services role in Windows Server 2012 and
Windows Server 2008 to help support both lite-touch and zero-touch, high-volume deployments. This
module explores the functionality of Windows Deployment Services, and explains how to use Windows
Deployment Services tools to perform lite-touch deployments.

Objectives
After completing this module, students will be able to:

Describe the important features and functionality of Windows Deployment Services.

Configure Windows Deployment Services in Windows Server 2012.

Perform deployments with Windows Deployment Services.

Lesson 1

Overview of Windows Deployment Services

MCT USE ONLY. STUDENT USE PROHIBITED

1-2 Deploying and Maintaining Server Images

Windows Deployment Services enables you to deploy Windows operating systems. You can use a
network-based installation of Windows Deployment Services to deploy these operating systems on new
computers. This means that you do not have to be physically present at each computer. In addition, you
do not have to install each operating system directly from local media. Consequently, Windows
Deployment Services scales well to support the deployment needs of larger organizations.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the function of Windows Deployment Services.

Describe the components of Windows Deployment Services.

Describe the benefits of Windows Deployment Services.

Identify how to use Windows Deployment Services to support various deployment scenarios.

What Is Windows Deployment Services?


Windows Deployment Services is a server role
provided with Windows Server 2012. It provides
the following functions:

Enables you to perform network-based


installations.

Simplifies the deployment process.

Supports deployment to computers that have


no current operating system.

Provides end-to-end deployment solutions


for both client and server computers.

Uses existing technologies, such as Windows Preinstallation Environment (Windows PE), Windows
image (.wim) file and Virtual Hard Disk (.vhd) image files, and image-based deployment.

Windows Deployment Services enables automated deployment of Windows operating systems. You can
completely automate deployment of the following operating systems:

Windows XP

Windows Server 2003

Windows Vista with Service Pack 1 (SP1)

Windows Server 2008

Windows 7

Windows Server 2008 R2

Windows 8

Windows Server 2012

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-3

Windows Deployment Services provides the ability to create, store, and deploy installation images of
supported operating systems, and supports .wim and .vhd image files. Deployment now can be unicast or
multicast. Using multicasting enables more effective management of network traffic that the deployment
process consumes. This potentially speeds up deployment without affecting other network services
adversely.

Operating Systems with Components

Windows Deployment Services integrates closely with Windows Vista, Windows Server 2008, Windows 7,
Windows Server 2008 R2, Windows 8, and Windows Server 2012. One important example of this
integration is the design of these operating systems with components. These operating systems consist
of self-describing elements, known as components. Self-describing refers to the fact that the elements
contain a manifest that lists the different configuration options that you can set for each component. You
can see the features and configurations for each component. Updates, service packs, and language packs
are components that are applied on top of operating systems that can be divided.

Drivers also are considered separate, configurable components. The primary benefit of this is that you
can install drivers, such as hotfixes and service packs, into an offline operating system. Instead of updating
complete images each time a new update, service pack, or driver becomes available, you can install these
components into the offline image so that Windows applies them when you deploy the image.
When deploying the images to the hard disk of a new computer, the system receives the base image with
each of the components added, before the system boots for the first time.

If your organization is multilingual or international, you can utilize the language-neutral nature of
the latest Windows operating systems. The number of images that you need to maintain shrinks again
because there are no longer localized versions. Some Windows operating systems versions are limited to
the number of language packs. You can add or remove language packs from a system as necessary and at
any time without otherwise altering the installation.
If you need to support multiple languages, you add all of the necessary language packs to your
deployment .wim file and then activate them as necessary, either on all computers or on specific
computers.

Windows Deployment Services Components


Windows Deployment Services provides a number
of distinct functions through a number of
identifiable components.

Windows Deployment Services Pre-Boot


EXecution Environment Server
The Pre-Boot EXecution Environment (PXE) server
provides the following functionality:

Binds to network interfaces.

Listens for incoming PXE requests.

Formats the Dynamic Host Configuration


Protocol (DHCP) response packets.

Windows Deployment Services client


The Windows Deployment Services client provides a graphical interface that is built on the
Windows Server setup graphical interface. It establishes a communication channel with the Windows
Deployment Services server and retrieves a list of install images on the Windows Deployment Services
server. Additionally, the Windows Deployment Services client provides status information at the target
computer during deployment.

Server Components

MCT USE ONLY. STUDENT USE PROHIBITED

1-4 Deploying and Maintaining Server Images

Additional server components include a Trivial File Transfer Protocol (TFTP) server that enables networkbooting clients to load a boot image into memory. Also included is: an image repository that contains
boot images, install images, files needed specifically for network-boot support, and a shared folder that
hosts the install images.

Multicasting Engine

Transmitting large operating system images over the network is more efficient with Windows Deployment
Services. However, pushing multi-gigabyte files across the network creates a large amount of network
traffic. By using the new multicast feature, you can further reduce the network cost of using Windows
Deployment Services deployment.
With multicasting, the server sends the data a single time, and multiple targets receive the same data.
If you are deploying to multiple targets, this can cut the network traffic to a fraction of the equivalent
number of multiple unicast transmissions. Windows Deployment Services provides two types of
multicasting:

Scheduled-cast. There are two ways that you can configure scheduled-cast:
o

Client count. When you specify a client count, the server waits until the defined count of
connected clients is reached, and then it starts to send the information.

Point in time. When you specify a point in time, the server waits until the specified time and
begins deployment to connected client computers.

While scheduled-cast provides a more efficient use of the network, it is somewhat labor-intensive;
each target computer must be connected, turned on, and cued.

Autocast. A target can join an Autocast at any time, and the server repeats the transmission as long as
targets are connected. If the target starts receiving the image in the middle, or if it misses some
portion of the image, it remains connected and collects the additional parts of the file when the
server restarts the transmission.
Question: What is the advantage of multicasting as opposed to unicasting in volume
deployment scenarios?

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-5

Why Use Windows Deployment Services?


Any organization that wants to reduce the
administrator interaction that is required
during deployment of Windows Server should
use Windows Deployment Services. Because of
its ability to support deployment from across
the network, potentially with no user interaction,
Windows Deployment Services allows
organizations to create a more autonomous
and efficient environment for installing Windows.
Consider the following scenarios.

Scenario 1

In a small network consisting of a single server


and around 25 Windows XP computers, you could use Windows Deployment Services to expedite the
upgrade process of the client computers to Windows 8. Once you have installed and configured the
Windows Deployment Services server role on the single server, you can use Windows Deployment Services
to perform the following tasks:
1.

Add boot.wim from the sources folder of the Windows Server 2012 media as a boot image in
Windows Deployment Services.

2.

Add install.wim from the sources folder of the Windows 8 media as an install image.

3.

Create a capture image from the boot image that you added previously.

Note: A capture image is a modified boot image that contains the necessary elements that
enable you to capture a WIM file image from a configured reference computer.
4.

Start your reference computer from the network using PXE.

5.

Perform a standard installation of Windows 8 from the install.wim image.

6.

Install office productivity applications and custom applications as required on the reference
computer.

7.

Generalize the reference computer with the System Preparation (Sysprep) tool.

8.

Restart the reference computer from the network using PXE.

9.

Connect to the capture image that you created, use it to capture the local operating system, and
upload it back to the Windows Deployment Services server.

10. Start each of the existing target computers from the network using PXE, and connect to the
appropriate boot image.
11. Select the custom install image.
12. Deployment starts.

Benefits to the organization in this scenario are:

A standardized desktop computer image.

Quick deployment of each computer with limited installer interaction.

MCT USE ONLY. STUDENT USE PROHIBITED

1-6 Deploying and Maintaining Server Images

This solution would not suit larger deployments, as you need the installer to start the deployment on the
target computer. Additionally, the installer is required to select a disk partition on which to install the
selected installation image.

Scenario 2

In the second scenario, a medium to large-sized organization wants to deploy multiple servers in branch
offices that are geographically dispersed. It would be time-consuming and expensive to send experienced
IT staff to each location to deploy the servers.
By using Windows Deployment Services, IT staff can address this issue:
1.

Add boot.wim from the Windows Server 2012 media as a boot image in Windows Deployment
Services.

2.

Add install.wim from the Windows Server 2012 media as an install image.

3.

Create a capture image.

4.

Start the reference computer from the network.

5.

Perform a standard installation of Windows Server 2012 from the install.wim image.

6.

Customize the reference computer as required.

7.

Generalize the reference computer.

8.

Restart the reference computer.

9.

Capture the reference Windows operating system, and upload it back to the Windows Deployment
Services server.

10. Configure the necessary Active Directory Domain Services (AD DS) computer accounts; this is known
as prestaging the computer accounts.
11. Use Windows System Image Manager (SIM) in the Windows Automated Installation Kit (Windows
ADK) to create an unattended answer file.
12. Configure the answer file for use with the captured installation image on Windows Deployment
Services.
13. Configure a custom naming policy in Windows Deployment Services so that each server computer
receives a suitable computer name during deployment.
14. Configure Windows Deployment Services to use a default boot image.
15. Configure Windows Deployment Services to respond to PXE requests and start deployment of the
install image automatically.
16. Start each of the target computers from the network.
Note: To avoid a boot loop, it is advisable to configure the computers basic input/output
system (BIOS) to start up from the hard disk and then the network. For further information about
avoiding a boot loop, refer to the Windows Deployment Services Deployment Guide.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-7

Benefits to the organization in this scenario are:

Standardized server builds.

Automatic domain-join following deployment.

Automatic computer naming.

Little or no installer interaction.

The solution does not implement multicast transmissions, nor does it use PXE referral. These technologies
could be used as well, to help manage network traffic during the deployment.

Discussion: How to Use Windows Deployment Services


Windows Deployment Services can be useful for
many deployment scenarios involving Windows
operating systems.
Question: The A. Datum Corporation IT
staff is about to deploy Windows Server 2012
to various branch offices. The following
information has been provided to the IT staff
by management:
o

The configuration of the various branch


office servers is expected to be fairly
consistent.

There is no requirement to upgrade settings from existing servers, as these are new branch
offices with no current IT infrastructure in place.

Automation of the deployment process is important, as there are many servers to deploy.

How would you use Windows Deployment Services to aid deployment?


Question: A. Datum Corporation wants to deploy several dozen new servers in their head
offices. These servers will be installed with Windows Server 2012. The following information
has been provided to the IT staff by management:
o

The configuration of the various servers is expected to vary slightly; there are two basic server
configurations: full server, and Server Core.

Managing network traffic is critical, as the network is near capacity.

How would you advise staff at A. Datum to proceed with the deployment?

Lesson 2

Implementing Deployment with Windows Deployment


Services

MCT USE ONLY. STUDENT USE PROHIBITED

1-8 Deploying and Maintaining Server Images

While Windows Deployment Services is not complicated to install and configure, it is important that
you understand the makeup of its components, and how to correctly configure it. By doing this, you
will ensure that it provides the appropriate level of deployment automation, and that it addresses the
deployment needs of your organization. Once you install and configure Windows Deployment Services,
you must understand how to use it and its associated tools to create, manage, and deploy images to
computers within your organization.

Lesson Objectives
After completing this lesson, you will be able to:

Describe Windows Deployment Services components.

Explain how to install and configure Windows Deployment Services.

Explain the process of using Windows Deployment Services to deploy Windows Server.

Understanding Windows Deployment Services Components


When you deploy the Windows Deployment
Services server role, you can choose from two
configuration options. You can choose the
default configuration, which deploys both the
Deployment Server and Transport Server role
services, or you can choose to deploy only the
Transport Server role service. In this second
scenario, the Deployment Server role service
provides the image server; the Transport Server
does not provide imaging functionality.
The Deployment Server enables an end-to-end
deployment solution, while the Transport Server
provides a platform that you use to create a custom multicast deployment solution.
The following table compares the two role services.
Server component

Deployment server

Transport server

Requirements

AD DS, DHCP, and Domain Name


System (DNS)

No infrastructure requirements

PXE

Uses the default PXE provider

You must create a PXE provider

Image server

Includes Windows Deployment


Services image server

None

Transmission

Unicast and multicast

Multicast only

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-9

Server component

Deployment server

Transport server

Management

Both the WDSutil.exe command-line


tools and the Windows Deployment
Services Microsoft Management
Console (MMC) snap-in

WDSutil.exe only

Target computer

Uses Windows Deployment Services


client or the Wdsmcast.exe tool

Wdsmcast.exe only

Transport Server Functionality


You can use the Transport Server to provide the following functions:

Boot from the network. The Transport Server provides only a PXE listener; this is the component that
listens and accepts incoming traffic. You must write a custom PXE provider to use a Transport Server
to boot a computer from the network.

Multicasting. The multicast server in Windows Deployment Services consists of a multicast provider
and a content provider:
o

Multicast provider. Transmits data over the network.

Content provider. Interprets the data and passes it to the multicast provider. This is installed with
both the Transport Servers and Deployment Server, and can be used to transfer any file type,
although it has specific knowledge about the .wim image file format.

Windows Deployment Services Installation Requirements

The specific requirements for installing the Windows Deployment Services role depend on whether you
are deploying a Deployment Server or only a Transport Server.
To install a Deployment Server, your network and target server must meet the following requirements.

AD DS. Your Windows Deployment Services server must be either a member of an AD DS domain or a
domain controller for an AD DS domain.

Note: The AD DS domain and forest functional levels are not relevant; all domain and
forest configurations support Windows Deployment Services.

DHCP. You must have a working DHCP server with an active scope on the network. This is because
Windows Deployment Services uses PXE, which relies on DHCP to allocate IP configurations.

DNS. You must have a working DNS server on the network so that client computers can locate the
required services for deployment.

NTFS file system volume. The server running Windows Deployment Services requires an NTFS volume
for the image store. Windows Deployment Services accesses the image store within the context of the
logged on user. Therefore, deployment user accounts must have sufficient permissions on image files.

While not a requirement, the Windows ADK enables you to simplify the process for creating answer
(unattend.xml) files for use with automated Windows Deployment Services deployments.
Note: To install the Windows Deployment Services role, you must be a member of the
Local Administrators group on the server. To initialize the server, you must be a member of the
Domain Users group.

Installing and Configuring Windows Deployment Services


Once your network infrastructure meets the
prerequisites, you can install the Windows
Deployment Services server role.

Installing the Windows Deployment


Services Server Role
Use the following high-level steps to provide
guidance on installing the role.
1.

Open Server Manager, and then add the


Windows Deployment Services server role.

2.

Choose whether you want to install the


Deployment Server role service (which
includes the Transport Server role), or just the Transport Server role service.

3.

Complete the wizard to install the required role.

Initial Windows Deployment Services Configuration

MCT USE ONLY. STUDENT USE PROHIBITED

1-10 Deploying and Maintaining Server Images

Once Windows Deployment Services is installed, open Windows Deployment Services from Administrative
Tools, and then use the following high-level guidance to configure Windows Deployment Services.
1.

Select your server in Windows Deployment Services the console, and launch the Configuration wizard.

2.

Specify a location to store images. This location:

3.

Must be an NTFS partition.

Must be large enough to accommodate the deployment images that you anticipate needing.

Should be a separate physical disk from that on which the operating system is installed to help
optimize performance.

If the DHCP server role is co-hosted on the Windows Deployment Services server, you must:
o

Prevent the PXE server from listening on User Datagram Protocol (UDP) port 67; this port is used
by DHCP.

Configure DHCP option 60 to PXEClient; this enables the PXE client to locate the Windows
Deployment Services server port.

Note: If you deploy Windows Deployment Services to a server that is already running the
DHCP Server role, these changes are made automatically. If you subsequently add the DHCP
Server role to a Windows Deployment Server, you must ensure that you make these changes.
4.

Determine how you want the PXE server to respond to clients:


o

The default is that the PXE server does not respond to any clients; this is useful when you are
initially configuring Windows Deployment Services, as you do not yet have any images available
for clients.

Alternatively, you can choose to configure the PXE server to:

Respond to known client computers; these are computers that you have prestaged.

Respond to all client computers, whether you have prestaged them or not; if you select this
option, you can additionally define that administrator approval is required for unknown
computers. While awaiting approval, client computers are held in a pending queue.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-11

Note: If necessary, you can reconfigure these settings after the initial configuration is
complete.

Managing Deployments with Windows Deployment Services


Once you install and configure Windows
Deployment Services, you can then prepare
Windows Deployment Services to service client
deployments; this involves the following
procedures.

Configuring Boot Settings


You must complete several configuration tasks
to configure boot settings on the server that is
hosting Windows Deployment Services.

Add boot images. A boot image is a Windows


PE image that you use to boot a computer
and install the install image. Typically, you use the boot.wim file on the Windows Server 2012 product
DVD in the \sources folder. You may also decide to create a capture image, which is a specific type of
boot image that you can use to capture a currently installed operating system on a reference
computer.

Configure the PXE boot policy for known and unknown clients. This policy determines the required
installer behavior during the initial part of the deployment. By default, both known and unknown
computer policies require the installer to press F12 to connect to the Windows Deployment Services
image server. Failure to do so results in the computer using BIOS settings to determine an alternative
boot methodfor example, hard disk or CD ROM. Instead of this default, you can configure the
following options:
o

Always continue the PXE boot. This option ensures that the computer continues through the
deployment process without any installer interaction.

Continue the PXE boot unless the user pressed the Esc key. This option gives the installer the
ability to cancel the deployment.

Configure a default boot image. If you have multiple boot imagesfor example, to support multiple
platformsyou can configure a default boot image for each of them. This image is selected after a
timeout period on the PXE client computer.

Associate an answer file for setup. You can define an associated answer file for each client
architecture. This answer file provides information that is used during the initial setup phase, and
enables the Windows Deployment Services image server to select the appropriate install image for
the client, without installer intervention.

Create discover images. Not all computers support PXE network boot. For those that do not, you can
create a discover image based on a boot image and export it to a removable storage device. To
create a discover image, specify:
o

The image name and description.

The boot image on which it is based.

A filename with which to store the image.

The name of the Windows Deployment Services server that will be used for deployment.

Configuring Install Settings


You must configure additional install settings in Windows Deployment Services.

Add install images. This is the operating system image that you use to install Windows Server.
Typically, you start with the installation image install.wim, in the \sources folder on the Windows
Server 2012 product DVD. Thereafter, you might choose to create custom images for groups of
computers that have similar configurations.

Note: Before you can create install images, you must define an install image group in
which to consolidate the related images. If you do not do so, the Windows Deployment Services
administration program creates a generic group.

MCT USE ONLY. STUDENT USE PROHIBITED

1-12 Deploying and Maintaining Server Images

Associate an answer file with an install image. If you have created an answer file, for example by using
Windows ADK, you can associate it with an install to provide the necessary information to complete
deployment of the computer with no installer interaction.

Configure a client naming policy. You can use the client naming policy to define computer names for
unknown computers during deployment. The policy uses a number of variables to create a unique
name:

a.

%First. The installers first name. Placing a number after the % sign results in using only that many
characters. For example, %3First uses the first three characters of the installers first name.

b.

%Last. The installers last name. You can also define the number of characters to use.

c.

%Username. The installers user name. Again, you can limit the number of characters by
specifying a number after the % sign.

d.

%MAC. The Media Access Control (MAC) address.

e.

%[n]#. You can use this sequence to define a unique identifying sequential number to the
computer name containing n digits. If you want to use a multiple-digit number, pad the variable
with leading zeros, after the % sign. For example, %2# results in the sequential numbers 1, 2, 3,
and so on. %02# results in 01, 02, and 03.

Specify the AD DS location for computer accounts. The default is to use the same AD DS domain as
the Windows Deployment Services server. Alternatively, you can select between:
o

The same domain as the user performing the deployment.

The same organizational unit (OU) as the user who is performing the deployment.

A specified AD DS location.

Note: The Windows Deployment Services computer requires Create Computer object and
Write All Properties permissions on the AD DS container that you specify.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-13

Configuring Transmission Settings

Configure multicast transmissions. Unicast transmission is enabled by default; that is, you need do nothing
further and you can deploy clients using unicast. However, to enable multicast transmission, specify:

The multicast transmission name.

An install image with which the transmission is associated.

A method of multicast transmission. Choose between Autocast and Scheduled-Cast. If you choose
Scheduled-Cast, you can define both a threshold minimum number of clients before transmission
starts and the start date and time.

Configuring Drivers

Windows Deployment Services in Windows Server 2012 enables you to add and configure driver packages
on the server, and then deploy them to client computers during installations based on their hardware.
Use the following high-level steps to configure drivers:
1.

Obtain the drivers that you need. These must be in the form of an .inf file rather than an .msi or .exe
file.

2.

Configure filters, if desired, on the driver group. These filters determine which computers receive the
drivers based on the hardware characteristics of the client computers. For example, you can create a
filter that applies the drivers only to computers that have a BIOS manufactured by A. Datum.

3.

Add the drivers as a driver package. Driver packages must be associated with a driver group. If you
associate the driver package with an unfiltered group, all computers receive the driver.

You can use Windows Deployment Services to add driver packages to your Windows 8 and Windows
Server 2012 boot images; consequently, you do not have to export the image. Use the tools in the
Windows ADK to add driver packages manually, and then add the updated boot image.
Question: What is the advantage of defining a client naming policy?

Lesson 3

Administering Windows Deployment Services

MCT USE ONLY. STUDENT USE PROHIBITED

1-14 Deploying and Maintaining Server Images

When you have completed the configuration of Windows Deployment Services, you must create and
administer boot images, install images, and optionally capture and discover images. In addition, you must
make these images available to client computers with the desired level of automation, using an
appropriate transmission mechanism.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the common administration tasks.

Explain how to add and configure boot, capture, discover, and install images.

Explain how to automate deployments.

Explain how to configure multicast transmission to deploy your images.

Common Administration Tasks


To configure Windows Deployment Services
effectively, you must complete a number of
common administration tasks. To help you
complete these tasks, Windows Deployment
Services provides a number of tools to help you.
The administrative tasks that you must complete
include the following:

Configuring DHCP

Creating and servicing images

Managing the boot menu

Prestaging client computers

Automating deployment

Configuring transmission

Configuring DHCP

Clients that boot using PXE require a dynamically allocated IPv4 configuration. You must create
and configure an appropriate DHCP scope for this purpose. Additionally, if the DHCP and Windows
Deployment Services server roles are co-hosted, then you must configure how the PXE server listens for
client requests; there is an inherent conflict as both DHCP and Windows Deployment Services use UDP
port 67. To create and manage DHCP scopes, you can use the DHCP snap-in or the Netsh.exe commandline tool.

Creating and Servicing Images


You can create and service images with the Windows Deployment Services snap-in, Windows SIM, the
WDSutil.exe command-line tool, or the Dism.exe command-line tool.
For example, to add a boot image, use the following command:
WDSUTIL /Verbose /Progress /Add-Image /ImageFile:<path> /ImageType:Boot

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-15

To create a capture image, use the following command:

WDSUTIL /New-CaptureImage /Image:<source boot image name> /Architecture:{x86|ia64|x64}


/DestinationImage /FilePath:<file path>

To add an install image, use the following two commands, pressing Enter after each line:

WDSUTIL /Add-ImageGroup /ImageGroup:<image group name>


WDSUTIL /Verbose /Progress /Add-Image /ImageFile:<path to .wim file> /ImageType:Install

Note: You can also perform these management tasks using the Windows Deployment
Service management console, found in Server Manager.

Managing the Boot Menu

The boot environment for Windows Server 2012 relies on the Boot Configuration Data (BCD) store. This
store defines how the boot menu is configured. You can customize the store using Bcdedit.exe.
Note: When you customize the BCD store, you must force it to be recreated for your
changes to take effect. To do this, run the following two WDSutil.exe commands (pressing Enter
after each line), to stop and then restart the Windows Deployment Services server:
wdsutil /stop-server
wdsutil /start-server
The following is a list of limitations for the boot menu user interface:

Screen size. Only 13 images can be displayed on the menu. If you have more, the installer must scroll
down to see them.

Mouse. There is no mouse pointer.

Keyboard. There is no support for alternate keyboards, other than what the BIOS supports.

Localization. There is limited support for localization, other than what the BIOS supports.

Accessibility. There is limited support for accessibility.

Prestaging Client Computers

Windows Deployment Services supports deployment to unknown clients. You can exert some control over
unknown clients by configuring administrator approval. This ensures that clients that are attempting to
deploy with Windows Deployment Services are placed in a pending queue awaiting your approval. You
can also configure the client computers name during approval.
However, if you want more specific control over deployments, you can prestage the computers in AD DS;
this enables you to configure the client to:

Start from a different Windows Deployment Services server.

Use a different network boot program.

Use a specific unattend file.

Use a specific boot image.

Join a particular AD DS domain.

You can use the following WDSutil.exe command-line tool to prestage computers:
WDSUTIL /Add-Device /Device:<name> /ID:<GUIDorMACAddress>

In this example, <GUIDorMACAddress> is the identifier of the new computer.

Automating Deployment
You can automate Windows Deployment Services deployments from end-to-end. You can use the
Windows Deployment Services snap-in and Windows SIM to complete these tasks.

Configuring Transmission

MCT USE ONLY. STUDENT USE PROHIBITED

1-16 Deploying and Maintaining Server Images

Multicasting enables you to deploy an image to a large number of client computers without consuming
excessive network bandwidth.
Consider enabling multicast transmissions if your organization:

Anticipates many concurrent deployments.

Has routers that support the propagation of multicasts; that is support for the Internet Group
Management Protocol (IGMP).

You can use the Windows Deployment Services snap-in or the WDSutil.exe command-line tool to manage
multicast transmission. For example, to create a multicast transmission with Autocast, use the following
command:
WDSUTIL /New-MulticastTransmission /Image:<image name> /FriendlyName:<friendly name>
/ImageType:Install /ImageGroup:<Image group name> /TransmissionType:AutoCast

To create a Scheduled-Cast transmission, use the following command:


WDSUTIL /New-MulticastTransmission /Image:<image name> /FriendlyName:<friendly name>
/ImageType:Install /ImageGroup:<Image group name> /TransmissionType:ScheduledCast
[/Time:<yyyy/mm/dd:hh:mm>][/Clients:<no of clients>]

Demonstration: How to Administer Images


This demonstration shows how to administer images. In this demonstration, this process will be broken
down into the following four steps:

Install and configure the Windows Deployment Services role.

Add a boot image.

Create a capture image.

Add an install image.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-17

Demonstration Steps
Install and configure the Windows Deployment Services role
1.

Switch to the LON-SVR1 computer.

2.

Open Server Manager.

3.

Install the Windows Deployment Services server role with both role services.

4.

In the Windows Deployment Services console, right-click LON-SVR1.Adatum.com, and then click
Configure Server.

5.

Use the following information to complete configuration:


o

Integrate Windows Deployment Services with Active Directory.

On the Remote Installation Folder Location page, accept the defaults.

Accept the System Volume Warning message.

On the PXE Server Initial Settings page, select the Respond to all (known and unknown)
client computers option.

When prompted, choose to not add images to the server.

Add a boot image


1.

Switch to LON-SVR1.

2.

If necessary, open the Windows Deployment Services console.

3.

Add a new boot image using the following information to complete the process:

4.

a.

On the Image File page, use the file name: D:\sources\boot.wim.

b.

Accept the defaults on the Image Metadata page.

c.

Accept the defaults on the Summary page.

On the Task Progress page, click Finish.

Add an install image


1.

If necessary, open Windows Deployment Services.

2.

Add a new Image Group with the image group name of Windows Server 2012.

3.

Use the Add Image Wizard to add a new install image to this group. Use the following information to
complete the process:

4.

a.

On the Image File page, use the following file name: D:\sources\install.wim.

b.

On the Available Images page, clear all check boxes except Windows Server 2012
SERVERSTANDARDCORE.

c.

Accept the defaults on the Summary page.

d.

On the Task Progress page, click Finish.

Minimize the Windows Deployment Services window.

Automating Deployments
There are four phases that you can automate
during the Windows Deployment Services
deployment process. These are:

MCT USE ONLY. STUDENT USE PROHIBITED

1-18 Deploying and Maintaining Server Images

PXE Boot Policy. You can determine how the


PXE server responds to clients, and whether
the installer is required to press the F12 key to
connect to the Windows Deployment Services
server and select a boot image. For example,
the Always continue the PXE boot option
ensures that the computer continues through
the deployment process without any installer
interaction.

The default boot image. If you configure a default boot image, the installer will not be prompted to
make a selection.

The Windows Deployment Services screens. When the client computer uses the TFTP protocol to
connect to the Windows Deployment Services server and select a boot image, the installer must then
provide credentials and select an operating system image to install. You can create an Unattend.xml
answer file to automate this phase.

Windows Setup. You can customize the setup program so that once the install image has been
selected (either automatically or manually), the setup program will complete the installation process
with no installer intervention. This is the same type of automation that you use to automate
installations with the Windows ADKADK.

Use Windows SIM to create both types of answer files, and then use the Windows Deployment Services
snap-in to associate the answer files with the required deployment phase.

Automate Client Unattend


Use the following procedure to associate an answer file for the client unattend deployment phase:
1.

Create the Unattend.xml file in Windows ADK with settings appropriate to Windows Deployment
Services.

2.

Copy the file to the Windows Deployment Services server, and paste it into a folder under
\RemoteInstall.

3.

Open Windows Deployment Services.

4.

View the Properties dialog box for the Windows Deployment Services server in the Windows
Deployment Services console.

5.

On the Client tab, enable unattended installation, and then select the answer file that you created
earlier.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-19

Sample Unattend Answer File for Windows Deployment Services client Unattend

The following is a portion of a sample answer file that required to automate the Windows Deployment
Services client Unattend phase:
<WindowsDeploymentServices>
<Login>
<WillShowUI>OnError</WillShowUI>
<Credentials>
<Username>Installer</Username>
<Domain>Adatum.com</Domain>
<Password>Pa$$w0rd</Password>
</Credentials>
</Login>
<ImageSelection>
<WillShowUI>OnError</WillShowUI>
<InstallImage>
<ImageName>Windows Server 2021</ImageName>
<ImageGroup>Adatum Server Images</ImageGroup>
<Filename>Install.wim</Filename>
</InstallImage>
<InstallTo>
<DiskID>0</DiskID>
<PartitionID>1</PartitionID>
</InstallTo>
</ImageSelection>
</WindowsDeploymentServices>

Automate Windows Setup


To automate the Windows Setup process, use the following steps:
1.

Create the Unattend.xml file in Windows ADK, with settings appropriate to Windows Setup.

2.

Copy the file to a suitable location on the Windows Deployment Services server.

3.

In Windows Deployment Services, view the properties of the appropriate install image.

4.

Enable the Allow image to install in unattended mode option, and then select the answer file that
you created.

Demonstration: How to Configure Multicast Transmission


This demonstration shows how to configure multicast transmission.

Demonstration Steps
1.

Open the Windows Deployment Services console on LON-SVR1.

2.

Create a new multicast transmission by using the following information:


o

Transmission name: Windows Server 2012 Branch Servers

Image group: Windows Server 2012

Image: Windows Server 2012 SERVERENTERPRISECORE

Multicast type: Autocast

Lab: Using Windows Deployment Services to Deploy


Windows Server 2012
Scenario
A. Datum Corporation is a global engineering and manufacturing company with its head office in
London, U.K. An IT office and data center are in London to support the head office and other branch
locations. A. Datum has recently deployed a Windows Server 2012 server and client infrastructure.

MCT USE ONLY. STUDENT USE PROHIBITED

1-20 Deploying and Maintaining Server Images

A. Datum is deploying servers to branch offices throughout the region for the Research department. You
have been tasked with helping to automate this deployment. You suggest using Windows Deployment
Services to deploy Windows Server 2012 to the branch offices. You have been sent some instructions by
email regarding the deployment. You must read these instructions, and then install and configure
Windows Deployment Services to support the deployment.

Objectives
After completing this lab, you will be able to:

Install and configure Windows Deployment Services.

Create operating system images using Windows Deployment Services.

Configure custom computer naming.

Deploy images with Windows Deployment Services.

Lab Setup
Estimated Time: 75 minutes

Virtual Machines

20411B-LON-DC1
20411B-LON-SVR1
20411B-LON-SVR3

User Name

Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Log on using the following credentials:

5.

User name: Adatum\Administrator

Password: Pa$$w0rd

Perform steps 2 through 4 for 20411B-LON-SVR1. Do not start 20411B-LON-SVR3 until directed to
do so.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-21

Exercise 1: Installing and Configuring Windows Deployment Services


Scenario

To assist with the process of configuring Windows Deployment Services, you have been sent an email with
the appropriate configuration information.
Branch Office Deployment Guide
Requirements Overview
To configure Microsoft Windows Deployment Services to aid in the deployment of branch office
servers.
Additional Information
Deployment method: Automated standard image deployments
Configuration information:
o LON-SVR1 is to be used to host Windows Deployment Services.
o Configure multicast transmission to use Autocast.
o Configure automatic naming to identify branch servers.
o Place branch servers in the Research organizational unit (OU).
o Operating system should be Windows Server 2012 Enterprise Edition.
o A Server Core installation should be performed.
The main tasks in this exercise are:
1.

Read the supporting documentation.

2.

Install the Windows Deployment Services role.

3.

Configure Windows Deployment Services.

Task 1: Read the supporting documentation

Read the supporting documentation in the exercise scenario to determine the deployment details.

Task 2: Install the Windows Deployment Services role


1.

Switch to the LON-SVR1 computer.

2.

Open Server Manager.

3.

Install the Windows Deployment Services server role with both role services.

4.

Close Server Manager.

Task 3: Configure Windows Deployment Services


1.

Open the Windows Deployment Services console.

2.

Right-click LON-SVR1.Adatum.com, and then click Configure Server.

3.

Use the following information to complete configuration:


a.

Integrate Windows Deployment Services with Active Directory.

b.

On the Remote Installation Folder Location page, accept the defaults.

MCT USE ONLY. STUDENT USE PROHIBITED

1-22 Deploying and Maintaining Server Images

c.

Accept the System Volume Warning message.

d.

On the PXE Server Initial Settings page, select the Respond to all client computers (known
and unknown) option.

e.

When prompted, choose to not add images to the server.

Results: After completing this exercise, you will have installed and configured Windows Deployment
Services.

Exercise 2: Creating Operating System Images with Windows Deployment


Services
Scenario
Windows Deployment Services is installed and configured successfully. You now must create various
operating-system images to aid deployment.
The main tasks in this exercise are:
1.

Insert the Windows Server 2012 installation media in LON-SVR1.

2.

Add a boot image.

3.

Add an install image.

Task 1: Insert the Windows Server 2012 installation media in LON-SVR1


1.

On the host computer, open Hyper-V Manager.

2.

Open the Settings page for 20411B-LON-SVR1.

3.

Select the DVD Drive, and attach the International Organization for Standardization (ISO) file
located at C:\Program Files\Microsoft Learning\20411\Drives\WIndows2012_RTM.iso.

Task 2: Add a boot image


1.

Switch to LON-SVR1.

2.

If necessary, open the Windows Deployment Services console.

3.

Add a new boot image using the following information to complete the process:

4.

On the Image File page, use the file name: D:\sources\boot.wim.

Accept the defaults on the Image Metadata page.

Accept the defaults on the Summary page.

On the Task Progress page, click Finish.

Task 3: Add an install image


1.

If necessary, open Windows Deployment Services.

2.

Add a new Image Group with the image group name of Windows Server 2012.

3.

Use the Add Image Wizard to add a new install image to this group. Use the following information to
complete the process:
a.

On the Image File page, use the following file name: D:\sources\install.wim.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-23

4.

b.

On the Available Images page, clear all check boxes except Windows Server 2012
SERVERSTANDARDCORE.

c.

Accept the defaults on the Summary page.

d.

On the Task Progress page, click Finish.

Minimize the Windows Deployment Services window.

Results: After completing this exercise, you will create an operating system image with Windows
Deployment Services.

Exercise 3: Configuring Custom Computer Naming


Scenario

To automate computer naming, you must configure the custom naming properties for Windows
Deployment Services as per the document that was sent to you. This also involves configuring delegation
on the Active Directory OU that will contain the computer accounts. Administrator approval is required, so
you must also configure that.
The main tasks in this exercise are:
1.

Configure automatic naming.

2.

Configure Administrator approval.

3.

Configure AD DS permissions.

Task 1: Configure automatic naming


1.

In Windows Deployment Services, view the properties of LON-SVR1.Adatum.com.

2.

On the AD DS tab, use the following information to configure automatic naming:


o

Format: BRANCH-SVR-%02#

Computer Account Location: Adatum Research OU

Task 2: Configure Administrator approval


1.

In Windows Deployment Services, view the properties of LON-SVR1.Adatum.com.

2.

On the PXE Response tab, select Require administrator approval for unknown computers, and
change the PXE Response Delay to 3 seconds.

3.

Open Windows PowerShell, and then type the following command to create a message for
installers to view while awaiting admin approval:

WDSUTIL /Set-Server /AutoAddPolicy /Message:The Adatum administrator is authorizing


this request. Please wait.

4.

Close the Command Prompt window.

Task 3: Configure Active Directory Domain Services (AD DS) permissions

MCT USE ONLY. STUDENT USE PROHIBITED

1-24 Deploying and Maintaining Server Images

1.

Switch to the LON-DC1 computer, and open Active Directory Users and Computers.

2.

Right-click the Research organizational unit (OU), and use the Delegate Control Wizard to delegate
the LON-SVR1 computer account the ability to create computer objects in the OU. Use the following
information to help:
a.

Tasks to delegate: Create a custom task to delegate

b.

On the Active Directory Object Type page, click Only the following objects in the folder,
select the Computer objects check box, and select the Create selected objects in this folder
check box.

c.

On the Permissions page, in the Permissions list, select the Full Control check box.

Results: After completing this exercise, you will have configured custom computer naming.

Exercise 4: Deploying Images with Windows Deployment Services


Scenario
You have provided instructions for a branch supervisor to initiate the installation process on the branch
office server computer. The installation now will occur.
The main tasks in this exercise are:
1.

Configure a Windows Deployment Services server for multicast transmission.

2.

Configure the client for Pre-Boot Execution Environment (PXE) Booting.

Task 1: Configure a Windows Deployment Services server for multicast transmission


1.

Switch to the LON-SVR1 computer.

2.

Create a new multicast transmission using the following information to complete the process:
o

Transmission name: Windows Sever 2012 Branch Servers

Image group: Windows Server 2012

Image: Windows Server 2012 SERVERSTANDARDCORE

Multicast type: Autocast

Task 2: Configure the client for Pre-Boot PXE Booting


1.

On the host computer, switch to Hyper-V Manager.

2.

In the Virtual Machines list, right-click 20411B-LON-SVR3, and then click Settings.

3.

In the Settings for 20411B-LON-SVR3 dialog box, click BIOS.

4.

In the results pane, click Legacy Network adapter.

5.

Use the arrows to move Legacy Network adapter to the top of the list, and then click OK.

6.

In Hyper-V Manager, click 20411B-LON-SVR3, and in the Actions pane, click Start.

7.

In the Actions pane, click Connect.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 1-25

8.

When the computer reboots, note the PXE Dynamic Host Configuration Protocol (DHCP) notice.
When prompted, press F12 for Network Boot.
Question: Do you see the admin approval message?

9.

Switch to the LON-SVR1 computer.

10. In Windows Deployment Services, click Pending Devices.


11. Right-click the pending request, and then click Approve.
12. In the Pending Device dialog box, click OK.
13. Switch to the LON-SVR3 computer.
Question: Which image is the default?
Question: Does setup start?
14. You do not have to continue setup.

To prepare for the next module


When you finish the lab, revert the virtual machines to their initial state.
1.

On the host computer, start Hyper-V Manager.

2.

Right-click 20411B-LON-DC1 in the Virtual Machines list, and then click Revert.

3.

In the Revert Virtual Machine dialog box, click Revert.

4.

Repeat these steps for 20411B-LON-SVR3 and 20411B-LON-SVR1.

Results: After completing this exercise, you will have deployed an image with Windows Deployment
Services.

Module Review and Takeaways


Tools
Tool

What it is used for

Where to find it

MCT USE ONLY. STUDENT USE PROHIBITED

1-26 Deploying and Maintaining Server Images

Windows Deployment
Services console

Administering Windows Deployment


Services

Server Manager - Tools

WDSutil.exe

Command-line management of
Windows Deployment Services

Command line

Windows ADK

Managing image files and creating


answer files

Download from Microsoft.com

Dism.exe

Offline and online servicing of images

Windows ADK

Netsh.exe

Command-line tool for managing


network-related settings

Command line

MCT USE ONLY. STUDENT USE PROHIBITED


2-1

Module 2
Configuring and Troubleshooting Domain Name System
Contents:
Module Overview

2-1

Lesson 1: Installing the DNS Server Role

2-2

Lesson 2: Configuring the DNS Server Role

2-8

Lesson 3: Configuring DNS Zones

2-14

Lesson 4: Configuring DNS Zone Transfers

2-19

Lesson 5: Managing and Troubleshooting DNS

2-22

Lab: Configuring and Troubleshooting DNS

2-30

Module Review and Takeaways

2-35

Module Overview

The Domain Name System (DNS) is the foundation name service in Windows Server 2012. It provides
name resolution, and enables DNS clients to locate network services, such as Active Directory Domain
Services (AD DS) domain controllers, global catalog servers, and messaging servers. If you configure
your DNS infrastructure poorly, or it is not working correctly, these important network services will be
inaccessible to your network servers and clients. Consequently, it is vital that you understand how to
deploy, configure, manage, and troubleshoot this critical service.

Objectives
After completing this module, you will be able to:

Install the DNS server role.

Configure the DNS server role.

Create and configure DNS zones.

Configure zone transfers.

Manage and troubleshoot DNS.

Lesson 1

Installing the DNS Server Role


To support the underlying network services within your organization, you must be able to install and
configure the Windows Server 2012 DNS server role. Before installing the DNS server role, you must
understand the requirement of your organizations network infrastructure and decide whether to use a
split-brain DNS. You also must consider the placement of the DNS server role, and the number of DNS
clients and zones that you will use. This lesson describes the installation process for a DNS server role.

Lesson Objectives
After completing this lesson, you will be able to:

Explain the role and benefits of DNS in the network infrastructure.

Explain a DNS namespace.

Describe how to integrate DNS into AD DS.

Explain the use of split-brain DNS.

Explain how to install the DNS server role.

Describe the considerations for deploying a DNS server.

Overview of the DNS Role


DNS is a name-resolution service that resolves
names to IP addresses. The DNS service is a
logically separated, hierarchical distributed
database, which enables many different servers
to host a worldwide database of DNS names.

How DNS Supports the Internet Naming


Scheme Foundation

MCT USE ONLY. STUDENT USE PROHIBITED

2-2 Configuring and Troubleshooting Domain Name System

DNS is a worldwide service that allows you to type


in a domain name (for example, Microsoft.com),
which your computer resolves to an IP address. A
benefit of DNS is that IPv4 addresses can be long
and difficult to remember, such as 131.107.0.32.
However, a domain name typically is easier to remember. Furthermore, you can use host names that do
not change, although you can modify the underlying IP addresses to suit your organizational needs.

With the adoption of IPv6, DNS will become even more critical because IPv6 addresses are even more
complex than IPv4 addresses. An example of an IPv6 address is 2001:db8:4136:e38c:384f:3764:b59c:3d97.

How DNS Supports an Organizations Foundation for AD DS Naming Schemes

DNS is responsible for resolving resources in an Active Directory Domain Services (AD DS) domain.
The DNS role is a prerequisite for installing AD DS. DNS provides information to workstation clients,
which enable them to sign in to the network. DNS resolves resources in the domain, such as servers,
workstations, printers, and shared folders. If you configure a DNS server incorrectly, it can be the source
of source of many AD DS problems.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-3

Overview of the DNS Namespace


The DNS namespace facilitates how a DNS
resolver locates a computer. The namespace is
organized hierarchically to distribute information
across many servers.

Root Domain
A period (.) represents the root domain, and you
do not type it into a web browser. The period (.) is
assumed. The next time that you type an address
into a computer, try adding the period at the end
(for example, www.microsoft.com.). There are 13
root domain servers worldwide.
Note: When troubleshooting DNS, it is usual to specify the trailing period.

Top-Level Domain

The top-level domain (TLD) is the first level of the DNS name space. Examples of TLDs on the Internet
include .com, .net, .org, .biz, and .ca. The most recognized domains are .com, .net, .org, and .gov, which is
for the government of the United States. There are several more domain names at this level, and there is a
TLD for each country. For example, the TLD for Canada is .ca, and the TLD for the United Kingdom is .uk.
The organization that regulates domain names, known as the Internet Corporation for Assigned Names
and Numbers (ICANN), adds new TLDs occasionally.

Second-Level Domain

The second-level domain name is the portion of the domain name that appears before the TLD.
An example of a second-level domain name is microsoft in the www.microsoft.com domain. The
organizations that register second-level domain names control them. Anyone may register a second-level
domain name through an Internet registry service. Many second-level domains have special rules about
what organizations or people can register a domain name. For example, only nonprofit organizations may
use .org.

Subdomain

The subdomain is listed before the second-level and top-level domains. An example of a subdomain is
www in the www.microsoft.com domain name. Subdomains are defined in the DNS server of the
organization that holds the second-level DNS server.

Fully Qualified Domain Name


A fully qualified domain name (FQDN) is the explicit DNS name that includes the computer name
and the subdomains to the root domain. For example, if the computer is designated as Server1 in the
sales.south.contoso.com domain, the FQDN for that computer is server1.sales.south.contoso.com.

DNS Naming Standards


The following characters are valid for DNS names:

A through Z

a through z

0 through 9

Hyphen (-)

Note: The underscore (_) is a reserved character.

Integrating AD DS and DNS


When you begin planning your DNS namespace,
you must consider both the internal and external
namespaces. The internal namespace is the one
that internal clients and servers use within your
private network. The external namespace is the
one by which your organization is referenced on
the Internet. There is no requirement that you
should implement the same DNS domain name
internally that you have externally.
When you implement AD DS, you must use a DNS
namespace for hosting AD DS records.
Note: Consider carefully your options
before selecting a namespace design for AD DS. Although it is possible to change a namespace
after implementing AD DS, it is a time-consuming and complex process that has many
limitations.
To determine a DNS namespace for your AD DS environment, you can choose from the following
scenarios:

MCT USE ONLY. STUDENT USE PROHIBITED

2-4 Configuring and Troubleshooting Domain Name System

Make the internal namespace the same as the public namespace. In this scenario, the internal and
public namespaces are the same, but will have different records. Although this provides simplicity,
which makes it a suitable choice for smaller organizations, it can be difficult to manage for larger
networks.

Make the internal namespace different from the public namespace. In this scenario, the internal and
public namespaces are completely different, with no link between them. This provides for obvious
separation in the namespace. In complex networks, with many Internet-facing applications, use of
a different name introduces some clarity when configuring these applications. For example, Edge
Servers that are placed on a perimeter network often require multiple network interface cards: one
connected to the private network; and one servicing requests from the public network. If each
network interface card has a different domain name, it often is easier to complete the configuration
of that server.

Make the internal namespace a subdomain of the public namespace. In this scenario, the internal
namespace is linked to the public namespace, but there is no overlap between them. This provides
a hybrid approach. The internal name is different, which allows for separation of the namespace.
However, the internal name also is related to the public name, which provides simplicity. This
approach is the simplest to implement and manage. However, if you cannot use a subdomain of the
public namespace for AD DS, you should use unique namespaces.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-5

Note: In most situations, computers within an AD DS domain have a primary DNS suffix
that matches the DNS domain name. Occasionally, you may require these names to differ, such
as following a merger or during an acquisition. When names differ, this is known as a disjoint
namespace. A disjoint namespace scenario is one in which the primary DNS suffix of a computer
does not match the DNS domain name in which that computer resides. The computer with the
primary DNS suffix that does not match is said to be disjointed. Another disjoint namespace
scenario occurs if the NetBIOS domain name of a domain controller does not match the DNS
domain name.

Determining Whether to Use Split DNS


Using the same namespace internally and
externally simplifies resource access from
the perspective of users, but it also increases
management complexity. You should not make
internal DNS records available externally, but
some synchronization of records for external
resources typically is required. For example, both
your internal and external namespaces might use
the name Contoso.com.
Using unique namespaces for the internal and
public namespaces provides a clear delineation
between internal and external DNS, and avoids
the need to synchronize records between the namespaces. However, in some cases, having multiple
namespaces may lead to user confusion. For example, you may choose the external namespace of
Contoso.com and the internal namespace of Contoso.local. Note that when you implement a unique
namespace configuration, you no longer are tied to using registered domain names.

Using a subdomain of the public namespace for AD DS avoids the need to synchronize records
between the internal and external DNS servers. Because the namespaces are linked, users typically find
this structure easy to understand. For example, if your public namespace is Contoso.com, you might
choose to implement your internal namespace as the subdomain AD, or AD.Contoso.com.

Considering Split DNS

Having a matching internal and external DNS namespace can pose certain problems. However, split DNS
can provide a solution to these problems. Split DNS is a configuration in which your domain has two rootserver zones that contain domain-name registration information. Your internal network hosts are directed
to one zone, while external hosts are directed to another for name resolution. For example, in a nonsplit
DNS configuration for the domain Contoso.com, you might have a DNS zone that looks like the example
in the following table.
Host

Record type

IP address

www

131.107.1.200

Relay

131.107.1.201

Webserver1

192.168.1.200

Exchange1

192.168.0.201

When a client computer on the Internet wants to access the Simple Mail Transfer Protocol (SMTP) relay
by using the published name of relay.contoso.com, it queries the DNS server that returns the result
131.107.1.201. The client then establishes a connection over SMTP to that IP address.

MCT USE ONLY. STUDENT USE PROHIBITED

2-6 Configuring and Troubleshooting Domain Name System

However, the client computers on the corporate intranet also use the published name of
relay.contoso.com. The DNS server returns the same result: a public IP address of 131.107.1.201. The client
now attempts to establish a connection to the returned IP address by using the external interface of the
publishing computer. Depending upon the client configuration, this may or may not be successful.
By configuring two zones for the same domain nameone on each of the two DNS serversyou can
avoid this problem.
The internal zone for adatum.com would resemble the information in the following table.
Host

Record type

IP address

www

CNAME

Webserver1.contoso.com

Relay

CNAME

Exchange1.contoso.com

Webserver1

192.168.1.200

Exchange1

192.168.0.201

The external zone for adatum.com would resemble the information in the following table.
Host

Record type

IP address

www

131.107.1.200

Relay

131.107.1.201

MX

Relay.contoso.com

Now, client computers in the internal and external networks can resolve the name relay.contoso.com to
the appropriate internal or external IP address.

Demonstration: Installing the DNS Server Role


This demonstration shows how to install the DNS server role.

Demonstration Steps
1.

Switch to LON-SVR1, and sign in as Adatum\Administrator with the password Pa$$w0rd.

2.

Use Server Manager to install the DNS Server role.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-7

Considerations for Deploying the DNS Server Role


When you are planning to deploy DNS, you
must review several considerations. Some of the
questions that you should ask include:

How many DNS zones will you configure on


the server and how many DNS records will
each zone contain? Typically, zones map on
a one-to-one basis with domains in your
namespace. When you have a large number
of records, it might make more sense to split
the records into multiple zones.

How many DNS clients will be


communicating with the server on which you
configure the DNS role? The larger the number of client resolvers, the greater is the load placed on
the server. When you anticipate additional load, consider deploying additional DNS servers.

Where will you place DNS servers? For example, will you place the servers centrally, or does it make
more sense to locate DNS servers in branch offices? If there are few clients at a branch office, you
could satisfy most DNS requests by using a central DNS server or by implementing a caching-only
server. A large number of users at a branch might benefit from a local DNS server with appropriate
zone data.

How you answer the preceding questions will determine how many DNS servers you must deploy, and
where you should place them.

Active Directory Integration

The Windows Server 2012 DNS role can store the DNS database in two different ways, as the following
table shows.
Storage method

Description

Text File

The DNS server role stores the DNS entries in a text file, which you can edit
with a text editor.

Active Directory

The DNS server role stores the DNS entries in the Active Directory database,
which replicates to other domain controllers, even if they do not run the
Windows Server 2008 DNS role. You cannot use a text editor to edit DNS data
that Active Directory stores.

Active Directory integrated zones are easier to manage than traditional text-based zones, and are more
secure. The replication of zone data occurs as part of Active Directory replication.

DNS Server Placement

Typically, you will deploy the DNS role on all domain controllers. If you decide to implement some other
strategy, ask yourself the following questions, and keep the answers in mind:

How will client computers resolve names if their usual DNS server becomes unavailable?

What will the impact on network traffic be if client computers start to use an alternate DNS server,
perhaps located remotely?

How will you implement zone transfers? Active Directory integrated zones use Active Directory
replication to transfer the zone to all other domain controllers. If you implement non-Active Directory
integrated zones, you must plan the zone transfer mechanism yourself.

Lesson 2

Configuring the DNS Server Role

MCT USE ONLY. STUDENT USE PROHIBITED

2-8 Configuring and Troubleshooting Domain Name System

The DNS infrastructure is the basis for name resolution on the Internet and in AD DS domains based on
Windows Server 2012. This lesson provides guidance and information about what is required to configure
the DNS server role, and explains the basic functions of a DNS server.

Lesson Objectives
After completing this lesson, you will be able to:

List the components of a DNS solution.

Describe how various types of DNS queries work.

Describe DNS resource records.

Explain how root hints work.

Explain how forwarding and conditional forwarding works.

Explain how DNS server caching works.

Explain how to configure the DNS server role properties.

What Are the Components of a DNS Solution?


The components of a DNS solution include DNS
servers, DNS servers on the Internet, and DNS
resolvers or clients.

DNS Servers
A DNS server answers recursive and iterative DNS
queries. DNS servers also can host one or more
zones of a particular domain. Zones contain
different resource records. DNS servers also can
cache lookups to save time for common queries.

DNS Servers on the Internet

DNS servers on the Internet are accessible


publicly. They host public zone information and the root server, and other common TLDs, such as .com,
.net, and .edu.
Note: Do not confuse these servers with your organizations DNS servers that host your
public namespace. These are located physically on your perimeter network.

DNS Resolvers

The DNS resolver generates and sends iterative or recursive queries to the DNS server. A DNS resolver can
be any computer performing a DNS lookup that requires interaction with the DNS server. DNS servers also
can issue DNS requests to other DNS servers.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-9

What Are DNS Queries?


A DNS query is the method that you use to
request name resolution, and involves a query
being sent to a DNS server. There are two types
of responses to DNS queries: authoritative and
nonauthoritative.
It is important to note that DNS servers also can
act as DNS resolvers and send DNS queries to
other DNS servers.
A DNS server can be either authoritative or
nonauthoritative for the querys namespace. A
DNS server is authoritative when it hosts a primary
or secondary copy of a DNS zone. The two types
of queries are:

An authoritative query is one for which the server can return an answer that it knows is correct,
because the request is directed to the authoritative server that manages the domain.

A DNS server that contains in its cache the domain being requested answers a nonauthoritative query
by using forwarders or root hints. However, the answer provided might not be accurate, because only
the authoritative DNS server for the given domain can issue that information.

If the DNS server is authoritative for the querys namespace, the DNS server will check the zone, and then
do one of the following:

Return the requested address.

Return an authoritative No, that name does not exist.

Note: An authoritative answer can be given only by the server with direct authority for the
queried name.

If the local DNS server is nonauthoritative for the querys namespace, the DNS server will do one of the
following:

Check its cache, and return a cached response.

Forward the unresolvable query to a specific server known as a forwarder.

Use well-known addresses of multiple root servers to find an authoritative DNS server to resolve the
query. This process uses root hints.

Recursive Queries
A recursive query can have two possible results:

It returns the IP address of the requested host.

The DNS server cannot resolve an IP address.

For security reasons, it sometimes is necessary to disable recursive queries on a DNS server. This prevents
the DNS server in question from forwarding its DNS requests to another server. This can be useful when
you do not want a particular DNS server communicating outside its local network.

Iterative Queries
Iterative queries provide a mechanism for accessing domain-name information that resides across the
DNS system, and enable servers to resolve names quickly and efficiently across many servers.
When a DNS server receives a request that it cannot answer using its local information or its cached
lookups, it makes the same request to another DNS server by using an iterative query.

MCT USE ONLY. STUDENT USE PROHIBITED

2-10 Configuring and Troubleshooting Domain Name System

When a DNS server receives an iterative query, it might answer with either the IP address for the domain
name (if known) or with a referral to the DNS servers that are responsible for the domain being queried.

DNS Resource Records


The DNS zone file stores resource records.
Resource records specify a resource type and
the IP address to locate the resource. The most
common resource record is an A resource record.
This is a simple record that resolves a hostname
to an IP address. The host can be a workstation,
server, or another network device, such as a
router.

Resource records also help find resources for


a particular domain. For instance, when an
Exchange server needs to find the server that
is responsible for delivering mail for another
domain, it will request that domains Mail Exchanger (MX) record, which points to the A record of the host
that is running the SMTP mail service.

Resource records also can contain custom attributes. MX records, for instance, have a preference attribute,
which is useful if an organization has multiple mail servers. This will inform the sending server which mail
server the receiving organization prefers. Service locator (SRV) records also contain information regarding
on which port the service is listening and the protocol that you should use to communicate with the
service.
The following table describes the most common resource records.
DNS resource records

Description

Start of authority (SOA) resource


record

The record identifies the primary name server for a DNS zone,
as well as other specifics, such as Time to Live (TTL) and refresh.

Host address (A) resource record

The main record that resolves a host name to an IPv4 address.

Canonical name (CNAME) resource


record

An alias record type that maps one name to another (for


example, www.microsoft.com is a CNAME of the A record
microsoft.com).

MX resource record

The record is used to specify an email server for a particular


domain.

SRV resource record

The record identifies a service that is available in the domain.


Active Directory uses these records extensively.

Name Server (NS) resource record

The record identifies a name server for a domain.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-11

DNS resource records

Description

AAAA

The main record that resolves a host name to an IPv6 address.

Pointer (PTR) resource record

The record is used to look up and map an IP address to a


domain name. The reverse lookup zone stores the names.

What Are Root Hints?


Root hints are the list of servers on the Internet
that your DNS server uses if it cannot resolve a
DNS query by using a DNS forwarder or its own
cache. The root hints are the highest servers in
the DNS hierarchy and can provide the necessary
information for a DNS server to perform an
iterative query to the next lowest layer of the
DNS namespace.
Root servers are installed automatically when
you install the DNS role. They are copied from the
cache.dns file that the DNS role setup files include.
You also can add root hints to a DNS server to
support lookups for noncontiguous domains within a forest.

When a DNS server communicates with a root hints server, it uses only an iterative query. If you select the
Do Not Use Recursion For This Domain option, the server will not be able to perform queries on the
root hints. If you configure the server to use a forwarder, it will attempt to send a recursive query to its
forwarding server. If the forwarding server does not answer this query, the server will respond that the
host could not be found.

It is important to understand that recursion on a DNS server and recursive queries are not the same thing.
Recursion on a server means that the server will use its root hints and try to resolve a DNS query. The next
topic discusses iterative and recursive queries in more detail.

What Is Forwarding?
A forwarder is a DNS server-configuration setting
that forwards DNS queries for external DNS
names to DNS servers outside that network. You
also can use conditional forwarders to forward
queries according to specific domain names.
A network DNS server is designated a forwarder
when the networks other DNS servers forward
to it the queries that they cannot resolve locally.
By using a forwarder, you can manage name
resolution for names outside your network,
such as names on the Internet, and improve the
efficiency of name resolution for your networks
computers.

MCT USE ONLY. STUDENT USE PROHIBITED

2-12 Configuring and Troubleshooting Domain Name System

The server that is forwarding requests in the network must be able to communicate with the DNS server
that is located on the Internet. This means that either you configure it to forward requests to another DNS
server or it uses root hints to communicate.

Best Practice

Use a central forwarding DNS server for Internet name resolution. This can improve performance, simplify
troubleshooting, and is a security best practice. You can isolate the forwarding DNS server on a perimeter
network, which ensures that no server within the network is communicating directly to the Internet.

Conditional Forwarding

A conditional forwarder is a configuration setting in the DNS server that forwards DNS queries according
to the querys DNS domain name. For example, you can configure a DNS server to forward all queries that
it receives for names ending with corp.contoso.com to the IP address of a specific DNS server or to the IP
addresses of multiple DNS servers. This can be useful when you have multiple DNS namespaces in a forest.

Best Practice for Conditional Forwarding

Use conditional forwarders if you have multiple internal namespaces. This provides faster name resolution.

How DNS Server Caching Works


DNS caching increases the performance of an
organizations DNS system by decreasing the
time it takes to provide DNS lookups.
When a DNS server resolves a DNS name
successfully, it adds the name to its cache.
Over time, this builds a cache of domain names
and their associated IP addresses for the most
common domains that the organization uses or
accesses.
Note: The default time to cache DNS data is
one hour. You can configure this by changing the SOA record for the appropriate DNS zone.

A caching-only server will not host any DNS zone data; it only answers lookups for DNS clients. This is the
ideal type of DNS server to use as a forwarder.

The DNS client cache is a DNS cache that the DNS Client service stores on the local computer. To view the
current client-side cache, run the ipconfig /displaydns command at the command prompt. If you must
clear the local cache, such as when you are troubleshooting name resolution, you can use ipconfig
/flushdns.
Note: You also can use the following Windows PowerShell cmdlets:

clear-DnsClientCache to delete the DNS resolver cache

get-DnsClientCache to view the resolver cache

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-13

Demonstration: Configuring the DNS Server Role


This demonstration shows how to configure the DNS server properties.

Demonstration Steps
Configure DNS server properties
1.

Switch to LON-DC1 and, if necessary, log on as Adatum\Administrator with the password


Pa$$w0rd.

2.

Open the DNS console.

3.

Review the properties of the LON-DC1 server:


a.

On the Forwarders tab, you can configure forwarding.

b.

On the Advanced tab, you can configure options including securing the cache against pollution,
and DNSSEC.

c.

On the Root Hints tab, you can see the configuration for the root hints servers.

d.

On the Debug Logging tab, you can configure debug logging options.

e.

On the Event Logging tab, you can configure the level of event recording.

f.

On the Monitoring tab, you can perform simple and recursive tests against the server.

g.

On the Security tab, you can define permissions on the DNS infrastructure.

Configure conditional forwarding

From the Conditional Forwarders node, you can configure conditional forwarding:
a.

In the New Conditional Forwarder dialog box, in the DNS Domain box, type contoso.com.

b.

Click the <Click here to add an IP Address or DNS Name> box. Type 131.107.1.2, and then
press Enter. Validation will fail since this is just an example configuration.

Clear the DNS cache

In the navigation pane, right-click LON-DC1, and then click Clear Cache.

Lesson 3

Configuring DNS Zones

MCT USE ONLY. STUDENT USE PROHIBITED

2-14 Configuring and Troubleshooting Domain Name System

DNS zones are an important concept in DNS infrastructure, because they enable you to logically separate
and manage DNS domains. This lesson provides the foundation for understanding how zones relate to
DNS domains, and provides information about the different types of DNS zones that are available in the
Windows Server 2012 DNS role.

Lesson Objectives
After completing this lesson, you will be able to:

Explain a DNS zone.

Explain the various DNS zone types available in Windows Server 2012.

Explain the purpose of forward and reverse lookup zones.

Explain the purpose of stub zones.

Explain how to create zones.

Explain how you can use DNS zone delegation.

What Is a DNS Zone?


A DNS zone hosts all or a portion of a domain
and its subdomains. The slide illustrates how
subdomains can belong to the same zone as
their parents or can be delegated to another
zone. The microsoft.com domain is separated
into two zones. The first zone hosts the
www.microsoft.com and ftp.microsoft.com
records. Example.microsoft.com is delegated
to a new zone, which hosts the
example.microsoft.com subdomain, and its
records ftp.example.microsoft.com and
www.example.microsoft.com.
Note: The zone that hosts a root of the domain (microsoft.com) must delegate the
subdomain (example.microsoft.com) to the second zone. If this does not occur,
example.microsoft.com will be treated as if it were part of the first zone.
Zone data can be replicated to more than one server. This adds redundancy to a zone because the
information needed to find resources in the zone now exists on two or more servers. The level of
redundancy that is needed is one reason to create zones. If you have a zone that hosts critical server
resource records, it is likely that this zone will have a higher level of redundancy than a zone in which
noncritical devices are defined.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-15

Characteristics of a DNS Zone


Zone data is maintained on a DNS server and is stored in one of two ways:

In a flat zone file that contains mapping lists

Integrated into Active Directory

A DNS server is authoritative for a zone if it hosts the resource records for the names and addresses that
the clients request in the zone file.

What Are the DNS Zone Types?


The four DNS zone types are:

Primary

Secondary

Stub

Active Directory-integrated

Primary Zone

When a zone that a DNS server hosts is a primary


zone, the DNS server is the primary source for
information about this zone, and it stores the
master copy of zone data in a local file or in
AD DS. When the DNS server stores the zone in a file, the primary zone file is by default, named
zone_name.dns, and is located in the %windir%\System32\Dns folder on the server. When the zone is
not stored in Active Directory, the DNS server hosting the primary zone is the only DNS server that has
a writable copy of the zone file.

Secondary Zone

When a zone that a DNS server hosts is a secondary zone, the DNS server is a secondary source for the
zone information. The zone at this server must be obtained from another remote DNS server that also
hosts the zone. This DNS server must have network access to the remote DNS server to receive updated
zone information. Because a secondary zone is a copy of a primary zone that another server hosts, it
cannot be stored in AD DS. Secondary zones can be useful if you are replicating data from DNS zones
that are not on Windows or you are running DNS on servers that are not AD DS domain controllers.

Stub Zone

Windows Server 2003 introduced stub zones, which solves several problems with large DNS namespaces
and multiple tree forests. A multiple tree forest is an Active Directory forest that contains two different
top-level domain names.

Active DirectoryIntegrated Zone

If Active Directory stores the zone, DNS can take advantage of the multimaster replication model to
replicate the primary zone. This enables you to edit zone data on any DNS server. Windows Server 2008
introduced a new concept called a read-only domain controller (RODC). Active Directoryintegrated
zone data can be replicated to domain controllers, even if the DNS role is not installed on the domain
controller. If the server is a read-only domain controller, a local process cannot write to the data.

What Are Forward and Reverse Lookup Zones?


Zones can be either forward or reverse, sometimes
known as inverse zones.

Forward Lookup Zone


The forward lookup zone resolves host names
to IP addresses and hosts the common resource
records: A, CNAME, SRV, MX, SOA, TXT, and NS.

Reverse Lookup Zone


The reverse lookup zone resolves an IP address to
a domain name, and hosts SOA, NS, and PTR
records.

MCT USE ONLY. STUDENT USE PROHIBITED

2-16 Configuring and Troubleshooting Domain Name System

A reverse zone functions in the same manner as a forward zone, but the IP address is the part of the query
and the host name is the returned information. Reverse zones are not always configured, but you should
configure them to reduce warning and error messages. Many standard Internet protocols rely on reverse
zone lookup data to validate forward zone information. For example, if the forward lookup indicates that
training.contoso.com is resolved to 192.168.2.45, you can use a reverse lookup to confirm that
192.168.2.45 is associated with training.contoso.com.
Having a reverse zone is important if you have applications that rely on looking up hosts by their IP
addresses. Many applications will log this information in security or event logs. If you see suspicious
activity from a particular IP address, you can resolve the host by using the reverse zone information.

Many email security gateways use reverse lookups to validate that the IP address that is sending messages
is associated with a domain.

Overview of Stub Zones


A stub zone is a replicated copy of a zone that
contains only those resource records necessary to
identify that zones authoritative DNS servers. A
stub zone resolves names between separate DNS
namespaces, which might be necessary when a
corporate merger requires that the DNS servers
for two separate DNS namespaces resolve names
for clients in both namespaces.
A stub zone consists of the following:

The delegated zones SOA resource record,


NS resource records, and A resource records.

The IP address of one or more master servers that you can use to update the stub zone.

The master servers for a stub zone are one or more DNS servers that are authoritative for the child zone,
usually the DNS server that is hosting the primary zone for the delegated domain name.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-17

Stub Zone Resolution

When a DNS resolver performs a recursive query operation on a DNS server that is hosting a stub zone,
the DNS server uses the resource records in the stub zone to resolve the query. The DNS server sends an
iterative query to the authoritative DNS servers that the stub zones NS resource records specify as if it
were using NS resource records in its cache. If the DNS server cannot find the authoritative DNS servers
in its stub zone, the DNS server that is hosting the stub zone attempts standard recursion by using root
hints.

The DNS server will store the resource records it receives from the authoritative DNS servers that a stub
zone in its cache lists, but it will not store these resource records in the stub zone itself. Only the SOA, NS,
and glue A resource records returned in response to the query are stored in the stub zone. The resource
records that the cache stores are cached according to the TTL value in each resource record. The SOA, NS,
and glue A resource records, which are not written to cache, expire according to the expire interval that
the stub zones SOA record specifies. During the stub zones creation, the SOA record is created. SOA
record updates occur during transfers to the stub zone from the original, primary zone.
If the query was an iterative query, the DNS server returns a referral containing the servers that the stub
zone specifies.

Communication between DNS Servers That Host Parent and Child Zones

A DNS server that delegates a domain to a child zone on a different DNS server is made aware of new
authoritative DNS servers for the child zone only when resource records for them are added to the parent
zone that the DNS server hosts. This is a manual process that requires administrators for the different DNS
servers to communicate often. Stub zones enable a DNS server that is hosting a stub zone for one of its
delegated domains to obtain updates of the authoritative DNS servers for the child zone when the stub
zone is updated. The update is performed from the DNS server that is hosting the stub zone, and the
administrator for the DNS server that is hosting the child zone does not need to be contacted.

Contrasting Stub Zones and Conditional Forwarders

There might be some confusion about when to use conditional forwarders rather than stub zones. This is
because both DNS features allow a DNS server to respond to a query with a referral for, or by forwarding
to, a different DNS server. However, these settings have different purposes:

A conditional forwarder setting configures the DNS server to forward a query that it receives to a DNS
server, depending on the DNS name that the query contains.

A stub zone keeps the DNS server that is hosting a parent zone aware of all the DNS servers that are
authoritative for a child zone.

When to Use Conditional Forwarders

If you want DNS clients on separate networks to resolve the names of each other without having to query
Internet DNS servers, such as when a company merger occurs, you should configure each networks DNS
servers to forward queries for names in the other network. DNS servers in one network will forward names
for clients in the other network to a specific DNS server, which builds a large information cache about the
other network. This allows you to create a direct point of contact between two networks DNS servers,
which reduces the need for recursion.
Stub zones do not provide the same server-to-server benefit, however. This is because a DNS server that
is hosting a stub zone in one network replies to queries for names in the other network with a list of all
authoritative DNS servers for the zone with that name, rather than the specific DNS servers that you
designated to handle this traffic. This configuration complicates any security settings that you want to
establish between specific DNS servers that are running in each of the networks.

When to Use Stub Zones


Use stub zones when you want a DNS server to remain aware of the authoritative DNS servers for a
foreign zone.

MCT USE ONLY. STUDENT USE PROHIBITED

2-18 Configuring and Troubleshooting Domain Name System

A conditional forwarder is not an efficient way to keep a DNS server that is hosting a parent zone aware
of the authoritative DNS servers for a child zone. This is because whenever the authoritative DNS servers
for the child zone change, you have to configure the conditional forwarder setting manually on the DNS
server that hosts the parent zone. Specifically, you must update the IP address for each new authoritative
DNS server for the child zone.

Demonstration: Creating Zones


This demonstration shows how to:

Create a reverse lookup zone.

Create a forward lookup zone.

Demonstration Steps
Create a reverse lookup zone
1.

Switch to LON-DC1, and then create a new reverse lookup zone for the 172.16.0.0 IPv4 subnet.

2.

Enable dynamic updates on the zone.

Create a forward lookup zone


1.

Switch to LON-SVR1, and then open the DNS console.

2.

Create a new forward lookup zone.

3.

Configure the type as secondary, and then define LON-DC1 as the Master server for this zone.

DNS Zone Delegation


DNS is a hierarchical system, and zone
delegation connects the DNS layers together. A
zone delegation points to the next hierarchical
level down, and identifies the name servers that
are responsible for lower-level domain.
When deciding whether to divide the DNS
namespace to make additional zones, consider
the following reasons to use additional zones:

You need to delegate management of a


part of the DNS namespace to another
organizational location or department.

You need to divide one large zone into smaller zones so you can distribute traffic loads among
multiple servers. This improves DNS name-resolution performance, and it creates a more faulttolerant DNS environment.

You need to extend the namespace by adding numerous subdomains immediately to accommodate
the opening of a new branch or site.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-19

Lesson 4

Configuring DNS Zone Transfers

DNS zone transfers determine how the DNS infrastructure moves DNS zone information from one server
to another. Without zone transfers, the various name servers in your organization maintain disparate
copies of the zone data. You also should consider that the zone contains sensitive data, and securing zone
transfers is important. This lesson covers the different methods that the DNS server role uses when
transferring zones.

Lesson Objectives
After completing this lesson, you will be able to:

Describe how DNS zone transfers work.

Explain how to configure zone transfer security.

Explain how to DNS zone transfers.

What Is a DNS Zone Transfer?


A zone transfer occurs when you replicate the
DNS zone that is on one server to another DNS
server.
Zone transfers synchronize primary and secondary
DNS server zones. This is how DNS builds its
resilience on the Internet. It is important that DNS
zones remain updated on primary and secondary
servers. Discrepancies in primary and secondary
zones can cause service outages and host names
that are resolved incorrectly.
Zone transfers can happen in one of three ways:

Full zone transfer. A full zone transfer occurs when you copy the entire zone from one DNS server to
another. A full zone transfer is known as an All Zone Transfer (AXFR).

Incremental zone transfer. An incremental zone transfer occurs when there is an update to the DNS
server and only the resource records that were changed are replicated to the other server. This is an
Incremental Zone Transfer (IXFR).

Fast transfer. Windows DNS servers also perform fast transfers, which is a type of zone transfer that
uses compression and sends multiple resource records in each transmission.

Not all DNS server implementations support incremental and fast zone transfers. When integrating a
Windows 2012 DNS server with a Berkeley Internet Name Domain (BIND) DNS server, you must ensure
that the features you need are supported by the BIND version that is installed.

The following table lists the features that various DNS servers support.
DNS server

Full zone (AXFR)

Incremental zone (IXFR)

Fast transfer

BIND Older than 4.9.4

Supported

Not supported

Not Supported

BIND 4.9.4 8.1

Supported

Not supported

Supported

BIND 8.2

Supported

Supported

Supported

Windows 2000 Service


Pack 3 (SP3)

Supported

Supported

Supported

Windows 2003 (R2)

Supported

Supported

Supported

Windows 2008 and R2

Supported

Supported

Supported

Windows 2012

Supported

Supported

Supported

MCT USE ONLY. STUDENT USE PROHIBITED

2-20 Configuring and Troubleshooting Domain Name System

Active Directory-integrated zones replicate by using multimaster AD DS replication instead of the zone
transfer process. This means that any standard domain controller that also holds the DNS role can update
the DNS zone information, which then replicates to all DNS servers that host the DNS zone.

DNS Notify

DNS notify is used by a master server to alert its configured secondary servers that zone updates are
available. The secondary servers then petition their master to obtain the updates. DNS notify is an update
to the original DNS protocol specification that permits notification to secondary servers when zone
changes occur. This is useful in a time-sensitive environment, where data accuracy is important.

Configuring Zone Transfer Security


Zone information provides organizational data,
so you should take precautions to ensure it is
protected from access by malicious users, and that
it cannot be overwritten with bad data, which is
known as DNS poisoning. One way to protect the
DNS infrastructure is to secure the zone transfers.
On the Zone Transfers tab in the Zone
Properties dialog box, you can specify the list
of allowed DNS servers. You also can use these
options to disallow zone transfer. By default, zone
transfers are turned off.
Although the option that specifies the servers that
might request zone data provides security by limiting the data recipients, it does not secure that data
during transmissions. If the zone information is highly confidential, we recommend that you use an
Internet Protocol Security (IPsec) policy to secure the transmission or replicate the zone data over a
virtual private network (VPN) tunnel. This prevents packet sniffing to determine information in the data
transmission.
Using Active Directoryintegrated zones replicates the zone data as part of normal AD DS replications.
The zone transfer is then secured as a part of AD DS replication.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-21

Demonstration: Configuring DNS Zone Transfers


This demonstration shows you how to:

Enable DNS zone transfers.

Update the secondary zone from the master server.

Update the primary zone, and then verify the change on the secondary zone.

Demonstration Steps
Enable DNS zone transfers
1.

On LON-DC1, enable zone transfers by configuring the Allow zone transfers option.

2.

Configure zone transfers to Only to servers listed on the Name Servers tab.

3.

Enable Notify to Only to servers listed on the Name Servers tab.

4.

Add LON-SVR1.adatum.com as a listed name server to receive transfers.

Update the secondary zone from the master server

Switch to LON-SVR1 and in the DNS Manager, select Transfer from Master. It is sometimes
necessary to perform this step a number of times before the zone transfers. Also, note that the
transfer might occur automatically at any time.

Update the primary zone, and then verify the change on the secondary zone
1.

Switch back to LON-DC1, and then create a new alias record.

2.

Switch back to LON-SVR1, and then verify that the new record is present in the secondary zone. This
may require a manual Transfer from Master and a screen refresh before the record is visible.

Lesson 5

Managing and Troubleshooting DNS

MCT USE ONLY. STUDENT USE PROHIBITED

2-22 Configuring and Troubleshooting Domain Name System

DNS is a crucial service in the Active Directory infrastructure. When the DNS service experiences problems,
it is important to know how to troubleshoot them and identify the common issues that can occur in a
DNS infrastructure. This lesson covers the common problems that occur in DNS, the common areas from
which you can gather DNS information, and the tools that you can use to troubleshoot problems.

Lesson Objectives
After completing this lesson, you will be able to:

Explain how TTL, aging, and scavenging help to manage DNS records.

Explain how to manage TTL, aging, and scavenging for DNS records.

Explain how to identify problems with DNS by using DNS tools.

Describe how to troubleshoot DNS by using DNS tools.

Explain how to monitor DNS by using the DNS Event Log and debug logging.

What Is TTL, Aging, and Scavenging?


TTL, aging, and scavenging help manage DNS
resource records in the zone files. Zone files can
change over time, so there needs to be a way to
manage DNS records that are updated or that are
not valid because the hosts they represent are no
longer on the network.
The following table describes the DNS tools that
help to maintain a DNS database.

Tool

Description

TTL

Indicates how long a DNS record remains valid and ineligible for scavenging.

Aging

Occurs when records inserted into the DNS server reach their expiration and are
removed. This keeps the zone database accurate. During normal operations, aging
should take care of stale DNS resource records.

Scavenging

Performs DNS server resource record grooming for old records in DNS. If resource
records have not been aged, an administrator can scavenge the zone database for stale
records to force a database cleanup.

If left unmanaged, the presence of stale resource records in zone data might cause problems. For
example:

If a large number of stale resource records remain in server zones, they eventually can use up server
disk space and cause unnecessarily long zone transfers.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-23

A DNS server that is loading zones with stale resource records might use outdated information to
answer client queries, which could cause the client computers to experience name resolution or
connectivity problems on the network.

The accumulation of stale resource records on the DNS server might degrade its performance and
responsiveness.

In some cases, the presence of a stale resource record in a zone could prevent another computer or
host device from using a DNS domain name.

To solve these problems, the DNS Server service has the following features:

Time stamping, based on the current date and time that is set at the server computer, for any
resource records that are added dynamically to primary-type zones. Additionally, time stamps are
recorded in standard primary zones where you enable aging and scavenging.

For resource records that you add manually, you use a time-stamp value of zero to indicate that the
aging process does not affect these records and that they can remain without limitation in zone data
unless you otherwise change their time stamp or delete them.

Aging of resource records in local data, based on a specified refresh time period, for any eligible
zones.

Only primary type zones that the DNS Server service loads are eligible to participate in this process.

Scavenging for any resource records that persist beyond the specified refresh period.

When a DNS server performs a scavenging operation, it can determine that resource records have aged to
the point of becoming stale, and then remove them from zone data. You can configure servers to perform
recurring scavenging operations automatically, or you can initiate an immediate scavenging operation at
the server.
Note: By default, the aging and scavenging mechanism for the DNS Server service is
disabled. You should enable it only when all parameters are understood fully. Otherwise, you
could configure the server to delete records accidentally that you should not delete. If a record
is deleted accidentally, not only will users fail to resolve queries for that record, but any user can
create the record and take ownership of it, even on zones that you configure for secure dynamic
update. This is a significant security risk.
The server uses the contents of each time stamp for specific resource records, as well as other aging
and scavenging properties that you can adjust or configure, to determine when it scavenges records.

Prerequisites for Aging and Scavenging


Before you can use the aging and scavenging features of DNS, several conditions must be met:

You must enable scavenging and aging at the DNS server and on the zone. By default, aging and
scavenging of resource records is disabled.

You must add resource records to zones dynamically or manually modify them for use in aging and
scavenging operations.

Typically, only those resource records that you add dynamically by using the DNS dynamic update
protocol are subject to aging and scavenging.

For records that you add to zones by loading a text-based zone file from another DNS server or by
manually adding them to a zone, a time stamp of zero is set. This makes these records ineligible for use in
aging and scavenging operations.

To change this default, you can administer these records individually to reset and permit them to use a
current (nonzero) time-stamp value. This enables these records to become aged and scavenged.

Demonstration: Managing DNS Records


This demonstration shows how to:

Configure TTL.

Enable and configure scavenging and aging.

Demonstration Steps
Configure TTL
1.

Switch to LON-DC1, and then open the Adatum.com zone properties.

2.

On the Start of Authority tab, configure the Minimum (default) TTL value to be 2 hours.

Enable and configure scavenging and aging

MCT USE ONLY. STUDENT USE PROHIBITED

2-24 Configuring and Troubleshooting Domain Name System

1.

Right-click LON-DC1, and then select the Set Aging/Scavenging for All Zones option to configure
aging and scavenging options.

2.

Enable Scavenge stale resource records, and then use the default values.

Demonstration: Testing the DNS Server Configuration

Issues can occur when you do not configure the DNS server, and its zones and resource records, properly.
When resource records are causing issues, it can sometimes be more difficult to identify the issue because
configuration problems are not always obvious.
The following table lists possible configuration issues that can cause DNS problems.
Issue

Result

Missing records

Records for a host are not in the DNS server. They might have been scavenged
prematurely. This can result in workstations not being able to connect with
each other.

Incomplete records

Records that are missing information required to locate the resource they
represent can cause clients requesting the resource to use invalid information.
For example, a service record that does not contain a needed port address is an
example of an incomplete record.

Incorrectly
configured records

Records that are pointing to an invalid IP address or have invalid information in


their configuration will cause problems when DNS clients try to find resources.

The tools used to troubleshoot these and other configuration issues are:

Nslookup. Use this tool to query DNS information. The tool is flexible, and it can provide valuable
information about DNS server status. You also can use it to look up resource records and validate
their configuration. Additionally, you can test zone transfers, security options, and MX record
resolution.

Note: You can use the Windows PowerShell cmdlet Resolve-DnsName to perform similar
functions to Nslookup when troubleshooting DNS.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-25

Windows PowerShell. You can use Windows PowerShell cmdlets to configure and troubleshoot various
DNS aspects.

Dnscmd. Manage the DNS Server service with this command-line interface. This utility is useful in
scripting batch files to help automate routine DNS management tasks or to perform simple
unattended setup and configuration of new DNS servers on your network.

IPconfig. Use this command to view and modify IP configuration details that the computer uses. This
utility includes additional command-line options that you can use to troubleshoot and support DNS
clients. You can view the client local DNS cache by using the command ipconfig /displaydns, and
you can clear the local cache using ipconfig /flushdns.
Note: You can also use the following Windows PowerShell cmdlets:

clear-DnsClientCache to delete the DNS resolver cache

get-DnsClientCache to view the resolver cache

Monitoring tab on DNS server. In the DNS server Monitoring tab, you can configure a test that allows
the DNS server to determine whether it can resolve simple local queries and perform a recursive
query to ensure that the server can communicate with upstream servers. You also can schedule these
tests for regular intervals.

These are basic tests, but they provide a good place to start troubleshooting the DNS service. Possible
causes for a test to fail include:
o

The DNS Server service has failed.

The upstream server is not available on the network.

This demonstration shows how to use Nslookup.exe to test the DNS server configuration.

Demonstration Steps
1.

Open a command prompt, and then run the following command:


nslookup d2 LON-svr1.Adatum.com

2.

Review the information provided by nslookup.

Monitoring DNS by Using the DNS Event Log


The DNS server has its own category in the event
log. As with any event log in Windows Event
Viewer, you should review the event log
periodically.

Common DNS Events


The following table describes common DNS
events.

Event
ID

Description

The DNS server has started. This message generally appears at startup when either the
server computer or the DNS Server service is started.

The DNS server has shut down. This message generally appears when either the server
computer is shut down or the DNS Server service is stopped manually.

408

The DNS server could not open socket for address [IPaddress]. Verify that this is a valid IP
address for the server computer.
To correct the problem, you can do the following:
1.

If the specified IP address is not valid, remove it from the list of restricted interfaces for
the server and restart the server.

2.

If the specified IP address is no longer valid and was the only address enabled for the
DNS server to use, the server might not have started as a result of this configuration
error. To correct this problem, delete the following value from the registry and restart
the DNS server:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters
\ListenAddress

3.

413

If the IP address for the server computer is valid, verify that no other application that
would attempt to use the same DNS server port (such as another DNS server
application) is running. By default, DNS uses TCP port 53.

MCT USE ONLY. STUDENT USE PROHIBITED

2-26 Configuring and Troubleshooting Domain Name System

The DNS server sends requests to other DNS servers on a port other than its default port
(TCP port 53).

This DNS server is multihomed and has been configured to restrict DNS Server service to
only some of its configured IP addresses. For this reason, there is no assurance that DNS
queries that this server makes to other remote DNS servers will be sent by using one of
the IP addresses that was enabled for the DNS server.

This might prevent query answer responses that these servers return from being received
on the DNS port that the server is configured to use. To avoid this problem, the DNS
server sends queries to other DNS servers using an arbitrary non-DNS port, and the
response is received regardless of the IP address used.
If you want to limit the DNS server to using only its configured DNS port for sending
queries to other DNS servers, use the DNS console to perform one of the following
changes in server properties configuration on the Interfaces tab:

414

Select All IP addresses to enable the DNS server to listen on all configured server IP
addresses.

Select Only the following IP addresses to limit the IP address list to a single server IP
address.

The server computer currently has no primary DNS suffix configured. Its DNS name
currently is a single label host name. For example, its configured name is host rather than
host.example.microsoft.com or another FQDN.
Although the DNS server has only a single label name, default resource records created for
its configured zones use only this single label name when mapping the host name for this
DNS server. This can lead to incorrect and failed referrals when clients and other DNS
servers use these records to locate this server by name.
In general, you should reconfigure the DNS server with a full DNS computer name that is
appropriate for its domain or workgroup use on your network.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-27

Event
ID

Description

708

The DNS server did not detect any zones of either primary or secondary type. It will run as a
caching-only server, but will not be authoritative for any zones.

3150

The DNS server wrote a new version of zone [zonename] to file [filename]. You can view the
new version number by clicking the Record Data tab.
This event should appear only if you configure the DNS server to operate as a root server.

6527

Zone [zonename] expired before it could obtain a successful zone transfer or update from a
master server that is acting as its source for the zone. The zone has been shut down.
This event ID might appear when you configure the DNS server to host a secondary copy of
the zone from another DNS server that is acting as its source or master server. Verify that
this server has network connectivity to its configured master server.
If the problem continues, consider one or more of the following options:
1.

Delete the zone and recreate it, specifying either a different master server, or an
updated and corrected IP address for the same master server.

2.

If zone expiration continues, consider adjusting the expiration interval.

Monitoring DNS by Using Debug Logging


Sometimes it might be necessary to get more
details about a DNS problem than what the Event
Viewer provides. In this instance, you can use
debug logging to provide additional information.
The following DNS debug logging options are
available:

Direction of packets. This option has the


following settings:
o

Send. The DNS server log file logs packets


that the DNS server sends.

Receive. The log file logs packets that the


DNS server receives.

Content of packets. This option has the following settings:


o

Standard query. Specifies that packets containing standard queries, according to Request for
Comments (RFC) 1034, are logged in the DNS server log file.

Updates. Specifies that packets containing dynamic updates, according to RFC 2136, are logged
in the DNS server log file.

Notifies. Specifies that packets containing notifications, according to RFC 1996, are logged in the
DNS server log file.

Transport protocol. This option has the following settings:


o

UDP. Specifies that packets sent and received over User Datagram Protocol (UDP) are logged in
the DNS server log file.

TCP. Specifies that packets sent and received over TCP are logged in the DNS server log file.

Type of packet. This option has the following settings:


o

Request. Specifies that request packets are logged in the DNS server log file. A request packet is
characterized by a Query/Response (QR) bit set to zero in the DNS message header.
A QR bit is a one-bit field that specifies whether this message is a query (0) or a response.

MCT USE ONLY. STUDENT USE PROHIBITED

2-28 Configuring and Troubleshooting Domain Name System

Response. Specifies that response packets are logged in the DNS server log file. A response packet
is characterized by a QR bit set to 1 in the DNS message header.

Enable filtering based on IP address. This option provides additional filtering of packets that are
logged in the DNS server log file. This option allows logging of packets that are sent from specific IP
addresses to a DNS server or from a DNS server to specific IP addresses.

Log file maximum size limit. This option allows you to set the maximum file size for the DNS server
log file. When the DNS server log file reaches its specified maximum size, the DNS server overwrites
the oldest packet information with new information.

If you do not specify a maximum log-file size, the DNS server log file can consume a large amount of
hard-disk space.
By default, all debug logging options are disabled. When you enable them selectively, the DNS Server
service can perform additional trace-level logging of selected types of events or messages for general
troubleshooting and server debugging.

Debug logging can be resource intensive, affecting overall server performance and consuming disk space.
Therefore, you should use it only on a temporary basis, when you need more detailed server-performance
information.
Note: Dns.log contains debug logging activity. By default, it is located in the
%systemroot%\System32\Dns folder.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-29

Lab: Configuring and Troubleshooting DNS


Scenario

A. Datum is a global engineering and manufacturing company with its head office in London, UK. An IT
office and a data center are located in London to support the head office and other locations. A. Datum
has recently deployed a Windows Server 2012 server and client infrastructure.
You have been asked to add several new resource records to the DNS service installed on LON-DC1.
Records include a new MX record for Exchange Server 2010 and a SRV record for a Microsoft Lync
deployment that is occurring.

A. Datum is working with a partner organization, Contoso, Ltd. You have been asked to configure internal
name resolution between the two organizations. A small branch office has reported that name resolution
performance is poor. The branch office contains a Windows Server 2012 server that performs several roles.
However, there is no plan to implement an additional domain controller. You have been asked to install
the DNS server role at the branch office and create a secondary zone of Adatum.com. To maintain
security, you have been instructed to configure the branch office server to be on the Notify list for
Adatum.com zone transfers. You also should update all branch office clients to use the new name server
in the branch office.
You should configure the new DNS server role to perform standard aging and scavenging, as necessary
and as specified by corporate policy. After implementing the new server, you need to test and verify the
configuration by using standard DNS troubleshooting tools.

Objectives
After completing this lab, you will be able to:

Configure DNS resource records.

Configure DNS conditional forwarding.

Install and configure DNS zones.

Troubleshoot DNS.

Lab Setup
Estimated Time: 60 minutes

Virtual Machines

20411B-LON-DC1
20411B-LON-SVR1
20411B-LON-CL1

User Name

Adatum\Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

5.

Sign in using the following credentials:


o

User name: Administrator

Password: Pa$$w0rd

Domain: Adatum

Repeat steps 2 through 4 for 20411B-LON-SVR1 and 20411B-LON-CL1.

Exercise 1: Configuring DNS Resource Records


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

2-30 Configuring and Troubleshooting Domain Name System

You have been asked to add several new resource records to the DNS service installed on LON-DC1.
Records include a new MX record for Exchange Server 2010, and a SRV record required for a Lync
deployment that is taking place currently. You have also been asked to configure a reverse lookup zone
for the domain.
The main tasks for this exercise are as follows:
1.

Add the required MX record.

2.

Add the required Lync server records.

3.

Create the reverse lookup zone.

Task 1: Add the required MX record


1.

Switch to LON-DC1, and sign in as Adatum\Administrator with the password Pa$$w0rd.

2.

Open the DNS Manager console.

3.

Create a new host record with the following properties:

4.

Zone: Adatum.com

Name: Mail1

IP address: 172.16.0.250

In the Adatum.com zone, add a new record with the following information:
o

Type: New Mail Exchanger (MX)

Fully qualified domain name (FQDN) of mail server: Mail1.Adatum.com.

Task 2: Add the required Lync server records


1.

2.

Create a new host record with the following properties:


o

Zone: Adatum.com

Name: Lync-svr1

IP address: 172.16.0.251

In the Adatum.com zone, add a new record:


o

Type: Service Location (SRV)

Service: _sipinternaltls

Protocol: _tcp

Port Number: 5061

Host offering this service: Lync-svr1.adatum.com.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-31

Task 3: Create the reverse lookup zone

Create a new reverse lookup zone with the following properties:


o

Zone Type: Primary zone

Active Directory Zone Replication Scope: Default

Reverse Lookup Zone Name: IPv4 Reverse Lookup Zone

Reverse Lookup Zone Name: 172.16.0

Dynamic Update: Default

Results: After this exercise, you should have configured the required messaging service records and the
reverse lookup zone successfully.

Exercise 2: Configuring DNS Conditional Forwarding


Scenario
You have been asked to configure internal name resolution between A. Datum Corporation and its
partner organization, Contoso Ltd.
The main task for this exercise is to add the conditional forwarding record for contoso.com.

Task 1: Add the conditional forwarding record for contoso.com

From the Conditional Forwarders node, configure conditional forwarding for Contoso.com:
a.

In the New Conditional Forwarder dialog box, in the DNS Domain box, type contoso.com.

b.

Click in the <Click here to add an IP Address or DNS Name> box. Type 131.107.1.2, and then
press Enter. Validation will fail since the server cannot be contacted.

c.

Enable Store this conditional forwarder in Active Directory, and replicate it as follows.

Results: After this exercise, you should have successfully configured conditional forwarding.

Exercise 3: Installing and Configuring DNS Zones


Scenario

A small branch office has reported that name resolution performance is poor. The branch office contains
a Windows Server 2012 Server that performs several roles. However, there is no plan to implement an
additional domain controller. You have been asked to install the DNS server role at the branch office,
and then create a secondary zone of Adatum.com. To maintain security, you also have been instructed to
configure the branch office server to be on the Notify list for Adatum.com zone transfers. You also should
update all branch office clients to use the new name server in the branch office, and then configure the
new DNS server role to perform standard aging and scavenging, as needed and specified by corporate
policy.
The main tasks for this exercise are as follows:
1.

Install the DNS server role on LON-SVR1.

2.

Create the required secondary zones on LON-SVR1.

3.

Enable and configure zone transfers.

4.

Configure TTL, aging, and scavenging.

5.

Configure clients to use the new name server.

Task 1: Install the DNS server role on LON-SVR1


1.

Switch to LON-SVR1, and sign in as Adatum\Administrator with the password Pa$$w0rd.

2.

Use Server Manager to install the DNS Server role.

Task 2: Create the required secondary zones on LON-SVR1


1.

Open a command prompt.

2.

Type the following command to create the required secondary zone:


Dnscmd.exe /zoneadd Adatum.com /secondary 172.16.0.10

3.

Open DNS Manager, and then verify the presence of the new secondary forward lookup zone
Adatum.com.

Task 3: Enable and configure zone transfers

MCT USE ONLY. STUDENT USE PROHIBITED

2-32 Configuring and Troubleshooting Domain Name System

1.

Switch to LON-DC1.

2.

Open a command prompt, and then run the following command to configure zone transfers for the
Adatum.com zone:
Dnscmd.exe /zoneresetsecondaries Adatum.com /notifylist 172.16.0.21

3.

In DNS Manager, verify the changes to the Zone Transfers settings:


a.

In the navigation pane, click Adatum.com, and then on the toolbar, click Refresh.

b.

Right-click Adatum.com, and then click Properties.

c.

In the Adatum.com Properties dialog box, click the Zone Transfers tab.

d.

Click Notify, and verify that the server 172.16.0.21 is listed. Click Cancel.

e.

Close the Adatum.com Properties dialog box.

Task 4: Configure TTL, aging, and scavenging


1.

On LON-DC1, open the Adatum.com zone properties.

2.

On the Start of Authority tab, configure the Minimum (default) TTL value to be 2 hours.

3.

Right-click LON-DC1, and then select the Set Aging/Scavenging for All Zones option to configure
aging and scavenging options.

4.

Enable Scavenge stale resource records, and then use the default values.

Task 5: Configure clients to use the new name server


1.

Sign in to the LON-CL1 virtual machine as Adatum\Administrator with the password Pa$$w0rd.

2.

Use Network and Sharing Center to view the properties of Local Area Connection.

3.

Reconfigure Internet Protocol Version 4 (TCP/IPv4) as follows:


o

Modify the Preferred DNS server: 172.16.0.21.

Results: After this exercise, you should have successfully installed and configured DNS on LON-SVR1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 2-33

Exercise 4: Troubleshooting DNS


Scenario

After implementing the new server, you need to test and verify the configuration by using standard DNS
troubleshooting tools.
The main tasks for this exercise are as follows:
1.

Test simple and recursive queries.

2.

Verify start-of-authority (SOA) resource records with Windows PowerShell.

Task 1: Test simple and recursive queries


1.

On LON-DC1, in DNS Manager, open the LON-DC1 properties.

2.

On the Monitoring tab, perform a simple query against the DNS server. This is successful.

3.

Perform simple and recursive queries against this and other DNS servers. The recursive test fails
because there are no forwarders configured.

4.

Stop the DNS service, and then repeat the previous tests. They fail because no DNS server is available.

5.

Restart the DNS service, and then repeat the tests. The simple test is successful.

6.

Close the LON-DC1 Properties dialog box.

Task 2: Verify start-of-authority (SOA) resource records with Windows PowerShell


1.

Open Windows PowerShell LON-DC1.

2.

Type the following command, and then press Enter:


resolve-dnsname name Adatum.com type SOA

3.

View the results, and then close the Windows PowerShell prompt.

Results: After this exercise, you should have successfully tested and verified DNS.

To prepare for the next module

When you finish the lab, revert the virtual machines to their initial state. To do this, perform the following
steps:
1.

On the host computer, start Hyper-V Manager.

2.

In the Virtual Machines list, right-click 20411B-LON-DC1, and then click Revert.

3.

In the Revert Virtual Machine dialog box, click Revert.

4.

Repeat steps 2 and 3 for 20411B-LON-SVR1 and 20411B-LON-CL1.

Module Review and Takeaways


Review Questions
Question: You are deploying DNS servers into an Active Directory domain, and your
customer requires that the infrastructure is resistant to single points of failure. What must
you consider while planning the DNS configuration?
Question: What is the difference between recursive and iterative queries?
Question: What must you configure before a DNS zone can be transferred to a secondary
DNS server?
Question: You are the administrator of a Windows Server 2012 DNS environment. Your
company recently acquired another company. You want to replicate their primary DNS zone.
The acquired company is using Bind 4.9.4 to host their primary DNS zones. You notice a
significant amount of traffic between the Windows Server 2012 DNS server and the Bind
server. What is one possible reason for this?
Question: You must automate a DNS server configuration process so that you can automate
the deployment of Windows Server 2012. What DNS tool can you use to do this?

Tools
Tool

Use for

Where to find it

Dnscmd.exe

Configure DNS server role

Command-line

Dnslint.exe

Test DNS server

Download from the Microsoft website


and then use from the command-line

Nslookup.exe

Test DNS name resolution

Command-line

Ping.exe

Simple test of DNS name resolution

Command-line

Ipconfig.exe

Verify and test IP functionality and view


or clear the DNS client resolver cache

Command-line

MCT USE ONLY. STUDENT USE PROHIBITED

2-34 Configuring and Troubleshooting Domain Name System

MCT USE ONLY. STUDENT USE PROHIBITED


3-1

Module 3
Maintaining Active Directory Domain Services
Contents:
Module Overview

3-1

Lesson 1: Overview of AD DS

3-2

Lesson 2: Implementing Virtualized Domain Controllers

3-7

Lesson 3: Implementing Read-Only Domain Controllers

3-11

Lesson 4: Administering AD DS

3-15

Lesson 5: Managing the AD DS Database

3-23

Lab: Maintaining AD DS

3-32

Module Review and Takeaways

3-38

Module Overview

Active Directory Domain Services (AD DS) is the most critical component in a Windows Server 2012
domain-based network. AD DS contains important information about authentication, authorization, and
resources in your environment. This module focuses on explaining why you implement specific AD DS
features, how important components integrate with each other, and how you can ensure that your
domain-based network functions properly.

You will learn about new features, such as virtualized domain controller cloning, recent features like readonly domain controllers (RODCs), and a host of other features and tools that you can use in the AD DS
environment.

Objectives
After completing this module, you will be able to:

Explain the general structure of AD DS.

Implement virtualized domain controllers.

Implement RODCs.

Administer AD DS.

Manage the AD DS database.

Lesson 1

Overview of AD DS

MCT USE ONLY. STUDENT USE PROHIBITED

3-2 Maintaining Active Directory Domain Services

The AD DS database stores information on user identity, computers, groups, services, and resources.
AD DS domain controllers also host the service that authenticates user and computer accounts when
they sign in to the domain. AD DS stores information about all of the domains objects, and all users and
computers must connect to AD DS domain controllers when signing into the network. Therefore, AD DS
is the primary means by which you can configure and manage user and computer accounts on your
network.
This lesson covers the core logical components of an AD DS deployment.

Lesson Objectives
After completing this lesson, you will be able to:

Describe AD DS components.

Explain AD DS forest and schema structure.

Explain AD DS domain structure.

Overview of AD DS Components
AD DS is composed of both physical and logical
components. You need to understand the way the
components of AD DS work together so that you
can maintain your AD DS environment effectively.

Physical Components
AD DS information is stored in a single file on
each domain controllers hard disk. The following
table lists some physical components and their
storage locations.

Physical component

Description

Domain controllers

Contain copies of the AD DS database.

Data store

The file on each domain controller that stores the AD DS information.

Global catalog servers

Host the global catalog, which is a partial, read-only copy of all the objects in
the forest. A global catalog speeds up searches for objects that might be
stored on domain controllers in a different domain in the forest.

Read-only domain
controllers (RODC)

A special AD DS install in read-only format. You typically use these in branch


offices where security and IT support may be less advanced than in an
enterprises main corporate centers.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-3

Logical Components

AD DS logical components are structures that you use to implement an Active Directory design that is
appropriate for an organization. The following table describes some of the types of logical structures that
an Active Directory database might contain.
Logical component

Description

Partition

A section of the AD DS database. Although the database actually is just one


file named NTDS.DIT, users view, manage, and replicate it as if it consists of
distinct sections or instances. These are partitions, or naming contexts.

Schema

Defines the list of object types and attributes that all AD DS objects can have.

Domain

A logical, administrative boundary for users and computers.

Domain tree

A collection of domains that share a common root domain and a Domain


Name System (DNS) namespace.

Forest

A collection of domains that share a common AD DS.

Site

A collection of users, groups, and computers, which are defined by their


physical locations. Sites are useful in planning administrative tasks such as
replication of changes to the AD DS database.

OU

Organizational units (OUs) are containers in AD DS that provide a framework


for delegating administrative rights and for linking Group Policy Objects
(GPOs).

Understanding AD DS Forest and Schema Structure


In AD DS forest and schema structure are
important for the defining the functionality and
scope of your environment.

AD DS Forest Structure

A forest is a collection of one or more domain


trees. A tree is a collection of one or more
domains. The first domain that is created in the
forest is called the forest root domain. The forest
root domain contains a few objects that do not
exist in other domains in the forest. For example,
the forest root domain contains two special roles,
the schema master and the domain naming
master. In addition, the Enterprise Admins group and the Schema Admins group exist only in the forest
root domain. The Enterprise Admins group has full control over every domain within the forest.

The AD DS forest is a security boundary. This means that, by default, no users from outside the forest can
access any resources inside the forest. It also means that administrators from outside the forest have no
administrative access within the forest. One of the primary reasons why organizations deploy multiple
forests is because they need to isolate administrative permissions between different parts of the
organization.

The AD DS forest is also the replication boundary for the configuration and schema partitions in the
AD DS database. This means that all domain controllers in the forest must share the same schema. A
second reason why organizations deploy multiple forests is because they must deploy incompatible
schemas in two parts of the organization.

MCT USE ONLY. STUDENT USE PROHIBITED

3-4 Maintaining Active Directory Domain Services

The AD DS forest is also the replication boundary for the global catalog. This makes most forms of
collaboration between users in different domains easier. For example, all Microsoft Exchange Server 2010
recipients are listed in the global catalog, making it easy to send mail to any of the users in the forest,
even those users in different domains.
By default, all the domains in a forest automatically trust the other domains in the forest. This makes it
easy to enable access to resources such as file shares and websites for all users in a forest, regardless of
the domain in which the user account is located.

AD DS Schema Structure

The AD DS schema is the AD DS component that defines all object types and attributes that AD DS uses to
store data. It is sometimes referred to as the blueprint for AD DS.
AD DS stores and retrieves information from a wide variety of applications and services. AD DS
standardizes how data is stored so that it can store and replicate data from these various sources. By
standardizing how data is stored, AD DS can retrieve, update, and replicate data, while ensuring that the
integrity of the data is maintained.
AD DS uses objects as units of storage. All object types are defined in the schema. Each time that the
directory handles data, the directory queries the schema for an appropriate object definition. Based on
the object definition in the schema, the directory creates the object and stores the data.

Object definitions control both the types of data that the objects can store, and the syntax of the data.
Using this information, the schema ensures that all objects conform to their standard definitions. As a
result, AD DS can store, retrieve, and validate the data that it manages, regardless of the application that
is the original source of the data. Only data that has an existing object definition in the schema can be
stored in the directory. If a new type of data needs to be stored, a new object definition for the data must
first be created in the schema.
In AD DS, the schema defines the following:

Objects that are used to store data in the directory

Rules that define what types of objects you can create, what attributes must be defined (mandatory)
when you create the object, and what attributes are optional

Structure and content of the directory itself

You can use an account that is a member of the Schema Administrators to modify the schema
components in a graphical form. Examples of objects that are defined in the schema include user,
computer, group, and site. Among the many attributes are location, accountExpires, buildingName,
company, manager, and displayName.

The schema master is one of the single master operations domain controllers in AD DS. Because it is a
single master, you must make changes to the schema by targeting the domain controller that holds the
schema master operations role.
The schema is replicated among all domain controllers in the forest. Any change that is made to the
schema is replicated to every domain controller in the forest from the schema operations master role
holder, typically the first domain controller in the forest.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-5

Because the schema dictates how information is stored, and because any changes that are made to the
schema affect every domain controller, changes to the schema should be made only when necessary.
Before making any changes, you should review the changes through a tightly-controlled process, and
then implement them only after you have performed testing to ensure that the changes will not adversely
affect the rest of the forest and any applications that use AD DS.
Although you might not make any change to the schema directly, some applications make changes to
the schema to support additional features. For example, when you install Exchange Server 2010 into your
AD DS forest, the installation program extends the schema to support new object types and attributes.

Understanding AD DS Domain Structure


An AD DS domain is a logical grouping of user,
computer, and group objects for the purpose of
management and security. All of these objects are
stored in the AD DS database, and a copy of this
database is stored on every domain controller in
the AD DS domain.

There are several types of objects that can be


stored in the AD DS database, including user
accounts. User accounts provide a mechanism
that you can use to authenticate and then
authorize users to access resources on the
network. Each domain-joined computer must
have an account in AD DS. This enables domain administrators to use policies that are defined in the
domain to manage the computers. The domain also stores groups, which are the mechanism for grouping
together objects for administrative or security reasons; for instance, user accounts and computer accounts.
The AD DS domain is also a replication boundary. When changes are made to any object in the domain,
that change is replicated automatically to all other domain controllers in the domain.

An AD DS domain is an administrative center. It contains an Administrator account and a Domain


Admins group, which both have full control over every object in the domain. Unless they are in the forest
root domain, however, their range of control is limited to the domain. Password and account rules are
managed at the domain level by default. The AD DS domain also provides an authentication center. All
user accounts and computer accounts in the domain are stored in the domain database, and users and
computers must connect to a domain controller to authenticate.
A single domain can contain more than 1 million objects, so most organizations need to deploy only a
single domain. Organizations that have decentralized administrative structures, or that are distributed
across multiple locations, might instead implement multiple domains in the same forest.

Domain Controllers

A domain controller is a server that you can configure to store a copy of the AD DS directory database
(NTDS.DIT) and a copy of the System Volume (SYSVOL) folder. All domain controllers except RODCs store
a read/write copy of both NTDS.DIT and the SYSVOL folder. NTDS.DIT is the database itself, and the
SYSVOL folder contains all the template settings for GPOs.

Changes to the AD DS database can be initiated on any domain controller in a domain except for RODCs.
The AD DS replication service then synchronizes the changes and updates to the AD DS database to all
other domain controllers in the domain. Additionally, either the file replication service (FRS), or the newer
Distributed File System Replication (DFS-R), replicates the SYSVOL folders.

An AD DS domain should always have a minimum of two domain controllers. This way, if one of the
domain controllers fails, there is a backup to ensure continuity of the AD DS domain services. When
you decide to add more than two domain controllers, consider the size of your organization and the
performance requirements.

Organization Units
An OU is a container object within a domain that you can use to consolidate users, groups, computers,
and other objects. There are two reasons to create OUs:

MCT USE ONLY. STUDENT USE PROHIBITED

3-6 Maintaining Active Directory Domain Services

To configure objects contained within the OU. You can assign GPOs to the OU, and the settings apply
to all objects within the OU. GPOs are policies that administrators create to manage and configure
computer and user accounts. The most common way to deploy these policies is to link them to OUs.

To delegate administrative control of objects within the OU. You can assign management permissions
on an OU, thereby delegating control of that OU to a user or group within AD DS other than the
administrator.

You can use OUs to represent the hierarchical, logical structures within your organization. For example,
you can create OUs that represent the departments within your organization, the geographic regions
within your organization, or a combination of both departmental and geographic regions. You can use
OUs to manage the configuration and use of user, group, and computer accounts based on your
organizational model.
Every AD DS domain contains a standard set of containers and OUs that are created when you install
AD DS, including the following:

Domain container. Serves as the root container to the hierarchy.

Users container. The default location for new user accounts and groups that you create in the
domain. The users container also holds the administrator and guest accounts for the domain, and
some default groups.

Computers container. The default location for new computer accounts that you create in the domain.

Domain Controllers OU. The default location for the computer accounts for domain controller
computer accounts. This is the only OU that is present in a new installation of AD DS.

Note: None of the default containers in the AD DS domain can have GPOs linked to them,
except for the default Domain Controllers OU and the domain itself. All the other containers are
just folders. To link GPOs to apply configurations and restrictions, create a hierarchy of OUs, and
then link GPOs to them.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-7

Lesson 2

Implementing Virtualized Domain Controllers

Virtualization is a common practice in IT departments. The consolidation and performance benefits that
virtualization provides are great assets to any organization. Windows Server 2012 AD DS and domain
controllers are now more aware of virtualization. In this lesson, you will learn the considerations for
implementing virtualized domain controllers in Windows Server 2012, and how you can deploy and
manage these domain controllers in the AD DS environment.

Lesson Objectives
After completing this lesson, you will be able to:

Identify considerations for implementing cloned virtualized domain controllers.

Explain how to deploy a cloned virtualized domain controller.

Describe how to manage virtualized domain controller snapshots.

Understanding Cloned Virtualized Domain Controllers

Windows Server 2012 introduces virtualized


domain-controller cloning. In previous Windows
Server versions, domain controllers that were
running within a virtual machine were unaware of
their virtual state. This made performing processes
like cloning and restoring virtual machine
snapshots potentially dangerous, because changes
could occur to the operating-system environment
that the domain controller did not expect. For
example, two domain controllers cannot coexist in
the same forest with the same name, invocation
ID, and directory system agent (DSA) globally
unique identifier (GUID). In earlier Windows versions prior to Windows Server 2012, you created
virtualized domain controllers by deploying a Sysprepped base server image, and then promoting it
manually to be a domain controller. Windows Server 2012 provides specific virtualization capabilities to
AD DS Virtualized Domain Controllers (VDCs) to resolve those issues.
Windows Server 2012 VDCs provide two significant benefits:

You can clone domain controllers safely to deploy additional capacity and save configuration time.

Accidental restoration of domain controller snapshots does not disrupt the AD DS environment.

Cloning VDCs in Windows Server 2012

In Windows Server 2012, cloning virtual machines that act as domain controllers provides the ability
to deploy domain controllers rapidly in your environment. For example, you may need to increase your
environments domain controllers to support increased AD DS usage. You can deploy additional domain
controllers quickly with the following process:
1.

Run the cloning operation on an existing VDC.

2.

Shut down the existing VDC, and then use Hyper-V to export the virtual machine files.

3.

Start the existing VDC (if its intended to continue in production usage).

4.

Use Hyper-V to import the virtual machine files as a new virtual machine, and then start the virtual
machine, which now contains the new domain controller.

Virtual domain controller cloning provides the following benefits in Windows Server 2012:

Rapid domain-controller deployment in a new forest or domain.

Scalable provisioning of domain controllers to handle increased load.

Quick replacement or recovery of domain controllers for business continuity.

Fast provisioning of test environments.

Safe Cloning

MCT USE ONLY. STUDENT USE PROHIBITED

3-8 Maintaining Active Directory Domain Services

Domain controllers have unique characteristics that make unmanaged cloning detrimental to the AD DS
database-replication process. Domain controllers that are simply cloned end up with the same name,
which is unsupported within the same domain or forest. In previous Windows Server versions, you had
to prepare a domain controller for cloning by using sysprep. After the cloning process, you then had to
promote the new server to a domain controller manually.

With Safe Cloning in Windows Server 2012, a cloned domain controller automatically runs a subset of the
sysprep process, and promotes with the existing local AD DS data as installation media.

Safe Backup and Restore

Rolling back to a previous snapshot of a VDC is problematic because AD DS uses multimaster replication
that relies on transactions being assigned numeric values called Update Sequence Numbers (USNs). The
VDC tries to assign USNs to prior transactions that have already been assigned to valid transactions. This
causes inconsistencies in the AD DS database. Windows Server 2003 and newer implements a process that
is known as USN rollback protection. With this in place, the VDC does not replicate, and you must demote
it forcibly or manually restore it.
Windows Server 2012 now detects the snapshot state of a domain controller, and synchronizes or
replicates the delta of changes, between a domain controller and its partners for AD DS and the SYSVOL.
You now can use snapshots without risk of permanently disabling domain controllers and requiring
manually forced demotion, metadata cleanup, and repromotion.

Deploying a Cloned Virtualized Domain Controller


When deploying a VDC, consider the following
regarding installation:

All Windows Server 2012 computers support


VDC cloning automatically.

The following requirements must be met to


support VDC cloning:
o

The primary domain controller (PDC)


Emulator FSMO role must be located on
a Windows Server 2012 domain
controller.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-9

The domain controller hosting the PDC Emulator flexible single master operations (FSMO) role
must be available during cloning operations.

The following requirements must be met to support both VDC cloning and safe restore:
o

Guest virtual machines must be running Windows Server 2012.

The virtualization host platform must support VM Generation ID (VM GENID). This includes
Windows Server 2012 Hyper-V.

Creating a VDC Clone


To create a VDC clone in Windows Server 2012, perform the following steps:
1.

Create a DcCloneConfig.xml file that contains the unique server configuration.

2.

Copy this file into the location of the AD DS database on the source domain controller
(C:\Windows\NTDS by default). This file can also be stored on removable media, if required.

3.

Take the source VDC offline and export or copy it.

4.

Create a new virtual machine by importing the exported one. This virtual machine is promoted
automatically as a unique domain controller.

Managing Virtualized Domain Controllers


The Windows Server 2012 safe restore capability
enables VDCs that are running Windows Server
2012 to participate gracefully in the AD DS
replication topology, after you apply a snapshot
within Hyper-V to the virtual machine that is
hosting the domain controller.
Taking and applying snapshots for a VDC in
Hyper-V requires specific considerations and
steps.

Validating AD DS Replication

When a virtual machine snapshot is applied to a


VDC, the safe restore process initiates, inbound replication for the changes in AD DS between the virtual
domain controller and the rest of the AD DS environment. The relative identifier (RID) pool is released,
and a new one is requested, to prevent duplicated SIDs in AD DS. It also initiates a nonauthoritative
replication of the SYSVOL folder. This process ensures that the new applied snapshot version of the virtual
domain controller is aware of all AD DS objects, fully up-to-date, and is fully functional.
To ensure that this process can complete successfully, the following elements of AD DS replication must
be considered:

A virtual domain controller recovered from a Hyper-V snapshot must be able to contact a writable
domain controller.

You may not restore all domain controllers in a domain simultaneously. If all domain controllers are
restored simultaneously, SYSVOL replication will halt, and all partners in synchronization will be
considered nonauthoritative. This is an important consideration for full environment rollback
situations that may occur frequently in a test environment.

Changes originated on a restored virtual domain controller that have not replicated since the
snapshot was taken are lost. Because of this, you must ensure that all outgoing replication on a
domain controller has been completed before taking a snapshot of the virtual machine.

Using Windows PowerShell for Hyper-V Snapshot Management

MCT USE ONLY. STUDENT USE PROHIBITED

3-10 Maintaining Active Directory Domain Services

You can use the following Windows PowerShell cmdlets to perform snapshot management in Windows
Server 2012:

Checkpoint-VM

Export-VMSnapshot

Get-VMSnapshot

Remove-VMSnapshot

Rename-VMSnapshot

Restore-VMSnapshot

Considerations for Managing Virtual Domain Controller Snapshots


Consider the following when managing virtual domain controller snapshots in Windows Server 2012:

Do not use snapshots to replace regular system state backups. In a frequently changing AD DS
environment, snapshots do not always contain the full contents of AD DS objects, due to replication
changes.

Do not restore a snapshot of a domain controller that was taken before it was promoted. Doing so
will require that you repromote the server manually after the snapshot is applied and the metadata
cleanup occurs.

Do not host all virtual domain controllers on the same hypervisor or server. This introduces a single
point of failure into the AD DS infrastructure, and circumvents many of the benefits that virtualizing
your domain-controller infrastructure provides.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-11

Lesson 3

Implementing Read-Only Domain Controllers

RODCs provide an alternative to a fully writable domain controller. In many scenarios, such as a remote
branch office or a location where a server cannot be placed in a secure physical environment, RODCs can
provide the functionality of a domain controller without potentially exposing your AD DS environment to
unnecessary risks. This lesson will help you to better understand the methods and best practices that you
can use to manage RODCs in the Windows Server 2012 environment.

Lesson Objectives
After completing this lesson, you will be able to:

Explain considerations for implementing RODCs.

Describe how to manage RODC credential caching.

Identify the important aspects of managing local administration for RODCs.

Considerations for Implementing RODCs


An RODC has a read-only copy of an Active
Directory domain, which contains all of the
domains objects, but not all of their attributes.
System-critical attributes, such as passwords,
do not replicate to an RODC because it is not
considered secure. You can prevent additional
attributes from being replicated to RODCs by
marking the attribute as confidential and adding
it to the Filtered Attribute Set (FAS).

Understanding RODC Functionality

You cannot make changes to the domain


database on the RODC, because the AD DS
database on the RODC does not accept modification requests from clients and applications. All requests
for changes are forwarded to a writable domain controller. Because no changes occur on the RODC,
replication of Active Directory changes is one way only from writable domain controllers to the RODC.

Credential Caching

User and computer credentials are not replicated to an RODC by default. To use an RODC to enhance user
logon, you need to configure a Password Replication Policy (PRP) that defines which user credentials can
be cached. Limiting the credentials cached on the RODC reduces the security risks. If the RODC is stolen,
only passwords for the cached user and computer accounts need to be reset.
If user and computer credentials are not replicated to an RODC then a writable domain controller must be
contacted during the authentication process. Typically (in a branch office scenario), the credentials for
local users and computers are cached on an RODC. When RODCs are placed in a perimeter network, the
credentials for users and computers typically are not cached.

Administrative Role Separation

MCT USE ONLY. STUDENT USE PROHIBITED

3-12 Maintaining Active Directory Domain Services

To manage a writable domain controller, you must be a member of the domain local Administrators
group. Any user placed in the domain local Administrators group is given permissions to manage all
domain controllers in the domain. This causes problems for remote-office administration with a writable
domain controller, because the administrator in a remote office should not be given access to the
organizations other domain controllers.

This gives the administrator of a remote office permission to manage only that RODC, which may also be
configured to provide other services such a file shares and printing.

Read-Only DNS

DNS is a critical resource for a Windows network. If you configure an RODC as a DNS server, then you can
replicate DNS zones through AD DS to the RODC. DNS on the RODC is read-only. DNS update requests
are referred to a writable copy of DNS.

Deploying RODCs
To deploy an RODC, ensure that the following activities are performed:

Ensure that the forest functional level is Windows Server 2003 or newer. That means that all domain
controllers must be Windows Server 2003 or newer, and each domain in the forest must be at the
domain functional level of Windows Server 2003 or newer.

Run ADPrep /RODCPrep. This configures permissions on DNS application directory partitions to allow
them to replicate to RODCs. This is required only if the Active Directory forest has been upgraded.

Ensure that there is a writable domain controller running Windows Server 2008 or newer. An RODC
replicates the domain partition only from these domain controllers. Therefore, each domain with
RODCs must have at least one Windows Server 2008 or newer domain controller. You can replicate
the Schema and Configuration partitions from Windows Server 2003.

RODC Installation

Like a writable domain controller, you can install an RODC by using an attended or an unattended
installation. If you perform an attended installation by using the graphical interface, you select the RODC
as one of the additional domain controller options.
You also can delegate the RODC installation to the administrator in the remote office by using a staged
installation. In a staged installation, you need to perform the following steps:
1.

Ensure that the server to be configured as the RODC is not a member of the domain.

2.

A domain administrator uses Active Directory Users and Computers to precreate the RODC account
in the Domain Controllers organizational unit (OU). The wizard for performing this process prompts
for the necessary information, including the user or group that is allowed to join the RODC to the
domain.

3.

The administrator in the remote office runs the Active Directory Domain Services installation Wizard,
and follows the wizard to join the domain as the precreated RODC account.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-13

Managing RODC Credential Caching


RODCs provide the capability to store only a
subset of credentials for accounts in AD DS
through the implementation of credential
caching. With credential caching, a password
replication policy (PRP) determines which user
and computer credentials can be cached on a
specific RODC. If PRP allows an RODC to cache an
accounts credentials, authentication and service
ticket activities of that account can be processed
locally by the RODC. If an accounts credentials
cannot be cached on RODC, or they are not
cached on the RODC, authentication and service
ticket activities are chained by the RODC to a writable domain controller.

Password Replication Policy Components

The PRP for an RODC contains both an Allowed List and a Denied List. Each list can contain specific
accounts or groups. An account must be on the Allowed List for credentials to be cached. If a group is
on the Allowed List and a member of that group is on the Denied List, caching is not allowed for that
member.

There are two domain local groups that you can use to allow or deny caching globally to all RODCs in a
domain:

Allowed RODC Password Replication Group is added to the Allowed List of all RODCs. This group has
no members by default.

Denied RODC Password Replication Group is added to the Denied List of all RODCs. By default,
Domain Admins, Enterprise Admins, and Group Policy Creator Owners are the members of this group.

You can configure the Allowed List and Denied List for each RODC. The Allowed List contains only the
Allowed RODC Password Replication Group. The default membership of the Denied List includes
Administrators, Server Operators, and Account Operators.

In most cases, you will want to add accounts separately to each RODC, or add global groups
containing accounts rather than globally allowing password caching. This allows you to limit the number
of credentials cached to only those accounts commonly at that location. Domain administrative accounts
should not be cached on RODCs in remote offices. You should cache computer accounts to speed up
authentication of computer accounts during system startup. Additionally, you should cache service
accounts for services that are running at the remote office.

Best Practices for Credential Caching

The following best practices should be observed to ensure the most effective use of cached credentials:

Create separate AD DS global groups for each RODC.

Do not cache passwords for domain-wide administrative accounts.

Managing Local Administration for RODCs


The management of RODCs is separated from
other domain controllers. Therefore, you can
delegate administration of RODCs to local
administrators in remote offices, without giving
those administrators access to writable domain
controllers.
You can delegate administration of an RODC in
the properties of the RODC computer account
on the Managed By tab. You should follow this
method to delegate the administration of an
RODC because you can manage it centrally
and easily.
You can specify only a single security principal on the Managed By tab of an RODC computer account.
Specify a group so that you can delegate management permissions to multiple users by making them
members of the group.
You also can delegate administration of an RODC by using ntdsutil or dsmgmt with the local roles
option, as the following example shows:
C:\>dsmgmt
Dsmgmt: local roles
local roles: add Adatum\Research

You should cache the password for delegated administrators to ensure that you can perform system
maintenance when a writable domain controller is unavailable.
Note: You should never access the RODC with an account that has permissions similar
to Domain Admins. RODC computers are considered compromised by default, so, you should
assume that by logging in to the RODC you are giving up domain admin credentials. Thus
domain administrators should have a separate server admin type account that is delegated
management access to the RODC.

MCT USE ONLY. STUDENT USE PROHIBITED

3-14 Maintaining Active Directory Domain Services

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-15

Lesson 4

Administering AD DS

AD DS management happens in many different forms. The AD DS environment contains a large number
of management tools that enable you to monitor and modify AD DS, to ensure that your organizations
domain infrastructure is serving its purpose and functioning properly. Windows Server 2012 includes a
broader set of tools for working within AD DS than previous Windows versions included. Improvements to
the Active Directory Administrative Center and the addition of several cmdlets to the Active Directory
module for Windows PowerShell enable even greater control over your AD DS domain.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the Active Directory administrative snap-ins.

Describe the Active Directory Administrative Center.

Explain how to manage AD DS by using management tools.

Describe the Active Directory module for Windows PowerShell.

Explain how to manage operations master roles.

Explain how to manage AD DS backup and recovery.

Overview of the Active Directory Administration Snap-ins


You typically will perform most Active Directory
administration by using the following snap-ins
and consoles:

Active Directory Users and Computers. This


snap-in manages most common day-to-day
resources, including users, groups, and
computers. This is likely to be the most
heavily used snap-in for an Active Directory
administrator.

Active Directory Sites and Services. This


manages replication, network topology, and
related services.

Active Directory Domains and Trusts. This configures and maintains trust relationships and the
domain and forest functional level.

Active Directory Schema. This schema examines and modifies the definition of Active Directory
attributes and object classes. The schema is the blueprint for Active Directory, and you typically do not
view or change it very often. Therefore, the Active Directory Schema snap-in is not fully installed, by
default.

Overview of the Active Directory Administrative Center


Windows Server 2012 provides another option for
managing AD DS objects. The Active Directory
Administrative Center provides a graphical user
interface (GUI) built on Windows PowerShell. This
enhanced interface allows you to perform Active
Directory object management by using taskoriented navigation. Tasks that you can perform
by using the Active Directory Administrative
Center include:

Creating and managing user, computer, and


group accounts.

Creating and managing OUs.

Connecting to and managing multiple domains within a single instance of the Active Directory
Administrative Center.

Searching and filtering Active Directory data by building queries.

Creating and managing fine-grained password policies.

Recovering objects from the Active Directory Recycle Bin.

Installation Requirements

MCT USE ONLY. STUDENT USE PROHIBITED

3-16 Maintaining Active Directory Domain Services

You can install the Active Directory Administrative Center only on computers that are running Windows
Server 2008 R2, Windows Server 2012, Windows 7 or Windows 8. You can install the Active Directory
Administrative Center by:

Installing the AD DS server role through Server Manager.

Installing the Remote Server Administration Tools (RSAT) on a Windows Server 2012 server or
Windows 8.

Note: The Active Directory Administrative Center relies on the Active Directory Web
Services (ADWS) service, which you must install on at least one domain controller in the domain.
The service also requires port 9389 to be open on the domain controller where ADWS is running.

New Active Directory Administrative Center Features in Windows Server 2012

Active Directory Administrative Center contains several new features in Windows Server 2012 that enable
the graphical management of AD DS functionality:

Active Directory Recycle Bin. Active Directory Administrative Center now offers complete
management of the Active Directory Recycle Bin. Administrators can use Active Directory
Administrative Center to view and locate deleted objects, and manage and restore those objects
to their original or other desired location.

Fine-Grained Password Policy. Active Directory Administrative Center also provides a graphical user
interface for the creation and management of password settings objects to implement fine-grained
password policies in an AD DS domain.

Windows PowerShell History Viewer. Active Directory Administrative Center functionality is built
on Windows PowerShell. Any command or action that you perform within the Active Directory
Administrative Center interface is carried out in Windows Server 2012 through Windows PowerShell
cmdlets. When an administrator performs a task within the Active Directory Administrative Center

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-17

interface, the Windows PowerShell History Viewer shows the Windows PowerShell commands that
were issued for the task. This enables administrators to reuse code to create reusable scripts, and
allows them to become more familiar with Windows PowerShell syntax and usage.

Overview of the Active Directory Module for Windows PowerShell


The Active Directory module for Windows
PowerShell in Windows Server 2012 consolidates
a group of cmdlets that you can use to manage
your Active Directory domains. Windows Server
2012 builds on the foundation built in the Active
Directory module for Windows PowerShell
originally introduced in Windows Server 2008 R2,
by adding an additional 60 cmdlets that expand
the preexisting areas of Windows PowerShell
capabilities and add new capabilities in the areas
of replication and resource access control.
The Active Directory module for Windows
PowerShell enables management of AD DS in the following areas:
1.

User management

2.

Computer management

3.

Group management

4.

OU management

5.

Password policy management

6.

Searching and modifying objects

7.

Forest and domain management

8.

Domain controller and operations master management

9.

Managed service account management

10. Site replication management


11. Central access and claims management

Cmdlet Examples

New-ADComputer creates a new computer object in AD DS.

Remove-ADGroup removes an Active Directory group.

Set-ADDomainMode sets the domain functional level for an Active Directory domain.

Installation
You can install the Active Directory module by using any of the following methods:

By default, on a Windows Server 2008 R2 or Windows Server 2012 server, when you install the AD DS
or Active Directory Lightweight Directory Services (AD LDS) server roles.

By default, when you make a Windows Server 2008 R2 or Windows Server 2012 server a domain
controller.

As part of the RSAT feature on a Windows Server 2008 R2, Windows Server 2012, Windows 7 or
Windows 8 computer.

Demonstration: Managing AD DS by Using Management Tools

MCT USE ONLY. STUDENT USE PROHIBITED

3-18 Maintaining Active Directory Domain Services

The various AD DS management tools each have a purpose in the administration of the complete AD DS
environment. This demonstration will show you the primary tools that you can use to manage AD DS and
a task that you typically perform with the tool.
This demonstration shows how to:

Create objects in Active Directory Users and Computers.

View object attributes in Active Directory Users and Computers.

Navigate within Active Directory Administrative Center.

Perform an administrative task in Active Directory Administrative Center.

Use the Windows PowerShell Viewer in Active Directory Administrative Center.

Manage AD DS objects with Windows PowerShell.

Demonstration Steps
Active Directory Users and Computers
View objects
1.

On LON-DC1, open Active Directory Users and Computers.

2.

Navigate the Adatum.com domain tree, viewing Containers, Organizational Units (OUs) and
Computer, User, and Group objects.

Refresh the view

Refresh the view in Active Directory Users and Computers.

Create objects
1.

Create a new computer object named LON-CL4 in the Computers container.

2.

To create an object in Active Directory Users and Computers, right-click a domain, or a container
(such as Users or Computers), or an organizational unit, point to New, and then click the type of
object that you want to create.

3.

When you create an object, you are prompted to configure several of the objects most basic
properties, including the properties that the object requires.

Configure object attributes


1.

In Active Directory Users and Computers, open the Properties page for LON-CL4.

2.

Add LON-CL4 to the Adatum/Research group.

View all object attributes


1.

Enable the Advanced Features view in Active Directory Users and Computers.

2.

Open the Properties page for LON-CL4, and then view the AD DS attributes.

Active Directory Administrative Center


Navigation
1.

On LON-DC1, open Active Directory Administrative Center.

2.

In Active Directory Administrative Center, click the Navigation nodes.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-19

3.

Switch to the tree view.

4.

Expand Adatum.com.

Perform administrative tasks


1.

Navigate to the Overview view.

2.

Reset the password for Adatum\Adam to Pa$$w0rd, without requiring the user to change the
password at the next logon.

3.

Use the Global Search section to find any objects that match the search string Rex.

Use the Windows PowerShell History Viewer


1.

Open the Windows PowerShell History pane.

2.

View the Windows PowerShell cmdlet that you used to perform the most recent task.

Windows PowerShell
Creating a group
1.

Open the Active Directory Module for Windows PowerShell.

2.

Create a new group called SalesManagers by using the following command:


New-ADGroup Name SalesManagersGroupCategory Security GroupScope Global
DisplayName Sales Managers Path CN=Users,DC=Adatum,DC=com

3.

Open Active Directory Administrative Center, and confirm that the SalesManager group is
present in the Users container.

Move an object to a new organizational unit (OU)


1.

At the PowerShell prompt, move SalesManagers to the Sales OU by using the following command:
Move-ADObject CN=SalesManagers,CN=Users,DC=Adatum,DC=com TargetPath
OU=Sales,DC=Adatum,DC=com

2.

Switch to Active Directory Administrative Center, and then confirm that the SalesManagers group
has been moved to the Sales OU.

Managing Operations Master Roles


In an AD DS environment multimaster replication
means that all domain controllers have the same
general capabilities and priorities when modifying
the AD DS database. However, certain operations
must be performed by only one system. In AD DS,
operation masters are domain controllers that
perform a specific function within the domain
environment.

Forest-Wide Operations Master Roles


The schema master and the domain-naming
master must be unique in the forest. Each role is
performed by only one domain controller in the
entire forest.

Domain Naming Master Role

MCT USE ONLY. STUDENT USE PROHIBITED

3-20 Maintaining Active Directory Domain Services

The domain-naming role is used when adding or removing domains and application partitions in the
forest. When you add or remove a domain or application partition, the domain naming master must be
accessible, or the operation will fail.

Schema Master Role

The domain controller holding the schema master role is responsible for making any changes to the
forests schema. All other domain controllers hold read-only replicas of the schema. When you need to
modify the schema, the modifications must be sent to the domain controller that hosts the schema master
role.

Domain-Wide Operations Master Roles


Each domain maintains three single master operations: relative identifier (RID) master, infrastructure
master, and primary domain controller (PDC) Emulator. Each role is performed by only one domain
controller in the domain.

RID Master Role

The RID master plays an integral part in the generation of security identifiers (SIDs) for security principals
such as users, groups, and computers. The SID of a security principal must be unique. Because any
domain controller can create accounts, and therefore, SIDs, a mechanism is necessary to ensure that the
SIDs generated by a domain controller are unique. Active Directory domain controllers generate SIDs by
appending a unique RID to the domain SID. The RID master for the domain allocates pools of unique RIDs
to each domain controller in the domain. Therefore, each domain controller can be confident that the
SIDs that it generates are unique.

Infrastructure Master Role

In a multidomain environment, it is common for an object to reference objects in other domains. For
example, a group can include members from another domain. Its multivalued member attribute contains
the distinguished names of each member. If the member in the other domain is moved or renamed, the
infrastructure master of the groups domain updates the references to the object.

PDC Emulator Role


The PDC Emulator role performs multiple, crucial functions for a domain:

Participates in special password update handling for the domain. When a user's password is reset or
changed, the domain controller that makes the change replicates the change immediately to the PDC
emulator. This special replication ensures that the domain controllers know about the new password
as quickly as possible.

Manages Group Policy updates within a domain. If you modify a GPO on two domain controllers at
approximately the same time, there could be conflicts between the two versions that could not be
reconciled as the GPO replicates. To avoid this situation, the PDC emulator acts as the default focal
point for all Group Policy changes.

Provides a master time source for the domain. Many Windows components and technologies rely
on time stamps, so synchronizing time across all systems in a domain is crucial. The PDC emulator in
the forest root domain is the time master for the entire forest, by default. The PDC emulator in each
domain synchronizes its time with the forest root PDC emulator. Other domain controllers in the
domain synchronize their clocks against that domains PDC emulator. All other domain members
synchronize their time with their preferred domain controller.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-21

Acts as the domain master browser. When you open network in Windows, you see a list of
workgroups and domains, and when you open a workgroup or domain, you see a list of computers.
The browser service creates these two lists, called browse lists. In each network segment, a master
browser creates the browse list: the lists of workgroups, domains, and servers in that segment. The
domain master browser serves to merge the lists of each master browser so that browse clients can
retrieve a comprehensive browse list.

Guidelines for Placing Operations Master Roles

Place the domain-level roles on a high-performance domain controller.

Do not place the Infrastructure Master domain-level role on a global catalog server, except when
your forest contains only one domain or all of the domain controllers in your forest also are global
catalogs.

Leave the two forest-level roles on a domain controller in the forest-root domain.

Adjust the workload of the PDC emulator, if necessary, by offloading non-AD DS roles to other
servers.

Note: You can view the assignment of operations master roles by running the following
from a command prompt:
Netdom query fsmo

Managing AD DS Backup and Recovery


In earlier Windows versions, backing up Active
Directory involved creating a backup of the
SystemState, which was a small collection of files
that included the Active Directory database and
the registry.
In Windows Server 2012, the SystemState
concept still exists, but it is much larger. Because
of interdependencies between server roles,
physical configuration, and Active Directory,
the SystemState is now a subset of a Full Server
backup and, in some configurations, might be just
as big. To back up a domain controller, you must
back up all critical volumes fully.

Restoring AD DS Data

When a domain controller or its directory is corrupted, damaged, or failed, you have several options with
which to restore the system.

Nonauthoritative Restore

The first such option is called normal restore or nonauthoritative restore. In a normal restore operation,
you restore a backup of Active Directory as of a known good date. Effectively, you roll the domain
controller back in time. When AD DS restarts on the domain controller, the domain controller contacts
its replication partners and requests all subsequent updates. Effectively, the domain controller catches up
with the rest of the domain by using standard replication mechanisms.

MCT USE ONLY. STUDENT USE PROHIBITED

3-22 Maintaining Active Directory Domain Services

Normal restore is useful when the directory on a domain controller has been damaged or corrupted, but
the problem has not spread to other domain controllers. What about a situation in which damage has
been done, and the damage has been replicated? For example, what if you delete one or more objects,
and that deletion has replicated?

In such situations, a normal restore is not sufficient. If you restore a known good version of Active
Directory and restart the domain controller, the deletion (which happened subsequent to the backup) will
simply replicate back to the domain controller.

Authoritative Restore

When a known good copy of AD DS has been restored that contains objects that must override existing
objects in the AD DS database, an authoritative restore is necessary. In an authoritative restore, you
restore the known good version of Active Directory just as you do in a normal restore. However, before
restarting the domain controller, you mark the accidentally deleted or previously corrupted objects that
you wish to retain as authoritative so that they will replicate from the restored domain controller to its
replication partners. Behind the scenes, when you mark objects as authoritative, Windows increments the
version number of all object attributes to be so high that the version is virtually guaranteed to be higher
than the version number on all other domain controllers.

When the restored domain controller is restarted, it replicates from its replication partners all changes that
have been made to the directory. It also notifies its partners that it has changes, and the version numbers
of the changes ensure that partners take the changes and replicate them throughout the directory service.
In forests with the Active Directory Recycle Bin enabled, you can use the Active Directory Recycle Bin as a
more simple alternative to an authoritative restore.

Other Restore Options

The third option for restoring the directory service is to restore the entire domain controller. This is done
by booting to the Windows Recovery Environment, and then restoring a full server backup of the domain
controller. By default, this is a normal restore. If you also need to mark objects as authoritative, you must
restart the server in the Directory Services Restore Mode and set those objects as authoritative prior to
starting the domain controller into normal operation.

Finally, you can restore a backup of the SystemState to an alternate location. This allows you to examine
files and, potentially, to mount the NTDS.dit file. You should not copy the files from an alternate restore
location over the production versions of those files. Do not do a piecemeal restore of Active Directory.
You also can use this option if you want to use the Install From Media option for creating a new domain
controller.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-23

Lesson 5

Managing the AD DS Database

At the core of the AD DS environment is the AD DS database. The AD DS database contains all the critical
information required to provide AD DS functionality. Maintaining this database properly is a critical aspect
of AD DS management, and there are several tools and best practices of which you should be aware so
that you can manage your AD DS database effectively. This lesson will introduce you to AD DS database
management, and show you the tools and methods for maintaining it.

Lesson Objectives
After completing this lesson, you will be able to:

Explain the AD DS database architecture.

Describe NTDSUtil.

Explain restartable AD DS.

Explain how to perform AD DS database management.

Describe how to create AD DS snapshots.

Explain how to restore deleted objects.

Describe how to configure the Active Directory Recycle Bin.

Understanding the AD DS Database


AD DS information is stored within the directory
database. Each directory partition, also called a
naming context, contains objects of a particular
replication scope and purpose. There are three
AD DS partitions on each domain controller, as
follows:

Domain. The Domain partition contains all


the objects stored in a domain, including
users, groups, computers, and Group Policy
containers (GPCs).

Configuration. The Configuration partition


contains objects that represent the logical
structure of the forest, including information about domains, as well as the physical topology,
including sites, subnets, and services.

Schema. The Schema partition defines the object classes and their attributes for the entire directory.

Domain controllers also can host application partitions. You can use application partitions to limit
replication of application-specific data to a subset of domain controllers. Active Directory integrated DNS
is a common example of an application that takes advantage of application partitions.

Each domain controller maintains a copy, or replica, of several partitions. The Configuration is replicated
to every domain controller in the forest, as is the Schema. The Domain partition for a domain is replicated
to all domain controllers within a domain, but not to domain controllers in other domains, with the
exception of global catalog servers. Therefore, each domain controller has at least three replicas: the
Domain partition for its domain, Configuration, and Schema.

AD DS Database Files

MCT USE ONLY. STUDENT USE PROHIBITED

3-24 Maintaining Active Directory Domain Services

The AD DS database is stored as a file named NTDS.dit. When you install and configure AD DS, you can
specify the location of the file. The default location is %systemroot%\NTDS. Within NTDS.dit are all of
the partitions hosted by the domain controller: the forest schema and configuration; the domain-naming
context; and, depending on the server configuration, the partial attribute set and application partitions.
In the NTDS folder, there are other files that support the Active Directory database. The Edb*.log files are
the transaction logs for Active Directory. When a change must be made to the directory, it is first written
to the log file. The change is committed to the directory as a transaction. If the transaction fails, it can be
rolled back.
The following table describes the different file level components of the AD DS database.
File
NTDS.dit

Description
Main AD DS database file
Contains all AD DS partitions and objects

EDB*.log

Transaction log(s)

EDB.chk

Database checkpoint file

Edbres00001.jrs
Edbres00002.jrs

Reserve transaction log file that allows the directory to process


transactions if the server runs out of disk space

AD DS Database Modifications and Replication


Under normal operations, the transaction log wraps around, with new transactions overwriting old
transactions that had already been committed. However, if a large number of transactions are made
within a short period of time, AD DS creates additional transaction log files, so you may see several
EDB*.log files if you look in the NTDS folder of a particularly busy domain controller. Over time, those
files are removed automatically.

The EDB.chk file acts like a bookmark into the log files, marking the location before which transactions
have been successfully committed to the database, and after which transactions remain to be committed.

If a disk drive runs out of space, it is highly problematic for the server. It is even more problematic if that
disk is hosting the AD DS database, because transactions that may be pending cannot be written to the
logs. Therefore, AD DS maintains two additional log files, edbres0001.jrs and edbres0002.jrs. These are
empty files of 10 megabytes (MB) each. When a disk runs out of space for normal transaction logs, AD DS
recruits the space used by these two files to write the transactions that are in a queue currently. After that,
it safely shuts down AD DS services, and dismounts the database. Of course, it will be important for an
administrator to remediate the issue of low disk space as quickly as possible. The file simply provides a
temporary solution to prevent the directory service from refusing new transactions.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-25

What Is NTDSUtil?
NTDSUtil is a command-line executable that
you can use to perform database maintenance,
including the creation of snapshots, offline
defragmentation, and the relocation of the
database files.
You also can use NTDSUtil to clean up domain
controller metadata. If a domain controller is
removed from the domain while offline, it is
unable to remove important information from the
directory service. You can then use NTDSUtil to
clean out the remnants of the domain controller,
and it is very important that you do so.
NTDSUtil can also reset the password used to log on to the Directory Services Restore Mode. This
password is initially configured during the configuration of a domain controller. If you forget the
password, the NTDSUtil set dsrm command can reset it.

Understanding Restartable AD DS
In most scenarios where AD DS management is
required, you should restart the domain controller
in Directory Services Restore mode.
Windows Server 2012 enables administrators to
stop and start AD DS just like any other service,
and without restarting a domain controller, to
perform some management tasks quickly. This
feature is called Restartable Active Directory
Domain Services.

Restartable AD DS reduces the time required to


perform certain operations. You can stop AD DS
so that you can apply updates to a domain
controller. Also, administrators can stop AD DS to perform tasks such as offline defragmentation of the
Active Directory database, without restarting the domain controller. Other services that are running on
the server and that do not depend on AD DS to function, such as Dynamic Host Configuration Protocol
(DHCP), remain available to satisfy client requests while AD DS is stopped.

Restartable AD DS is available by default on all domain controllers that run Windows Server 2012. There
are no functional-level requirements or any other prerequisites for using this feature.
Note: You cannot perform a system state restore of a domain controller while AD DS
is stopped. To complete a system state restore of a domain controller, you need to start in
Directory Services Restore Mode (DSRM). You can however perform an authoritative restore
of Active Directory objects while AD DS is stopped by using Ntdsutil.exe.

MCT USE ONLY. STUDENT USE PROHIBITED

3-26 Maintaining Active Directory Domain Services

Restartable AD DS adds minor changes to the existing Microsoft Management Console (MMC) snap-ins. A
domain controller running Windows Server 2012 AD DS displays Domain Controller in the Services (Local)
node of the Component Services snap-in and the Computer Management snap-in. Using the snap-in, an
administrator can easily stop and restart AD DS the same way as any other service that is running locally
on the server.
Although stopping AD DS is similar to logging on in Directory Services Restore Mode, restartable
AD DS provides a unique state, known as AD DS Stopped, for a domain controller that is running Windows
Server 2012.

Domain Controller States


The three possible states for a domain controller running Windows Server 2012 are:

AD DS Started. In this state, AD DS is started. The domain controller is able to perform AD DS related
tasks normally.

AD DS Stopped. In this state, AD DS is stopped. Although this mode is unique, the server has some
characteristics of both a domain controller in DSRM and a domain-joined member server.

DSRM. This mode (or state) allows standard AD DS administrative tasks.

With DSRM, the Active Directory database (Ntds.dit) on the local domain controller is offline. Another
domain controller can be contacted for logon, if one is available. If no other domain controller can be
contacted, by default you can do one of the following:

Log on to the domain controller locally in DSRM by using the DSRM password.

Restart the domain controller to log on with a domain account.

As with a member server, the server is joined to the domain. This means that Group Policy and other
settings are still applied to the computer. However, a domain controller should not remain in the AD DS
Stopped state for an extended period of time because in this state, it cannot service logon requests or
replicate with other domain controllers.

Demonstration: Performing AD DS Database Maintenance


There are several tasks and related tools that you can use to perform AD DS database maintenance.
This demonstration shows how to:

Stop AD DS.

Perform an offline defragmentation of the AD DS database.

Check the integrity of the AD DS database.

Start AD DS.

Demonstration Steps
Stop AD DS
1.

On LON-DC1, open the Services console.

2.

Stop the Active Directory Domain Services service.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-27

Perform an offline defragmentation of the AD DS database

Run the following commands from a Windows PowerShell prompt. Press Enter after each line:
ntdsutil
activate instance NTDS
files
compact to C:\

Check the integrity of the offline database


1.

Run the following commands from a Windows PowerShell prompt. Press Enter after each line:
Integrity
quit
Quit

2.

Close the command prompt window.

Start AD DS
1.

Open the Services console.

2.

Start the Active Directory Domain Services service.

Creating AD DS Snapshots
NTDSUtil in Windows Server 2012 can create
and mount snapshots of AD DS. A snapshot is
a form of historical backup that captures the
exact state of the directory service at the time of
the snapshot. You can use tools to explore the
contents of a snapshot to examine the state of
the directory service at the time the snapshot was
made, or connect to a mounted snapshot with
LDIFDE and export a reimport objects into AD DS.

Creating an AD DS Snapshot
To create a snapshot:
1.

Open the command prompt.

2.

Type ntdsutil, and then press Enter.

3.

Type snapshot, and then press Enter.

4.

Type activate instance ntds, and then press Enter.

5.

Type create, and then press Enter.

6.

The command returns a message that indicates that the snapshot set was generated successfully.

7.

The GUID that is displayed is important for commands in later tasks. Make note of the GUID or,
alternatively, copy it to the Clipboard.

8.

Type quit, and then press Enter.

Schedule snapshots of Active Directory regularly. You can use the Task Scheduler to execute a batch file
by using the appropriate NTDSUtil commands.

Mounting an AD DS Snapshot

MCT USE ONLY. STUDENT USE PROHIBITED

3-28 Maintaining Active Directory Domain Services

To view the contents of a snapshot, you must mount the snapshot as a new instance of AD DS. This is also
accomplished with NTDSUtil.
To mount a snapshot:
1.

Open an elevated command prompt.

2.

Type ntdsutil, and then press Enter.

3.

Type activate instance ntds, and then press Enter.

4.

Type snapshot, and then press Enter.

5.

Type list all, and then press Enter.

6.

The command returns a list of all snapshots.

7.

Type mount {GUID}, where GUID is the GUID returned by the create snapshot command, and then
press Enter.

8.

Type quit, and then press Enter.

9.

Type quit, and then press Enter.

10. Type dsamain -dbpath c:\$snap_datetime_volumec$\windows\ntds\ntds.dit -ldapport 50000,


and then press Enter.
11. The port number, 50000, can be any open and unique TCP port number.
12. A message indicates that Active Directory Domain Services startup is complete.
13. Do not close the command prompt window and leave the command you just ran, Dsamain.exe,
running while you continue to the next step.

Viewing an AD DS Snapshot
After the snapshot has been mounted, you can use tools to connect to and explore the snapshot. Even
Active Directory Users and Computers can connect to the instance.
To connect to a snapshot with Active Directory Users and Computers:
1.

Open Active Directory Users and Computers.

2.

Right-click the root node, and then click Change Domain Controller.

3.

The Change Directory Server dialog box appears.

4.

Click <Type a Directory Server name[:port] here>.

5.

Type LON-DC1:50000, and then press Enter.

6.

LON-DC1 is the name of the domain controller on which you mounted the snapshot, and 50000 is
the TCP port number that you configured for the instance. You now are connected to the snapshot.

7.

Click OK.

Note that snapshots are read-only. You cannot modify the contents of a snapshot. Moreover, there are no
direct methods with which to move, copy, or restore objects or attributes from the snapshot to the
production instance of Active Directory.

Unmounting an AD DS Snapshot
To unmount the snapshot:
1.

Switch to the command prompt in which the snapshot is mounted.

2.

Press Ctrl+C to stop DSAMain.exe.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-29

3.

Type ntdsutil, and then press Enter.

4.

Type activate instance ntds, and then press Enter.

5.

Type snapshot, and then press Enter.

6.

Type unmount GUID, where GUID is the GUID of the snapshot, and then press Enter.

7.

Type quit, and then press Enter.

8.

Type quit, and then press Enter.

Understanding How to Restore Deleted Objects


When an object in AD DS is deleted, it is moved
to the Deleted Objects container, and stripped
of many important attributes. You can extend
the list of attributes that remain when an object is
deleted, but you can never retain linked attribute
values (such as group membership).
As long as the object has not yet been scavenged
by the garbage collection process after reaching
the end of its tombstone lifetime, you can restore
or reanimate the deleted object.
To restore a deleted object:
1.

Click Start, and in the Start Search box, type LDP.exe, and then press Ctrl+Shift+Enter, which
executes the command as an administrator.

2.

The User Account Control dialog box appears.

3.

Click Use another account.

4.

In the User name box, type the user name of an administrator.

5.

In the Password box, type the password for the administrative account, and then press Enter.

6.

LDP opens.

7.

Click the Connection menu, click Connect, and then click OK.

8.

Click the Connection menu, click Bind, and then click OK.

9.

Click the Options menu, and then click Controls.

10. In the Load Predefined list, click Return Deleted Objects, and then click OK.
11. Click the View menu, click Tree, and then click OK.
12. Expand the domain, and then double-click CN=Deleted Objects,DC=contoso,DC=com.
13. Right-click the deleted object, and then click Modify.
14. In the Attribute box, type isDeleted.
15. In the Operation section, click Delete.
16. Press Enter.
17. In the Attribute box, type distinguishedName.

MCT USE ONLY. STUDENT USE PROHIBITED

3-30 Maintaining Active Directory Domain Services

18. In the Values box, type the distinguished name of the object in the parent container or the OU into
which you want the objects restoration to occur. For example, type the distinguished name of the
object before it was deleted.
19. In the Operation section, click Replace.
20. Press Enter.
21. Select the Extended check box.
22. Click Run, click Close, and then close LDP.

23. Use Active Directory Users and Computers to repopulate the objects attributes, reset the password
(for a user object), and enable the object (if disabled).

Configuring the Active Directory Recycle Bin


In Windows 2012, the Active Directory Recycle Bin
can be enabled to provide a simplified process for
restoring deleted objects. This feature overcomes
problems with authoritative restore or tombstone
reanimation. The Active Directory Recycle Bin
enables administrators to restore deleted objects
with full functionality, without having to restore
AD DS data from backups, and then restart AD DS
or reboot domain controllers. Active Directory
Recycle Bin builds on the existing tombstone
reanimation infrastructure and enhances your
ability to preserve and recover accidentally
deleted Active Directory objects.

How Active Directory Recycle Bin Works

When you enable Active Directory Recycle Bin, all link-valued and nonlink-valued attributes of the
deleted Active Directory objects are preserved, and the objects are restored in their entirety to the same
consistent logical state that they were in immediately before deletion. For example, restored user accounts
automatically regain all group memberships and corresponding access rights that they had immediately
before deletion, within and across domains. Active Directory Recycle Bin works for both AD DS and Active
Directory Lightweight Directory Services (AD LDS) environments.
After you enable Active Directory Recycle Bin, when an Active Directory object is deleted, the system
preserves all of the object's link-valued and non-link-valued attributes, and the object becomes logically
deleted. A deleted object is moved to the Deleted Objects container, and its distinguished name is
mangled. A deleted object remains in the Deleted Objects container in a logically deleted state
throughout the duration of the deleted object lifetime. Within the deleted object lifetime, you can recover
a deleted object with Active Directory Recycle Bin and make it a live Active Directory object again.
The deleted object lifetime is determined by the value of the msDS-deletedObjectLifetime attribute.
For an item deleted after the Active Directory Recycle Bin has been enabled (recycled object), the recycled
object lifetime is determined by the value of the legacy tombstoneLifetime attribute. By default,
msDS-deletedObjectLifetime is set to null. When msDS-deletedObjectLifetime is set to null, the
deleted object lifetime is set to the value of the recycled object lifetime. By default, the recycled object
lifetime, which is stored in the tombstoneLifetime attribute, is also set to null. When tombstoneLifetime
is set to null, the recycled object lifetime defaults to 180 days. You can modify the values of the msDSdeletedObjectLifetime and tombstoneLifetime attributes anytime. When msDS-deletedObjectLife is
set to some value other than null, it no longer assumes the value of tombstoneLifetime.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-31

Enabling the Active Directory Recycle Bin

You can enable the Active Directory Recycle Bin only when the forest functional level is set to Windows
Server 2008 R2 or higher.
To enable the Active Directory Recycle Bin in Windows 2012, you can perform one the following:

From the Active Directory module for Windows PowerShell prompt, use the
Enable-ADOptionalFeature cmdlet.

From Active Directory Administrative Center, select the domain, and then click Enable Active
Directory Recycle Bin in the Tasks pane.

Only items deleted after the Active Directory Recycle Bin is turned on can be restored from the Active
Directory Recycle Bin.

Restoring Items from the Active Directory Recycle Bin

In Windows Server 2012, the Active Directory Administrative Center provides a graphical interface for
restoring AD DS objects that are deleted. When the Active Directory Recycle Bin has been enabled, the
Deleted Objects container is visible in Active Directory Administrative Center. Deleted objects will be
visible in this container until their deleted object lifetime period has expired. You can choose to restore
the objects to their original location or to an alternate location within AD DS.

Lab: Maintaining AD DS
Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

3-32 Maintaining Active Directory Domain Services

A. Datum Corporation is a global engineering and manufacturing company with its head office in London,
U.K.. An IT office and data center in London supports the head office and other locations. A. Datum
recently deployed a Windows Server 2012 server and client infrastructure.
A. Datum is making several organizational changes that require modifications to the AD DS infrastructure.
A new location requires a secure method of providing onsite AD DS, and you have been asked to extend
the capabilities of Active Directory Recycle Bin to the entire organization.

Virtual Machine(s)

20411B-LON-DC1
20411B-LON-SVR1

User Name

Administrator

Password

Pa$$w0rd

Objectives
After completing this lab, you will be able to:

Install and configure a RODC.

Configure and view Active Directory snapshots.

Configure the Active Directory recycle bin.

Lab Setup
For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Log on using the following credentials:

5.

a.

User name: Administrator

b.

Password: Pa$$w0rd

c.

Domain: Adatum

Repeat steps 2 through 4 for 20411B-LON-SVR1.

Exercise 1: Installing and Configuring a RODC


Scenario
A. Datum is adding a new branch office. You have been asked to configure a RODC to service logon
requests at the branch office. You also need to configure password policies that ensure caching only of
passwords for local users in the branch office.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-33

The main tasks for this exercise are as follows:


1.

Verify requirements for installing a RODC.

2.

Install an RODC.

3.

Configure a password-replication policy.

Task 1: Verify requirements for installing a RODC


1.

On LON-DC1, from Server Manager, open Active Directory Users and Computers.

2.

In the properties of Adatum.com, verify that the forest functional level is at least Windows
Server 2003.

3.

On LON-SVR1, open Server Manager, and verify whether the computer is a domain member.

4.

Use System Properties to place LON-SVR1 in a workgroup named TEMPORARY.

5.

Restart LON-SVR1.

6.

On LON-DC1, open Active Directory Users and Computers.

7.

Delete the LON-SVR1 computer account from the Computers container.

8.

In the Domain Controllers OU, precreate a RODC account by using default settings, except for the
following:

9.

Computer name: LON-SVR1

Delegate to: ADATUM\IT

Close Active Directory Users and Computers.

Task 2: Install an RODC


1.

Sign in to LON-SVR1 as Administrator with the password Pa$$w0rd.

2.

On LON-SVR1, add the Active Directory Domain Services Role.

3.

Complete the Active Directory Domain Services Installation Wizard by using default options except
those listed below:

4.

Domain: Adatum.com

Network credentials: Adatum\April (a member of the IT group)

Password for April: Pa$$w0rd

Directory Services restore mode password: Pa$$w0rd

Replicate from: LON-DC1.Adatum.com

When installation is complete, restart LON-SVR1.

Task 3: Configure a password-replication policy


1.

On LON-DC1, from Server Manager, open Active Directory Users and Computers.

2.

In the Users container, view the membership of the Allowed RODC Password Replication Group,
and verify that there are no current members.

3.

In the Domain Controllers OU, open the properties of LON-SVR1.

4.

On the Password Replication Policy tab, verify that the Allowed RODC Password Replication
Group and Denied RODC Password Replication Group are listed.

MCT USE ONLY. STUDENT USE PROHIBITED

3-34 Maintaining Active Directory Domain Services

5.

On LON-DC1, in Active Directory Users and Computers, in the Research OU, create a new group
named Remote Office Users.

6.

Add Aziz, Colin, Lukas, Louise, and LON-CL1 to the membership of Remote Office Users.

7.

On LON-DC1, in Active Directory Users and Computers, click the Domain Controllers OU, and then
open the properties of LON-SVR1.

8.

On the Password Replication Policy tab, allow the Remote Office Users group to replicate
passwords to LON-SVR1.

9.

On LON-DC1, in Active Directory Users and Computers, in the Domain Controllers OU, open the
properties of LON-SVR1.

10. On the Password Replication Policy tab, open the Advanced configuration. On the Resultant
Policy tab, add Aziz, and then confirm that Azizs password can be cached.

11. Attempt to log on to LON-SVR1 as Aziz. This logon will fail because Aziz does not have permission to
logon to the RODC, but authentication is performed and the credentials are cached.
12. On LON-DC1, in Active Directory Users and Computers, in the Domain Controllers OU, open the
properties of LON-SVR1.
13. On the Password Replication Policy tab, open the Advanced configuration.
14. On the Policy Usage tab, select the Accounts that have been authenticated to this Read-only
Domain Controller option. Notice that Azizs password has been cached.
15. On LON-DC1, in Active Directory Users and Computers, in the Domain Controllers OU, right-click
LON-SVR1, and then click Properties.
16. On the Password Replication Policy tab, open the Advanced configuration.
17. On the Policy Usage tab, prepopulate the password for Louise and LON-CL1.
18. Read the list of cached passwords, and then confirm that Louise and LON-CL1 have been added.
19. Close all open windows on LON-DC1.

Results: After completing this exercise, you will have installed and configured a RODC.

Exercise 2: Configuring AD DS snapshots


Scenario

As part of the overall disaster recovery plan for A. Datum, you have been instructed to test the process for
taking Active Directory snapshots and viewing them. If the process is successful, you will schedule them to
occur on a regular basis to assist in the recovery of deleted or modified AD DS objects.
The main tasks for this exercise are as follows:
1.

Create a snapshot of AD DS.

2.

Make a change to AD DS.

3.

Mount an Active Directory snapshot, and create a new instance.

4.

Explore a snapshot with Active Directory Users and Computers.

5.

Unmount an Active Directory snapshot.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-35

Task 1: Create a snapshot of AD DS


1.

On LON-DC1, open a command prompt window, and then type the following commands each
followed by Enter:
ntdsutil
snapshot
activate instance ntds
create
quit
Quit

2.

The command returns a message indicating that the snapshot set was generated successfully. The
globally unique identifier (GUID) that displays is important for commands in later tasks. Make a note
of the GUID or copy it to the Clipboard.

Task 2: Make a change to AD DS


1.

On LON-DC1, open Server Manager.

2.

From Server Manager, open Active Directory Users and Computers.

3.

Delete Adam Barr's account from the Marketing OU.

Task 3: Mount an Active Directory snapshot, and create a new instance


1.

Open an administrative command prompt, and then type the following commands each followed
by Enter:
ntdsutil
snapshot
activate instance ntds
list all

The command returns a list of all snapshots.


2.

Type the following commands each followed by Enter:


mount guid
quit
Quit

Where guid is the GUID of the snapshot you created.


3.

Use the snapshot to start an instance of Active Directory by typing the following command, all on one
line, and then press Enter:
dsamain /dbpath c:\$snap_datetime_volumec$\windows\ntds\ntds.dit /ldapport 50000

Note that datetime will be a unique value. There only should be one folder on your C:/ drive with a
name that begins with $snap.

A message indicates that AD DS startup is complete. Leave Dsamain.exe running, and do not close the
command prompt.

Task 4: Explore a snapshot with Active Directory Users and Computers


1.

Switch to Active Directory Users and Computers. Right-click the root node of the snap-in, and then
click Change Domain Controller. Type the directory server name and port LON-DC1:50000, and
then press Enter. Click OK.

2.

Locate the Adam Barr user account object in the Marketing OU. Note that Adam Barr's object is
displayed because the snapshot was taken prior to deleting it.

Task 5: Unmount an Active Directory snapshot


1.

In the command prompt, press Ctrl+C to stop DSAMain.exe.

2.

Type the following commands:


ntdsutil
snapshot
activate instance ntds
list all
unmount guid
list all
quit
Quit

Where guid is the GUID of the snapshot.

Results: After completing this exercise, you will have configured AD DS snapshots.

Exercise 3: Configuring the Active Directory Recycle Bin


Scenario
As part of the Disaster Recovery plan for AD DS, you need to configure and test the Active Directory
Recycle Bin to allow for object and container level recovery.
The main tasks for this exercise are as follows:
1.

Enable the Active Directory Recycle Bin.

2.

Create and delete test users.

3.

Restore the deleted users.

4.

To prepare for the next module.

Task 1: Enable the Active Directory Recycle Bin


1.

On LON-DC1, from Server Manager, open Active Directory Administrative Center.

2.

Enable the Recycle Bin.

3.

Press F5 to refresh Active Directory Administrative Center.

Task 2: Create and delete test users


1.

2.

MCT USE ONLY. STUDENT USE PROHIBITED

3-36 Maintaining Active Directory Domain Services

In Active Directory Administrative Center, create the following users in the Research OU. Give each a
password of Pa$$w0rd:
o

Test1

Test2

Delete the Test1 and Test2 accounts.

Task 3: Restore the deleted users


1.

In Active Directory Administrative Center, navigate to the Deleted Objects folder for the Adatum
domain.

2.

Restore Test1 to its original location.

3.

Restore Test2 to the IT OU.

4.

Confirm that Test1 is now located in the Research OU and that Test2 is in the IT OU.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 3-37

To prepare for the next module

When you finish the lab, revert the virtual machines to their initial state.

Results: After completing this exercise, you will have configured the Active Directory Recycle Bin.

Module Review and Takeaways


Best Practices for Administering AD DS

MCT USE ONLY. STUDENT USE PROHIBITED

3-38 Maintaining Active Directory Domain Services

Do not virtualize all domain controllers on the same hypervisor host or server.

Virtual machine snapshots provide an excellent reference point or quick recovery method, but you
should not use them as a replacement for regular backups. They also will not allow you to recover
objects by reverting to an older snapshot.

Use RODCs when physical security makes a writable domain controller unfeasible.

Use the best tool for the job. Active Directory Users and Computers is the most commonly used tool
for managing AD DS, but it is not always the best. You can use Active Directory Administrative Center
for performing large-scale tasks or those tasks that involve multiple objects. You also can use the
Active Directory module for Windows PowerShell to create reusable scripts for frequently repeated
administrative tasks.

Enable Active Directory Recycle Bin if your forest functional level supports the functionality. It can be
invaluable in saving time when recovering accidentally deleted objects in AD DS.

Tools
Tool

Used for

Where to find it

Hyper-V Manager

Managing virtualized hosts on


Windows Server 2012

Server Manager - Tools

Active Directory module for


Windows PowerShell

Managing AD DS through scripts


and from the command line

Server Manager - Tools

Active Directory Users and


Computers

Managing objects in AD DS

Server Manager Tools

Active Directory
Administrative Center

Managing objects in AD DS,


enabling and managing the Active
Directory Recycle Bin

Server Manager - Tools

Ntdsutil.exe

Managing AD DS snapshots

Command prompt

Dsamain.exe

Mounting AD DS snapshots for


browsing

Command prompt

MCT USE ONLY. STUDENT USE PROHIBITED


4-1

Module 4
Managing User and Service Accounts
Contents:
Module Overview

4-1

Lesson 1: Automating User Account Management

4-2

Lesson 2: Configuring Password-Policy and User-Account Lockout Settings

4-7

Lesson 3: Configuring Managed Service Accounts

4-14

Lab: Managing User and Service Accounts

4-20

Module Review and Takeaways

4-24

Module Overview

Managing user accounts in an enterprise environment can be a challenging task. You must ensure
that you configure the user accounts in your environment properly, and that you protect them from
unauthorized use and from users who abuse their account privileges. Using dedicated service accounts for
system services and background processes, as well as setting appropriate account policies, will help to
ensure that your Windows Server 2012 environment gives users and applications the access they need to
function properly.
This module will help you to understand how to manage large groups of user accounts, explain the
different options available for providing adequate password security for accounts in your environment,
and show you how to configure accounts to provide authentication for system services and background
processes.

Objectives
After completing this module, you will be able to:

Automate user account creation.

Configure password-policy and account-lockout settings.

Configure managed service accounts.

Lesson 1

Automating User Account Management

MCT USE ONLY. STUDENT USE PROHIBITED

4-2 Managing User and Service Accounts

Active Directory Users and Computers and the Active Directory Administrative Center provide
graphical user interfaces (GUIs) for creating one or more user accounts. While the interface that these
tools provide is easy to navigate, creating multiple users or performing modifications for multiple users
can be cumbersome. Windows Server 2012 contains a number of tools that enable you to manage user
accounts more efficiently in your Active Directory Domain Services (AD DS) domain. This lesson introduces
tools that allow you to perform tasks such as changing user attributes for many users, searching for users,
and importing and exporting users to and from external data sources or directories.

Lesson Objectives
After completing this lesson, you will be able to:

Explain how to export users by using the Comma-Separated Values Data Exchange tool.

Explain how to import users by using the Comma-Separated Values Data Exchange tool.

Describe how to import user accounts by using the LDAP Data Interchange Format (LDIFDE) Internet
standard.

Explain how to import user accounts by using Windows PowerShell.

Demonstration: Exporting Users Accounts with Comma-Separated Values


Data Exchange Tool
Comma-Separated Values Data Exchange tool is a command-line tool that exports or imports AD DS
objects to or from a comma-delimited text file, which also is known as a comma-separated value text
file or .csv file. You can create, modify, and open comma-delimited files by using familiar tools such as
Notepad and Microsoft Office Excel. Additionally, you can use these files to export information from
AD DS, for use in other areas of your organization, or you can use them to import information from
other sources for use in creating or modifying your domains AD DS objects.
The following is the basic syntax of the Comma-Separated Values Data Exchange tool command for
export:
csvde -f filename

However, this command will export all objects in your Active Directory domain. You will want to limit the
scope of the export, which you can do with the following four parameters:

-d RootDN. Specifies the distinguished name of the container from which the export will begin. The
default is the domain itself.

-p SearchScope. Specifies the scope of the search relative to the container specified by -d.
SearchScope can be either base (this object only), onelevel (objects within this container), or subtree
(this container and all subcontainers). The default is subtree.

-r Filter. Filters the objects returned within the scope configured by -d and -p. Filter is specified in
Lightweight Directory Access Protocol (LDAP) query syntax. You will work with a filter in the lab for
this lesson. The LDAP query syntax is beyond the scope of this course. For more information, see
http://go.microsoft.com/fwlink/?LinkId=168752.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-3

-l ListOfAttributes. Specifies the attributes that will be exported. Use the LDAP name for each
attribute, separated by a comma, as in
-l DN,objectClass,sAMAccountName,sn,givenName,userPrincipalName

The output of a Comma-Separated Values Data Exchange tool export lists the LDAP attribute names on
the first line. Each object follows, one per line, and must contain exactly the attributes listed on the first
line, as illustrated in the following examples:
DN,objectClass,sn,givenName,sAMAccountName,userPrincipalName
"CN=David Jones,OU=Employees,OU=User
Accounts,DC=contoso,DC=com",user,Jones,David,david.jones,david.jones@contoso.com
"CN=Lisa Andrews,OU=Employees,OU=User
Accounts,DC=contoso,DC=com",user,Andrews,Lisa,lisa.andrews,lisa.andrews@contoso.com

In this demonstration, you will see how to:

Export user accounts with Comma-Separated Values Data Exchange tool.

Demonstration Steps
1.

On LON-DC1, open a command prompt.

2.

In the command prompt window, type the following command, and then press Enter:
csvde -f E:\Labfiles\Mod04\UsersNamedRex.csv -r "(name=Rex*)" -l
DN,objectClass,sAMAccountName,sn,givenName,userPrincipalName

3.

Open E:\LABFILES\Mod04\UsersNamedRex.csv in Notepad.

4.

Examine the file, and then close Notepad.

5.

Close all open windows on LON-DC1.

Demonstration: Importing User Accounts with the Comma-Separated


Values Data Exchange Tool

You also can use Comma-Separated Values Data Exchange tool to create user accounts by importing a
.csv file. If you have user information in existing Excel or Microsoft Office Access databases, you will find
that Comma-Separated Values Data Exchange tool is a powerful way to take advantage of that
information to automate user account creation.
The following is the basic syntax of the Comma-Separated Values Data Exchange tool command for
import:
csvde -i -f filename -k

The i parameter specifies import mode. Without this parameter, the default mode of the CommaSeparated Values Data Exchange tool is export. The f parameter identifies the file name to import from
or export to. The k parameter is useful during import operations because it instructs the CommaSeparated Values Data Exchange tool to ignore errors, including Object Already Exists.

MCT USE ONLY. STUDENT USE PROHIBITED

4-4 Managing User and Service Accounts

The import file itself is a comma-delimited text file (.csv or .txt) in which the first line defines the imported
attributes by their LDAP attribute names. Each object follows, one per line, and must contain exactly the
attributes listed on the first line, for example, a sample file will be as follows:
DN,objectClass,sn,givenName,sAMAccountName,userPrincipalName
"CN=David Jones,OU=Employees,OU=User
Accounts,DC=contoso,DC=com",user,Jones,David,david.jones,david.jones@contoso.com
"CN=Lisa Andrews,OU=Employees,OU=User
Accounts,DC=contoso,DC=com",user,Andrews,Lisa,lisa.andrews,lisa.andrews@contoso.com

This file, when imported by the Comma-Separated Values Data Exchange tool command, will create a
user object for Lisa Andrews in the Employees organizational unit (OU). The file configures the user logon
names, last name and first name. You cannot use the Comma-Separated Values Data Exchange tool to
import passwords. Without a password, the user account will be disabled initially. After you have reset the
password, you can enable the object in AD DS.
In this demonstration, you will see how to:

Import user accounts with the Comma-Separated Values Data Exchange tool.

Demonstration Steps
1.

On LON-DC1, open E:\Labfiles\Mod04\NewUsers.csv with Notepad. Examine the information


about the users listed in the file.

2.

Open a command prompt, type the following command, and then press Enter:
csvde -i -f E:\Labfiles\Mod04\NewUsers.csv -k

3.

From Server Manager, open Active Directory Users and Computers, and confirm that the users
were created successfully.

4.

Examine the accounts to confirm that first name, last name, user principal name, and pre-Windows
2000 logon name are populated according to the instructions in NewUsers.csv.

5.

Reset the passwords of the two accounts to Pa$$w0rd.

6.

Enable the two accounts.

7.

Close all open windows on LON-DC1.

Demonstration: Importing User Accounts with LDIFDE

You can also use LDIFDE.exe to import or export Active Directory objects, including users. LDPA
Interchange Format (LDIF) is a standard file format that you can use to store information and perform
batch operations against directories that conform to the LDAP standards. LDIF supports both import and
export operations, and batch operations that modify objects in the directory. The LDIFDE command
implements these batch operations by using LDIF files.

The LDIF file format consists of a block of lines, which together constitute a single operation. Multiple
operations in a single file are separated by a blank line. Each line, comprising an operation, consists of an
attribute name followed by a colon and the value of the attribute. For example, suppose you wanted to
import user objects for two sales representatives named Bonnie Kearney and Bobby Moore. The contents
of the LDIF file would look similar to the following example:

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-5

dn: CN=Bonnie Kearney,OU=Employees,OU=User Accounts,DC=contoso,DC=com


changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Bonnie Kearney
sn: Kearney
title: Operations
description: Operations (London)
givenName: Bonnie
displayName: Kearney, Bonnie
company: Contoso, Ltd.
sAMAccountName: bonnie.kearney
userPrincipalName: bonnie.kearney@contoso.com
mail: bonnie.kearney@contoso.com
dn: CN=Bobby Moore,OU=Employees,OU=User Accounts,DC=contoso,DC=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Bobby Moore
sn: Moore
title: Legal
description: Legal (New York)
givenName: Bobby
displayName: Moore, Bobby
company: Contoso, Ltd.
sAMAccountName: bobby.moore
userPrincipalName: bobby.moore@contoso.com
mail: bobby.moore@contoso.com

Each operation begins with the domain-name (DN)attribute of the object that is the operations target.
The next line, changeType, specifies the type of operation: add, modify, or delete.

As you can see, the LDIF file format is not as intuitive or familiar as the comma-separated text format.
However, because the LDIF format also is a standard, many directory services and databases can export
LDIF files.
After creating or obtaining an LDIF file, you can perform the operations that the file specifies, by using
the LDIFDE command. From a command prompt, type ldifde /? for usage information. The two most
important switches for the LDIFDE command are:

i. Turns on import mode. Without this parameter, LDIFDE exports information.

f filename. The file from which to import, or to which to export.

In this demonstration, you will see how to:

Import user accounts with LDIFDE.

Demonstration Steps
1.

Open E:\Labfiles\Mod04\NewUsers.ldf with Notepad. Examine the information about the users
that is listed in the file.

2.

Open a command prompt, type the following command, and then press Enter:
ldifde -i -f E:\Labfiles\Mod04\NewUsers.ldf -k

3.

Open Active Directory Users and Computers, and then confirm that the users were created
successfully.

MCT USE ONLY. STUDENT USE PROHIBITED

4-6 Managing User and Service Accounts

4.

Examine the accounts to confirm that user properties are populated according to the instructions in
NewUsers.ldf.

5.

Reset the passwords of the two accounts to Pa$$w0rd.

6.

Enable the two accounts.

7.

Close all open windows on LON-DC1.


Question: What advantages does LDIFDE have over the Comma-Separated Values Data
Exchange tool when managing user accounts in an AD DS environment?

Demonstration: Importing User Accounts with Windows PowerShell

The Active Directory module for Windows PowerShell also can utilize the contents of a .csv file to import
objects into AD DS.
Two cmdlets are used to perform this task:

Import-CSV. This cmdlet creates objects from .csv files that can then be piped into other Windows
PowerShell cmdlets.

New-ADUser. This cmdlet is used to create the objects that have been imported from the ImportCSV cmdlet.

In this demonstration, you will see how to:

Import user accounts with Windows PowerShell.

Demonstration Steps
1.

On LON-DC1, from Server Manager, open Active Directory Users and Computers, and under
Adatum.com, create a new OU named Import Users.

2.

Open E:\Labfiles\Mod04\ImportUsers.ps1 with Notepad. Examine the contents of the file.

3.

Next to $impfile, change path and filename to csv to E:\Labfiles\Mod04\ImportUsers.csv, and


then save the file.

4.

Open the Active Directory Module for Windows PowerShell.

5.

Type the following commands, and then press Enter after each command. When prompted to change
the execution policy, press enter to accept the default option of Y:
Set-ExecutionPolicy remotesigned
E:\Labfiles\Mod04\importusers.ps1

6.

At the password prompt, type Pa$$w0rd.

7.

Open Active Directory Users and Computers, and verify that the user accounts have been imported
into the Import Users OU.

8.

Close all open windows on LON-DC1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-7

Lesson 2

Configuring Password-Policy and User-Account Lockout


Settings

As an administrator, you must ensure that the user accounts in your environment conform to the security
settings established by your organization. Window Server 2012 uses account policies to configure
security-related settings for user accounts. This module will help you to identify the settings available for
configuring account security and the methods available to configure those settings.

Lesson Objectives
After this lesson, you will be able to:

Explain user-account policies.

Explain how to configure user-account policies.

Describe password settings objects.

Explain how to configure Password Settings Objects.

Understanding User-Account Policies


Account policies in AD DS define the default
settings for security-related attributes assigned
to user objects. In AD DS, account policies are
separated into two different groups of settings:
password policy and account lockout. You can
configure both groups of settings in the local
policy settings for an individual Windows Server
2012 server, or for the entire domain by using the
Group Policy Management Console (GPMC) in
AD DS. When settings between local policy and
group policy conflict, group policy settings
override local policy settings.

In Group Policy Management within AD DS, most policy settings can be applied at different levels
within the AD DS structure: domain, site, or OU. However, account policies can be applied only at one
level in AD DSto the entire domain. Therefore, only one set of account policy settings can be applied to
an AD DS domain.

Password Policy
You define the password policy by using the following settings:

Enforce password history. This is the number of unique, new passwords that must be associated with
a user account before an old password can be reused. The default setting is 24 previous passwords.
When you use this setting with the minimum password-age setting, the enforce password history
setting prevents constant reuse of the same password.

Maximum password age. This is the number of days that a password can be used before the user
must change it. Regularly changing passwords helps to prevent the compromise of passwords.
However, you must balance this security consideration against the logistical considerations that result
from requiring users to change passwords too often. The default setting of 42 days is probably
appropriate for most organizations.

MCT USE ONLY. STUDENT USE PROHIBITED

4-8 Managing User and Service Accounts

Minimum password age. This is the number of days that a password must be used before the user can
change it. The default value is one day, which is appropriate if you also enforce password history. You
can restrict the constant use of the same password if you use this setting in conjunction with a short
setting to enforce password history.

Minimum password length. This is the minimum number of characters that a users password must
contain. The default value is seven. This default is a widely used minimum, but you should consider
increasing the password length to at least 10 to enhance security.

Complexity requirements. Windows Server includes a default password filter that is enabled by
default, and you should not disable it. The filter requires that a password have the following
characteristics:
o

Does not contain your name or your user name

Contains at least six characters

Contains characters from three of the following four groups:

Uppercase letters [AZ]

Lowercase letters [az]

Numerals [09]

Special, nonalphanumeric characters, such as !@#)(*&^%

Account Lockout Policy

You can define thresholds for account lockout, duration of the lockout, and a way to unlock accounts.
Thresholds for account lockout stipulate that accounts become inoperable after a certain number of failed
logon attempts during a certain amount of time. Account-lockout policies help detect and prevent brute
force attacks on account passwords. The following settings are available:

Account lockout duration. Defines the number of minutes that a locked account remains locked.
After the specified number of minutes, the account is unlocked automatically. To specify that an
administrator must unlock the account, set the value to 0. Consider using fine-grained password
policies to require administrators to unlock high security accounts, and then configuring this setting
to 30 minutes for normal users.

Account lockout threshold. Determines the number of failed logon attempts that are allowed before
a user account is locked out. A value of 0 means that the account is never locked out. You should set
this value high enough to allow for users who mistype their password, but low enough to help ensure
that brute force attempts to guess the password fail. Common values for this setting range from three
to five.

Reset account lockout counter after. Determines how many minutes must elapse after a failed logon
attempt before the bad logon counter is reset to 0. This setting applies when a user has typed in their
password incorrectly, but they have not exceeded the account lockout threshold. Consider setting this
value to 30 minutes.

Kerberos Policy
The Kerberos Policy configuration options contain settings for the Kerberos version 5 protocol Ticket
Granting Ticket (TGT), and the session-ticket lifetimes and time-stamp settings. For most organizations,
the default settings are appropriate.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-9

Configuring User Account Policies


There are several options available for configuring
user-account policies when administering an
AD DS environment.

Local Policy Settings with Secpol.msc


Each individual Windows Server 2012 computer
has its own set of account policies, which apply
to accounts created and managed on the local
computer. To configure these policy settings,
open the Local Security Policy console by running
secpol.msc from the command prompt. The
password-policy and account-policy settings can
be located within the Local Security Policy
Console by expanding Security Settings, and then expanding Account Policies.

Group Policy with Group Policy Management

In the AD DS domain environment, domain-wide account policy settings are configured within the Group
Policy Management Console. The settings can be found in the Computer Configuration, by expanding
the Policies node, expanding the under the Windows Settings node, expanding the Security Settings
node, and then expanding the Account Policies node.
The settings found within the Account Policies node are the same settings found in the Local Security
Policy, with the addition of the Kerberos Policy settings that apply to domain authentication.

The Group Policy Account Policy settings exist in the template of every Group Policy Object (GPO) created
in the GPMC). However, you can apply an account policy only once in a domain and in only one GPO. This
is the Default Domain Policy, and it links to the root of the AD DS domain. As such, the Account Policy
settings in the Default Domain Policy apply to every computer that is joined to the domain.
Note: If settings conflict between the account policy settings in the Local Security Policy
and the account policy settings in the Default Domain Policy GPO, the Default Domain Policy
settings take precedence.
Question: Why would you use secpol.msc to configure local account policy settings for a
Windows Server 2012 computer instead of using domain- based Group Policy account-policy
settings?

What Are Password Settings Objects?


Starting with Windows Server 2008, administrators
can define more than one password policy in a
single domain by implementing fine-grained
password policies. These enable you to have more
granular control over user password requirements,
and you can have different password
requirements for different users or groups.
To support the fine-grained password policy
feature, AD DS in Windows Server 2008 and newer
versions includes two object types:

MCT USE ONLY. STUDENT USE PROHIBITED

4-10 Managing User and Service Accounts

Password Setting Container. Windows Server


creates this container by default, and you can
view it in the domains System container. The container stores the Password Settings Objects that you
create and link to global security groups or to users.

Password Settings Objects. Members of the Domain Admins group create Password Settings Objects,
and then define the specific password and account-lockout settings to be linked to a specific security
group or user.

Fine-grained password policies apply only to user objects (or to inetOrgPerson objects, if you use those
instead of user objects) and to global security groups. By linking a Password Settings Objects to a user
or a group, youre modifying an attribute called msDS-PSOApplied, which is empty by default. This
approach now treats password and account-lockout settings not as domain-wide requirements, but as
attributes to a specific user or a group.
For example, to configure a strict password policy for administrative accounts, create a global security
group, add the administrative user accounts as members, and link a Password Settings Object to the
group. Applying fine-grained password policies to a group in this manner is more manageable than
applying the policies to each individual user account. If you create a new service account, you simply
add it to the group, and the account becomes managed by the Password Settings Object.

By default, only members of the Domain Admins group can set fine-grained password policies. However,
you also can delegate the ability to set these policies to other users.

Applying Fine-Grained Password Policies


You cannot apply a fine-grained password policy to an OU directly. To apply a fine-grained password
policy to users of an OU, you can use a shadow group. A shadow group is a global security group that
maps logically to an OU, and enforces a fine-grained password policy. You can add an OUs users as
members of the newly created shadow group, and then apply the fine-grained password policy to this
shadow group. If you move a user from one OU to another, you must update the membership of the
corresponding shadow groups.

The settings managed by fine-grained password policy are identical to those in the Password Policy and
Accounts Policy nodes of a GPO. However, fine-grained password policies are neither implemented as
part of Group Policy nor are they applied as part of a GPO. Instead, there is a separate class of object in
Active Directory that maintains the settings for fine-grained password policythe PSO.

You can create one or more PSOs in your domain. Each contains a complete set of password and lockout
policy settings. A Password Settings Object is applied by linking the Password Settings Object to one or
more global security groups or users.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-11

To use a fine-grained password policy, your domain functional level must be at least Windows Server
2008, which means that all of your domain controllers in the domain are running at least Windows
Server 2008, and the domain functional level has been raised to at least Windows Server 2008.
To confirm and modify the domain functional level:
1.

Open Active Directory Domains and Trusts.

2.

In the console tree, expand Active Directory Domains and Trusts, and then expand the tree until
you can see the domain.

3.

Right-click the domain, and then click Raise domain functional level.

Configuring Password Settings Objects


You can create and apply Password Settings
Objects in the Windows Server 2012 environment
by using either of the following tools:

Active Directory Administrative Center

Windows PowerShell

Configuring Password Settings Objects


By Using Windows PowerShell
In Windows Server 2012, new Windows
PowerShell cmdlets in the Active Directory
module for Windows PowerShell can be used to
create and manage Password Settings Objects in
your domain.

New-ADFineGrainedPasswordPolicy

This cmdlet is used to create a new Password Settings Object, and define the Password Settings
Object parameters. For example, the following command creates a new Password Settings Object
named TestPwd, and then specifies its settings:

New-ADFineGrainedPasswordPolicy TestPswd -ComplexityEnabled:$true LockoutDuration:"00:30:00" -LockoutObservationWindow:"00:30:00" -LockoutThreshold:"0"


-MaxPasswordAge:"42.00:00:00" -MinPasswordAge:"1.00:00:00" -MinPasswordLength:"7" PasswordHistoryCount:"24" -Precedence:"1" -ReversibleEncryptionEnabled:$false ProtectedFromAccidentalDeletion:$true

Add-FineGrainedPasswordPolicySubject

This cmdlet enable you to link a user or group to an existing Password Settings Object. For example,
the following command links the TestPwd Password Settings Object to the AD DS group named
group1:
Add-ADFineGrainedPasswordPolicySubject TestPswd -Subjects Marketing

Configuring Password Settings Objects By Using Active Directory Administrative


Center

MCT USE ONLY. STUDENT USE PROHIBITED

4-12 Managing User and Service Accounts

The Active Directory Administrative Center provides a GUI for creating and managing Password Settings
Objects. To manage Password Settings Objects in Active Directory Administrative Center, follow these
steps:
1.

Open Active Directory Administrative Center.

2.

Click Manage, click Add Navigation Nodes, select the appropriate target domain in the Add
Navigation Node dialog box, and then click OK.

3.

In the Active Directory Administrative Center navigation pane, open the System container, and then
click Password Settings Container.

4.

In the Tasks pane, click New, and then click Password Settings.

5.

Fill in or edit fields inside the property page to create a new Password Settings object.

6.

Under Directly Applies To, click Add, type Marketing, and then click OK.

7.

This associates the Password Policy object with the members of the global group that you created
for the test environment.

8.

Click OK to submit the creation of the Password Settings Object.

Note: The Active Directory Administrative Center interface for Password Settings Object
management uses the Windows PowerShell cmdlets mentioned previously to carry out the
creation and management of Password Settings Objects.

Considerations for Configuring Password Settings Objects

It is possible for you to link more than one Password Settings Object to a user or a security group.
You might do this if a user is a member of multiple security groups, which might each have an assigned
Password Settings Object already, or if you assign multiple Password Settings Objects directly to a user
object. In either case, it is important to understand that you can apply only one Password Settings Object
as the effective password policy.
If you assign multiple Password Settings Objects to a user or a group, the
msDS-PasswordSettingsPrecedence attribute helps to determine the resultant Password Settings
Object. A Password Settings Object with a lower value takes precedence over a Password Settings Object
with a higher value.

The following process describes how AD DS determines the resultant Password Settings Object if you link
multiple Password Settings Objects to a user or a group:
1.

Any Password Settings Object that you link directly to a user object is the resultant Password Settings
Object. If you link multiple Password Settings Objects directly to the user object, the Password
Settings Object with the lowest msDS-PasswordSettingsPrecedence value is the resultant Password
Settings Object. If two Password Settings Objects have the same precedence, the Password Settings
Object with the mathematically smallest objectGUID is the resultant PSO.

2.

If you do not link any Password Settings Objects directly to the user object, AD DS compares the
Password Settings Objects for all global security groups that contain the user object. The Password
Settings Object with the lowest msDS-PasswordSettings

Precedence value is the resultant Password Settings Object. If you apply multiple Password Settings
Objects to the same user, and they have the same msDS-PasswordSettingsPrecedence value,
AD DS applies the Password Settings Object with the mathematically smallest globally unique
identifier (GUID).

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-13

3.

If you do not link any Password Settings Objects to the user object, either directly or indirectly
(through group membership), AD DS applies the Default Domain Policy.

All user objects contain a new attribute called msDS-ResultantPSO. You can use this attribute to help
determine the distinguished name of the Password Settings Object that AD DS applies to the user object.
If you do not link a Password Settings Object to the user object, this attribute does not contain any value
and the Default Domain Policy GPO contains the effective password policy.
To view the effect of a policy that AD DS is applying to a user, open Active Directory Users and
Computers, and then, on the View menu, ensure that Advanced Features is enabled. Then open the
properties of a user account. You can view the msDS-ResultantPSO attribute on the Attribute Editor
tab, if the Show Constructed Attributes option has been configured under the Filter options.

Lesson 3

Configuring Managed Service Accounts

MCT USE ONLY. STUDENT USE PROHIBITED

4-14 Managing User and Service Accounts

Creating user accounts to provide authentication for applications, system services, and background
processes is a common practice in the Windows environment. Historically, accounts were created, and
often named, for use by a specific service. Windows Server 2012 supports AD DS account-like objects
called managed service accounts that make service accounts easier to manage and less of a security risk
to your environment.
This lesson will introduce you to managed service accounts, and new functionality related to managed
service accounts in Windows Server 2012.

Lesson Objectives
After completing this lesson, you will be able to:

Identify the challenges of using standard user accounts for services.

Describe managed service accounts.

Explain how to configure managed service accounts.

Describe group-managed service accounts.

What Are The Challenges Of Using Standard User Accounts For Services?
Many applications such as Microsoft SQL Server
or Internet Information Services (IIS) contain
services that are installed on the server that hosts
the application. These services typically run at
server startup or are triggered by other events.
Services often run in the background and do not
require any user interaction.
For a service to start up and authenticate, a
service account is used. A service account may be
an account that is local to the computer, such as
the built-in Local Service, Network Service, or
Local System accounts. You also can configure a
service account to use a domain-based account located in AD DS.

To help centralize administration and to meet application requirements, many organizations choose to
use a domain-based account to run application services. This does provide some benefit over using a local
account. However, there are a number of associated challenges, such as the following:

Extra administration effort may be necessary to manage the service account password securely. This
includes tasks such as changing the password and resolving situations that cause an account lockout.
Service accounts also typically are configured to have passwords that do not expire, which may go
against your organizations security policies.

It can be difficult to determine where a domain-based account is being used as a service account.
A standard user account may be used for multiple services on various servers throughout the
environment. A simple task, such as changing the password, may cause authentication issues for some
applications. It is important to know where and how a standard user account is being used when it is
associated with an application service.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-15

Extra administration effort may be necessary to manage the service principal name (SPN). Using a
standard user account may require manual administration of the SPN. If the logon account of the
service changes, the computer name is changed. Or, if a Domain Name System (DNS) host name
property is modified, the SPN registrations may need to be manually modified to reflect the change.
A misconfigured SPN causes authentication problems with the application service.

Windows Server 2012 supports an AD DS object used to ease service-account management, called a
managed service account. The following topics provide information on the requirements and use of
managed service accounts in Windows Server 2012.

What Is A Managed Service Account?


A Managed Service Account is an AD DS object
class that enables simplified password and SPN
management for service accounts.
Many network-based applications use an account
to run services or provide authentication. For
example, an application on a local computer
might use the Local Service, Network Service, or
Local System accounts. These service accounts
may work fine. However, these typically are shared
among multiple applications and services, making
it difficult to manage for a specific application.
Furthermore, you cannot manage these local
service accounts at the domain level.
Alternatively, it is quite common that an application might use a standard domain account that is
configured specifically for the application. However, the main drawback is that you need to manage
passwords manually, which increases administration effort.

A managed service account can provide an application with its own unique account, while eliminating the
need for an administrator to administer the accounts credentials manually.

How a Managed Service Account Works

Managed Service Accounts are stored in AD DS as msDS-ManagedServiceAccount objects. This class


inherits structural aspects from the Computer class (which inherits from the User class). This enables an
Managed Service Account to fulfill User-like functions such as providing authentication and security
context for a running service. It also enables an Managed Service Account to use the same password
update mechanism used by Computer objects in AD DS, a process that requires no user intervention.
Managed service accounts provide the following benefits to simplify administration:

Automatic password management. A managed service account automatically maintains its own
password, including password changes.

Simplified SPN management. SPN management can be managed automatically if your domain is
configured at the Windows Server 2008 R2 domain functional level or higher.

Managed Service Accounts are stored in the CN=Managed Service Accounts, DC=<domain>,
DC=<com> container. You can see this by enabling the Advanced Features option in the View menu
within Active Directory Users and Computers. This container is visible by default in the Active Directory
Administrative Center.

Requirements for Using Managed Service Accounts

MCT USE ONLY. STUDENT USE PROHIBITED

4-16 Managing User and Service Accounts

To use a managed service account, the server that runs the service or application must be running
Windows Server 2008 R2 or Windows Server 2012. You also must ensure that .NET Framework 3.5.x and
the Active Directory module for Windows PowerShell are both installed on the server.
Note: A standard managed service account cannot be shared between multiple computers
or be used in server clusters where the service is replicated between nodes.

To simplify and provide full automatic password and SPN management, we strongly recommend that
the AD DS domain be at the Windows Server 2008 R2 functional level or higher. However, if you have a
domain controller running Windows Server 2008 or Windows Server 2003, you can update the Active
Directory schema to Windows Server 2008 R2 to support this feature. The only disadvantage is that the
domain administrator must configure SPN data manually for the managed service accounts.

To update the schema in Windows Server 2008, Windows Server 2003, or mixed-mode environments, you
must perform the following tasks:
1.

Run adprep/forestprep at the forest level and run adprep/domainprep at the domain level.

2.

Deploy a domain controller running Windows Server 2008 R2, Windows Server 2008 with the Active
Directory Management Gateway Service, or Windows Server 2003 with the Active Directory
Management Gateway Service.

Note: The Active Directory Management Gateway Service allows administrators with
domain controllers running Windows Server 2003 or Windows Server 2008 to use Windows
PowerShell cmdlets to manage managed service accounts.

Considerations for Managed Service Accounts on Windows Server 2012 Domain


Controllers
On Windows 2012, Managed Service Accounts are created as the new group Managed Service Account
object type by default. However, to accommodate this, you must fulfill the one of the requirements for
group Managed Service Accounts before you can create any Managed Service Account on a Windows
2012 domain controller.

On a Windows 2012 domain controller, a key distribution services root key must be created for the
domain before any Managed Service Accounts can be created. To create the root key, run the following
cmdlet from the Active Directory PowerShell module for Windows PowerShell:
Add-KDSRootKey EffectiveTime ((Get-Date).AddHours(-10))

More information on group Managed Service Accounts, including further explanation of the cmdlet
above, and creating a Key Distribution Services (KDS) root key can be found later in this lesson.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-17

Demonstration: Configuring Managed Service Accounts by Using


Windows PowerShell

Creating and configuring a Managed Service Account requires the use of four cmdlets from the Active
Directory Module for Windows PowerShell:

Add-KDSRootkey creates the KDS root key to support group Managed Service Accounts, a
requirement on Windows Server 2012 DCs:
Add-KDSRootKey EffectiveTime ((Get-Date).AddHours(-10))

New-ADServiceAccount creates the Managed Service Account within AD DS:


New-ADServiceAccount Name <MSA Name> -DNSHostname <DC DNS Name>

Add-ADComputerServiceAccount associates the Managed Service Account with a computer account


in the AD DS domain:
Add-ADComputerServiceAccount identity <Host Computer Name> -ServiceAccount <MSA
Name>

Install-ADServiceAccount installs the Managed Service Account on a host computer in the domain,
and makes the Managed Service Account available for use by services on the host computer:
Install-ADServiceAccount Identity <MSA Name>

In this demonstration, you will see how to:

Create the KDS root key for the domain.

Create and associate a managed service account.

Demonstration Steps
Create the Key Distribution Services (KDS) root key for the domain
1.

On LON-DC1, from Server Manager, open the Active Directory Module for Windows PowerShell
console.

2.

Use the Add-KDSRootKey cmdlet to create the domain KDS root key.

Create and associate a managed service account


1.

On LON-DC1, open the Active Directory Module for Windows PowerShell console.

2.

Use the New-ADServiceAccount cmdlet to create a Managed Service Account.

3.

Use the Add-ADComputerServiceAccount cmdlet to associate the Managed Service Account with
LON-SVR1.

4.

Use the Get-ADServiceAccount cmdlet to view the newly created Managed Service Account and
confirm proper configuration.

Install a managed service account


1.

On LON-SVR1, open the Active Directory Module for Windows PowerShell console.

2.

Use the Install-ADServiceAccount cmdlet to install the Managed Service Account on LON-SVR1.

3.

Open Server Manager, and start the Services console.

4.

Open the Properties pages for the Application Identity service, and then select the Log On tab.

5.

Configure the Application Identity service to use Adatum\SampleApp_SVR1$.

What Are Group Managed Service Accounts?


Group Managed Service Accounts enable you
to extend the capabilities of Standard Managed
Service Accounts to more than one server in your
domain. In server farm scenarios such as network
load balancing (NLB) clusters or IIS servers, there
often is a need to run system or application
services under the same service account. Standard
Managed Service Accounts cannot provide
managed service account functionality to services
that are running on more than one server. By
using Group Managed Service Accounts, you
can configure multiple servers to use the same
Managed Service Account, and still retain the benefits that Managed Service Accounts provide, like
automatic password maintenance and simplified SPN management.

Group Managed Service Account Requirements


In order to support group Managed Service Account functionality, your environment must meet the
following requirements:

At least one domain controller must be running Windows Server 2012 to store managed password
information.

A KDS root key must be created on a domain controller in the domain.


To create the KDS root key, run the following command from the Active Directory Module for
Windows PowerShell on a Windows Server 2012 domain controller:
Add-KdsRootKey EffectiveImmediately

Note: The EffectiveImmediately switch uses the current time to establish the timestamp
that marks the key as valid. However, when using EffectiveImmediately, the actual effective
time is set to 10 hours later than the current time. This 10-hour difference is to allow for AD DS
replication to replicate the changes to other domain controllers in the domain. For testing
purposes, it is possible to bypass this functionality by setting the EffectiveTime parameter to
10 hours before the current time:
Add-KdsRootKey EffectiveTime ((get-date).addhours(-10))

Understanding Group Managed Service Account Functionality

MCT USE ONLY. STUDENT USE PROHIBITED

4-18 Managing User and Service Accounts

Group Managed Service Accounts enable Managed Service Account functionality across multiple servers
by delegating the management of Managed Service Account password information to Windows Server
2012 domain controllers. By doing this, the management of passwords is no longer dependent on the
relationship between a single server and AD DS, but rather controlled entirely by AD DS.

The group Managed Service Account object contains a list of principals (computers or AD DS groups) that
are allowed to retrieve group Managed Service Account password information from AD DS, and then use
the group Managed Service Account for authentication for services.

Group Managed Service Accounts are created by using the same cmdlets from the Active Directory
Module for Windows PowerShell. In fact, the cmdlets used for Managed Service Account management will
create group Managed Service Accounts, by default.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-19

On a Windows Server 2012 domain controller, create a new Managed Service Account by using the
New-ADServiceAccount cmdlet with the PrinicipalsAllowedToRetrieveManagedPassword
parameter. This parameter accepts one or more comma-separated computer accounts or AD DS groups
that are permitted to obtain password information for the group Managed Service Account that is stored
in AD DS on Windows Server 2012 domain controllers.

For example, the following cmdlet will create a new group Managed Service Account called SQLFarm, and
enable the LON-SQL1, LON-SQL2, and LON-SQL3 hosts to use the group Managed Service Account:
New_ADServiceAccount Name LondonSQLFarm PrincipalsAllowedToRetrieveManagedPassword LONSQL1, LON-SQL2, LON-SQL3

Once a computer has been added to using the PrincipalsAllowedToRetrieveManagedPassword, the


group Managed Service Account service account is available to be assigned to services by using same
assignment process as standard Managed Service Accounts.

Using AD DS Groups to Manage Group Managed Service Account Server Farms

AD DS security groups can be used to identify group Managed Service Accounts. When you use an AD DS
group for the PrincipalsAllowedToRetriveManagedPassword parameter, any computers that are
members of that group will be allowed to retrieve the password and utilize group Managed Service
Account functionality. When using an AD DS group as the principal allowed to retrieve a managed
password, any accounts that are members of the group will also have the same capability.

Lab: Managing User and Service Accounts


Scenario
A. Datum is a global engineering and manufacturing company with its head office in London, UK. An IT
office and data center is located in London to support the London office and other locations. A. Datum
has recently deployed a Windows Server 2012 server and client infrastructure, and needs to implement
changes to how user accounts are managed in the environment.

Objectives
After completing this lab, you will be able to:

Configure password-policy and account-lockout settings.

Create and associate a Managed Service Account.

Lab Setup
Estimated Time: Estimated time: 45 minutes

Virtual Machine

20411B-LON-DC1

User Name

Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:

MCT USE ONLY. STUDENT USE PROHIBITED

4-20 Managing User and Service Accounts

1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Log on using the following credentials:


a.

User name: Adatum\Administrator

b.

Password: Pa$$w0rd

Exercise 1: Configuring Password-Policy and Account-Lockout Settings


Scenario

A. Datum has recently completed a security review for passwords and account-lockout policies. You
need to implement the recommendations contained in the report to control password complexity and
length. You also need to configure appropriate account-lockout settings. Part of your password policy
configuration will include a specific password policy to be assigned to the Managers security group. This
group requires a different password policy than what has been applied at the domain level.
The report has recommended that the following password settings should be applied to all accounts in
the domain:

Password history: 20 passwords

Maximum password age: 45 days

Minimum password age: 1 day

Password length: 10 characters

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-21

Complexity enabled: Yes

Account Lockout duration: 30 minutes

Account lockout threshold: 5 attempts

Reset account lockout counter after: 15 minutes

The report has also recommended that a separate policy be applied to users in the Managers group, due
to the elevated privileges assigned to those user accounts. The policy applied to the Managers groups
should contain the following settings:

Password history: 20 passwords

Maximum password age: 20 days

Minimum password age: 1 day

Password length: 15 characters

Complexity enabled: Yes

Account Lockout duration: 0 minutes (An administrator will have to unlock the account)

Account lockout threshold: 3 attempts

Reset account lockout counter after: 30 minutes

The main tasks for this exercise are as follows:


1.

Configure a domain-based password policy.

2.

Configure an account-lockout policy.

3.

Configure and apply a fine-grained password policy.

Task 1: Configure a domain-based password policy


1.

On LON-DC1, open the Group Policy Management console.

2.

Edit the Default Domain Policy, and configure the following Account Password Policy settings:
o

Password history: 20 passwords

Maximum password age: 45 days

Minimum password age: 1 day

Password length: 10 characters

Complexity enabled: Yes

Task 2: Configure an account-lockout policy


1.

In the Group Policy Management Editor, configure the following Account Lockout Policy settings for
the Default Domain Policy:
o

Account Lockout duration: 30 minutes

Account lockout threshold: 5 attempts

Reset account lockout counter after: 15 minutes

2.

Close Group Policy Management Editor.

3.

Close Group Policy Management.

Task 3: Configure and apply a fine-grained password policy


1.

On LON-DC1, open the Active Directory Administrative Center console.

2.

Change the group scope for the Managers group to Global.

Note: Ensure you open the Properties page for the Managers group, and not the
Managers OU.
3.

4.

In Active Directory Administrative Center, configure a fine-grained password policy for the
Adatum\Managers group with the following settings:
o

Name: ManagersPSO

Precedence: 10

Password length: 15 characters

Password history: 20 passwords

Complexity enabled: Yes

Minimum password age: 1 day

Maximum password age: 30 days

Number of failed logon attempts allowed: 3 attempts

Reset failed logon attempts count after: 30 minutes

Until an administrator manually unlocks the account: selected

Close Active Directory Administrative Center.

Results: After completing this exercise, you will have configured password-policy and account-lockout
settings.

Exercise 2: Creating and Associating a Managed Service Account


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

4-22 Managing User and Service Accounts

You need to configure a managed service account to support a new Web-based application that is being
deployed to the DefaultAppPool Web service on LON-DC1. Using a managed service account will help
maintain the password security requirements for the account.
The main tasks for this exercise are as follows:
1.

Create and associate a Managed Service Account.

2.

Install a managed service account on a LON-DC1.

3.

To prepare for the next module.

Task 1: Create and associate a Managed Service Account


1.

On LON-DC1, open the Active Directory Module for Windows PowerShell console.

2.

Create the KDS root key by using the Add-KdsRootKey cmdlet. Make the effective time minus 10
hours, so the key will be effective immediately.

3.

Create the new service account named Webservice for the host LON-DC1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 4-23

4.

Associate the Webservice managed account with LON-DC1.

5.

Verify the group managed service account was created by using the Get-ADServiceAccount cmdlet.

Task 2: Install a managed service account on a LON-DC1


1.

On LON-DC1, install the Webservice service account.

2.

From the Tools menu in Server Manager, open Internet Information Services (IIS) Manager.

3.

Configure the DefaultAppPool to use the Webservice$ account as the identity.

4.

Stop and start the application pool.

To prepare for the next module

When you are finished the lab, revert the virtual machines to their initial state.

Results: After completing this exercise, you will have created and associated a Managed Service Account.

Module Review and Takeaways


Common Issues and Troubleshooting Tips
Common Issue

Troubleshooting Tip

User accounts contained in a .csv file fail to


import when using the Comma-Separated
Values Data Exchange tool.

User password settings are not applying as


expected.

The New-ADServiceAccount cmdlet fails


with key-related messages.

Tools
Tool

What it is used for

Where to find it

MCT USE ONLY. STUDENT USE PROHIBITED

4-24 Managing User and Service Accounts

Comma-Separated Values Data


Exchange tool

Importing and exporting users


by using .csv files

Command prompt: csvde.exe

LDIFDE

Importing, exporting, and


modifying users by using .ldf
files

Command prompt: ldifde.exe

Local Security Policy

Configuring local accountpolicy settings

Secpol.msc

Group Policy Management


console

Configuring domain Group


Policy account-policy settings

Server Manager Tools

Active Directory Administrative


Center

Creating and managing


Password Settings Objects

Server Manager Tools

Active Directory module for


Windows PowerShell

Creating and Managing


Managed Service Accounts

Server Manager - Tools

MCT USE ONLY. STUDENT USE PROHIBITED


5-1

Module 5
Implementing a Group Policy Infrastructure
Contents:
Module Overview

5-1

Lesson 1: Introducing Group Policy

5-2

Lesson 2: Implementing and Administering GPOs

5-10

Lesson 3: Group Policy Scope and Group Policy Processing

5-16

Lesson 4: Troubleshooting the Application of GPOs

5-31

Lab: Implementing a Group Policy Infrastructure

5-38

Module Review and Takeaways

5-44

Module Overview

Group Policy provides an infrastructure within which you can define settings centrally and deploy them
to users and computers in your enterprise. In an environment managed by a well-implemented Group
Policy infrastructure, very little configuration takes place by an administrator directly touching a users
computer. You can define, enforce, and update the entire configuration by using the settings in Group
Policy Objects (GPOs) or GPO filtering. By using GPO settings, you can affect an entire site or domain
within an enterprise, or narrow your focus to a single organizational unit (OU). This module will detail
what Group Policy is, how it works, and how best to implement it in your organization.

Objectives
After completing this module, you will be able to:

Describe the components and technologies that comprise the Group Policy framework.

Configure and understand a variety of policy setting types.

Scope GPOs by using links, security groups, Windows Management Instrumentation (WMI) filters,
loopback processing, and preference targeting.

Describe how GPOs are processed.

Locate the event logs that contain Group Policy-related events and troubleshoot the Group Policy
application.

Lesson 1

Introducing Group Policy

MCT USE ONLY. STUDENT USE PROHIBITED

5-2 Implementing a Group Policy Infrastructure

A Group Policy infrastructure has several interacting components, and you need to understand what
each component does, as well as how they work together and how you can assemble them into different
configurations. This lesson provides a comprehensive overview of Group Policy components, procedures,
and functions.

Lesson Objectives
After completing this lesson, you will be able to:

Identify the business requirements for configuration management.

Describe the core components and terminology of Group Policy.

Explain the benefits of implementing GPOs.

Describe GPOs.

Explain the function and behavior of the client-side GPO components.

Explain GPO refresh.

Create and configure GPOs.

What Is Configuration Management?


If you have only one computer in your
environmentat home, for exampleand you
need to modify the desktop background, you
can achieve that in several different ways. Most
people would probably open Appearance and
Personalization from Control Panel, and make
the change by using the Windows interface.
While that works well for one computer, it may
be tedious if you want to make the change across
multiple computers. Implementing any change
and maintaining a consistent environment is more
difficult with multiple computers.
Configuration management is a centralized approach to applying one or more changes to one or more
users or computers. The key elements of configuration management are:

Setting. A setting is also known as a centralized definition of a change. The setting brings a user or a
computer to a desired state of configuration.

Scope. The scope of the change is the ability to change users computers.

Application. The application is a mechanism or process that ensures that the setting is applied to
users and computers within the scope.

Group Policy is a framework within Windowswith components that reside in Active Directory Domain
Services (AD DS), on domain controllers, and on each Windows server and clientthat enables you to
manage configuration in an AD DS domain.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-3

Overview of Group Policies


The most granular component of Group Policy is
an individual policy setting, also known as a policy
that defines a specific configuration change to
apply, such as a policy setting that prevents a user
from accessing registry-editing tools. If you define
that policy setting, and then apply it to the user,
the user will be unable to run tools such as
Regedit.exe.
It is important to know that some settings affect a
user, known as user-configuration settings (or user
policies), and some affect the computer, known as
computer-configuration settings (or computer
policies).

Group Policy manages various policy settings, and the Group Policy framework is extensible. In the end,
you can manage just about any configurable setting with Group Policy.
Within the Group Policy Management Editor, you can define a policy setting by double-clicking it. The
policy setting Properties dialog box appears. A policy setting can have three states: Not Configured,
Enabled, and Disabled.

In a new GPO, every policy setting defaults to Not Configured. This means that the GPO cannot modify
the existing configuration of that particular setting for a user or computer. If you enable or disable a
policy setting, a change is made to the configuration of users and computers to which the GPO is applied.
When you return a setting to its Not Configured value, you return it to its default value.
The effect of the change depends on the policy setting. For example, if you enable the Prevent Access
To Registry Editing Tools policy setting, users are unable to launch the Regedit.exe Registry Editor. If
you disable the policy setting, you ensure that users can launch the Registry Editor. Notice the double
negative in this policy setting: You disable a policy that prevents an action, so you allow the action.
Some policy settings bundle several configurations into one policy, and these might require additional
parameters.
Note: Many policy settings are complex, and the effect of enabling or disabling them
might not be obvious. Furthermore, some policy settings affect only certain versions of the
Windows operating system. Be sure to review a policy settings explanatory text in the Group
Policy Management Editor detail pane or on the Explain tab in the policy settings Properties
dialog box. Additionally, always test the effects of a policy setting and its interactions with other
policy settings before deploying a change in your production environment.

Benefits of Using Group Policy


Group Policies are very powerful administrative
tools. You can use them to push various settings
to a large number of users and computers.
Because you can apply them to various levels from
local to domain, you also can focus these settings
very precisely.
Primarily, you can use Group Policies to
configure settings that you do not want users
to configure. Additionally, you can use Group
Policies to standardize desktop environments on
all computers in an OU or in an entire enterprise,
to provide additional security and some advanced
system settings, and for other purposes that the following sections detail.

Apply Security Settings

MCT USE ONLY. STUDENT USE PROHIBITED

5-4 Implementing a Group Policy Infrastructure

In the Windows Server 2012 operating system, GPOs include a large number of security-related settings
that you can apply to both users and computers. For example, you can enforce settings for Windows
Firewall, and configure auditing and other security settings. You also can configure full sets of user-rights
assignments.

Manage Desktop and Application Settings


You can use a Group Policy to provide a consistent desktop and application environment to all users in
your organization. By using GPOs, you can configure each setting that affects the look and feel of user
environment and also configure settings for some applications that support GPOs.

Deploy Software

Group Policies enable you to deploy software to users and computers. You can use Group Policy to
deploy all software that is in the .msi format. Additionally, you can enforce automatic software installation
or you can let your users decide whether they want the software to deploy to their machines.
Note: Deploying large packages with GPOs may not be the most efficient way of
distributing an application to your organizations computers. In many circumstances, it may be
more effective to distribute the applications as part of the desktop computer image.

Manage Folder Redirection

With folder redirection, you can manage and back up data quickly and easily. By redirecting folders,
you also ensure that users have access to their data regardless of the computer on which they sign in.
Additionally, you can centralize all users data to one place on the network server, while still providing a
user experience that is similar to storing these folders on their computers. For example, you can configure
folder redirection to redirect the users Documents folders to a shared folder on a network server.

Configure Network Settings

Using Group Policy enables you to configure various network settings on client computers. For example,
you can enforce settings for wireless networks to allow users to connect only to specific service set
identifiers (SSIDs), and with predefined authentication and encryption settings. You also can deploy
policies that apply to wired network settings as well as configure the client side of services, such as
Network Access Protection (NAP).

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-5

Group Policy Objects


Policy settings are defined and exist within a
GPO. A GPO is an object that contains one or
more policy settings that apply to one or more
configuration settings for a user or a computer.
Note: GPOs can be managed in AD DS by
using the Group Policy Management Console
(GPMC).
GPOs are displayed in a container named Group
Policy Objects.

To create a new GPO in a domain, right-click the Group Policy Objects container, and then click New.
To modify the configuration settings in a GPO, right-click the GPO, and then click Edit. This opens the
Group Policy Management Editor snap-in.

The Group Policy Management Editor displays the thousands of policy settings available in a GPO in
an organized hierarchy that begins with the division between computer settings and user settings: the
Computer Configuration node and the User Configuration node.

The next two levels of the hierarchy are nodes called Policies and Preferences. You will learn about the
difference between these two nodes later in this module. Progressing further down the hierarchy, you can
see that the Group Policy Management Editor displays folders, which also are called nodes or policy
setting groups. Within the folders are the policy settings themselves.
Note: The GPO must be applied to a domain, site, or OU in the AD DS hierarchy for the
settings within the object to take effect.

GPO Scope
Configuration is defined by policy settings in
GPOs. However, the configuration changes in
a GPO do not affect computers or users in your
organization until you specify the computers
or users to which the GPO applies. This is called
scoping a GPO. The scope of a GPO is the
collection of users and computers that will apply
the settings in the GPO.

You can use several methods to manage the


scope of GPOs. The first is the GPO link. You can
link GPOs to sites, domains, and OUs in AD DS.
The site, domain, or OU then becomes the
maximum scope of the GPO. All computers and users within the site, domain, or OU, including those in
child OUs, will be affected by the configurations that the policy settings in the GPO specify.

Note: You can link a GPO to more than one domain, OU, or site. Linking GPOs to multiple
sites can introduce performance issues when the policy is being applied, and you should avoid
linking a GPO to multiple sites. This is because in a multisite network, the GPOs are stored in the
domain controllers of the forest root domain. The consequence of this is that computers in other
domains may need to traverse a slow wide area network (WAN) link to obtain the GPOs.

MCT USE ONLY. STUDENT USE PROHIBITED

5-6 Implementing a Group Policy Infrastructure

You can further narrow the scope of the GPO with one of two types of filters. Security filters specify
security groups that fall within the GPOs scope, but to which the GPO explicitly should or should not
apply. WMI filters specify a scope by using characteristics of a system, such as operating-system version or
free disk space. Use security filters and WMI filters to narrow or specify the scope within the initial scope
that the GPO link created.
Note: Windows Server 2008 introduced a new component of Group Policy: Group Policy
Preferences. Settings that are configured by Group Policy Preferences within a GPO can be
filtered or targeted based on several criteria. Targeted preferences allow you to further refine the
scope of preferences within a single GPO.

Group Policy Client and Client-Side Extensions


Group Policy Application
It is important to understand how Group Policies
apply on client computers. The outline below
details the process:
1.

When Group Policy refresh begins, a


service that is running on all Windows-based
computers, known as the Group Policy Client
in Windows Vista, Windows 7, Windows 8,
Windows Server 2008, Windows Server 2008
R2, and Windows Server 2012, determines
which GPOs apply to the computer or user.

2.

This service downloads any GPOs that are not cached already.

3.

Client-side extensions (CSEs) interpret the settings in a GPO and make appropriate changes to the
local computer or to the currently logged-on user. There are CSEs for each major category of policy
setting. For example, there is a security CSE that applies security changes, a CSE that executes startup
and logon scripts, a CSE that installs software, and a CSE that makes changes to registry keys and
values. Each Windows version has added CSEs to extend the functional reach of Group Policy, and
there are several dozen CSEs in Windows.

One of the more important concepts to remember about Group Policy is that it is very client-driven. The
Group Policy client pulls the GPOs from the domain, triggering the CSEs to apply settings locally. Group
Policy is not a push technology.

In fact, you can configure the behavior of CSEs by using Group Policy. Most CSEs will apply settings in
a GPO only if that GPO has changed. This behavior improves overall policy processing by eliminating
redundant applications of the same settings. Most policies are applied in such a way that standard users
cannot change the setting on their computerthey will always be subject to the configuration enforced
by Group Policy. However, standard users can change some settings, and many can be changed if a user is
an administrator on that system. If users in your environment are administrators on their computers, you

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-7

should consider configuring CSEs to reapply policy settings even if the GPO has not changed. That way,
if an administrative user changes a configuration so that it is no longer compliant with policy, the
configuration will be reset to its compliant state at the next Group Policy refresh.
Note: You can configure CSEs to reapply policy settings at the next background refresh,
even if the GPO has not changed. You can do this by configuring a GPO scoped to computers,
and then defining the settings in the Computer Configuration\Policies\Administrative Templates
\System\ Group Policy node. For each CSE that you want to configure, open its policyprocessing policy setting, such as Registry Policy Processing for the Registry CSE. Click Enabled,
and select the Process even if the Group Policy objects have not changed check box.
The security CSE manages an important exception to the default policy-processing settings. Security
settings are reapplied every 16 hours, even if a GPO has not changed.
Note: Enable the Always Wait For Network At Startup And Logon policy setting for all
Windows clients. Without this setting, by default, Windows XP, Windows Vista, Windows 7, and
Windows 8 clients perform only background refreshes. This means that a client may start up, and
then a user might sign in without receiving the latest policies from the domain. The setting is
located in Computer Configuration\Policies\Administrative Templates\System\Logon. Be sure to
read the policy settings explanatory text.

Group Policy Refresh

Policy settings in the Computer Configuration node are applied at system startup, and then every 90 to
120 minutes thereafter. User Configuration policy settings are applied at logon, and then every 90 to 120
minutes thereafter. The application of policies is called Group Policy refresh.
Note: You also can force a policy refresh by using the GPUpdate command.

Demonstration: How to Create a GPO and Configure GPO Settings

Group Policy settings, also known as policies, are contained in a GPO, and you can view and modify them
by using the Group Policy Management Editor. This demonstration delves more closely into the categories
of settings available in a GPO.

Computer Configuration and User Configuration

There are two major divisions of policy settings: computer settings, which are contained in the Computer
Configuration node, and user settings, which are contained in the User Configuration node:

The Computer Configuration node contains the settings that are applied to computers, regardless
of who logs on to them. Computer settings are applied when the operating system starts, during
background refreshes, and every 90 to 120 minutes thereafter.

The User Configuration node contains settings that are applied when a user logs on to the
computer, during background refreshes, and every 90 to 120 minutes thereafter.

Within the Computer Configuration and User Configuration nodes are the Policies and Preferences
nodes. Policies are settings that are configured and behave similarly to the policy settings in older
Windows operating systems. Preferences were introduced in Windows Server 2008.

MCT USE ONLY. STUDENT USE PROHIBITED

5-8 Implementing a Group Policy Infrastructure

Within the Policies nodes of Computer Configuration and User Configuration are a hierarchy of folders
that contain policy settings. Because there are thousands of settings, it is beyond the scope of this course
to examine individual settings. However, it is worthwhile to define the broad categories of settings in the
folders.

Software Settings Node

The Software Settings node is the first node. It contains only the Software Installation extension, which
helps you specify how applications are installed and maintained within your organization.

Windows Settings Node

In both Computer Configuration and User Configuration nodes, the Policies node contains a
Windows Settings node, which includes the Scripts, Security Settings, and Policy-Based QoS nodes.
Note: It also contains the Name Resolution Policy folder that contains settings for
configuring Windows 8 DirectAccess, which is discussed in a later module.

Scripts Node

The Scripts extension enables you to specify two types of scripts, startup/shutdown (in the Computer
Configuration node), and logon/logoff (in the User Configuration node). Startup/shutdown scripts
run at computer startup or shutdown. Logon/logoff scripts run when a user logs on or off. When you
assign multiple logon/logoff or startup/shutdown scripts to a user or computer, the Scripts CSE executes
the scripts from top to bottom. You can determine the order of execution for multiple scripts in the
Properties dialog box. When a computer is shut down, the CSE first processes logoff scripts, followed
by shutdown scripts. By default, the timeout value for processing scripts is 10 minutes. If the logoff and
shutdown scripts require more than 10 minutes to process, you must adjust the timeout value with a
policy setting. You can use any ActiveX scripting language to write scripts. Some possibilities include
Microsoft Visual Basic Scripting Edition (VBScript), Microsoft JScript, Perl, and Microsoft MS-DOS
style batch files (.bat and .cmd). Logon scripts on a shared network directory in another forest are
supported for network logon across forests. Windows 7 and Windows 8 both support Windows
PowerShell scripts, too.

Security Settings Node

The Security Settings node allows a security administrator to configure security by using GPOs. This can
be done after, or instead of, using a security template to set system security.

Policy-Based QoS Node

This quality of service (QoS) node, known as Policy-Based QoS node, defines policies that manage
network traffic. For example, you might want to ensure that users in the Finance department have priority
for running a critical network application during the end-of-year financial reporting period. The PolicyBased QoS node enables you to do that.
In the User Configuration node only, the Windows Settings folder contains the additional Remote
Installation Services, Folder Redirection, and Internet Explorer Maintenance nodes. Remote
Installation Services (RIS) policies control the behavior of a remote operating-system installation. Folder
Redirection enables you to redirect user data and settings folders such as AppData, Desktop, Documents,
Pictures, Music, and Favorites from their default user profile location to an alternate location on the
network, where they can be centrally managed. Internet Explorer Maintenance enables you to administer
and customize Windows Internet Explorer.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-9

Administrative Templates Node

In the Computer Configuration and User Configuration nodes, the Administrative Templates
node contains registry-based Group Policy settings. There are thousands of such settings available for
configuring the user and computer environment. As an administrator, you might spend a significant
amount of time manipulating these settings. To assist you with the settings, a description of each policy
setting is available in two locations:

On the Explain tab in the Properties dialog box for the setting. Additionally, the Settings tab in the
Properties dialog box for each setting also lists the required operating system or software for the
setting.

On the Extended tab of the Group Policy Management Editor. The Extended tab appears on the
lower right of the details pane, and provides a description of each selected setting in a column
between the console tree and the settings pane. The required operating system or software for each
setting is also listed.

Demonstration
This demonstration shows how to:
1.

Open the Group Policy Management Console.

2.

Create a new GPO named Desktop in the Group Policy container.

3.

In the computer configuration, prevent the last logon name from displaying, and then prevent
Windows Installer from running.

4.

In the user configuration, remove the Search link from the Start menu, and then hide the display
settings tab.

Demonstration Steps
Use the GPMC to create a new GPO
1.

Sign in to LON-DC1 as administrator.

2.

Open the Group Policy Management console.

3.

Create a new GPO called Desktop.

Configure Group Policy settings


1.

Open the new Desktop policy for editing.

2.

In the computer configuration, prevent the last logon name from displaying, and prevent Windows
Installer from running.

3.

In the user configuration, remove the Search link from the Start menu, and then hide the display
settings tab.

4.

Close all open windows.

Lesson 2

Implementing and Administering GPOs


In this lesson, you will examine GPOs in more detail, learning how to create, link, edit, manage, and
administer GPOs and their settings.

Lesson Objectives
After completing this lesson, you will be able to:

Describe domain-based GPOs.

Explain how to create, link, and edit GPOs.

Explain GPO storage.

Describe starter GPOs.

Perform common GPO management tasks.

Explain how to delegate administration of GPOs.

Describe how to use Windows PowerShell to manage GPOs.

Domain-Based GPOs
Domain-based GPOs are created in AD DS and
stored on domain controllers. You can use them
to manage configuration centrally for the
domains users and computers. The remainder of
this course refers to domain-based GPOs rather
than local GPOs, unless otherwise specified.
When you install AD DS, two default GPOs are
created: Default Domain Controllers Policy and
Default Domain Policy.

Default Domain Policy

MCT USE ONLY. STUDENT USE PROHIBITED

5-10 Implementing a Group Policy Infrastructure

This GPO is linked to the domain, and has no


security group or WMI filters. Therefore, it affects all users and computers in the domain, including
computers that are domain controllers. This GPO contains policy settings that specify password, account
lockout, and Kerberos version 5 protocol policies. You should not add unrelated policy settings to this
GPO. If you need to configure other settings to apply broadly in your domain, create additional GPOs that
link to the domain.

Default Domain Controllers Policy


This GPO is linked to the OU of the domain controllers. Because computer accounts for domain
controllers are kept exclusively in the Domain Controllers OU, and other computer accounts should be
kept in other OUs, this GPO affects only domain controllers. You should modify the Default Domain
Controllers GPO to implement your auditing policies and to assign user rights required on domain
controllers.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-11

Note: Windows computers also have local GPOs, which are used when computers are not
connected to domain environments. Windows Vista, Windows 7, Windows 8, Windows Server
2008, Windows Server 2008 R2, and Windows Server 2012 support the notion of multiple local
GPOs. The Local Computer GPO is the same as the GPO in the previous Windows versions. In
the Computer Configuration node, you can configure all computer-related settings. In the
User Configuration node, you can configure settings that you want to apply to all users on the
computer. The user settings in the Local Computer GPO can be modified by the user settings in
two new local GPOs: Administrators and Non-Administrators. These two GPOs apply user settings
to logged-on users according to whether they are members of the local Administrators group, in
which case they would use the Administrators GPO, or not members of the Administrators group,
and therefore use the Non-Administrators GPO. You can further refine the user settings with a
local GPO that applies to a specific user account. User-specific local GPOs are associated with
local, not domain, user accounts.
It is important to understand that domain-based GPO setting combined with those applied using
local GPOs, but as domain-based GPOs apply last, they take precedence over local GPO settings.

GPO Storage
Group Policy settings are presented as GPOs in
AD DS user interface tools, but a GPO is actually
two components: a Group Policy container and a
Group Policy template.

The Group Policy container is an AD DS object


stored in the Group Policy Objects container
within the domain-naming context of the
directory. Like all AD DS objects, each Group
Policy container includes a globally unique
identifier (GUID) attribute that uniquely identifies
the object within AD DS. The Group Policy
container defines basic attributes of the GPO, but
it does not contain any of the settings. The settings are contained in the Group Policy template,
a collection of files stored in the System Volume (SYSVOL) of each domain controller in the
%SystemRoot%\SYSVOL\Domain\Policies\GPOGUID path, where GPOGUID is the GUID of the Group
Policy container. When you make changes to the settings of a GPO, the changes are saved to the Group
Policy template of the server from which the GPO was opened.
By default, when Group Policy refresh occurs, the CSEs apply settings in a GPO only if the GPO has been
updated.

The Group Policy client can identify an updated GPO by its version number. Each GPO has a version
number that is incremented each time a change is made. The version number is stored as a Group Policy
container attribute and in a text file, Group Policy template.ini, in the Group Policy template folder. The
Group Policy client knows the version number of each GPO it has previously applied. If, during Group
Policy refresh, the Group Policy client discovers that the version number of the Group Policy container has
been changed, the CSEs will be informed that the GPO is updated.

GPO Replication

Group Policy container and Group Policy template are both replicated between all domain controllers in
AD DS. However, different replication mechanisms are used for these two items.

The Group Policy container in AD DS is replicated by the Directory Replication Agent (DRA). The DRA
uses a topology generated by the Knowledge Consistency Checker (KCC), which you can define or
refine manually. The result is that the Group Policy container is replicated within seconds to all domain
controllers in a site and is replicated between sites based on your intersite replication configuration.

MCT USE ONLY. STUDENT USE PROHIBITED

5-12 Implementing a Group Policy Infrastructure

The Group Policy template in the SYSVOL is replicated by using one of the following two technologies.
The File Replication Service (FRS) is used to replicate SYSVOL in domains running Windows Server 2008,
Windows Server 2008 R2, Windows Server 2003, and Windows 2000. If all domain controllers are running
Windows Server 2008 or newer, you can configure SYSVOL replication by using Distributed File System
(DFS) Replication, which is a much more efficient and robust mechanism.
Because the Group Policy container and Group Policy template are replicated separately, it is possible for
them to become out of sync for a short time.

Typically, when this happens, the Group Policy container will replicate to a domain controller first. Systems
that obtained their ordered list of GPOs from that domain controller will identify the new Group Policy
container, will attempt to download the Group Policy template, and will notice that the version numbers
are not the same. A policy processing error will be recorded in the event logs. If the reverse happens, and
the GPO replicates to a domain controller before the Group Policy container, clients obtaining their
ordered list of GPOs from that domain controller will not be notified of the new GPO until the Group
Policy container has replicated.

Starter GPOs
A Starter GPO is used as a template from which to
create other GPOs within GPMC. Starter GPOs
only contain Administrative Template settings.
You may use a Starter GPO to provide a starting
point for new GPOs created in your domain. The
Starter GPO already may contain specific settings
that are recommended best practices for your
environment. Starter GPOs can be exported to,
and imported from, cabinet (.cab) files to make
distribution to other environments simple and
efficient.
GPMC stores Starter GPOs in a folder named,
StarterGPOs, which is located in SYSVOL.

Preconfigured Starter GPOs from Microsoft are available for Windows client operating systems. These
Starter GPOs contain Administrative Template settings that reflect Microsoft-recommended best practices
for the configuration of the client environment.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-13

Common GPO Management Tasks


Like critical data and AD DS-related resources,
you must back up GPOs to protect the integrity
of AD DS and GPOs. GPMC not only provides
the basic backup and restore options, but also
provides additional control over GPOs for
administrative purposes. Options for managing
GPOs include the following:

Backing Up GPOs

You can back up GPOs individually or as a whole


with GPMC. You must provide only a backup
location, which can be any valid local or shared
folder. You must have Read permission on the
GPO to back it up. Every time that you perform a backup, a new backup version of the GPO is created,
which provides a historical record.

Restoring Backed Up GPOs

You can restore any version of a GPO. If one becomes corrupt or you delete it, you can restore any of the
historical versions of that GPO. The restore interface provides the ability for you to view the settings
stored in the backed-up version before restoring it.

Importing GPO Settings from a Backed Up GPO

You can import policy settings from one GPO into another. Importing a GPO allows you to transfer
settings from a backed up GPO to an existing GPO. Importing a GPO transfers only the GPO settings.
The import process does not import GPO links. Security principals defined in the source may need to be
migrated to target.
Note: It is not possible to merge imported settings with the current target GPO settings.
The imported settings will overwrite all existing settings.

Copying GPOs

You can copy GPOs by using GPMC, both in the same domain and across domains. A copy operation
copies an existing, live GPO to the desired destination domain. A new GPO always gets created during
this process. The new GPO is named copy of OldGPOName. For example, if you copied a GPO named
Desktop, the new version would be named Copy of Desktop. After the file is copied and pasted into
the Group Policy Objects container, you can rename the policy. The destination domain can be any
trusted domain in which you have the rights to create new GPOs. When copying between domains,
security principals defined in the source may need to be migrated to target.
Note: It is not possible to copy settings from multiple GPOs into a single GPO.

Migration Tables

When importing GPOs or copying them between domains, you can use migration tables to modify
references in the GPO that need to be adjusted for the new location. For example, you may need to
replace the Universal Naming Convention (UNC) path for folder redirection with a UNC path that is
appropriate for the new user group to which the GPO will be applied. You can create migration tables
prior to this process, or you can create them during the import or cross-domain copy operation.

Delegating Administration of Group Policies


Delegation of GPO-related tasks allows you to
distribute the administrative workload across the
enterprise. You can task one group with creating
and editing GPOs, while another group performs
reporting and analysis duties. A third group might
be in charge of creating WMI filters.
You can delegate the following Group Policy tasks
independently:

Creating GPOs

Editing GPOs

Managing Group Policy links for a site,


domain, or OU

Performing Group Policy Modeling analyses on a given domain or OU

Reading Group Policy Results data for objects in a given domain or OU

Creating WMI filters in a domain

MCT USE ONLY. STUDENT USE PROHIBITED

5-14 Implementing a Group Policy Infrastructure

The Group Policy Creator Owners group lets its members create new GPOs, and edit or delete GPOs that
they have created.

Group Policy Default Permissions


By default, the following user and groups have Full Control over GPO management:

Domain Admins

Enterprise Admins

Creator Owner

Local System

The Authenticated User group has Read and Apply Group Policy permissions.

Creating GPOs
By default, only Domain Admins, Enterprise Admins, and Group Policy Creator Owners can create new
GPOs. You can use two methods to grant a group or user this right:

Add the user or group to the Group Policy Creator Owners group.

Explicitly grant the group or user permission to create GPOs by using GPMC.

Editing GPOs

To edit a GPO, the user must have both Read and Write access to the GPO. You can grant this permission
by using the GPMC.

Managing GPO Links

The ability to link GPOs to a container is a permission that is specific to that container. In GPMC, you can
manage this permission by using the Delegation tab on the container. You also can delegate it through
the Delegation of Control Wizard in Active Directory Users and Computers.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-15

Group Policy Modeling and Group Policy Results


You can delegate the ability to use the reporting tools in the same fashion, through GPMC or the
Delegation of Control Wizard in Active Directory Users and Computers.

Create WMI Filters

You can delegate the ability to create and manage WMI filters in the same fashion, through GPMC or the
Delegation of Control Wizard in Active Directory Users and Computers.

Managing GPOs with Windows PowerShell


In addition to using the Group Policy
Management console and the Group Policy
Management Editor, you can also perform
common GPO administrative tasks by using
Windows PowerShell.
The following table lists some of the more
common administrative tasks possible with
Windows PowerShell.

Cmdlet name

Description

New-GPO

Creates a new GPO

New-GPLink

Creates a new GPO link for the specified GPO

Backup-GPO

Backs up the specified GPOs

Restore-GPO

Restores the specified GPOs

Copy-GPO

Copies a GPO

Get-GPO

Gets the specified GPOs

Import-GPO

Imports the backed up settings into a specified GPO

Set-GPInheritance

Grants specified permissions to a user or security group for the


specified GPOs

For example, the following command creates a new GPO called Sales:
New-GPO -Name Sales -comment "This the sales GPO"

The following code imports the settings from the backed up Sales GPO stored in the C:\Backups folder
into the NewSales GPO.
import-gpo -BackupGpoName Sales -TargetName NewSales -path c:\backups

Lesson 3

Group Policy Scope and Group Policy Processing

MCT USE ONLY. STUDENT USE PROHIBITED

5-16 Implementing a Group Policy Infrastructure

A GPO is, by itself, a collection of configuration instructions that will be processed by the CSEs of
computers. Until the GPO is scoped, it does not apply to any users or computers. The GPOs scope
determines the CSEs of which computers will receive and process the GPO, and only the computers or
users within the scope of a GPO will apply the settings in that GPO. In this lesson, you will learn to manage
the scope of a GPO. The following mechanisms are used to scope a GPO:

The GPO link to a site, domain, or OU, and whether that link is enabled

The Enforce option of a GPO

The Block Inheritance option on an OU

Security group filtering

WMI filtering

Policy node enabling or disabling

Preferences targeting

Loopback policy processing

You must be able to define the users or computers to which you plan to deploy these configurations.
Consequently, you must master the art of scoping GPOs. In this lesson, you will learn each of the
mechanisms with which you can scope a GPO and, in the process, you will master the concepts of Group
Policy application, inheritance, and precedence.

Lesson Objectives
After completing this lesson, you will be able to:

Describe GPO links.

Explain GPO processing.

Describe GPO inheritance and precedence.

Use security filters to filter GPO scope.

Explain how to use WMI filters to filter GPO scope.

Describe how to enable and disable GPOs.

Explain how and when to use loopback processing.

Explain considerations for computers that are disconnected, or which are connected by slow links.

Explain when Group Policy settings take effect.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-17

GPO Links
You can link a GPO to one or more AD DS sites,
domains, or OUs. After you have linked a GPO, the
users or computers in that container are within
the scope of the GPO, including computers and
users in child OUs.

Link a GPO
To link a GPO, either:

Right-click the domain or OU in the GPMC


console tree, and then click Link as existing
GPO.

If you have not yet created a GPO, click


Create A GPO In This {Domain | OU | Site} And Link It Here.

You can choose the same commands to link a GPO to a site, but by default, your AD DS sites are not
visible in the GPMC. To show sites in the GPMC, right-click Sites in the GPMC console tree, and then click
Show Sites.
Note: A GPO linked to a site affects all computers in the site, without regard to the domain
to which the computers belong, as long as all computers belong to the same Active Directory
forest. Therefore, when you link a GPO to a site, that GPO can be applied to multiple domains
within a forest. Site-linked GPOs are stored on domain controllers in the domain in which you
create the GPO. Therefore, domain controllers for that domain must be accessible for site-linked
GPOs to be applied correctly. If you implement site-linked policies, you must consider policy
application when planning your network infrastructure. You can either place a domain controller
from the GPOs domain in the site to which the policy is linked, or ensure that a WAN
connectivity provides accessibility to a domain controller in the GPOs domain.

When you link a GPO to a container, you define the initial scope of the GPO. Select a GPO, and then click
the Scope tab to identify the containers to which the GPO is linked. In the details pane of the GPMC, the
GPO links are displayed in the first section of the Scope tab.

The impact of the GPOs links is that the Group Policy Client downloads the GPO if either the computer or
the user objects fall within the scope of the link. The GPO will be downloaded only if it is new or updated.
The Group Policy Client caches the GPO to make policy refresh more efficient.

Link a GPO to Multiple OUs

You can link a GPO to more than one site or OU. It is common, for example, to apply configuration to
computers in several OUs. You can define the configuration in a single GPO, and then link that GPO to
each OU. If you later change settings in the GPO, your changes will apply to all OUs to which the GPO is
linked.

Delete or Disable a GPO Link

After you have linked a GPO, the GPO link appears in the GPMC underneath the site, domain, or OU. The
icon for the GPO link has a small shortcut arrow. When you right-click the GPO link, a context menu
appears:

To delete a GPO link, right-click the GPO link in the GPMC console tree, and then click Delete.

MCT USE ONLY. STUDENT USE PROHIBITED

5-18 Implementing a Group Policy Infrastructure

Deleting a GPO link does not delete the GPO itself, which remains in that GPO container. However,
deleting the link does change the scope of the GPO, so that it no longer applies to computers and users
within the previously linked container object.
You also can modify a GPO link by disabling it:

To disable a GPO link, right-click the GPO link in the GPMC console tree and then clear the Link
Enabled option.

Disabling the link also changes the GPO scope so that it no longer applies to computers and users within
that container. However, the link remains so that you can more easily re-enable it.

Demonstration: How to Link GPOs


This demonstration shows how to:

Open the Group Policy Management console.

Create two new GPOs.

Link the first GPO to the domain.

Link the second GPO to the IT OU.

Disable the first GPOs link.

Delete the second GPO.

Re-enable the first GPOs link.

Demonstration Steps
Create and edit two GPOs
1.

Open the Group Policy Management Console.

2.

Create two new GPOs called Remove Run Command and Do Not Remove Run Command.

3.

Edit the settings of the two GPOs.

Link the GPOs to different locations


1.

Link the Remove Run Command GPO to the domain. The Remove Run Command GPO is now
attached to the Adatum.com domain.

2.

Link the Do Not Remove Run Command GPO to the IT OU. The Do Not Remove Run Command
GPO is now attached to the IT OU.

3.

View the GPO inheritance on the IT OU. The Group Policy Inheritance tab shows the order of
precedence for the Group Policy objects.

Disable a GPO link


1.

Disable the Remove Run Command GPO on the Adatum.com domain.

2.

Refresh the Group Policy Inheritance pane for the IT OU and then notice the results in the right pane.
The Remove Run Command GPO is no longer listed.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-19

Delete a GPO link


1.

Select the IT OU, and then delete the Do Not Remove Run Command GPO link. Verify the removal of
the Do Not Remove Run command and the absence of the Remove Run command GPOs.

2.

Enable the Remove Run Command GPO on the Adatum.com domain. Refresh the Group Policy
Inheritance window for the IT OU, and then notice the results in the right pane.

Group Policy Processing Order


The GPOs that apply to a user, computer, or both
do not all apply at once. GPOs are applied in a
particular order. This order means that settings
that are processed first may be overwritten by
conflicting settings that are processed later.
Group Policy follows the following hierarchical
processing order:
1.

Local group policies. Each computer running


Windows 2000 or newer has at least one local
group policy. The local policies are applied
first.

2.

Site group policies. Policies linked to sites are processed second. If there are multiple site policies,
they are processed synchronously in the listed preference order.

3.

Domain group policies. Policies linked to domains are processed third. If there are multiple domain
policies, they are processed synchronously in the listed preference order.

4.

OU group policies. Policies linked to top-level OUs are processed fourth. If there are multiple toplevel OU policies, they are processed synchronously in the listed preference order.

5.

Child OU group policies. Policies linked to child OUs are processed fifth. If there are multiple child OU
policies, they are processed synchronously in the listed preference order. When there are multiple
levels of child OUs, policies for higher-level OUs are applied first and policies for the lower-level OUs
are applied next.

In Group Policy application, the general rule is that the last policy applied wins. For example, a policy that
restricts access to Control Panel applied at the domain level could be reversed by a policy applied at the
OU level for the objects contained in that particular OU.
If you link several GPOs to an OU, their processing occurs in the order that the administrator specifies on
the OUs Linked Group Policy Objects tab in the GPMC.
By default, processing is enabled for all GPO links. You can disable a containers GPO link to block the
application of a GPO completely for a given site, domain, or OU. Note that if the GPO is linked to other
containers, they will continue to process the GPO if their links are enabled.
You also can disable the user or computer configuration of a particular GPO independent of either the
user or computer. If one section of a policy is known to be empty, disabling the other side speeds up
policy processing. For example, if you have a policy that only delivers user desktop configuration, you
could disable the computer side of the policy.

Configuring GPO Inheritance and Precedence

MCT USE ONLY. STUDENT USE PROHIBITED

5-20 Implementing a Group Policy Infrastructure

You can configure a policy setting in more than


one GPO, which results in GPOs conflicting with
each other. For example, you may enable a policy
setting in one GPO, disable it in another GPO, and
then not configure it in a third GPO. In this case,
the precedence of the GPOs determines which
policy setting the client applies. A GPO with
higher precedence prevails over a GPO with lower
precedence. Precedence is shown as a number in
the GPMC. The smaller the numberthat is, the
closer to 1the higher the precedence. Therefore,
a GPO that has a precedence of 1 will prevail over
other GPOs. Select the relevant AD DS container, and then click the Group Policy Inheritance tab to view
the precedence of each GPO.
When a policy setting is enabled or disabled in a GPO with higher precedence, the configured setting
takes effect. However, remember that policy settings are set to Not Configured, by default. If a policy
setting is not configured in a GPO with higher precedence, the policy setting (either enabled or disabled)
in a GPO with lower precedence will take effect.

You can link more than one GPO to an AD DS container object. The link order of GPOs determines the
precedence of GPOs in such a scenario. GPOs with a higher-link order take precedence over GPOs with a
lower-link order. When you select an OU in the GPMC, the Linked Group Policy Objects tab shows the link
order of GPOs linked to that OU.
The default behavior of Group Policy is that GPOs linked to a higher-level container are inherited by
lower-level containers. When a computer starts up or a user logs on, the Group Policy Client examines the
location of the computer or user object in AD DS, and evaluates the GPOs with scopes that include the
computer or user. Then, the CSEs apply policy settings from these GPOs. Policies are applied sequentially,
beginning with the policies linked to the site, followed by those linked to the domain, followed by those
linked to OUsfrom the top-level OU down to the OU in which the user or computer object exists. It is a
layered application of settings, so a GPO that is applied later in the process, because it has higher
precedence, overrides settings applied earlier in the process.

The sequential application of GPOs creates an effect called policy inheritance. Policies are inherited, so
the resultant set of Group Policies for a user or computer will be the cumulative effect of site, domain, and
OU policies.
By default, inherited GPOs have lower precedence than GPOs linked directly to the container. For
example, you might configure a policy setting to disable the use of registry-editing tools for all users
in the domain by configuring the policy setting in a GPO linked to the domain. That GPO, and its policy
setting, is inherited by all users within the domain. However, you probably want administrators to be able
to use registry-editing tools, so you will link a GPO to the OU that contains administrators accounts, and
then configure the policy setting to allow the use of registry-editing tools. Because the GPO linked to the
administrators OU takes higher precedence than the inherited GPO, administrators will be able to use
registry-editing tools.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-21

Precedence of Multiple Linked GPOs

If there are multiple GPOs linked to an AD DS container object, the objects link order determines their
precedence.
To change the precedence of a GPO link:
1.

Select the AD DS container object in the GPMC console tree.

2.

Click the Linked Group Policy Objects tab in the details pane.

3.

Select the GPO.

4.

Use the Up, Down, Move To Top, and Move To Bottom arrows to change the link order of the
selected GPO.

Block Inheritance

You can configure a domain or OU to prevent the inheritance of policy settings. This is known as blocking
inheritance. To block inheritance, right-click the domain or OU in the GPMC console tree, and then select
Block Inheritance.
The Block Inheritance option is a property of a domain or OU, so it blocks all Group Policy settings from
GPOs linked to parents in the Group Policy hierarchy. For example, when you block inheritance on an OU,
GPO application begins with any GPOs linked directly to that OU. Therefore, GPOs linked to higher-level
OUs, the domain, or the site will not apply.
You should use the Block Inheritance option sparingly because blocking inheritance makes it more
difficult to evaluate Group Policy precedence and inheritance. With security group filtering, you can
carefully scope a GPO so that it applies to only the correct users and computers in the first place, making
it unnecessary to use the Block Inheritance option.

Enforce a GPO Link

Additionally, you can set a GPO link to be Enforced. To enforce a GPO link, right-click the GPO link in the
console tree, and then select Enforced from the context menu.
When you set a GPO link to Enforced, the GPO takes the highest level of precedence; policy settings
in that GPO will prevail over any conflicting policy settings in other GPOs. Furthermore, a link that is
enforced will apply to child containers even when those containers are set to Block Inheritance. The
Enforced option causes the policy to apply to all objects within its scope. Enforced will cause policies to
override any conflicting policies and will apply regardless of whether a Block Inheritance option is set.

Enforcement is useful when you must configure a GPO that defines a configuration mandated by your
corporate IT security and usage policies. Therefore, you want to ensure that other GPOs do not override
those settings. You can do this by enforcing the GPOs link.

Evaluating Precedence

To facilitate evaluation of GPO precedence, you can simply select an OU (or domain), and then click the
Group Policy Inheritance tab. This tab will display the resulting precedence of GPOs, accounting for GPO
link, link order, inheritance blocking, and link enforcement. This tab does not account for policies that are
linked to a site, nor does it account for GPO security or WMI filtering.

Using Security Filtering to Modify Group Scope


Although you can use Enforcement and Block
Inheritance options to control the application of
GPOs to container objects, you might need to
apply GPOs only to certain groups of users or
computers rather than to all users or computers
within the scope of the GPO. Although you cannot
directly link a GPO to a security group, there is a
way to apply GPOs to specific security groups.
The policies in a GPO apply only to users who
have Allow Read and Allow Apply Group Policy
permissions to the GPO.

MCT USE ONLY. STUDENT USE PROHIBITED

5-22 Implementing a Group Policy Infrastructure

Each GPO has an ACL that defines permissions to


the GPO. Two permissions, Allow Read and Allow Apply Group Policy, are required for a GPO to apply to a
user or computer. For example, if a GPO is scoped to a computer by its link to the computers OU, but the
computer does not have Read and Apply Group Policy permissions, it will not download and apply the
GPO. Therefore, by setting the appropriate permissions for security groups, you can filter a GPO so that its
settings apply only to the computers and users that you specify.

By default, Authenticated Users are given the Allow Apply Group Policy permission on each new GPO. This
means that by default, all users and computers are affected by the GPOs set for their domain, site, or OU,
regardless of the other groups in which they might be members. Therefore, there are two ways of filtering
GPO scope:

Remove the Apply Group Policy permission (currently set to Allow) for the Authenticated Users group,
but do not set this permission to Deny. Then, determine the groups to which the GPO should be
applied and set the Read and Apply Group Policy permissions for these groups to Allow.

Determine the groups to which the GPO should not be applied and set the Apply Group Policy
permission for these groups to Deny. If you deny the Apply Group Policy permission to a GPO, the
user or computer will not apply settings in the GPO, even if the user or computer is a member of
another group that is allowed the Apply Group Policy Permission.

Filtering a GPO to Apply to Specific Groups


To apply a GPO to a specific security group:
1.

Select the GPO in the Group Policy Objects container in the console tree.

2.

In the Security Filtering section, select the Authenticated Users group, and then click Remove.
Note: You cannot filter GPOs with domain local security groups.

3.

Click OK to confirm the change.

4.

Click Add.

5.

Select the group to which you want the policy to apply, and then click OK.

Filtering a GPO to Exclude Specific Groups


The Scope tab of a GPO does not allow you to exclude specific groups. To exclude a groupthat is, to
deny the Apply Group Policy permissionyou must use the Delegation tab.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-23

To deny a group the Apply Group Policy permission:


1.

Select the GPO in the Group Policy Objects container in the console tree.

2.

Click the Delegation tab.

3.

Click the Advanced button. The Security Settings dialog box appears.

4.

Click the Add button.

5.

Select the group you want to exclude from the GPO. Remember, it must be a global group. GPO
scope cannot be filtered by domain local groups.

6.

Click OK. The group you selected is given the Allow Read permission, by default.

7.

Clear the Allow Read permission check box.

8.

Select the Deny Apply Group Policy check box.

9.

Click OK. You are warned that Deny permissions override other permissions. Because Deny
permissions override Allow permissions, we recommend that you use them sparingly. Microsoft
Windows reminds you of this best practice with the warning message. The process to exclude groups
with the Deny Apply Group Policy permission is far more laborious than the process to include groups
in the Security Filtering section of the Scope tab.

10. Confirm that you want to continue.


Note: Deny permissions are not exposed on the Scope tab. Unfortunately, when you
exclude a group, the exclusion is not shown in the Security Filtering section of the Scope tab. This
is yet one more reason to use Deny permissions sparingly.

What Are WMI Filters?


WMI is a management-infrastructure technology
that enables administrators to monitor and
control managed objects in the network. A WMI
query is capable of filtering systems based on
characteristics, including random access memory
(RAM), processor speed, disk capacity, IP address,
operating-system version, and service-pack level,
installed applications, and printer properties.
Because WMI exposes almost every property
of every object within a computer, the list of
attributes that you can use in a WMI query is
virtually unlimited. WMI queries are written by
using WMI Query Language (WQL).

You can use a WMI query to create a WMI filter, with which you can filter a GPO. You can use Group
Policy to deploy software applications and service packs. You might create a GPO to deploy an
application, and then use a WMI filter to specify that the policy should apply only to computers with a
certain operating system and service pack, such as Windows XP Service Pack 3 (SP3). The WMI query to
identify such systems is:

Select * FROM Win32_OperatingSystem WHERE Caption="Microsoft Windows XP Professional" AND


CSDVersion="Service Pack 3"

MCT USE ONLY. STUDENT USE PROHIBITED

5-24 Implementing a Group Policy Infrastructure

When the Group Policy Client evaluates GPOs it has downloaded to determine which should be handed
off to the CSEs for processing, it performs the query against the local system. If the system meets the
criteria of the query, the query result is a logical True, and the CSEs process the GPO.
WMI exposes namespaces, within which are classes that can be queried. Many useful classes, including
Win32_Operating System, are found in a class called root\CIMv2.
To create a WMI filter:
1.

Right-click the WMI Filters node in the GPMC console tree, and then click New. Type a name and
description for the filter, and then click the Add button.

2.

In the Namespace box, type the namespace for your query.

3.

In the Query box, enter the query.

4.

Click OK.

To filter a GPO with a WMI filter:


1.

Select the GPO or GPO link in the console tree.

2.

Click the Scope tab.

3.

Click the WMI drop-down list, and then select the WMI filter.

You can filter a GPO with only a single WMI filter, but you can create a WMI filter with a complex query
that uses multiple criteria. You can link a single WMI filter to one or more GPOs. The General tab of a
WMI filter displays the GPOs that use the WMI filter.
There are three significant caveats regarding WMI filters:

First, the WQL syntax of WMI queries can be challenging to master. You often can find examples
on the Internet when you search by using the keywords WMI filter and WMI query, along with a
description of the query that you want to create.

Second, WMI filters are expensive in terms of Group Policy processing performance. Because the
Group Policy Client must perform the WMI query at each policy processing interval, there is a slight
impact on system performance every 90 to 120 minutes. With the performance of todays computers,
the impact might not be noticeable. However, you should test the effects of a WMI filter prior to
deploying it widely in your production environment.

Note: Note that the WMI query is processed only once, even if you use it to filter the scope
of multiple GPOs.

Third, WMI filters are not processed by computers running the Microsoft Windows 2000 Server
operating system. If a GPO is filtered with a WMI filter, a Windows 2000 Server system ignores the
filter, and then processes the GPO as if the results of the filter were true.

Demonstration: How to Filter Policies


This demonstration shows how to:

Create a GPO that removes the Help menu link from the Start menu, and then link it to the IT OU.

Use security filtering to exempt a user from the GPO.

Test Group Policy application.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-25

Demonstration Steps
Create a new GPO, and link it to the IT organizational unit
1.

Open the Group Policy Management console on LON-DC1.

2.

Create a new GPO called Remove Help menu, and then link it to the IT organizational unit.

3.

Modify the settings of the GPO to remove Help from the Start menu.

Filter Group Policy application by using security group filtering


1.

Remove the Authenticated Users entry from the Security Filtering list for the Remove Help menu
GPO in the IT organizational unit.

2.

Add the user Ed Meadows to the Security Filtering list. Now, only Ed Meadows has the apply policy
permission.

Filter Group Policy application by using WMI filtering


1.

Create a WMI filter called XP filter.

2.

Add the following query to the filter:


Select * from Win32_OperatingSystem where Caption = "Microsoft Windows XP
Professional"

3.

Save the query as XP filter.

4.

Create a new GPO called Software Updates for XP, and link it to the IT organizational unit.

5.

Modify the policys properties to use the XP filter.

6.

Close the Group Policy Management console.

Enable of Disable GPOs and GPO Nodes


You can prevent the settings in the Computer
Configuration or User Configuration nodes
from processing during policy refresh by changing
the GPO Status.
To enable or disable a GPO's nodes, select the
GPO or GPO link in the console tree, click the
Details tab, shown in the figure, and then select
one of the following from the GPO Status dropdown list:

Enabled. Both computer configuration


settings and user configuration settings will
be processed by CSEs during policy refresh.

All Settings Disabled. CSEs will not process the GPO during policy refresh.

Computer Configuration Settings Disabled. During computer policy refresh, computer configuration
settings in the GPO will not be applied.

User Configuration Settings Disabled. During user policy refresh, user configuration settings in the
GPO will not be applied.

MCT USE ONLY. STUDENT USE PROHIBITED

5-26 Implementing a Group Policy Infrastructure

You can configure GPO status to optimize policy processing. For example, if a GPO contains only user
settings, then setting the GPO Status option to disable computer settings prevents the Group Policy client
from attempting to process the GPO during computer policy refresh. Because the GPO contains no
computer settings, there is no need to process the GPO, and you can save a few processor cycles.
Note: You can define a configuration that should take effect in case of an emergency,
security incident, or other disasters in a GPO, and then link the GPO so that it is scoped to
appropriate users and computers. Then, disable the GPO. If you require the configuration to be
deployed, enable the GPO.

Loopback Policy Processing


By default, a users settings come from GPOs
scoped to the user object in AD DS. Regardless
of which computer the user logs on to, the
resultant set of policies that determine the users
environment is the same. There are situations,
however, in which you might want to configure
a user differently, depending on the computer in
use. For example, you might want to lock down
and standardize user desktops when users sign in
to computers in closely managed environments,
such as conference rooms, reception areas,
laboratories, classrooms, and kiosks. It also is
important for Virtual Desktop Infrastructure (VDI) scenarios, including remote virtual machines and
Remote Desktop Services (RDS).

Imagine a scenario in which you want to enforce a standard corporate appearance for the Windows
desktop on all computers in conference rooms and other public areas of your office. How will you
centrally manage this configuration by using Group Policy? Policy settings that configure desktop
appearance are located in the User Configuration node of a GPO. Therefore, by default, the settings
apply to users, regardless of which computer they sign in to. The default policy processing does not give
you a way to scope user settings to apply to computers, regardless of which user logs on. That is how
loopback policy processing can be useful.

Loopback policy processing alters the default algorithm that the Group Policy client uses to obtain
the ordered list of GPOs that should be applied to a users configuration. Instead of user configuration
being determined by the User Configuration node of GPOs that are scoped to the user object, user
configuration can be determined by the User Configuration node policies of GPOs that are scoped to the
computer object.
The Configure user Group Policy loopback processing mode policy, located in the Computer
Configuration\Policies\Administrative Templates\System\Group Policy folder in Group Policy
Management Editor, can be, like all policy settings, set to Not Configured, Enabled, or Disabled.
When enabled, the policy can specify the Replace or Merge mode:

Replace. In this case, the GPO list for the user is replaced entirely by the GPO list already obtained for
the computer at computer startup. The settings in User Configuration policies of the computers GPOs
are applied to the user. The Replace mode is useful in a situation such as a classroom where users
should receive a standard configuration rather than the configuration applied to those users in a less
managed environment.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-27

Merge. In this case, the GPO list obtained for the computer at computer startup is appended to the
GPO list obtained for the user when logging on. Because the GPO list obtained for the computer is
applied later, settings in GPOs on the computers list have precedence if they conflict with settings in
the users list. This mode would be useful to apply additional settings to users typical configurations.
For example, you might allow a user to receive the users typical configuration when logging on to a
computer in a conference room or reception area, but replace the wallpaper with a standard bitmap,
and disable the use of certain applications or devices.

Note: Note that when you combine loopback processing with security group filtering, the
application of user settings during policy refresh uses the computers credentials to determine
which GPOs to apply as part of the loopback processing. However, the logged-on user also must
have the Apply Group Policy permission for the GPO to be applied successfully. Also note that
the loopback processing flag is configured on a per-session basis rather than per GPO.

Considerations for Slow Links and Disconnected Systems


Some settings that you can configure with Group
Policy can be impacted by the speed of the link
that the users computer has with your domain
network. For instance, deploying software by
using GPOs would be inappropriate over slower
links. Furthermore, it is important to consider the
effect of Group Policies on computers that are
disconnected from the domain network.

Slow Links

The Group Policy Client addresses the issue of


slow links by detecting the connection speed to
the domain, and by determining whether the
connection should be considered a slow link. That determination is then used by each CSE to decide
whether to apply settings. The software extension, for example, is configured to forgo policy processing,
so that software is not installed if a slow link is detected.
Note: By default, a link is considered to be slow if it is less than 500 kilobits per second
(Kbps). However, you can configure this to a different speed.

If Group Policy detects a slow link, it sets a flag to indicate the slow link to the CSEs. The CSEs then can
determine whether to process the applicable Group Policy settings. The following table describes the
default behavior of the client-side extensions.
Client-side extension

Slow link processing

Can it be changed?

Registry policy processing

On

No

Internet Explorer maintenance

Off

Yes

Software Installation policy

Off

Yes

Folder Redirection policy

Off

Yes

Client-side extension

Slow link processing

Can it be changed?

Scripts policy

Off

Yes

Security policy

On

No

Internet Protocol Security (IPsec)


policy

Off

Yes

Wireless policy

Off

Yes

Encrypted File System (EFS)


Recovery policy

On

Yes

Disk Quota policy

Off

Yes

Disconnected Computers

MCT USE ONLY. STUDENT USE PROHIBITED

5-28 Implementing a Group Policy Infrastructure

If a user is working while disconnected from the network, the settings previously applied by Group Policy
continue to take effect. That way, a users experience is identical, irrespective of whether he or she is on
the network or away. There are exceptions to this rule, most notably that startup, logon, logoff, and
shutdown scripts will not run if the user is disconnected.
If a remote user connects to the network, the Group Policy client wakes up and determines whether a
Group Policy refresh window was missed. If so, it performs a Group Policy refresh to obtain the latest
GPOs from the domain. Again, the CSEs determine, based on their policy processing settings, whether
settings in those GPOs are applied.
Note: This process does not apply to Windows XP or Windows Server 2003 systems. It
applies only to Windows Vista, Windows Server 2008, Windows Server 2008 R2, Windows 7,
Windows 8, and Windows Server 2012.

Identifying When Settings Become Effective


There are several processes that must be
completed before Group Policy settings are
actually applied to a user or a computer. This
topic discusses these processes.

GPO Replication Must Happen


Before a GPO can take effect, the Group Policy
container in Active Directory must be replicated
to the domain controller from which the Group
Policy Client obtains its ordered list of GPOs.
Additionally, the Group Policy template in SYSVOL
must replicate to the same domain controller.

Group Changes Must Be Incorporated

Finally, if you have added a new group or changed the membership of a group that is used to filter the
GPO, that change also must be replicated. Furthermore, the change must be in the security token of the
computer and the user, which requires a restart (for the computer to update its group membership) or a
logoff and logon (for the user to update its group membership).

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-29

User or Computer Group Policy Refresh Must Occur


Refresh happens at startup (for computer settings), at logon (for user settings), and every 90 to 120
minutes thereafter, by default.
Note: Remember that the practical impact of the Group Policy refresh interval is that when
you make a change in your environment, it will be, on average, one-half that time, or 45 to 60
minutes, before the change starts to take effect.

By default, Windows XP, Windows Vista, Windows 7, and Windows 8 clients perform only background
refreshes at startup and logon, which means that a client might start up and a user might sign in without
receiving the latest policies from the domain. We highly recommend that you change this default
behavior so that policy changes are implemented in a managed, predictable way. Enable the policy
setting Always Wait For Network At Startup And Logon for all Windows clients. The setting is
located in Computer Configuration\Policies\Administrative Templates\System\Logon. Be sure to
read the policy settings explanatory text. Note that this does not affect the startup or logon time for
computers that are not connected to a network. If the computer detects that it is disconnected, it does
not "wait" for a network.

Logon or Restart

Although most settings are applied during a background policy refresh, some CSEs do not apply the
setting until the next startup or logon event. For example, newly added startup and logon script policies
do not run until the next computer startup or logon. Software installation will occur at the next startup if
the software is assigned in computer settings. Changes to folder-redirection policies will not take effect
until the next logon.

Manually Refresh Group Policy

When you experiment with Group Policy troubleshoot Group Policy processing, you might need to initiate
a Group Policy refresh manually so that you do not have to wait for the next background refresh. You can
use the GPUpdate command to initiate a Group Policy refresh. Used on its own, this command triggers
processing identical to a background Group Policy refresh. Both computer policy and user policy are
refreshed. Use the /target:computer or /target:user parameter to limit the refresh to computer or user
settings, respectively. During background refresh, by default, settings are applied only if the GPO has been
updated. The /force switch causes the system to reapply all settings in all GPOs scoped to the user or
computer. Some policy settings require a logoff or reboot before they actually take effect. The /logoff
and /boot switches of GPUpdate cause a logoff or reboot, respectively. You can use these switches when
you apply settings that require a logoff or reboot.
For example, the command that will cause a total refresh application, and, if necessary, reboot and logon
to apply updated policy settings is:
gpupdate /force /logoff /boot

Most CSEs Do Not Reapply Settings if the GPO Has Not Changed

MCT USE ONLY. STUDENT USE PROHIBITED

5-30 Implementing a Group Policy Infrastructure

Remember that most CSEs apply settings in a GPO only if the GPO version has changed. This means that if
a user can change a setting that was specified originally by Group Policy, the setting will not be brought
back into compliance with the settings that the GPO specifies until the GPO changes. Fortunately, most
policy settings cannot be changed by a nonprivileged user. However, if a user is an administrator of his or
her computer, or if the policy setting affects a part of the registry or of the system that the user has
permissions to change, this could be a real problem.
You have the option of instructing each CSE to reapply the settings of GPOs, even if the GPOs have not
been changed. Processing behavior of each CSE can be configured in the policy settings found in
Computer Configuration\Administrative Templates\System\Group Policy.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-31

Lesson 4

Troubleshooting the Application of GPOs

With the interaction of multiple settings in multiple GPOs scoped by using a variety of methods,
Group Policy application can be complex to analyze and understand. Therefore, you must be equipped
to evaluate and troubleshoot your Group Policy implementation effectively, identify potential problems
before they arise, and solve unforeseen challenges. Windows Server provides tools that are indispensable
for supporting Group Policy. In this lesson, you will explore the use of these tools in both proactive and
reactive troubleshooting and support scenarios.

Lesson Objectives
After completing this lesson, you will be able to:

Describe how to refresh GPOs on a client computer.

Analyze the set of GPOs and policy settings that have been applied to a user or computer.

Generate Resultant Set of Policy (RSoP) reports to help in the analysis of GPO settings.

Proactively model the impact of Group Policy or Active Directory changes on the RSOP.

Locate the event logs containing Group Policyrelated events.

Refreshing GPOs
Computer configuration settings are applied at
startup, and then are refreshed at regular
intervals. Any startup scripts are run at computer
startup. The default interval is every 90 minutes,
but this is configurable. The exception to the set
interval is domain controllers, which have their
settings refreshed every five minutes.
User settings are applied at logon and are
refreshed at regular, configurable intervals; the
default is also 90 minutes. Any logon scripts are
run at logon.
Note: A number of user settings require two
logons before the user sees the effect of the GPO. This is because users logging on to the same
computer use cached credentials to speed up logons. This means that, although the policy
settings are being delivered to the computer, the user is already logged on and the settings will
therefore not take effect until the next logon. The folder redirection setting is an example of this.

You can change the refresh interval by configuring a Group Policy setting. For computer settings, the
refresh interval setting is found in the Computer Configuration\Policies\Administrative Templates
\System\Group Policy node. For user settings, the refresh interval is found at the corresponding settings
under User Configuration. An exception to the refresh interval is security settings. The security settings
section of the Group Policy will be refreshed at least every 16 hours, regardless of the interval that you set
for the refresh interval.

You can also refresh Group Policy manually. The command line utility Gpupdate refreshes and delivers
any new Group Policy configurations. The Gpupdate /force command refreshes all the Group Policy
settings. There is also a new Windows PowerShell Invoke-Gpupdate cmdlet, which performs the same
function.

MCT USE ONLY. STUDENT USE PROHIBITED

5-32 Implementing a Group Policy Infrastructure

A new feature in Windows Server 2012 is Remote Policy Refresh. This feature allows administrators to use
the GPMC to target an OU and force Group Policy refresh on all of its computers and their currently
logged-on users. To do this, you right-click any OU, and then click Group Policy Update. The update
occurs within 10 minutes.
Note: Sometimes, the failure of a GPO to apply is as a result of problems with the
underlying technology that is responsible for replicating both AD DS and SYSVOL. In Windows
Server 2012, you can view the replication status by using Group Policy Management, selecting
the Domain node, clicking the Status tab, and then click Detect Now.

Resultant Set of Policy


Group Policy inheritance, filters, and exceptions
are complex, and it is often difficult to determine
which policy settings will apply.
RSoP is the net effect of GPOs applied to a
user or computer, taking into account GPO
links, exceptions, such as Enforced and Block
Inheritance, and application of security and WMI
filters.

RSoP is also a collection of tools that help you


evaluate, model, and troubleshoot the application
of Group Policy settings. RSoP can query a local or
remote computer, and then report back the exact
settings that were applied to the computer and to any user who has logged on to the computer.
RSoP also can model the policy settings that are anticipated to be applied to a user or computer under a
variety of scenarios, including moving the object between OUs or sites, or changing the objects group
membership. With these capabilities, RSoP can help you manage and troubleshoot conflicting policies.
Windows Server 2012 provides the following tools for performing RSoP analysis:

The Group Policy Results Wizard

The Group Policy Modeling Wizard

GPResult.exe

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-33

Generate RSoP Reports


To help you analyze the cumulative effect of GPOs
and policy settings on a user or computer in your
organization, the GPMC includes the Group Policy
Results Wizard. If you want to understand exactly
which policy settings have applied to a user or a
computer, and why, the Group Policy Results
Wizard is the tool to use.

Generate RSoP Reports with the Group


Policy Results Wizard

The Group Policy Results Wizard can reach into


the WMI provider on a local or remote computer
that is running Window Vista or newer. The WMI
provider can report everything there is to know about the way Group Policy was applied to the system. It
knows when processing occurred, which GPOs were applied, which GPOs were not applied and why,
errors that were encountered, and the exact policy settings that took precedence and their source GPO.
There are several requirements for running the Group Policy Results Wizard, as follows:

The target computer must be online.

You must have administrative credentials on the target computer.

The target computer must be running Windows XP or newer. The Group Policy Results Wizard cannot
access Windows 2000 systems.

You must be able to access WMI on the target computer. This means the computer must be online,
connected to the network, and accessible through ports 135 and 445.

Note: Performing RSoP analysis by using Group Policy Results Wizard is just one example
of remote administration. To perform remote administration, you may need to configure
inbound rules for the firewall that your clients and servers use.

The WMI service must be started on the target computer.

If you want to analyze RSoP for a user, that user must have logged on at least once to the computer,
although it is not necessary for the user to be currently logged on.

After you have ensured that the requirements are met, you are ready to run an RSoP analysis.

To run an RSoP report, right-click Group Policy Results in the GPMC console tree, and then click Group
Policy Results Wizard.

The wizard prompts you to select a computer. It then connects to the WMI provider on that computer,
and provides a list of users that have logged on to it. You then can select one of the users, or you can skip
RSoP analysis for user configuration policies.
The wizard produces a detailed RSoP report in a dynamic HTML format. If Internet Explorer Enhanced
Security Configuration is set, you will be prompted to allow the console to display the dynamic content.
You can expand or collapse each section of the report by clicking the Show or Hide link, or by doubleclicking the heading of the section.

The report is displayed on three tabs:

MCT USE ONLY. STUDENT USE PROHIBITED

5-34 Implementing a Group Policy Infrastructure

Summary. The Summary tab displays the status of Group Policy processing at the last refresh. You
can identify information that was collected about the system, the GPOs that were applied and denied,
security group membership that might have affected GPOs filtered with security groups, WMI filters
that were analyzed, and the status of CSEs.

Settings. The Settings tab displays the resultant set of policy settings applied to the computer or user.
This tab shows you exactly what has happened to the user through the effects of your Group Policy
implementation. You can learn a tremendous amount of information from the Settings tab, although
some data is not reported, including IPsec, wireless, and disk-quota policy settings.

Policy Events. The Policy Events tab displays Group Policy events from the event logs of the target
computer.

After you generate an RSoP report with the Group Policy Results Wizard, you can right-click the report to
rerun the query, print the report, or save the report as either an XML file or an HTML file that maintains
the dynamic expanding and collapsing sections. You can open both file types with Internet Explorer, so
the RSoP report is portable outside the GPMC.

If you right-click the node of the report itself, under the Group Policy Results folder in the console tree,
you can switch to Advanced View. In Advanced View, RSoP is displayed by using the RSoP snap-in, which
exposes all applied settings, including IPsec, wireless, and disk quota policies.

Generate RSoP Reports with GPResult.exe


The GPResult.exe command is the command-line version of the Group Policy Results Wizard.
GPResult taps into the same WMI provider as the wizard, produces the same information and, in fact,
enables you to create the same graphical reports. GPResult runs on Windows XP, Windows Vista,
Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, and Windows Server 2012.
Note: Windows 2000 includes a GPResult.exe command, which produces a limited report
of Group Policy processing. However, it is not as sophisticated as the command that newer
Windows versions include.
When you run the GPResult command, you are likely to use the following options:
/scomputername

This option specifies the name or IP address of a remote system. If you use a dot (.) as the computer
name, or do not include the /s option, the RSoP analysis is performed on the local computer:
/scope [user | computer]

This displays RSoP analysis for user or computer settings. If you omit the /scope option, RSoP analysis
includes both user and computer settings:
/userusername

This specifies the name of the user for which you want to display RSoP data:
/r

This option displays a summary of RSoP data:


/v

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-35

This option displays verbose RSoP data, which presents the most meaningful information:
/z

This displays super verbose data, including the details of all policy settings applied to the system. Often,
this is more information than you will require for typical Group Policy troubleshooting:
/udomain\user/ppassword

This provides credentials that are in the Administrators group of a remote system. Without these
credentials, GPResult runs by using the credentials with which you are logged on:
[/x | /h] filename

This option saves the reports in the XML or HTML format. These options are available in Windows Vista
Service Pack 1 (SP1) and newer, Windows Server 2008 and newer, Windows 7, and Windows 8.

Troubleshoot Group Policy with the Group Policy Results Wizard or GPResult.exe

As an administrator, you will likely encounter scenarios that require Group Policy troubleshooting. You
might need to diagnose and solve problems, including the following:

GPOs are not being applied at all.

The resultant set of policies for a computer or user is not what was expected.

The Group Policy Results Wizard and GPResult.exe often will provide the most valuable insight into
Group Policy processing and application problems. Remember that these tools examine the WMI RSoP
provider to report exactly what happened on a system. Examining the RSoP report will often point you
to GPOs that are scoped incorrectly or policy processing errors that prevented the application of GPO
settings.

Demonstration: How to Perform What-If Analysis with the Group Policy


Modeling Wizard

If you move a computer or user between sites, domains, or OUs, or change its security group membership,
the GPOs scoped to that user or computer will change. Therefore, the RSoP for the computer or user will
be different. The RSoP will also change if slow link or loopback processing occurs, or if there is a change to
a system characteristic that a WMI filter targets.
Before you make any of these changes, you should evaluate the potential impact that a user or computer
will have on the RSoP. The Group Policy Results Wizard can perform RSoP analysis only on what has
actually happened. To predict the future, and to perform what-if analyses, you can use the Group Policy
Modeling Wizard.
To perform Group Policy Modeling, right-click the Group Policy Modeling node in the GPMC console
tree, click Group Policy Modeling Wizard, and then perform the steps in the wizard.

Modeling is performed by conducting a simulation on a domain controller, so you are first asked to select
a domain controller. You do not need to be logged on locally to the domain controller, but the modeling
request will be performed on the domain controller. You then are asked to specify the settings for the
simulation, including to:

Select a user or computer object to evaluate, or specify the OU, site, or domain to evaluate.

Choose whether slow link processing should be simulated.

Specify to simulate loopback processing and, if so, choose Replace or Merge mode.

Select a site to simulate.

Select security groups for the user and for the computer.

Choose which WMI filters to apply in the simulation of user and computer policy processing.

MCT USE ONLY. STUDENT USE PROHIBITED

5-36 Implementing a Group Policy Infrastructure

When you have specified the simulations settings, a report is produced that is very similar to the Group
Policy Results report discussed earlier. The Summary tab shows an overview of which GPOs will be
processed, and the Settings tab details the policy settings that will be applied to the user or computer.
This report, too, can be saved by right-clicking it, and then choosing Save Report.

Demonstration
This demonstration shows how to:

Run GPResult.exe from the command prompt.

Run GPResult.exe from the command prompt, and then output the results to an HTML file.

Open the GPMC.

Run the Group Policy Reporting Wizard, and then view the results.

Run the Group Policy Modeling Wizard, and then view the results.

Demonstration Steps
Use GPResult.exe to create a report
1.

On LON-DC1, open a command prompt.

2.

Run the following commands:


Gpresult /t
Gpresult /h results.html

3.

Open the results.html report in Internet Explorer, and then review the report.

Use the Group Policy Reporting Wizard to create a report


1.

Close the command prompt, and then open the Group Policy Management Console.

2.

From the Group Policy Results node, launch the Group Policy Results Wizard.

3.

Complete the wizard by using the defaults.

4.

Review the report, and then save the report to the Desktop.

Use the Group Policy Modeling Wizard to create a report


1.

From the Group Policy Modeling node, launch the Group Policy Modeling Wizard.

2.

Specify the user for the report as Ed Meadows and the computer container as the IT organizational
unit.

3.

Complete the wizard using the defaults, and then review the report.

4.

Close the Group Policy Management Console.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-37

Examine Policy Event Logs


Windows Vista, Windows 7, Windows 8, Windows
Server 2008, and Windows Server 2012 improve
your ability to troubleshoot Group Policy not only
with RSoP tools, but also with improved logging
of Group Policy events, including the:

System log, in which you will find high-level


information about Group Policy, including
errors created by the Group Policy client
when it cannot connect to a domain
controller or locate GPOs.

Application log, which captures events


recorded by CSEs.

Group Policy Operational Log, which provides detailed information about Group Policy processing.

To find Group Policy logs, open the Event Viewer snap-in or console. The System and Application logs are
in the Windows Logs node. The Group Policy Operational Log is found in:
Applications And Services Logs\Microsoft \Windows\GroupPolicy\Operational

Lab: Implementing a Group Policy Infrastructure


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

5-38 Implementing a Group Policy Infrastructure

A. Datum is a global engineering and manufacturing company with its head office in London, UK. An IT
office and a data center are located in London to support the London office and other locations. A. Datum
recently has deployed a Windows Server 2012 server and client infrastructure.
You have been asked to use Group Policy to implement standardized security settings to lock computer
screens when users leave computers unattended for 10 minutes or more. You also have to configure a
policy setting that will prevent access to certain programs on local workstations.

After some time, you have been made aware that a critical application fails when the screens saver starts,
and an engineer has asked you to prevent the setting from applying to the team of Research engineers
that uses the application every day. You have also been asked to configure conference room computers to
use a 45 minute timeout.
After creating the policies you need to evaluate the resultant set of policies for users in your environment
to ensure that the Group Policy infrastructure is optimized, and that all policies are applied as they were
intended.

Objectives
After completing this lab, you will be able to:

Create and configure a GPO.

Manage Group Policy scope.

Troubleshoot Group Policy application.

Manage GPOs.

Lab Setup
Estimated Time: 90 minutes

Virtual machine(s)

20411B-LON-DC1
20411B-LON-CL1

User Name

Adatum\Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:

5.

a.

User name: Administrator

b.

Password: Pa$$w0rd

c.

Domain: Adatum

Repeat steps 2 and 3 for 20411B-LON-CL1. Do not sign in to LON-CL1 until directed to do so.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-39

Exercise 1: Creating and Configuring GPOs


Scenario

You have been asked to use Group Policy to implement standardized security settings to lock computer
screens when users leave computers unattended for 10 minutes or more. You also have to configure a
policy setting that will prevent users from running the Notepad application on local workstations.
The main tasks for this exercise are as follows:
1.

Create and edit a Group Policy Object (GPO).

2.

Link the GPO.

3.

View the effects of the GPOs settings.

Task 1: Create and edit a Group Policy Object (GPO)


1.

On LON-DC1, from Server Manager, open the Group Policy Management console.

2.

Create a GPO named ADATUM Standards in the Group Policy Objects container.

3.

Edit the ADATUM Standards policy, and navigate to User Configuration, Policies, Administrative
Templates, System.

4.

Prevent users from running notepad.exe by configuring the Dont run specified Windows
applications policy setting.

5.

Navigate to the User Configuration, Policies, Administrative Templates, Control Panel,


Personalization folder, and then configure the Screen saver timeout policy to 600 seconds.

6.

Enable the Password protect the screen saver policy setting, and then close the Group Policy
Management Editor window.

Task 2: Link the GPO

Link the ADATUM Standards GPO to the Adatum.com domain.

Task 3: View the effects of the GPOs settings


1.

Sign in to LON-CL1 as Adatum\Pat with the password Pa$$w0rd.

2.

Attempt to change the screen saver wait time and resume settings. You are prevented from doing this
by Group Policy.

3.

Attempt to run Notepad. You are prevented from doing this by Group Policy.

Results: After this exercise, you should have successfully created, edited, and linked the required GPOs.

Exercise 2: Managing GPO Scope


Scenario

After some time, you have been made aware that a critical application that the Research engineering
team uses is failing when the screen saver starts. You have been asked to prevent the GPO setting from
applying to any member of the Engineering security group. You also have been asked to configure
conference room computers to be exempt from corporate policy. However, they always must have a 45minute screensaver timeout applied.

The main tasks for this exercise are as follows:


1.

Create and link the required GPOs.

2.

Verify the order of precedence.

3.

Configure the scope of a GPO with security filtering.

4.

Configure loopback processing.

Task 1: Create and link the required GPOs

MCT USE ONLY. STUDENT USE PROHIBITED

5-40 Implementing a Group Policy Infrastructure

1.

On LON-DC1, open Active Directory Users and Computers and in the Research OU, create a subOU called Engineers, and then close Active Directory Users and Computers.

2.

In the Group Policy Management Console, create a new GPO linked to the Engineers OU called
Engineering Application Override.

3.

Configure the Screen saver timeout policy setting to be disabled, and then close the Group Policy
Management Editor.

Task 2: Verify the order of precedence

In the Group Policy Management console tree, select the Engineers OU, and then click the Group
Policy Inheritance tab. Notice that the Engineering Application Override GPO has precedence over
the ADATUM Standards GPO. The screen saver timeout policy setting you just configured in the
Engineering Application Override GPO will be applied after the setting in the ADATUM Standards
GPO. Therefore, the new setting will overwrite the standards setting, and will win. Screen saver
timeout will be disabled for users within the scope of the Engineering Application Override GPO.

Task 3: Configure the scope of a GPO with security filtering


1.

On LON-DC1, open Active Directory Users and Computers. In the Research\Engineers OU, create
a global security group named GPO_Engineering Application Override_Apply.

2.

In the Group Policy Management console, select the Engineering Application Override GPO. Notice
that in the Security Filtering section, the GPO applies by default to all authenticated users. Configure
the GPO to apply only to the GPO_Engineering Application Override_Apply group.

3.

In the Users folder, create a global security group named GPO_ADATUM Standards_Exempt.

4.

In the Group Policy Management console, select the ADATUM Standards GPO. Notice that in the
Security Filtering section, the GPO applies by default to all authenticated users.

5.

Configure the GPO delegation to deny Apply Group Policy permission to the GPO_ADATUM
Standards_Exempt group.

Task 4: Configure loopback processing


1.

On LON-DC1, switch to Active Directory Users and Computers.

2.

Create a new OU called Kiosks.

3.

Under Kiosks, create a sub-OU called Conference Rooms.

4.

Switch to the Group Policy Management console.

5.

Create a new GPO named Conference Room Policies and link it to the Kiosks\Conference Rooms
OU.

6.

Confirm that the Conference Room Policies GPO is scoped to Authenticated Users.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-41

7.

Edit the Conference Room Policies GPO and modify the Screen Saver timeout policy to launch the
screen saver after 45 minutes.

8.

Modify the Configure user Group Policy loopback processing mode policy setting to use Merge
mode.

Results: After this exercise, you should have successfully configured the required scope of the GPOs.

Exercise 3: Verifying GPO Application


Scenario

After creating the policies that you need to evaluate the resultant set of policies for your environments
users to ensure that the Group Policy infrastructure is healthy, and that all policies are applied as they
were intended.
The main tasks for this exercise are as follows:
1.

Perform Resultant Set of Policy (RSoP) analysis.

2.

Analyze RSoP with GPResults.

3.

Evaluate GPO results by using the Group Policy Modeling Wizard.

4.

Review policy events and determine GPO infrastructure status.

Task 1: Perform Resultant Set of Policy (RSoP) analysis


1.

On LON-CL1, verify that you are still logged on as Adatum\Pat. If necessary, provide the password of
Pa$$w0rd.

2.

Run the command prompt as an administrator, with the user name Adatum\Administrator and the
password Pa$$w0rd.

3.

Run the gpupdate /force command. After the command has completed, make a note of the current
system time, which you will need to know for a task later in this lab:
Time: ____________________________________

4.

Restart LON-CL1, and then wait for it to restart before proceeding with the next task.

5.

On LON-DC1, switch to the Group Policy Management console.

6.

Use the Group Policy Results Wizard to run an RSoP report for Pat on LON-CL1.

7.

Review Group Policy Summary results. For both user and computer configuration, identify the time of
the last policy refresh and the list of allowed and denied GPOs. Identify the components that were
used to process policy settings.

8.

Click the Details tab. Review the settings that were applied during user and computer policy
application, and then identify the GPO from which the settings were obtained.

9.

Click the Policy Events tab, and then locate the event that logs the policy refresh you triggered with
the GPUpdate command in Task 1.

10. Click the Summary tab, right-click the page, and then choose Save Report. Save the report as an
HTML file your desktop. Then open the RSoP report from the desktop.

Task 2: Analyze RSoP with GPResults

MCT USE ONLY. STUDENT USE PROHIBITED

5-42 Implementing a Group Policy Infrastructure

1.

Sign in to LON-CL1 as Adatum\Administrator with the password Pa$$w0rd.

2.

Open a command prompt and run the gpresult /r command. RSoP summary results are displayed.
The information is very similar to the Summary tab of the RSoP report produced by the Group Policy
Results Wizard.

3.

Type gpresult /v, and then press Enter. A more detailed RSoP report is produced. Notice that many
of the Group Policy settings applied by the client are listed in this report.

4.

Type gpresult /z, and then press Enter. The most detailed RSoP report is produced.

5.

Type gpresult /h:"%userprofile%\Desktop\RSOP.html", and then press Enter. An RSoP report is


saved as an HTML file to your desktop.

6.

Open the saved RSoP report from your desktop. Compare the report, its information, and its
formatting with the RSoP report you saved in the previous task.

Task 3: Evaluate GPO results by using the Group Policy Modeling Wizard
1.

Switch to LON-DC1.

2.

Start the Group Policy Modeling Wizard.

3.

Select Adatum\Mike as the user, and LON-CL1 as the computer for modeling.

4.

When prompted, select the Loopback Processing check box, and then click Merge. Even though the
Conference Room Polices GPO specifies loopback processing, you must instruct the Group Policy
Modeling Wizard to consider loopback processing in its simulation.

5.

When prompted, on the Alternate Active Directory Paths page, choose the Kiosks\Conference
Rooms location. You are simulating the effect of LON-CL1 as a conference room computer.

6.

Accept all other options as defaults.

7.

On the Summary tab, scroll to and expand, if necessary, User Details, Group Policy Objects, and
Applied GPOs.

8.

Check whether the Conference Room Policies GPO applies to Mike as a User policy when he logs on
to LON-CL1 if LON-CL1 is in the Conference Rooms OU.

9.

Scroll to, and expand if necessary, User Details, Policies, Administrative Templates and Control
Panel/Personalization.

10. Confirm that the screen saver timeout is 2,700 seconds (45 minutes), the setting configured by the
Conference Room Policies GPO that overrides the 10-minute standard configured by the ADATUM
Standards GPO.

Task 4: Review policy events and determine GPO infrastructure status


1.

On LON-CL1, you are logged on as Adatum\Administrator.

2.

Open the Control Panel and then browse to the Event Viewer.

3.

Locate and review Group Policy events in the System log.

4.

Locate and review Group Policy events in the Application log. Review the events and identify the
Group Policy events that have been entered in this log. Which events are related to Group Policy
application and which are related to the activities you have been performing to manage Group
Policy? Note that depending on how long the virtual machine has been running, you may not have
any Group Policy Events in the application log.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 5-43

5.

Browse to the Group Policy Operational log and locate the first event related in the Group Policy
refresh you initiated in Exercise 1, with the GPUpdate command. Review that event and the events
that followed it.

Results: After this exercise, you should have successfully used RSoP tools to verify the correct application
of your GPOs.

Exercise 4: Managing GPOs


Scenario

You must back up all critical GPOs. You use the Group Policy Management backup feature to back up the
ADATUM Standard GPO.
The main tasks for this exercise are as follows:
1.

Perform a backup of GPOs.

2.

Perform a restore of GPOs.

3.

To prepare for the next module.

Task 1: Perform a backup of GPOs


1.

Switch to LON-DC1, and in the Group Policy Management console, in the navigation pane, click on
the Group Policy Objects folder.

2.

Back up the ADATUM Standards GPO to C:\.

Task 2: Perform a restore of GPOs

In the Group Policy Management console, restore the previous back up of ADATUM Standards.

To prepare for the next module


When you have finished the lab, revert all virtual machines back to their initial state.

Results: After this exercise, you should have successfully performed common management tasks on your
GPOs.

Module Review and Takeaways


Common Issues and Troubleshooting Tips
Common Issue

Troubleshooting Tip

Group Policy settings are not applied to all


users or computers in OU where GPO is
applied

Group Policy settings sometimes need two


restarts to apply

Tools
Tool

Use for

Where to find it

Group policy reporting RSoP

Reporting information about the


current policies being delivered to
clients.

Group Policy Management


Console

GPResult

A command-line utility that displays


RSoP information.

Command-line utility

GPUpdate

Refreshing local and Active Directory


Domain Services (AD DS)-based
Group Policy settings.

Command-line utility

Dcgpofix

Restoring the default Group Policy


objects to their original state after
initial installation.

Command-line utility

GPOLogView

Exporting Group Policy-related events


from the system and operational logs
into text, HTML, or XML files. For use
with Windows Vista, Windows 7, and
newer versions.

Command-line utility

Group Policy Management


scripts

Sample scripts that perform a number


of different troubleshooting and
maintenance tasks.

MCT USE ONLY. STUDENT USE PROHIBITED

5-44 Implementing a Group Policy Infrastructure

MCT USE ONLY. STUDENT USE PROHIBITED


6-1

Module 6
Managing User Desktops with Group Policy
Contents:
Module Overview

6-1

Lesson 1: Implementing Administrative Templates

6-2

Lesson 2: Configuring Folder Redirection and Scripts

6-7

Lesson 3: Configuring Group Policy Preferences

6-12

Lesson 4: Managing Software with Group Policy

6-16

Lab: Managing User Desktops with Group Policy

6-19

Module Review and Takeaways

6-23

Module Overview

Using Group Policy Objects (GPOs), you can implement desktop environments across your organization
by using Administrative Templates, Folder Redirection, Group Policy preferences, and where applicable,
use software deployment to install and update application programs. It is important to know how to use
these various GPO features so that you can configure your users computer settings properly.

Objectives
After completing this module, you will be able to:

Describe and implement Administrative Templates.

Configure folder redirection and scripts by using GPOs.

Configure GPO preferences.

Deploy software by using GPOs.

Lesson 1

Implementing Administrative Templates

MCT USE ONLY. STUDENT USE PROHIBITED

6-2 Managing User Desktops with Group Policy

The Administrative Template files provide the majority of available GPO settings, which modify specific
registry keys. Using Administrative Templates sometimes is referred to as registry-based policy. For many
applications, the use of registry-based policy that the Administrative Template files deliver is the most
simple and best way to support centralized management of policy settings. In this lesson, you will learn
how to configure Administrative Templates.

Lesson Objectives
After completing this lesson, you will be able to:

Describe Group Policy administrative templates.

Describe ADM and ADMX, or administrative template, files.

Describe the central store.

Describe example scenarios for using Administrative Templates.

Explain how to configure settings with Administrative Templates.

What Are Administrative Templates?


You can use Administrative Templates to
control the environment of an operating system
and the user experience. There are two sets of
Administrative Templates: one for users and one
for computers.
Using the Administrative Template sections of the
GPO, you can deploy hundreds of modifications
to the registry. Administrative Templates have the
following characteristics:

They are organized into subfolders that deal


with specific areas of the environment, such
as network, system, and Windows
components.

The settings in the computer section edit the HKEY_LOCAL_MACHINE hive in the registry, and the
settings in the user section edit the HKEY_CURRENT_USER hive in the registry.

Some settings exist for both user and computer. For example, there is a setting to prevent Windows
Messenger from running in both the user and the computer templates. In case of conflicting settings,
the computer setting prevails.

Some settings are available only to certain versions of Windows operating systems. For example, you
can apply a number of new settings only to Windows 7 and newer versions of the Windows operating
system. Double-clicking the settings displays the supported versions for that setting.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-3

What Are ADM and ADMX Files?


ADM Files
Traditionally, ADM files have been used to define
the settings that an administrator can configure
through Group Policy. Each successive Windows
operating system and service pack has included
a newer version of these files. ADM files use their
own markup language. Therefore, it is difficult
to customize ADM files. The ADM templates are
located in the %SystemRoot%\Inf folder.
A major drawback of ADM files is that they
are copied into every GPO that is created, and
consume about 3 megabytes (MB) of space. This can cause the System Volume (SYSVOL) folder to
become very large and increase replication traffic.

ADMX Files

Windows Vista and Windows Server 2008 introduced a new format for displaying registry-based policy
settings. These settings are defined by using a standards-based XML file format known as ADMX files.
These new files replace ADM files.
Group Policy tools on Windows Vista and newer operating systems, and Windows Server 2008, continue
to recognize the custom ADM files that you have in your existing environment, but ignore any ADM file
that ADMX files have superseded. Unlike ADM files, ADMX files are not stored in individual GPOs. The
GPO Editor automatically reads and displays settings from the local ADMX file store. By default, ADMX
files are stored in the Windows\PolicyDefinitions folder, but they can be stored in a central location.
ADMX files are language neutral. The plain language descriptions of the settings are not part of the
ADMX files. They are stored in language-specific ADML files. This means that administrators who speak
different languages, such as English and Spanish, can look at the same GPO and see the policy
descriptions in their own language, because they can each use their own language-specific ADML files.
ADML files are stored in a subfolder of the PolicyDefinitions folder. By default, only the ADML language
files for the language of the installed operating system are added.

Migrate Classic Administrative Templates to .ADMX

ADMX Migrator is a snap-in for the Microsoft Management Console (MMC) that simplifies the process of
converting your existing Group Policy ADM templates to the new ADMX format and provides a graphical
user interface for creating and editing Administrative Templates. You can download the ADMX Migrator
from the Microsoft Download website at http://go.microsoft.com/fwlink/?linkID=270013.

The Central Store


For domain-based enterprises, you can create a
central store location of ADMX files, which anyone
with permission to create or edit GPOs can access.
The GPO Editor on Windows Vista and Windows
Server 2008 (or newer) automatically reads and
displays Administrative Template policy settings
from ADMX files that the central store caches, and
then ignores the ones stored locally. If the domain
controller is not available, the local store is used.

MCT USE ONLY. STUDENT USE PROHIBITED

6-4 Managing User Desktops with Group Policy

You must create the central store, and then


update it manually on a domain controller. The
use of ADMX files is dependent on the computers
operating system where you are creating or editing the GPO. Therefore, the domain controller can be
a server with Windows 2000 or newer. The File Replication Service (FRS) will not replicate the domain
controller to that domains other controllers. Depending on your server operating system and
configuration, you can use either FRS or Distributed File System Replication (DFS-R) to replicate the data.
To create a central store for .admx and .adml files, create a folder that is named PolicyDefinitions in the
following location: \\FQDN\SYSVOL\FQDN\policies.

For example, to create a central store for the Test.Microsoft.com domain, create a PolicyDefinitions folder
in the following location: \\Test.Microsoft.Com\SYSVOL\Test.Microsoft.Com\Policies.
A user must copy all files and subfolders of the PolicyDefinitions folder. The PolicyDefinitions folder on a
Windows 7based computer resides in the Windows folder. The PolicyDefinitions folder stores all .admx
files and .adml files for all languages that are enabled on the client computer.
Note: You must update the PolicyDefintions for each service pack and for other additional
software, such as Microsoft Office 2010 ADMX files.

Discussion: Practical Uses of Administrative Templates


Spend a few minutes examining the
Administrative Templates, and consider how you
could employ some of them in your organization.
Be prepared to share information about your
organizations current use of GPOs and logon
scripts, such as:

How do you provide desktop security


currently?

How much administrative access do users


have to their systems?

Which Group Policy settings will you find


useful in your organization?

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-5

Demonstration: Configuring Settings with Administrative Templates

Group Policy editing tools in Windows Server 2012 provide several functionalities that ease configuration
and management of GPOs. In this demonstration, you will review these options.

Filter Policy Settings for Administrative Templates

A disadvantage in the Group Policy editing tools in previous Windows versions is the inability to search for
a specific policy setting. With thousands of policies to choose from, it can be difficult to locate exactly the
setting you want to configure. The Group Policy Management Editor in Windows Server 2012 solves this
problem for Administrative Template settings. You now can create filters to locate specific policy settings.
To create a filter:
1.

Right-click Administrative Templates, and then click Filter Options.

2.

To locate a specific policy, select the Enable keyword filters check box, enter the words with which
to filter, and then select the fields within which to search.

You also can filter for Group Policy settings that apply to specific versions of Windows, Windows Internet
Explorer, and other Windows components.
Unfortunately, the filter only applies to settings in the Administrative Templates nodes.

Filter Based on Comments

You also can search and filter based on policy-setting comments. Windows Server 2012 enables you to
add comments to policy settings in the Administrative Templates node. To do so, double-click a policy
setting, and then click the Comment tab.

It is a best practice to add comments to configured policy settings. You should document the justification
for a setting and its intended effect. You also should add comments to the GPO itself. Windows Server
2012 enables you to attach comments to a GPO. In the Group Policy Management Editor, in the console
tree, right-click the root node, click Properties, and then click the Comment tab.

How to Copy GPO Settings

Starter GPOs can contain only Administrative Templates policy settings. But in addition to using Starter
GPOs, there are two other ways to copy settings from one GPO into a new GPO:

You can copy and paste entire GPOs in the Group Policy Objects container of the GPMC, so that you
have a new GPO with all settings of the source GPO.

To transfer settings between GPOs in different domains or forests, right-click a GPO, and then click
Back Up. In the target domain, create a new GPO, right-click the GPO, and then click Import
Settings. You will be able to import the settings of the backed up GPO.

Additional Reading: Group Policy Search


http://go.microsoft.com/fwlink/?linkID=270014
This demonstration shows how to:

Filter Administrative Template policy settings.

Apply comments to Administrative Templates policy settings.

Add comments to Administrative Templates policy settings.

Create a new GPO by copying an existing GPO.

Create a new GPO by importing settings that were exported from another GPO.

Demonstration Steps
Filter Administrative Template policy settings
1.

On LON-DC1, open the Group Policy Management console.

2.

Create a new Group Policy Object (GPO) named GPO1.

3.

Open GPO1 for editing.

4.

Locate the User Configuration, Policies, Administrative Templates node.

5.

Filter the settings to display only those that contain the keywords screen saver.

6.

Filter the settings to display only configured values.

Add comments to a policy setting


1.

Locate the Personalization value from User Configuration\Policies\ Administrative Templates


\Control Panel.

2.

Add a comment to both the Password Protect the screen saver and Enable screen saver values.

Add comments to a GPO

Open the GPO1 policy root node, and then add a comment to the Comment tab.

Create a new GPO by copying an existing GPO

Copy GPO1, and then paste it to the Group Policy Objects folder.

Create a new GPO by importing settings that were exported from another GPO
1.

Back up GPO1.

2.

Create a new GPO called ADATUM Import.

3.

Import the settings from the GPO1 backup into the ADATUM Import GPO.

MCT USE ONLY. STUDENT USE PROHIBITED

6-6 Managing User Desktops with Group Policy

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-7

Lesson 2

Configuring Folder Redirection and Scripts


In Windows Server 2012, you can use GPOs to deploy scripts to users and computers. You also can
redirect folders that are included in the users profile to a central server. These features enable you to
configure the users desktop settings more easily and, where desirable, create a standardized desktop
environment that meets your organizational needs.

Lesson Objectives
After completing this lesson, you will be able to:

Describe folder redirection.

Explain the settings available for configuring folder redirection.

Describe security settings for redirected folders.

Explain how to configure folder redirection.

Describe Group Policy settings for applying scripts.

Explain how to configure scripts by using Group Policy.

What Is Folder Redirection?


You can use the Folder Redirection feature to
manage data effectively, and optionally, back up
data. By redirecting folders, you can ensure user
access to data regardless of the computers to
which the users sign in. Folder redirection has the
following characteristics:

When you redirect folders, you change


the folders storage location from the user
computers local hard disk to a shared folder
on a network file server.

After you redirect a folder to a file server, it


still appears to the user as if it is stored on the
local hard disk.

You can use the Offline Files technology in conjunction with redirection to synchronize data in the
redirected folder to the users local hard drive. This ensures that users have access to their data if a
network outage occurs or if the user is working offline.

Advantages of Folder Redirection


There are many advantages of folder redirection, including:

Users that sign in to multiple computers can access their data as long as they can access the network
share.

Offline folders allow users to access their data even if they disconnect from the local area network
(LAN).

Data that is stored on servers in network shares is backed up.

Roaming profile size can be reduced greatly by redirecting data from the profile.

Settings for Configuring Folder Redirection


In a GPO, the following settings are available for
folder redirection:

None. None is the default setting. Folder


redirection is not enabled.

Basic. Basic folder redirection is for:


o

Users who must redirect their folders to a


common area.

Users who need their data to be private.

Advanced. You can use Advanced redirection


to specify different network locations for
different Active Directory security groups.

Follow the Documents folder. Follow the Documents folder redirection is available only for the
Pictures, Music, and Videos folders. This setting makes the affected folder a subfolder of the
Documents folder.

Target Folder Locations for Basic and Advanced Settings


If you choose Basic or Advanced, you can choose from the following target folder locations:

MCT USE ONLY. STUDENT USE PROHIBITED

6-8 Managing User Desktops with Group Policy

Create a folder for each user under the root path. This option creates a folder in the form
\\server\share\User Account Name\Folder Name. For example, if you want to store your users
desktop settings in a shared folder called Documents, on a server called LON-DC1, you could define
the root path as \\lon-dc1\Documents.

Each user has a unique path for the redirected folder to ensure that data remains private. By default,
that user is granted exclusive rights to the folder. In the case of the Documents folder, the current
contents of the folder are moved to the new location.

Redirect to the following location. This option uses an explicit path for the redirection location. It
causes multiple users to share the same path for the redirected folder. By default, that user is granted
exclusive rights to the folder. In the case of the Documents folder, the current contents of the folder
are moved to the new location.

Redirect to the local user profile location. This option moves the location of the folder to the local user
profile under the Users folder.

Redirect to the users home directory. This option is available only for the Documents folder.

Note: After the initial creation and application of a GPO that delivers folder redirection
settings, users require two logons before redirection takes effect. This is because users will sign in
with cached credentials.
Question: Users in the same department often sign in to different computers. They need
access to their Documents folder. They also need data to be private. What folder redirection
setting would you choose?

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-9

Security Settings for Redirected Folders


You must create and configure the permissions
manually on a shared network folder to store the
redirected folders. However, folder redirection
also can create the users redirected folders.
Folder permissions are handled as follows:

When you use this option, the correct


subfolder permissions are set automatically.

If you manually create folders, you must know


the correct permissions. The slide illustrates
these permissions.

Demonstration: Configuring Folder Redirection


This demonstration shows how to:

Create a shared folder.

Create a GPO to redirect the Documents folder.

Test folder redirection.

Demonstration Steps
Create a shared folder
1.

On LON-DC1, create a folder named C:\Redirect.

2.

Share the folder to Everyone with Read/Write permission.

Create a GPO to redirect the Documents folder


1.

Open the Group Policy Management console. Create a GPO named Folder Redirection, and then
link it to the Adatum domain.

2.

Edit the Folder Redirection GPO.

3.

Configure the Documents folder properties to use the Basic-Redirect everyones folder to the
same location setting.

4.

Ensure that the Target folder location is set to Create a folder for each user under the root path.

5.

Specify the root path as \\LON-DC1\Redirect.

6.

Close all open windows on LON-DC1.

Test folder redirection


1.

Sign in to LON-CL1 as Adatum\Administrator with the password Pa$$w0rd.

2.

Check the properties of the Documents folder. The path will be \\LON-DC1\Redirect.

3.

Sign out of LON-CL1.

Group Policy Settings for Applying Scripts


You can use Group Policy scripts to perform a
number of tasks. There may be actions that you
need to perform every time a computer starts up
or shuts down, or when users sign in or sign off.
For example, you can use scripts to:

Clean up desktops when users sign out, and


shut down computers.

Delete the contents of temporary directories.

Map drives or printers.

Set environment variables.

MCT USE ONLY. STUDENT USE PROHIBITED

6-10 Managing User Desktops with Group Policy

Scripts that are assigned to the computer run in the security context of the Local System account. Scripts
that are assigned to the user who is logging on run in that users security context.
Other Group Policy settings control aspects of how scripts run. For example, if multiple scripts are
assigned, you can control whether they run synchronously or asynchronously.
You can write scripts in any scripting language that the Windows client can interpret, such as VBScript,
Jscript, or simple command or batch files.
Note: In Windows Server 2008 R2 and Windows Server 2012, the user interface (UI) in
Group Policy Editor for Logon, Logoff, Startup, and Shutdown scripts provides an additional tab
for Windows PowerShell scripts. You can deploy your Windows PowerShell script by adding it to
this tab. Windows Server 2008 R2, Windows Server 2012, Windows 7, or Windows 8 can run
Windows PowerShell scripts through Group Policy.

Scripts are stored in shared folders on the network. You need to ensure that the client has access to
that network location. If clients cannot access the network location, the scripts fail to run. Although any
network location stores scripts, as a best practice, use the Netlogon share because all users and computers
that are authenticated to Active Directory Domain Services (AD DS) have access to this location.
For many of these settings, using Group Policy preferences is a better alternative to configuring them in
Windows images or using logon scripts. Group Policy preferences are covered in more detail later in this
module.

Demonstration: Configuring Scripts with GPOs


This demonstration shows how to:

Create a logon script to map a network drive.

Create and link a GPO to use the script, and store the script in the Netlogon share.

Sign in to the client to test the results.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-11

Demonstration Steps
Create a logon script to map a network drive
1.

On LON-DC1, launch Notepad, and then type the following command:


Net use t: \\LON-dc1\Redirect

2.

Save the file as Map.bat.

3.

Copy the file to the clipboard.

Create and link a GPO to use the script, and store the script in the Netlogon share
1.

Use the Group Policy Management console to create a new GPO named Drivemap, and then link it
to the Adatum.com domain.

2.

Edit the GPO to configure a user logon script.

3.

Paste the Map.bat script into the Netlogon share.

4.

Add the Map.bat script to the logon scripts.

Sign in to the client to test the results


1.

On LON-CL1, sign in as Adatum\Administrator with the password Pa$$word.

2.

Verify that drive is mapped.

3.

Sign out of LON-CL1.

Lesson 3

Configuring Group Policy Preferences

MCT USE ONLY. STUDENT USE PROHIBITED

6-12 Managing User Desktops with Group Policy

In previous Windows Server versions, you could not use Group Policy to control common settings that
affect the user and computer environment, such as mapped drives. Typically, these settings were delivered
through logon scripts or imaging solutions.
However, Windows Server 2012 includes the Group Policy preferences built-in to the GPMC, which enable
settings such as mapped drives to be delivered through Group Policy. Additionally, you can configure
preferences by installing the Remote Server Administration Tools (RSAT) on a computer that is running
Windows 7 or Windows 8. This allows you to deliver many common settings by using Group Policy.

Lesson Objectives
After completing this lesson, you will be able to:

Describe Group Policy preferences.

Identify the differences between Group Policy settings and preferences.

Describe Group Policy preference features.

Explain how to configure settings by using preferences.

What Are Group Policy Preferences?


Group Policy preference extensions include more
than 20 Group Policy extensions that expand the
range of configurable settings within a GPO. You
now can use preferences to apply a number of
settings that had to be applied by scripts in the
past, such as drive mappings.
Group Policy preferences are supported natively
on Windows Server 2008 and newer versions, and
on Windows Vista Service Pack 2 (SP2) and newer
versions. You can download and install client-side
extensions (CSEs) of Group Policy preferences for
Windows Server 2003, Windows XP Service Pack 3
(SP3), and Windows Vista Service Pack 1 (SP1) to provide support for preferences on those systems.
Examples of the new Group Policy preference extensions include:

Folder Options

Drive Maps

Printers

Scheduled Tasks

Services

Start Menu

Configuring Group Policy preferences does not require any special tools or software installation, but they
are natively part of the GPMC in Windows Server 2008 (and newer), and are applied in the same manner
as Group Policy settings, by default. Preferences have two distinct sections: Windows Settings and Control
Panel Settings.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-13

When you configure a new preference, you can perform the following four basic actions:

Create. Create a new preference setting for the user or computer.

Delete. Remove an existing preference setting for the user or computer.

Replace. Delete and recreate a preference setting for the user or computer. The result is that Group
Policy preferences replace all existing settings and files associated with the preference item.

Update. Modify an existing preference setting for the user or computer.

Comparing Group Policy Preferences and GPO Settings


Preferences are similar to policies in that they
apply configurations to the user or computer.
However, there are several differences in the way
that you can configure and apply them. One of
these differences is that preferences are not
enforced. However, you can configure preferences
to be reapplied automatically.
The following is a list of other differences between
Group Policy settings and preferences:

Preference settings are not enforced.

Group Policy settings disable the user


interface for settings that the policy manages. Preferences do not do this.

Group Policy settings are applied at regular intervals. You can apply preferences once only or at
intervals.

The end user can change any preference setting that is applied through Group Policy, but policy
settings prevent users from changing them.

In some cases, you can configure the same settings through a policy setting as well as a preference
item. If conflicting preference and Group Policy settings are configured and applied to the same
object, the value of the policy setting always applies.

Features of Group Policy Preferences


After you create a Group Policy preference,
you must configure its properties. Different
preferences will require different input
information. For example, shortcut preferences
require target paths, whereas environment
variables require variable types and values.
Preferences also provide a number of features
in the common properties to assist in the
deployment.

General Properties Tab

MCT USE ONLY. STUDENT USE PROHIBITED

6-14 Managing User Desktops with Group Policy

The General Properties tab is where basic information is provided. The first step is to specify the action for
the preference: Create, Delete, Replace, or Update. Different settings will be available, depending on the
initial action selected. For example, when creating a drive mapping, you must provide a Universal Naming
Convention (UNC) path and an option for the drive letter, which you want to assign.

Common Properties Tab


The common properties are consistent for all preferences. You can use the Common Property tab to
control the behavior of the preference as follows:

Stop processing items in this extension if an error occurs. If an error occurs while processing a
preference, no other preferences in this GPO will process.

Run in logged-on users security context. Preferences can run as the System account or the logged-on
user. This setting forces the logged-on user context.

Remove this item when it is no longer applied. Unlike policy settings, preferences are not removed
when the GPO that delivered it is removed. This setting will change that behavior.

Apply once and do not reapply. Normally, preferences are refreshed at the same interval as Group
Policy settings. This setting changes that behavior to apply the setting only once on logon or startup.

Use Item-level targeting. One of the most powerful features of preferences is item-level targeting. You
can use this feature to specify criteria easily, so that you can determine exactly which users or
computers will receive a preference. Criteria includes, but is not limited to:
o

Computer name

IP address range

Operating system

Security group

User

Windows Management Instrumentation (WMI) queries

Demonstration: Configuring Group Policy Preferences


This demonstration shows how to:

Configure a desktop shortcut with Group Policy preferences.

Target the preference.

Configure a new folder with Group Policy preferences.

Target the preference.

Test the preference.

Demonstration Steps
Configure a desktop shortcut with Group Policy preferences
1.

On LON-DC1, in the Group Policy Management console, open the Default Domain Policy
for editing.

2.

Navigate to Computer Configuration\Preferences\ Windows Settings\Shortcuts.

3.

Create a new shortcut to the Notepad.exe program.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-15

Target the preference

Target the preference for the computer, LON-CL1.

Configure a new folder with Group Policy preferences


1.

Navigate to User Configuration\Preferences\Windows Settings\Folders.

2.

Create a new folder for the C:\Reports folder.

Target the preference

Target this preference for computers that are running the Windows 8 operating system.

Test the preferences


1.

Switch to LON-CL1, and refresh the group policies by using the following command at the command
prompt:
gpupdate /force

2.

Sign in and verify the presence of both the C:\Reports folder and the Notepad shortcut on the
Desktop.

Lesson 4

Managing Software with Group Policy

MCT USE ONLY. STUDENT USE PROHIBITED

6-16 Managing User Desktops with Group Policy

Windows Server 2012 includes a feature called Software Installation and Maintenance that AD DS,
Group Policy, and the Windows Installer service use to install, maintain, and remove software from your
organizations computers. In this lesson, you will learn how to manage software with Group Policy.

Lesson Objectives
After completing this lesson, you will be able to:

Describe how Group Policy software distribution addresses the software lifecycle.

Describe how Windows Installer enhances software distribution.

Describe the difference between assigning and publishing software.

Explain how to manage software upgrades by using Group Policy.

How Group Policy Software Distribution Helps to Address the Software


Lifecycle
The software lifecycle consists of four phases:
preparation, deployment, maintenance, and
removal. You can use Group Policy to manage all
phases except the preparation. You can apply
Group Policy settings to users or computers in a
site, domain, or organization unit (OU) to install,
upgrade, or remove software automatically.
By applying Group Policy settings to software, you
can manage the phases of software deployment
without deploying software on each computer
individually.

How Windows Installer Enhances Software Distribution


To enable Group Policy to deploy and manage
software, Windows Server 2012 uses the Windows
Installer service. This component automates the
installation and removal of applications by
applying a set of centrally defined setup rules
during the installation process. The Windows
Installer service installs the Microsoft Installer
(MSI) package files. MSI files contain a database
that stores all the instructions required to install
the application. Small applications may be
entirely stored as MSI files, whereas other larger
applications will have many associated source files
that the MSI references. Many software vendors provide MSI files for their applications.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-17

The Windows Installer service has the following characteristics:

This service runs with elevated privileges, so that software can be installed by the Windows Installer
service, no matter which user is logged onto the system. Users only require read access to the
software distribution point.

Applications are resilient. If an application becomes corrupted, the installer will detect and reinstall or
repair the application.

Windows Installer cannot install .exe files. To distribute a software package that installs with an .exe
file, the .exe file must be converted to an .msi file by using a third-party utility.
Question: Do users need administrative rights to install applications manually that have MSI
files?
Question: What are some disadvantages of deploying software through Group Policy?

Assigning and Publishing Software


There are two deployment types available for
delivering software to clients. Administrators can
either install software for users or computers in
advance by assigning the software, or give users
the option to install the software when they
require it by publishing the software in AD DS.
Both user and computer configuration sections
of a GPO have a Software Settings section. You
can add software to a GPO by adding a new
package to the Software Installation node, and
then specifying whether to assign or publish it.

You also can choose advanced deployment of a


package. Use this option to apply a customization file to a package for custom deployment. For
example, if you use the Office Customization tool to create a setup customization file to deploy Microsoft
Office 2010.

Assigning Software
Assigning software has the following characteristics:

When you assign software to a user, the users Start menu advertises the software when the user logs
on. Installation does not begin until the user double-clicks the application's icon or a file that is
associated with the application.

Users do not share deployed applications. When you assign software to a user, an application that
you install for one user through Group Policy will not be available to other users.

When you assign an application to a computer, the application is installed the next time that the
computer starts. The application will be available to all users of the computer.

Publishing Software
Publishing software has the following characteristics:

MCT USE ONLY. STUDENT USE PROHIBITED

6-18 Managing User Desktops with Group Policy

The Programs shortcut in Control Panel advertises a published program to the user. Users can install
the application by using the Programs applet, or you can set it up so that document activation installs
the application.

Applications that users do not have permission to install are not advertised to them.

Applications cannot be published to computers.

Note: When configuring Group Policy to deploy applications, they must be mapped to
UNC paths. If you use local paths, the deployment will fail.

Managing Software Upgrades by Using Group Policy


Software vendors occasionally release software
updates. These usually address minor issues, such
as an update or feature enhancements, which do
not warrant a complete application reinstallation.
Microsoft releases some software patches as .MSP
files.
Major upgrades that provide new functionality
require an upgrading of a software package to a
newer version. You can use the Upgrades tab to
upgrade a package by using the GPO. When you
perform upgrades by using Group Policy, youll
notice the following characteristics:

You may redeploy a package if the original Windows Installer file has been modified.

Upgrades will often remove the old version of an application and install a newer version, usually
maintaining application settings.

You can remove software packages if they were delivered originally by using Group Policy. This is
useful if a line-of-business (LOB) application is being replaced with a different application. Removal
can be mandatory or optional.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-19

Lab: Managing User Desktops with Group Policy


Scenario

A. Datum Corporation is a global engineering and manufacturing company with its head office in London,
U.K. An IT office and a data center are located in London to support the London head office and other
locations. A. Datum has recently deployed a Windows Server 2012 server and client infrastructure.
A. Datum has just opened up a new branch office. Users in this office require an automated method for
mapping drives to shared server resources and you decide to use Group Policy preferences. Furthermore,
you have been asked to create a shortcut to the Notepad application for all users that belong to the IT
security group. To help minimize profile sizes, you have been asked to configure folder redirection to
redirect several profile folders to each users home drive.

Objectives
After completing this lab, you will be able to:

Implement settings by using Group Policy preferences.

Configure folder redirection.

Lab Setup
Estimated Time: 45 minutes

Virtual Machines

20411B-LON-DC1
20411B-LON-CL1

User Name

Adatum\Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:

5.

User name: Administrator

Password: Pa$$w0rd

Domain: Adatum

Repeat steps 2 through 4 for 20411B-LON-CL1.

Exercise 1: Implementing Settings by Using Group Policy Preferences


Scenario

A. Datum has been using logon scripts to provide users with drive mappings to file shares. The
maintenance of these scripts is an ongoing problem because they are large and complex. Your manager
has asked you to implement the drive mappings by using Group Policy preferences so that logon scripts
can be removed. You also have been asked to place a shortcut to the Notepad application for all users
that belong to the IT security group.

The main tasks for this exercise are as follows:


1.

Create the required logon script.

2.

Create a new GPO, and link it to the Branch Office 1 organization unit (OU).

3.

Edit the Default Domain Policy with the required Group Policy preferences.

4.

Test the preferences.

Task 1: Create the required logon script

MCT USE ONLY. STUDENT USE PROHIBITED

6-20 Managing User Desktops with Group Policy

1.

Sign in to LON-DC1 as Adatum\Administrator with the password Pa$$w0rd.

2.

Open File Explorer and create a folder, and then share it with Specific people by using the following
properties:

3.

Path: C:\Branch1

Share name: Branch1

Permissions: Everyone, Read/Write.

Launch Notepad, and then type the following command:


Net use S: \\LON-dc1\Branch1

4.

Save the file to the desktop as BranchScript.bat.

5.

On the desktop, copy the file to the Clipboard. You will paste the file into the appropriate folder later
in the lab.

Task 2: Create a new GPO, and link it to the Branch Office 1 organization unit (OU)
1.

On LON-DC1, open Active Directory Users and Computers, and then create an organizational unit
(OU) in the Adatum.com domain called Branch Office 1.

2.

Move user Holly Dickson from the IT OU to the Branch Office 1 OU.

3.

Move the LON-CL1 computer to the Branch Office 1 OU.

4.

Open the Group Policy Management console.

5.

Create and link a new GPO named Branch1 to the Branch Office 1 organizational unit.

6.

Open the Branch1 GPO for editing.

7.

Edit the GPO to configure a user logon script.

8.

Paste the BranchScript.bat script into the Netlogon share.

9.

Add the BranchScript.bat script to the logon scripts GPO setting.

Task 3: Edit the Default Domain Policy with the required Group Policy preferences
1.

On LON-DC1, open the Default Domain Policy for editing.

2.

Navigate to User Configuration\Preferences\Windows Settings\Shortcuts.

3.

Create a new shortcut to the Notepad.exe program:


o

Name: Notepad

Action: Create

Location: Desktop

Target path: C:\Windows\notepad.exe

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-21

4.

Target the preference for members of the IT security group.

5.

Close all open windows.

Task 4: Test the preferences


1.

Switch to LON-CL1 and restart the computer.

2.

Sign in as Adatum\Administrator with the password Pa$$w0rd.

3.

Open the Command Prompt window, and then use the gpupdate /force command to refresh the
Group Policy.

4.

Sign out of LON-CL1.

5.

Sign in as Adatum\Holly with the password Pa$$w0rd.

6.

Verify that a drive is mapped to \\LON-DC1\Branch1.

7.

Verify that the shortcut to Notepad is on Hollys desktop.

8.

If the shortcut does not appear, repeat steps 2 through 5.

9.

Sign out of LON-CL1.

Results: After this exercise, you should have created the required scripts and preference settings
successfully, and then assigned them by using GPOs.

Exercise 2: Configuring Folder Redirection


Scenario

In order to help minimize profile sizes, you have been asked to configure folder redirection for the branch
office users to redirect several profile folders to each users home drive.
The main tasks for this exercise are as follows:
1.

Create a shared folder to store the redirected folders.

2.

Create a new GPO and link it to the branch office OU.

3.

Edit the folder redirection settings in the policy.

4.

Test the folder redirection settings.

Task 1: Create a shared folder to store the redirected folders

On LON-DC1, open File Explorer and then create a folder and share it with Specific people by using
the following properties:
o

Path: C:\Branch1\Redirect

Share name: Branch1Redirect

Permissions: Everyone, Read/Write

Task 2: Create a new GPO and link it to the branch office OU

On LON-DC1, open Group Policy Management and then create and link a new GPO named Folder
Redirection to the Branch Office 1 OU.

Task 3: Edit the folder redirection settings in the policy

MCT USE ONLY. STUDENT USE PROHIBITED

6-22 Managing User Desktops with Group Policy

1.

Open the Folder Redirection GPO for editing.

2.

Under User Configuration, browse to Folder Redirection and then configure the Documents folder
properties to use the Basic-Redirect everyones folder to the same location setting.

3.

Ensure that the Target folder location is set to Create a folder for each user under the root path.

4.

Specify the root path as \\LON-DC1\Branch1Redirect.

5.

Close all open windows on LON-DC1.

Task 4: Test the folder redirection settings


1.

Switch to LON-CL1.

2.

Sign in as Adatum\Administrator with the password Pa$$w0rd.

3.

Open the Command Prompt window, and use the gpupdate /force command to refresh the
Group Policy.

4.

Sign out and then sign in as Adatum\Holly with the password Pa$$word.

5.

Browse to the desktop.

6.

Right-click the desktop and use the Personalize menu to enable Users Files on the desktop.

7.

From the Desktop, open the Holly Dickson folder.

8.

Right-click My Documents, and then click Properties.

9.

In the My Document Properties dialog box, note that the location of the folder is now the network
share in a subfolder named for the user.

10. If the folder redirection is not evident, sign out, and then sign in as Adatum\Holly with the password
Pa$$word. Repeat steps 7 to 9.
11. Sign out of LON-CL1.

Results: After this exercise, you should have successfully configured folder redirection to a shared folder
on the LON-DC1 server.

To prepare for the next module

When you finish the lab, revert the virtual machines to their initial state. To do this, perform the following
steps:
1.

On the host computer, start Hyper-V Manager.

2.

In the Virtual Machines list, right-click 20411B-LON-DC1, and then click Revert.

3.

In the Revert Virtual Machine dialog box, click Revert.

4.

Repeat steps 2 and 3 for 20411B-LON-CL1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 6-23

Module Review and Takeaways


Best Practices Related to Group Policy Management

Include comments on GPO settings

Use a central store for Administrative Templates when having clients with Windows Vista, Windows 7,
and Windows 8

Use Group Policy preferences to configure settings that are not available in the Group Policy set of
settings

Use Group Policy software installation to deploy packages in .msi format to a large number of users
or computers

Common Issues and Troubleshooting Tips


Common Issue
You have configured folder redirection for
an OU, but none of the users folders are
being redirected to the network location.
When you look in the root folder, you
observe that a subdirectory named for
each user has been created, but they are
empty.
You have assigned an application to an
OU. After multiple logons, users report that
no one has installed the application.

You have a mixture of Windows XP and


Windows 8 computers. After configuring
several settings in the Administrative
Templates of a GPO, users with Windows
XP operating system report that some
settings are being applied and others are
not.
Group Policy preferences are not being
applied.

Troubleshooting Tip

Review Questions
Question: Why do some Group Policy settings take two logons before going into effect?
Question: How can you support Group Policy preferences on Windows XP?
Question: What is the benefit of having a central store?
Question: What is the main difference between Group Policy settings and Group Policy
preferences?
Question: What is the difference between publishing and assigning software through Group
Policy?
Question: Can you use Windows PowerShell scripts as startup scripts?

MCT USE ONLY. STUDENT USE PROHIBITED

6-24 Managing User Desktops with Group Policy

MCT USE ONLY. STUDENT USE PROHIBITED


7-1

Module 7
Configuring and Troubleshooting Remote Access
Contents:
Module Overview

7-1

Lesson 1: Configuring Network Access

7-2

Lesson 2: Configuring VPN Access

7-10

Lesson 3: Overview of Network Policies

7-19

Lesson 4: Troubleshooting Routing and Remote Access

7-25

Lab A: Configuring Remote Access

7-30

Lesson 5: Configuring DirectAccess

7-34

Lab B: Configuring DirectAccess

7-47

Module Review and Takeaways

7-56

Module Overview

Most organizations have users that work remotely, perhaps from home or maybe from customer sites.
To facilitate and support these remote connections, you must implement remote access technologies to
support this distributed workforce. You must become familiar with the technologies that enable remote
users to connect to your organizations network infrastructure. These technologies include virtual private
networks (VPNs), and DirectAccess, a feature of the Windows 7 and Windows 8 operating systems. It is
important that you understand how to configure and secure your remote access clients by using network
policies. This module explores these remote access technologies.

Objectives
After completing this module, you will be able to:

Configure network access.

Create and configure a VPN solution.

Describe the role of network policies.

Troubleshoot routing and remote access.

Configure DirectAccess.

Lesson 1

Configuring Network Access

MCT USE ONLY. STUDENT USE PROHIBITED

7-2 Configuring and Troubleshooting Remote Access

Network Access in the Windows Server 2012 operating system provides the required services that enable
remote users to connect to your network. To support the needs of both your organization and your
remote users, it is important that you are able to install and configure these Windows Server 2012
network access components successfully.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the components of a Network Access Services infrastructure.

Describe the Network Policy and Access Services role.

Describe Routing and Remote access.

Explain network access authentication and authorization.

Explain the types of authentication methods that are used for network access.

Describe a public key infrastructure (PKI).

Explain how Dynamic Host Configuration Protocol (DHCP) servers are used with the Routing and
Remote Access Service.

Components of a Network Access Services Infrastructure


The underlying infrastructure in a complete
Network Access Services infrastructure in
Windows Server 2012 typically includes the
following components:

Virtual Private Network (VPN) Server. Provides


remote access connectivity based on various
VPN tunneling protocols over a public
network, such as the Internet.

Active Directory Domain Services (AD DS).


Services authentication requests from remote
access client connection attempts.

Active Directory Certificate Services (AD CS). You can use digital certificates to provide for
authentication in remote access scenarios. By deploying AD CS, you can create a PKI in your
organization to support the issue, management, and revocation of certificates.

DHCP Server. Supplies accepted inbound remote access connections with an IP configuration for
network connectivity to the corporate local area network (LAN).

Network Policy Server (NPS). Provides authentication services for other network access components.

Network Access Protection (NAP) components:


o

NAP Health Policy Server. Evaluates system health against configured health policies that
describe health requirements and enforcement behaviors, such as requiring that connecting
clients must be compliant before they gain access to the network.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-3

Health Registration Authority (HRA). Obtains health certificates for clients that pass the health
policy verification.

Remediation Servers. Provide remediation services to those clients that do not meet the health
requirements for the corporate network. Remediation Servers are special servers on a limited
network.

What Is the Network Policy and Access Services Role?


The Network Policy and Access Services role in
Windows Server 2012 provides the following
network connectivity solutions:

Enforces health policies. Establishes and


enforces health policies automatically, which
can include software requirements, security
update requirements, and required computer
configurations.

Helps to secure wireless and wired access.


When you deploy 802.1X wireless access
points, secure wireless access provides
wireless users with a secure certificate or
password-based authentication method that is simple to deploy. When you deploy 802.1X
authenticating switches, they allow you to secure your wired network by ensuring that intranet users
are authenticated before they can connect to the network or obtain an IP address using DHCP.

Centralizes network policy management with Remote Authentication Dial-in User Service (RADIUS)
server and proxy. Rather than configuring network access policy at each network access server (such
as wireless access points, 802.1X authenticating switches, VPN servers, and dial-up servers), you can
create policies in a single location that specify all aspects of network connection requests. These
policies can include who is allowed to connect, when they can connect, and the level of security that
they must use to connect to your network.
Note: The Remote Access components are a separate server role in Windows Server 2012.

What Is the Remote Access Role?


The Remote Access role enables you to provide
users with remote access to your organizations
network using one of the following technologies:

VPN Access. A VPN provides a point-to-point


connection between components of a private
network through a public network, such as
the Internet. Tunneling protocols enable a
VPN client to establish and maintain a
connection to a VPN servers listening virtual
port. You also can connect branch offices to
your network with VPN solutions, deploy fullfeatured software routers on your network,
and share Internet connections across the intranet.

DirectAccess. DirectAccess enables seamless remote access to intranet resources without the user first
establishing a VPN connection. DirectAccess ensures seamless connectivity to the application
infrastructure for both internal users and remote users.

You can deploy the following technologies during the installation of the Remote Access role:

MCT USE ONLY. STUDENT USE PROHIBITED

7-4 Configuring and Troubleshooting Remote Access

DirectAccess and VPN Remote Access Service (RAS). Using DirectAccess and VPN RAS, you can enable
and configure:
o

DirectAccess solutions for your organization.

VPN connections to provide end users with remote access to your organizations network.

Routing. This provides a full-featured software router and an open platform for routing and Internet
working. It offers routing services to businesses in LAN and wide area network (WAN) environments.
When you choose routing, Network Address Translation (NAT) is also installed. When you deploy
NAT, the server that is running Remote Access is configured to share an Internet connection with
computers on a private network, and to translate traffic between its public address and the private
network. By using NAT, the computers on the private network gain some measure of protection
because the router on which you configure NAT does not forward traffic from the Internet into the
private network unless a private network client requests it or traffic is explicitly allowed.

When you deploy VPN and NAT, you configure the server that is running Remote Access to provide
NAT for the private network, and to accept VPN connections. Computers on the Internet will not be
able to determine the IP addresses of computers on the private network. However, VPN clients will be
able to connect to computers on the private network as if they were physically attached to the same
network.

Network Authentication and Authorization


The distinction between authentication and
authorization is important in understanding why
connection attempts are accepted or denied:

Authentication is the verification of the


connection attempts credentials. This process
consists of sending the credentials from the
remote access client to the Remote Access
server in either plaintext or encrypted form
by using an authentication protocol.

Authorization is the verification that the


connection attempt is allowed. Authorization
occurs after successful authentication.

For a connection attempt to be accepted, the connection attempt must be authenticated and authorized.
It is possible for the connection attempt to be authenticated by using valid credentials, but not
authorized; in this case, the connection attempt is denied.
If you configure a Remote Access server for Windows Authentication, the security features of Windows
Server 2012 verify the authentication credentials, while the user accounts dial-in properties and locally
stored remote access policies authorize the connection. If the connection attempt is both authenticated
and authorized, then the connection attempt is accepted.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-5

If you configure the Remote Access server for RADIUS authentication, the connection attempts
credentials are passed to the RADIUS server for authentication and authorization. If the connection
attempt is both authenticated and authorized, the RADIUS server sends an accept message back to the
Remote Access server and the connection attempt is accepted. If the connection attempt is either not
authenticated or not authorized, the RADIUS server sends a reject message back to the Remote Access
server and the connection attempt is rejected.

Authentication Methods
The authentication of access clients is an
important security concern. Authentication
methods typically use an authentication
protocol that is negotiated during the connection
establishment process. The following methods
are supported by the Remote Access role.

PAP

Password Authentication Protocol (PAP) uses


plaintext passwords and is the least secure
authentication protocol. It typically is negotiated if
the remote access client and Remote Access server
cannot negotiate a more secure form of
validation. PAP is included in Microsoft Windows Server 2012 to support older client operating systems
than support no other authentication method.

CHAP

The Challenge Handshake Authentication Protocol (CHAP) is a challenge-response authentication


protocol that uses the industry-standard MD5 hashing scheme to encrypt the response. Various vendors
of network access servers and clients use CHAP. Because CHAP requires the use of a reversibly encrypted
password, you should consider using another authentication protocol, such as Microsoft Challenge
Handshake Authentication Protocol (MS-CHAP) version 2.

MS-CHAP V2
MS-CHAP v2 is a one-way, encrypted password, mutual-authentication process that works as follows:
1.

The authenticator (the Remote Access server or the computer that is running NPS) sends a challenge
to the remote access client. The challenge consists of a session identifier and an arbitrary challenge
string.

2.

The remote access client sends a response that contains a one-way encryption of the received
challenge string, the peer challenge string, the session identifier, and the user password.

3.

The authenticator checks the response from the client and sends back a response containing an
indication of the success or failure of the connection attempt and an authenticated response based
on the sent challenge string, the peer challenge string, the clients encrypted response, and the user
password.

4.

The remote access client verifies the authentication response and, if correct, uses the connection. If
the authentication response is not correct, the remote access client terminates the connection.

EAP

MCT USE ONLY. STUDENT USE PROHIBITED

7-6 Configuring and Troubleshooting Remote Access

With the Extensible Authentication Protocol (EAP), an arbitrary authentication mechanism authenticates
a remote access connection. The remote access client and the authenticator (either the Remote Access
server or the RADIUS server) negotiate the exact authentication scheme to be used. Routing and Remote
Access includes support for EAP-Transport Level Security (EAP-TLS) by default. You can plug in other EAP
modules to the server that is running Routing and Remote Access to provide other EAP methods.

Other Options

In addition to the previously mentioned authentication methods, there are two other options that you can
enable when selecting an authentication method:

Unauthenticated Access. Strictly speaking, this is not an authentication method, but rather the lack of
one. Unauthenticated access allows remote systems to connect without authentication. This option
should never be enabled in a production environment, however, as it leaves your network at risk.
Nonetheless, this option can sometimes be useful for troubleshooting authentication issues in a test
environment.

Machine Certificate for Internet Key Exchange version 2 (IKEv2). Select this option if you wish to use
VPN Reconnect.

What Is a PKI?
A PKI consists of several components that help
you secure corporate communications and
transactions, including those used in remote
access scenarios. There are many components
that are required to work together to provide a
complete PKI solution. The PKI components in
Windows Server 2012 are:

Certification Authority (CA). CA issues and


manages digital certificates for users, services,
and computers. By deploying CA, you
establish the PKI in your organization.

Digital certificates. Digital certificates are


similar in function to an electronic passport. A digital certificate is used to prove the identity of the
user (or other entity). Digital certificates contain the electronic credentials that are associated with a
public key and a private key, which are used to authenticate users and other devices such as Web
servers and mail servers. Digital certificates also ensure that software or code is run from a trusted
source. Digital certificates contain various fields, such as Subject, Issuer, and Common Name. These
fields are used to determine the specific use of the certificate. For example, a Web server certificate
might contain the Common Name field of web01.contoso.com, which would make that certificate
valid only for that web server. If an attempt were made to use that certificate on a web server named
web02.contoso.com, the user of that server would receive a warning.

Certificate templates. This component describes the content and purpose of a digital certificate. When
requesting a certificate from an AD CS enterprise CA, the certificate requestor will, depending on his
or her access rights, be able to select from a variety of certificate types based on certificate templates,
such as User and Code Signing. The certificate template saves users from low-level, technical decisions
about the type of certificate they need. In addition, they allow administrators to distinguish who
might request which certificates.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-7

CRLs and Online Responders.


o

Certificate revocation lists (CRLs) are complete, digitally signed lists of certificates that have been
revoked. These lists are published periodically and can be retrieved and cached by clients, based
on the configured lifetime of the CRL. The lists are used to verify a certificates revocation status.

Online Responders are part of the Online Certificate Status Protocol (OCSP) role service in
Windows Server 2008 and Windows Server 2012. An Online Responder can receive a request to
check for revocation of a certificate without requiring the client to download the entire CRL. This
speeds up certificate revocation checking, and reduces the network bandwidth. It also increases
scalability and fault tolerance by allowing for array configuration of Online Responders.

Public keybased applications and services. This relates to applications or services that support public
key encryption. In other words, the application or services must be able to support public key
implementations to gain the benefits from it.

Certificate and CA management tools. Management tools provide command-line and GUI-based
tools to:
o

Configure CAs.

Recover archived private keys.

Import and export keys and certificates.

Publish CA certificates and CRLs.

Manage issued certificates.

Authority information access (AIA) and CRL distribution points (CDPs). AIA points determine the
location where CA certificates can be found and validated, and CDP locations determine the points
where certificate revocation lists can be found during certificate validation process. Because CRLs can
become large, (depending on the number of certificates issued and revoked by a CA), you can also
publish smaller, interim CRLs called delta CRLs. Delta CRLs contain only the certificates revoked since
the last regular CRL was published. This allows clients to retrieve the smaller delta CRLs and more
quickly build a complete list of revoked certificates. The use of delta CRLs also allows revocation data
to be published more frequently, because the size of a delta CRL means that it usually does not
require as much time to transfer as a full CRL.

Hardware security module (HSM). A hardware security module is an optional secure cryptographic
hardware device that accelerates cryptographic processing for managing digital keys. It is a high
security, specialized storage that is connected to the CA for managing the certificates. An HSM is
typically attached to a computer physically. This is an optional add-on in your PKI, and is most widely
used in high security environments where there would be a significant impact if a key were
compromised.

Integrating DHCP with Routing and Remote Access


You can deploy the DHCP role with the Remote
Access role, which provides remote access clients
with a dynamically assigned IP address during
connection. When you use these services together
on the same server, the information that is
provided during dynamic configuration is
provided in a way that is different from typical
DHCP configuration for LANbased clients.
In LAN environments, DHCP clients negotiate and
receive the following configuration information,
based entirely on settings that you configure in
the DHCP console for the DHCP server:

MCT USE ONLY. STUDENT USE PROHIBITED

7-8 Configuring and Troubleshooting Remote Access

A leased IP address that is provided from an available address pool of an active scope on the DHCP
server. The DHCP server directly manages and distributes the address to the LAN-based DHCP client.

Additional parameters and other configuration information that assigned DHCP options in the
address lease provided. The values and list of options correspond to option types that you configure
and assign on the DHCP server.

When a Remote Access server provides dynamic configuration for remote access clients, it first performs
the following steps:
1.

When the server that is running Remote Access starts with the Use DHCP to assign remote TCP/IP
addresses option, it instructs the DHCP client to obtain 10 IP addresses from a DHCP server.

2.

The Remote Access server uses the first of these 10 IP addresses that are obtained from the DHCP
server for the Remote Access server interface.

3.

The remaining nine addresses are allocated to TCP/IP-based clients as they dial in to establish a
session with the Remote Access server.

IP addresses that are freed when remote access clients disconnect are reused. When all 10 IP addresses are
used, the Remote Access server obtains 10 more from a DHCP server. When the Routing and Remote
Access service stops, all IP addresses that were obtained through DHCP are released.
When the Remote Access server uses this type of proactive caching of DHCP address leases for dial-up
clients, it records the following information for each lease response that it obtains from the DHCP server:

The IP address of the DHCP server.

The client-leased IP address (for later distribution to the Routing and Remote Access client).

The time at which the lease was obtained.

The time at which the lease expires.

The lease duration.

All other DHCP option information that the DHCP server returnssuch as server, scope, or reservation
optionsis discarded. When the client dials in to the server and requests an IP address (that is, when
Server Assigned IP Address is selected), it uses a cached DHCP lease to provide the dial-up client with
dynamic IP address configuration.

When the IP address is provided to the dial-up client, the client is unaware that the IP address has been
obtained through this intermediate process between the DHCP server and the Remote Access server. The
Remote Access server maintains the lease on the clients behalf. Therefore, the only information that the
client receives from the DHCP server is the IP address.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-9

In dial-up environments, DHCP clients negotiate and receive dynamic configuration using the following
modified behavior:

A leased IP address from the Routing and Remote Access server cache of DHCP scope addresses. The
Routing and Remote Access server obtains and renews its cached address pool with the DHCP server.

If the DHCP server typically provides the additional parameters and other configuration information
that currently is provided through assigned DHCP options in the address lease, this information is
returned to the Remote Access client based on TCP/IP properties that are configured on the Remote
Access server.

Note: DHCP servers that are running Windows Server 2012 provide a predefined user
classthe Default Routing and Remote Access Classfor assigning options that are provided
only to Routing and Remote Access clients. To assign these options, you must create a DHCP
policy with a condition of the User Class Equals Default Routing and Remote Access Class.
Then, configure the required options.

Lesson 2

Configuring VPN Access

MCT USE ONLY. STUDENT USE PROHIBITED

7-10 Configuring and Troubleshooting Remote Access

To properly implement and support a VPN environment within your organization, it is important that you
understand how to select a suitable tunneling protocol, how to configure VPN authentication, and how to
configure the Network Policy and Access Services server role to support your chosen configuration.

Lesson Objectives
After completing this lesson, you will be able to:

Describe what a VPN connection is, and how it is used to connect remote network clients.

Describe the tunneling protocols used for a VPN connection.

Describe VPN Reconnect.

Describe configuration requirements for a VPN connection.

Explain how to configure VPN access.

Describe additional tasks that you can be completed after configuring a VPN server.

Describe the features in and benefits of the Connection Manager Administration Kit.

Explain how to create a connection profile using the Connection Manager Administration Kit.

What Is a VPN Connection?


To emulate a point-to-point link, data is
encapsulated (or wrapped) and prefixed with a
header; this header provides routing information
that enables the data to traverse the shared or
public network to reach its endpoint.
To emulate a private link, data is encrypted
to ensure confidentiality. Packets that are
intercepted on the shared or public network are
indecipherable without encryption keys. The link
in which the private data is encapsulated and
encrypted is known as a VPN connection.
There are two types of VPN connections:

Remote access

Site-to-site

Remote Access VPN


Remote access VPN connections enable your users who are working offsite (for example, at home, at a
customer site, or from a public wireless access point) to access a server on your organizations private
network using the infrastructure that a public network provides, such as the Internet. From the users
perspective, the VPN is a point-to-point connection between the computer, the VPN client, and your
organizations server. The exact infrastructure of the shared or public network is irrelevant because it
appears logically as if the data is sent over a dedicated private link.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-11

Site-to-Site VPN

Site-to-site VPN connections, which are also known as router-to-router VPN connections, enable your
organization to have routed connections between separate offices (or with other organizations) over a
public network while helping to maintain secure communications. A routed VPN connection across the
Internet logically operates as a dedicated WAN link. When networks connect over the Internet, a router
forwards packets to another router across a VPN connection. To the routers, the VPN connection operates
as a data-link layer link.

A site-to-site VPN connection connects two portions of a private network. The VPN server provides a
routed connection to the network to which the VPN server is attached. The calling router (the VPN client)
authenticates itself to the answering router (the VPN server), and for mutual authentication, the answering
router authenticates itself to the calling router. In a site-to site VPN connection, the packets sent from
either router across the VPN connection typically do not originate at the routers.

Properties of VPN Connections

VPN connections that use the Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol with
Internet Protocol Security (L2TP/IPsec), and Secure Socket Tunneling Protocol (SSTP), have the following
properties:

Encapsulation. With VPN technology, private data is encapsulated with a header containing routing
information that allows the data to traverse the transit network.

Authentication. Authentication for VPN connections takes the following three different forms:

User-level authentication by using Point-to-Point Protocol (PPP) authentication. To establish the


VPN connection, the VPN server authenticates the VPN client that is attempting the connection
by using a PPP user-level authentication method, and verifies that the VPN client has the
appropriate authorization. If you use mutual authentication, the VPN client also authenticates the
VPN server, which provides protection against computers that are masquerading as VPN servers.

Computer-level authentication by using Internet Key Exchange (IKE). To establish an IPsec


security association, the VPN client and the VPN server use the IKE protocol to exchange either
computer certificates or a pre-shared key. In either case, the VPN client and server authenticate
each other at the computer level. We recommend computer-certificate authentication because it
is a much stronger authentication method. Computer-level authentication is only performed for
L2TP/IPsec connections.

Data origin authentication and data integrity. To verify that the data sent on the VPN connection
originated at the other end of the connection and was not modified in transit, the data contains a
cryptographic checksum based on an encryption key known only to the sender and the receiver.
Data origin authentication and data integrity are only available for L2TP/IPsec connections.

Data encryption. To ensure the confidentiality of data as it traverses the shared or public transit
network, the sender encrypts the data, and the receiver decrypts it. The encryption and decryption
processes depend on the sender and the receiver both using a common encryption key.

Packets that are intercepted in the transit network are unintelligible to anyone who does not have the
common encryption key. The encryption keys length is an important security parameter. You can use
computational techniques to determine the encryption key. However, such techniques require more
computing power and computational time as the encryption keys get larger. Therefore, it is important
to use the largest possible key size to ensure data confidentiality.

Tunneling Protocols for VPN Connections


PPTP, L2TP, and SSTP depend heavily on the
features originally specified for PPP. PPP was
designed to send data across dial-up or
dedicated point-to-point connections. For IP,
PPP encapsulates IP packets within PPP frames,
and then transmits the encapsulated PPP packets
across a point-to-point link. PPP was defined
originally as the protocol to use between a dial-up
client and a network access server.

PPTP

MCT USE ONLY. STUDENT USE PROHIBITED

7-12 Configuring and Troubleshooting Remote Access

PPTP enables you to encrypt and encapsulate in


an IP header multi-protocol traffic that then is
sent across an IP network or a public IP network, such as the Internet. You can use PPTP for remote access
and site-to-site VPN connections. When using the Internet as the VPN public network, the PPTP server is a
PPTPenabled VPN server with one interface on the Internet, and a second interface on the intranet.

Encapsulation. PPTP encapsulates PPP frames in IP datagrams for network transmission. PPTP uses a
Transmission Control Protocol (TCP) connection for tunnel management, and a modified version of
Generic Route Encapsulation (GRE) to encapsulate PPP frames for tunneled data. Payloads of the
encapsulated PPP frames can be encrypted, compressed, or both.

Encryption. The PPP frame is encrypted with Microsoft Point-to-Point Encryption (MPPE) by using
encryption keys that are generated from the MS-CHAPv2 or EAP-TLS authentication process. VPN
clients must use the MS-CHAPv2 or EAP-TLS authentication protocol so that the payloads of PPP
frames are encrypted. PPTP uses the underlying PPP encryption and encapsulating a previously
encrypted PPP frame.

L2TP

L2TP enables you to encrypt multi-protocol traffic to send over any medium that supports point-to-point
datagram delivery, such as IP or asynchronous transfer mode (ATM). L2TP is a combination of PPTP and
Layer 2 Forwarding (L2F). L2TP represents the best features of PPTP and L2F.
Unlike PPTP, the Microsoft implementation of L2TP does not use MPPE to encrypt PPP datagrams. L2TP
relies on IPsec in Transport Mode for encryption services. The combination of L2TP and IPsec is known as
L2TP/IPsec.

To utilize L2TP/IPsec, both the VPN client and server must support L2TP and IPsec. Client support for L2TP
is built in to the Windows XP, Windows Vista, Windows 7, and Windows 8 remote access clients. VPN
server support for L2TP is built in to members of the Windows Server 2012, Windows Server 2008, and
Windows Server 2003 families.

Encapsulation: Encapsulation for L2TP/IPsec packets consists of two layers, L2TP encapsulation, and
IPsec encapsulation. L2TP encapsulates and encrypts data in the following way:
o

First layer. The first layer is the L2TP encapsulation. A PPP frame (an IP datagram) is wrapped with
an L2TP header and a User Datagram Protocol (UDP) header.

Second layer. The second layer is the IPsec encapsulation. The resulting L2TP message is wrapped
with an IPsec encapsulating security payload (ESP) header and trailer, an IPsec Authentication
trailer that provides message integrity and authentication, and a final IP header. The IP header
contains the source and destination IP address that corresponds to the VPN client and server.

Encryption: The L2TP message is encrypted with either Advanced Encryption Standard (AES) or Triple
Data Encryption Standard (3DES) by using encryption keys that the IKE negotiation process generates.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-13

SSTP

SSTP is a tunneling protocol that uses the HTTP/Secure (HTTPS) protocol over TCP port 443 to pass
traffic through firewalls and web proxies, which otherwise might block PPTP and L2TP/IPsec traffic. SSTP
provides a mechanism to encapsulate PPP traffic over the Secure Sockets Layer (SSL) channel of the HTTPS
protocol. The use of PPP allows support for strong authentication methods, such as EAP-TLS. SSL provides
transport-level security with enhanced key negotiation, encryption, and integrity checking.
When a client tries to establish a SSTP-based VPN connection, SSTP first establishes a bidirectional HTTPS
layer with the SSTP server. Over this HTTPS layer, the protocol packets flow as the data payload using the
following encapsulation and encryption methods:

Encapsulation. SSTP encapsulates PPP frames in IP datagrams for transmission over the network. SSTP
uses a TCP connection (over port 443) for tunnel management and as PPP data frames.

Encryption. The SSTP message is encrypted with the SSL channel of the HTTPS protocol.

IKEv2

IKEv2 uses the IPsec Tunnel Mode protocol over UDP port 500. IKEv2 supports mobility making it a good
protocol choice for a mobile workforce. IKEv2-based VPNs enable users to move easily between wireless
hotspots, or between wireless and wired connections.
The use of IKEv2 and IPsec enables support for strong authentication and encryption methods.

Encapsulation. IKEv2 encapsulates datagrams by using IPsec ESP or Authentication Header (AH) for
transmission over the network.

Encryption. The message is encrypted with one of the following protocols by using encryption keys
that are generated from the IKEv2 negotiation process: AES 256, AES 192, AES 128, and 3DES
encryption algorithms.

IKEv2 is supported only on computers that are running Windows 7, Windows 8, Windows Server 2008 R2,
and Windows Server 2012. IKEv2 is the default VPN tunneling protocol in Windows 7 and Windows 8.

What Is VPN Reconnect?


In dynamic business scenarios, users must be able
to securely access data anytime, from anywhere,
and access it continuously, without interruption.
For example, users might want to securely access
data that is on the companys server, from a
branch office or while on the road.
To meet this requirement, you can configure
the VPN Reconnect feature that is available in
Windows Server 2012, Windows Server 2008 R2,
Windows 8, and Windows 7. With this feature,
users can access the companys data by using
a VPN connection, which will reconnect
automatically if connectivity is interrupted. VPN Reconnect also enables roaming between different
networks.

VPN Reconnect uses the IKEv2 technology to provide seamless and consistent VPN connectivity. Users
who connect via a wireless mobile broadband will benefit most from this capability. Consider a user with
a laptop that is running Windows 8. When the user travels to work in a train, he or she connects to the
Internet with a wireless mobile broadband card, and then establishes a VPN connection to the companys
network. When the train passes through a tunnel, the Internet connection is lost. After the train emerges

MCT USE ONLY. STUDENT USE PROHIBITED

7-14 Configuring and Troubleshooting Remote Access

from the tunnel, the wireless mobile broadband card reconnects automatically to the Internet. With older
versions of Windows client and server operating systems, VPN did not reconnect automatically. Therefore,
the user would have to repeat the multistep process of connecting to the VPN manually. This was timeconsuming and frustrating for mobile users with intermittent connectivity.

With VPN Reconnect, Windows Server 2012 and Windows 8 re-establish active VPN connections
automatically when Internet connectivity is re-established. Even though the reconnection might take
several seconds, users need not reinstate the connection manually, or authenticate again to access internal
network resources.
The system requirements for using the VPN Reconnect feature are as follows:

Windows Server 2008 R2 or Windows Server 2012 as a VPN server.

Windows 7, Windows 8, Windows Server 2008 R2, or Windows Server 2012 client.

Public Key Infrastructure PKI, because a computer certificate is required for a remote connection with
VPN Reconnect. You can use certificates issued by either an internal or public CA.

Configuration Requirements
Before deploying your organizations VPN
solution, consider the following configuration
requirements:

Your VPN server requires two network


interfaces. You must determine which
network interface will connect to the Internet,
and which network interface will connect to
your private network. During configuration,
you will be asked to choose which network
interface connects to the Internet. If you
specify the incorrect interface, your remote
access VPN server will not operate correctly.

Determine whether remote clients receive IP addresses from a DHCP server on your private network
or from the remote access VPN server that you are configuring. If you have a DHCP server on your
private network, the remote access VPN server can lease 10 addresses at a time from the DHCP
server, and then assign those addresses to remote clients. If you do not have a DHCP server on your
private network, the remote access VPN server can automatically generate and assign IP addresses to
remote clients. If you want the remote access VPN server to assign IP addresses from a range that you
specify, you must determine what that range should be.

Determine whether you want connection requests from VPN clients to be authenticated by a RADIUS
server or by the remote access VPN server that you are configuring. Adding a RADIUS server is useful
if you plan to install multiple remote access VPN servers, wireless access points, or other RADIUS
clients to your private network.

Note: To enable a RADIUS infrastructure, install the Network Policy and Access Services
server role. The NPS can act as either a RADIUS proxy or a RADIUS server.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-15

Determine whether VPN clients can send DHCPINFORM messages to the DHCP server on your private
network. If a DHCP server is on the same subnet as your remote access VPN server, DHCPINFORM
messages from VPN clients will be able to reach the DHCP server after the VPN connection is
established. If a DHCP server is on a different subnet from your remote access VPN server, make sure
that the router between subnets can relay DHCP messages between clients and the server. If your
router is running Windows Server 2008 R2 or Windows Server 2012, you can configure the DHCP
Relay Agent service on the router to forward DHCPINFORM messages between subnets.

Ensure that the person who is responsible for the deployment of your VPN solution has the necessary
administrative group memberships to install the server roles and configure the necessary services;
membership of the local Administrators group is required to perform these tasks.

Demonstration: How to Configure VPN Access


This demonstration shows how to:

Configure Remote Access as a VPN server.

Configure a VPN client.

Demonstration Steps
Configure Remote Access as a VPN server
1.

Sign in to LON-RTR as Adatum\Administrator with the password Pa$$w0rd.

2.

On LON-RTR, open Server Manager, and add the Network Policy and Access Services role.

3.

Close Server Manager.

4.

Open the Network Policy Server console.

5.

Register the server in AD DS.

6.

Leave the Network Policy Server window open.

7.

Open Routing and Remote Access.

8.

Disable the existing configuration.

9.

Reconfigure LON-RTR as a VPN Server using the following settings:


o

Local Area Connection 2 is the public interface.

The VPN server allocates addresses from the pool: 172.16.0.100 - 172.16.0.111.

The server is configured with the option No, use Routing and Remote Access to authenticate
connection requests.

10. Start the VPN service.

Configure a VPN Client


1.

Switch to LON-CL2, and sign in as Adatum\Administrator with the password of Pa$$w0rd.

2.

Create a new VPN connection with the following properties:


o

Internet address to connect to: 10.10.0.1

Destination name: Adatum VPN

Allow other people to use this connection: true

3.

4.

5.

MCT USE ONLY. STUDENT USE PROHIBITED

7-16 Configuring and Troubleshooting Remote Access

Once you have created the VPN, modify its settings by viewing the properties of the connection, and
then select the Security tab to reconfigure the VPN using the following settings:
o

Type of VPN: Point to Point Protocol (PPTP)

Authentication: Allow these protocols =Microsoft CHAP Version 2 (MS-CHAP v2)

Test the VPN connection using the following credentials:


o

User name: Adatum\administrator

Password: Pa$$w0rd

Wait for the VPN connection to be made. Your connection is unsuccessful. You receive an error
relating to authentication issues.

Completing Additional Configuration Tasks


After you complete the steps to deploy and
initially configure your Remote Access solution,
your server is ready for use as a remote access
VPN server. However, the following are the
additional tasks that you can also perform on
your remote access/VPN server:

Configure static packet filters. Add static


packet filters to better protect your network.

Configure services and ports. Choose which


services on the private network you want to
make available for remote access users.

Adjust logging levels. Configure the level of event details that you want to log. You can decide which
information you want to track in log files.

Configure the number of VPN ports. Add or remove VPN ports.

Create a Connection Manager profile for users. Manage the client connection experience for users,
and simplify configuration and troubleshooting of client connections.

Add (AD CS. Configure and manage a CA on a server for use in a PKI.

Increase remote access security. Protect remote users and the private network by enforcing use of
secure authentication methods, requiring higher levels of data encryption, and more.

Increase VPN security. Protect remote users and the private network by requiring use of secure
tunneling protocols, configuring account lockout, and more.

Consider implementing VPN Reconnect. Consider adding VPN Reconnect to re-establish VPN
connections automatically for users who temporarily lose their Internet connections.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-17

What Is the Connection Manager Administration Kit?


The Connection Manager Administration Kit
(CMAK) allows you to customize users remote
connection options by creating predefined
connections to remote servers and networks. The
CMAK wizard creates an executable file, which
you can then distribute in many ways, or include
during deployment activities as part of the
operating system image.
Connection Manager is a client network
connection tool that allows a user to connect to
a remote network, such as an Internet Service
Provider (ISP) or a corporate network protected
by a VPN server.

CMAK is a tool that you can use to customize the remote connection experience for users on your
network by creating predefined connections to remote servers and networks. You use the CMAK wizard to
create and customize a connection for your users.
CMAK is an optional component that is not installed by default. You must install CMAK to create
connection profiles that your users can install to access remote networks.

Distributing the Connection Profile

The CMAK wizard compiles the connection profile into a single executable file with an .exe file name
extension. You can deliver this file to users through any method that is available to you. Some methods to
consider are:

Include the connection profile as part of the image that is included with new computers.

You can install your connection profile as part of the client computer images that are installed on
your organizations new computers.

Deliver the connection profile on removable media for the user to install manually.

You can deliver the connection profile installation program on a CD/DVD, USB flash drive, or any
other removable media that you permit your users to access. Some removable media support autorun
capabilities, which allow you to start the installation automatically, when the user inserts the media
into the client computer.

Deliver the connection profile with automated software distribution tools.

Many organizations use a desktop management and software deployment tool such as
Microsoft System Center Configuration Manager (previously called Systems Management Server).
Configuration Manager provides the ability to package and deploy software that is intended for your
client computers. The installation can be invisible to your users, and you can configure it to report
back to the management console whether the installation was successful or not.

Demonstration: How to Create a Connection Profile


This demonstration shows how to:

Install CMAK.

Create a connection profile.

Examine the profile.

Demonstration Steps
Install CMAK
1.

If necessary, on LON-CL2, sign in as Adatum\administrator with the password Pa$$w0rd.

2.

Open Control Panel, and turn on a new windows feature called RAS Connection Manager
Administration Kit (CMAK) feature.

Create a connection profile


1.

In Administrative Tools, open the Connection Manager Administration Kit.

2.

Complete the Connection Manager Administration Kit Wizard to create the connection profile.

Examine the created profile

Use Windows Explorer to examine the contents of the folder that you created with the Connection
Manager Administration Kit Wizard to create the connection profile. Normally, you would now
distribute this profile to your users.

MCT USE ONLY. STUDENT USE PROHIBITED

7-18 Configuring and Troubleshooting Remote Access

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-19

Lesson 3

Overview of Network Policies


Network policies determine whether a connection attempt is successful. If the connection attempt is
successful, then the network policy also defines connection characteristics, such as day and time
restrictions, session idle-disconnect times, and other settings.

Understanding how to configure network policies is essential if you are to successfully implement VPNs
based on the Network Policy and Access Services server role within your organization.

Lesson Objectives
After completing this lesson, you will be able to:

Describe what a network policy is.

Describe network policy processing.

Describe the process for creating a new network policy.

Explain how to create a network policy for VPN connections.

What Is a Network Policy?


A network policy is a set of conditions, constraints,
and settings that enable you to designate who is
authorized to connect to the network, and the
circumstances under which they can or cannot
connect. Additionally, when you deploy NAP,
health policy is added to the network policy
configuration so that NPS performs client health
checks during the authorization process.
You can view network policies as rules: each
rule has a set of conditions and settings. NPS
compares the rules conditions to the properties
of connection requests. If a match occurs between
the rule and the connection request, then the settings that you define in the rule are applied to the
connection.

When you configure multiple network policies in NPS, they are an ordered set of rules. NPS checks each
connection request against the lists first rule, then the second, and so on, until a match is found.
Note: Once a matching rule is determined, further rules are disregarded. Therefore, it is
important that you order your network policies appropriately, in order of importance.

Each network policy has a Policy State setting that allows you to enable or disable the policy. When you
disable a network policy, NPS does not evaluate the policy when authorizing connection requests.

Network Policy Properties


Each network policy has four categories of properties:

MCT USE ONLY. STUDENT USE PROHIBITED

7-20 Configuring and Troubleshooting Remote Access

Overview. Overview properties allow you to specify whether the policy is enabled, whether the policy
grants or denies access, and whether a specific network connection method or type of network access
server is required for connection requests. Overview properties also enable you to specify whether to
ignore the dial-in properties of user accounts in AD DS. If you select this option, NPS uses only the
network policys settings to determine whether to authorize the connection.

Conditions. These properties allow you to specify the conditions that the connection request must
have to match the network policy. If the conditions that are configured in the policy match the
connection request, NPS applies the network policy settings to the connection. For example, if you
specify the network access server IPv4 address (NAS IPv4 Address) as a condition of the network
policy, and NPS receives a connection request from a NAS that has the specified IP address, the
condition in the policy matches the connection request.

Constraints. Constraints are additional parameters of the network policy that are required to match
the connection request. If the connection request does not match a constraint, NPS rejects the
request automatically. Unlike the NPS response to unmatched conditions in the network policy, if
a constraint is not matched, NPS does not evaluate additional network policies, and the connection
request is denied.

Settings. The Settings properties allow you to specify the settings that NPS applies to the connection
request, provided that all of the policys network policy conditions are matched and the request is
accepted.

When you add a new network policy using the NPS Microsoft Management Console (MMC) snap-in,
you must use the New Network Policy Wizard. After you have created a network policy using the New
Network Policy Wizard, you can customize the policy by double-clicking it in NPS to obtain the policy
properties.
Note: The default policies on the NPS block network access. After creating your own
policies, you should change the priority, disable, or remove these default policies.

Network Policy Processing


When NPS performs authorization of a connection
request, it compares the request with each
network policy in the ordered list of policies,
starting with the first policy and moving down the
list. If NPS finds a policy in which the conditions
match the connection request, NPS uses the
matching policy and the dial-in properties of the
user account to perform authorization. If you
configure the dial-in properties of the user
account to grant or control access through
network policy, and the connection request is
authorized, NPS applies the settings that you
configure in the network policy to the connection:

If NPS does not find a network policy that matches the connection request, NPS rejects the
connection unless the dial-in properties on the user account are set to grant access.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-21

If the dial-in properties of the user account are set to deny access, NPS rejects the connection request.

Process for Creating and Configuring a Network Policy


NPS uses network policies and the dial-in
properties of user accounts to determine
whether to authorize a connection request to your
network. You can configure a new network policy
in either the NPS MMC snap-in, or the Routing
and Remote Access Service MMC snap-in.

Creating Your Policy

When you use the New Network Policy Wizard


to create a network policy, the value that you
specify as the network connection method is
used automatically to configure the Policy
Type condition. If you keep the default value of
Unspecified, NPS evaluates the network policy that you create for all network connection types through
any type of network access server. If you specify a network connection method, NPS evaluates the
network policy only if the connection request originates from the type of network access server that you
specify.
For example, if you specify Remote Desktop Gateway, NPS evaluates the network policy only for
connection requests that originate from Remote Desktop Gateway servers.

On the Specify Access Permission page, you must select Access granted if you want the policy to
allow users to connect to your network. If you want the policy to prevent users from connecting to your
network, select Access denied. If you want user account dial-in properties in AD DS to determine access
permission, you can select the Access is determined by User Dial-in properties check box. This setting
overrides the NPS policy.

Configuring Your Policy

Once you have created your network policy, you can use the network policys Properties dialog box to
view or modify its settings.

Network Policy Properties - Overview Tab

From the Overview tab of the network policys Properties dialog box, or while running the New Network
Policy Wizard, you can configure the following settings:

Policy name. Type a friendly and meaningful name for the network policy.

Policy State. Designate whether to enable the policy.

Access Permission. Designate whether the policy grants or denies access. Also, specify whether NPS
should ignore the dial-in properties of user accounts in AD DS when using the policy to perform the
connection attempts authorization.

The network connection method to use for the connection request:


o

Unspecified. If you select Unspecified, NPS evaluates the network policy for all connection
requests that originate from any type of network access server, and for any connection method.

Remote Desktop Gateway. If you specify Remote Desktop Gateway, NPS evaluates the
network policy for connection requests that originate from servers that are running Remote
Desktop Gateway.

MCT USE ONLY. STUDENT USE PROHIBITED

7-22 Configuring and Troubleshooting Remote Access

Remote Access Server (VPN-Dial-up). If you specify Remote Access Server (VPN-Dial-up),
NPS evaluates the network policy for connection requests that originate from a computer that
is running Routing and Remote Access service configured as a dial-up or VPN server. If another
dial-up or VPN server is used, the server must support both the RADIUS protocol and the
authentication protocols that NPS provides for dial-up and VPN connections.

DHCP Server. If you specify DHCP Server, NPS evaluates the network policy for connection
requests that originate from servers that are running DHCP.

Health Registration Authority. If you specify Health Registration Authority, NPS evaluates
the network policy for connection requests that originate from servers that are running Health
Registration Authority.

HCAP server. If you specify HCAP server, NPS evaluates the network policy for connection
requests that originate from servers that are running HCAP.

Network Policy Properties - Conditions Tab

You must configure at least one condition for every network policy. You do this on the network policys
Properties dialog box Conditions tab. From this tab, NPS provides many condition groups, which allow
you to define clearly the properties that the connection request must have to match the policy.
The available condition groups from which you can select are:

Groups. These specify user or computer groups that you configure in AD DS and to which you want
the other rules of the network policy to apply, when group members attempt to connect to the
network.

Host Credential Authorization Protocol (HCAP). These conditions are used only when you want to
integrate your NPS NAP solution with Cisco Network Admission Control. To use these conditions, you
must deploy Cisco Network Admission Control and NAP. You also must deploy a HCAP server that is
running Internet Information Services (IIS) and NPS.

Day and Time Restrictions. The Day and Time Restrictions condition allows you to specify, at a weekly
interval, whether to allow connections on a specific set of days and times.

NAP. Settings include Identity Type, MS-Service Class, NAP-Capable Computers, Operating System,
and Policy Expiration.

Connection Properties. Settings include Access Client IPv4 Address, Access Client IPv6 Address,
Authentication Type, Allowed EAP Types, Framed Protocol, Service Type, and Tunnel Type.

RADIUS Client Properties. Settings include Calling Station ID, Client Friendly Name, Client IPv4
Address, Client IPv6 Address, Client Vendor, and MS RAS Vendor.

Gateway. Settings include Called Station ID, NAS Identifier, NAS IPv4 Address, NAS IPv6 Address, and
NAS Port Type.

Network Policy Properties - Constraints Tab

Constraints are optional additional network policy parameters that differ from network policy conditions
in one substantial way: when a condition does not match a connection request, NPS continues to evaluate
other configured network policies to find a match for the connection request. When a constraint does not
match a connection request, NPS does not evaluate additional network policies, but rejects the
connection request and the user or computer is denied network access.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-23

The following list describes the constraints that you can configure on the network policys Properties
dialog box Constraints tab:

Authentication Methods. Allows you to specify the authentication methods that are required for the
connection request to match the network policy.

Idle Timeout. Allows you to specify the maximum time, in minutes, that the network access server can
remain idle before the connection disconnects.

Session Timeout. Allows you to specify the maximum amount of time, in minutes, that a user can be
connected to the network.

Called Station ID. Allows you to specify the telephone number of the dial-up server that clients use to
access the network.

Day and time restrictions. Allows you to specify when users can connect to the network.

NAS Port Type. Allows you to specify the access media types that are allowed for users to connect to
the network.

Network Policy Properties - Settings Tab

If all of the conditions and constraints that you configure in the policy match the connection requests
properties, then NPS applies to the connection the settings that you configure on the network policys
Properties dialog box Settings tab. These settings include:

RADIUS Attributes. This setting allows you to define additional RADIUS attributes to send to the
RADIUS server.

NAP. This setting enables you to configure NAPrelated settings, including whether connecting
clients are granted full network access, limited access, or are enabled for auto-remediation.

Routing and Remote Access. This setting allows you to configure multilink and bandwidth allocation
protocol settings, IP filters, encryption settings, and other IP settings for the connections.

Demonstration: How to Create a Network Policy


This demonstration shows how to:

Create a VPN policy based on Windows Group condition.

Test the VPN.

Demonstration Steps
Create a VPN policy based on Windows Groups condition
1.

On LON-RTR, switch to the Network Policy Server console.

2.

Disable the two existing network policies. These would interfere with the processing of the policy you
are about to create.

3.

Create a new Network Policy using the following properties:


o

Policy name: Adatum VPN Policy

Type of network access server: Remote Access Server(VPN-Dial up)

Condition: Windows Groups = Domain Admins

Permission: Access granted

Authentication methods: default

Constraints: default

Settings: default

Test the VPN


1.

Switch to LON-CL2.

2.

Test the Adatum VPN connection. Use the following credentials:


o

User name: Adatum\administrator

Password: Pa$$w0rd

MCT USE ONLY. STUDENT USE PROHIBITED

7-24 Configuring and Troubleshooting Remote Access

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-25

Lesson 4

Troubleshooting Routing and Remote Access

Troubleshooting the Routing and Remote Access Service can be a time-consuming task. The issues might
be varied and not easily identifiable. Given that you might be using dial-up, dedicated, leased, or publicbased networks to satisfy your remote connectivity solution, you must perform troubleshooting in a
methodical, systematic process.
In some cases, you can identify and resolve the problem quickly, while other cases might test your
understanding of all the available tools to help you determine the issues source and resolve it in a timely
fashion.

Lesson Objectives
After completing this lesson, you will be able to:

Describe how to configure remote access logging.

Describe how to configure remote access tracing.

Explain how to resolve general VPN connectivity problems.

Explain how to troubleshoot other common remote access issues.

Configuring Remote Access Logging


To configure remote-access logging, open the
Routing and Remote Access console, right-click
servername, and then click Properties. Click the
Logging tab to view the available options for, and
the location of the tracing log.
Initially, it might be best to specify more logging
options than you might necessarily need, rather
than specifying too few options. Once you
determine the logging level that is most useful
for troubleshooting your infrastructure, you can
change the options and/or level of logging at
your discretion.
Four logging levels are available on the Logging tab, as described in the following table.
Dialogue box option

Description

Log Errors Only

Specifies that only errors are logged in the system log in Event
Viewer.

Log Errors and Warnings

Specifies that errors and warnings are both logged in the system log
in Event Viewer.

Log all events

Specifies that the maximum amount of information is logged in the


system log in Event Viewer.

Do not log any events

Specifies that no events are logged in the system log in Event Viewer.

MCT USE ONLY. STUDENT USE PROHIBITED

7-26 Configuring and Troubleshooting Remote Access

The Log additional Routing and Remote Access information (used for debugging) check box
enables you to specify whether the events in the PPP connection-establishment process are written to the
PPP.LOG file. This log file is stored in the systemroot\Tracing folder (the default location).

Configuring Remote Access Tracing


The Remote Access service in Windows Server
2012 has an extensive tracing capability that
you can use to troubleshoot complex network
problems. You can enable the components in
Windows Server 2012 to log tracing information
to files using the Netsh command, or through
the registry.

Enabling Tracing with the Netsh


Command
You can use the Netsh command to enable and
disable tracing for specified components or for all
components. To enable and disable tracing for a
specific component, use the following syntax:
netsh ras set tracing component enabled|disabled

Where component is a component in the list of Routing and Remote Access service components found in
the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing. For example, to enable tracing
for the RASAUTH component, the command is as follows:
netsh ras set tracing rasauth enabled

To enable tracing for all components, use the following command:


netsh ras set tracing * enabled

Enabling Tracing through the Registry


You also can configure tracing by changing settings in the registry under the following path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing

You can enable tracing for each Remote Access service component by setting the appropriate registry
values. You can enable and disable tracing for components while the Routing and Remote Access service
is running. Each component is capable of tracing, and appears as a subkey under the preceding Registry
key.

To enable tracing for each component, you can configure the following registry entries for each protocol
key:
EnableFileTracing REG_DWORD Flag

You can enable logging tracing information to a file by setting EnableFileTracing to 1. The default value
is 0.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-27

You can change the default location of the tracing files by setting FileDirectory to the path that you want.
The log files file name is the component name for which tracing is enabled. By default, log files are placed
in the SystemRoot\Tracing folder.
FileDirectory REG_EXPAND_SZ Path

FileTracingMask determines how much tracing information is logged to the file. The default value is
0xFFFF0000.
FileTracingMask REG_DWORD LevelOfTracingInformationLogged

You can change the log file size by setting different values for MaxFileSize. The default value is 0x10000
(64K).
MaxFileSize REG_DWORD SizeOfLogFile

Note: Tracing consumes system resources, and you should use it sparingly to help identify
network problems. After you capture the trace or identify the problem, you should disable
tracing immediately. Do not leave tracing enabled on multiprocessor computers.
Tracing information can be complex and detailed. Therefore, typically only Microsoft support
professionals or network administrators who are experienced with the Routing and Remote
Access service find this information useful.
You can save tracing information as files, and send it to Microsoft support for analysis.

Resolving General VPN Problems


To resolve general problems with establishing a
remote access VPN connection, perform the
following tasks:

Use the ping command to verify that the


host name is being resolved to its correct
IP address. The ping itself might not be
successful due to packet filtering that is
preventing the delivery of Internet Control
Message Protocol (ICMP) messages to and
from the VPN server.

Verify that the credentials of the VPN client


which consist of user name, password, and
domain nameare correct and that the VPN server can validate them.

Verify that the user account of the VPN client is not locked out, expired, disabled, or that the
time that the connection is being made does not correspond to the configured logon hours. If the
password on the account has expired, verify that the remote access VPN client is using MS-CHAP v2.
MS-CHAP v2 is the only authentication protocol that Windows Server 2012 provides that allows you
to change an expired password during the connection process.

Reset expired administrator-level account passwords by using another administrator-level account.

Verify that the user account has not been locked out due to remote access account lockout.

Verify that the Routing and Remote Access service is running on the VPN server.

MCT USE ONLY. STUDENT USE PROHIBITED

7-28 Configuring and Troubleshooting Remote Access

Verify that the VPN server is enabled for remote access from the VPN server Properties dialog box
General tab.

Verify that the WAN Miniport (PPTP) and WAN Miniport (L2TP) devices are enabled for inbound
remote access from the properties of the Ports object in the Routing and Remote Access snap-in.

Verify that the VPN client, the VPN server, and the network policy that correspond to VPN
connections are configured to use at least one common authentication method.

Verify that the VPN client and the network policy that correspond to VPN connections are configured
to use at least one common encryption strength.

Verify that the connections parameters have permission through network policies.

Troubleshooting Other Issues


This topic lists other common issues that you
might encounter when using Remote Access in
Windows Server 2012.

Error 800: VPN Server is Unreachable

Cause: PPTP/L2TP/SSTP packets from the VPN


client cannot reach the VPN server.

Solution: Ensure that the appropriate ports


are open on the firewall.
o

PPTP. For PPTP traffic, configure the


network firewall to open TCP port 1723,
and to forward IP protocol 47 for GRE
traffic to the VPN server.

L2TP. For L2TP traffic, configure the network firewall to open UDP port 1701, and to allow IPsec
ESPformatted packets (IP protocol 50).

SSTP. For SSTP, enable TCP port 443.

Error 721: Remote Computer is Not Responding

Cause: This issue can occur if the network firewall does not permit GRE traffic (IP protocol 47). PPTP
uses GRE for tunneled data.

Solution: Configure the network firewall between the VPN client and the server to permit GRE.
Additionally, make sure that the network firewall permits TCP traffic on port 1723. Both of these
conditions must be met to establish VPN connectivity by using PPTP.
Note: The firewall might be on or in front of the VPN client, or in front of the VPN server.

Error 741/742: Encryption Mismatch Error

Cause: These errors occur if the VPN client requests an invalid encryption level or if the VPN server
does not support an encryption type that the client requests.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-29

Solution: Check the properties on the Security tab of the VPN connection on the VPN client.
If Require data encryption (disconnect if none) is selected, clear the selection and retry the
connection. If you are using NPS, check the encryption level in the network policy in the NPS console,
or check the policies on other RADIUS servers. Ensure that the encryption level that the VPN client
requested is selected on the VPN server.

L2TP/IPsec Authentication Issues


The following list describes the most common reasons that L2TP/IPsec connections fail:

No certificate. By default, L2TP/IPsec connections require that, for IPsec peer authentication, an
exchange of computer certificates occur between the Remote Access server and Remote Access client.
Check the Local Computer certificate stores of both the Remote Access client and the Remote Access
server that are using the Certificates snap-in to ensure that a suitable certificate exists.

Incorrect certificate. The VPN client must have a valid computer certificate installed, that was issued
by a CA that follows a valid certificate chain from the issuing CA to a root CA, and that the VPN server
trusts. Additionally, the VPN server must have a valid computer certificate installed that was issued by
a CA that follows a valid certificate chain from the issuing CA to a root CA, and that the VPN client
trusts.

A NAT device exists between the remote access client and Remote Access server. If there is a NAT
between a Windows 2000 Server, Windows Server 2003, or Windows XP-based L2TP/IPsec client and
a Windows Server 2008 L2TP/IPsec server, you cannot establish an L2TP/IPsec connection unless the
client and server support IPsec NAT traversal (NAT-T).

A firewall exists between the Remote Access client and the Remote Access server. If there is a firewall
between a Windows L2TP/IPsec client and a Windows Server 2012 L2TP/IPsec server, and if you
cannot establish an L2TP/IPsec connection, verify that the firewall allows forwarding of L2TP/IPsec
traffic.

EAP-TLS Authentication Issues

When you use EAP-TLS for authentication, the VPN client submits a user certificate and the authenticating
server (the VPN server or the RADIUS server) submits a computer certificate. To enable the authenticating
server to validate the VPN clients certificate, the following must be true for each certificate in the
certificate chain that the VPN client sends:

The current date must be within the certificates validity dates. When certificates are issued, they are
issued with a range of valid dates, before which they cannot be used, and after which they are
considered expired.

The certificate has not been revoked. Issued certificates can be revoked at any time. Each issuing CA
maintains a list of certificates that are not considered valid, and publishes an up-to-date certificate
revocation list CRL. By default, the authenticating server checks all certificates in the VPN clients
certificate chain (the series of certificates from the VPN client certificate to the root CA) for
revocation. If any of the chains certificates have been revoked, certificate validation fails.

The certificate has a valid digital signature. CAs digitally sign certificates that they issue. The
authenticating server verifies the digital signature of each certificate in the chain (with the exception
of the root CA certificate), by obtaining the public key from the certificates issuing CA and
mathematically validating the digital signature.

For the VPN client to validate the authenticating servers certificate for either EAP-TLS authentication,
the following must be true for each certificate in the certificate chain that the authenticating server
sends:
o

The current date must be within the certificates validity dates.

The certificate must have a valid digital signature.

Lab A: Configuring Remote Access


Scenario
A. Datum Corporation is a global engineering and manufacturing company with a head office based in
London, United Kingdom. An IT office and a data center are located in London to support the London
location and other locations. A. Datum has recently deployed a Windows Server 2012 server and client
infrastructure.

MCT USE ONLY. STUDENT USE PROHIBITED

7-30 Configuring and Troubleshooting Remote Access

The management at A. Datum wants to implement a remote access solution for their employees so that
the users can connect to the corporate network while away from the office. You decide to deploy a pilot
project that will enable users in the IT department to connect using a VPN to the corporate intranet.

Objectives
After completing this lab, you will be able to:
1.

Configure a VPN server.

2.

Configure VPN clients.

Lab Setup

Virtual machines

20411B-LON-DC1
20411B-LON-RTR
20411B-LON-CL2

User Name

Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:

5.

User name: Adatum\Administrator

Password: Pa$$w0rd

Perform steps 2 through 4 for 20411B-LON-RTR and 20411B-LON-CL2.

Exercise 1: Configuring a Virtual Private Network Server


Scenario

A. Datum Corporation wants to implement a Remote Access solution for its employees so they can
connect to the corporate network while away from the office. You are required to enable and configure
the necessary server services to facilitate this remote access. To support the VPN solution, you need to
configure a Network Policy that reflects corporate remote connection policy. For the pilot, only the IT
security group should be able to use VPN. Required conditions include the need for a client certificate,
and connection hours are only allowed between Monday and Friday, at any time.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-31

The main tasks for this exercise are as follows:


1.

Configure server and client certificates.

2.

Configure the Remote Access role.

3.

Create a network policy for virtual private network (VPN) clients.

Task 1: Configure server and client certificates


1.

Switch to LON-DC1.

2.

Sign in as Adatum\Administrator with the password Pa$$w0rd.

3.

Open Certification Authority.

4.

From the Certificate Templates console, open the properties of the Computer certificate template.

5.

On the Security tab, grant the Authenticated Users group the Allow Enroll permission.

6.

Restart the Certification Authority.

7.

Close Certification Authority.

8.

Open the Group Policy Management Console.

9.

Navigate to Forest: Adatum.com\Domains\Adatum.com.

10. Edit the Default Domain Policy.


11. Navigate to Computer Configuration\Policies\Windows Settings\Security Settings
\Public Key Policies.
12. Create a new Automatic Certificate Request Settings for the Computer certificate template.
13. Close the Group Policy Management Editor and the Group Policy Management Console.
14. Switch to the LON-RTR computer.
15. Create a management console by running mmc.exe.
16. Add the Certificates snap-in with the focus on the local computer account.
17. Navigate to the Personal certificate store, and Request New Certificate.

18. On the Select Certificate Enrollment Policy page, click Active Directory Enrollment Policy, and
then click Next.
19. Enroll the Computer certificate that is listed.
20. Close the console, and do not save the console settings.
21. Switch to the LON-CL2 computer, and sign in as Adatum\Administrator with the password
Pa$$w0rd.
22. Open a command prompt, and run the gpupdate /force command to refresh the group policy
settings.
23. Create a management console by running mmc.exe.
24. Add the Certificates snap-in with the focus on the local computer account.
25. Navigate to the Personal certificate store.
26. Verify that a certificate exists for LON-CL2 that has been issued by Adatum-LON-DC1-CA.
27. Close the console, and do not save the console settings.

Task 2: Configure the Remote Access role


1.

On LON-RTR, open Server Manager, and add the Network Policy and Access Services role.

2.

Close Server Manager.

3.

Open the Network Policy Server console.

4.

Register the server in AD DS.

5.

Leave the Network Policy Server window open.

6.

Open Routing and Remote Access.

7.

Disable the existing configuration.

8.

Reconfigure LON-RTR as a VPN Server with the following settings:

9.

MCT USE ONLY. STUDENT USE PROHIBITED

7-32 Configuring and Troubleshooting Remote Access

a.

Local Area Connection 2 is the public interface

b.

The VPN server allocates addresses from the pool: 172.16.0.100 - 172.16.0.111

c.

The server is configured with the option No, use Routing and Remote Access to authenticate
connection requests.

Start the VPN service.

Task 3: Create a network policy for virtual private network (VPN) clients
1.

On LON-RTR, switch to the Network Policy Server console.

2.

Disable the two existing network policies. These would interfere with the processing of the policy you
are about to create.

3.

Create a new Network Policy using the following properties:


a.

Policy name: IT Pilot VPN Policy

b.

Type of network access server: Remote Access Server (VPN-Dial up)

c.

Condition: Windows Groups = IT

d.

Permission: Access granted

e.

Authentication methods: Microsoft Encrypted Authentication version 2 (MS-CHAP-v2)

f.

Constraints: Day and time restrictions = All day Monday to Friday allowed.

g.

Settings: default

Results: After this exercise, you should have successfully deployed a VPN server, and configured access for
members of the IT global security group.

Exercise 2: Configuring VPN Clients


Scenario

You must now provide a simple client solution so that users can install a preconfigured L2TP-based VPN
connection, which enables them to connect to the corporate network.
The main tasks for this exercise are as follows:
1.

Configure and distribute a Connection Manager Administration Kit profile.

2.

Verify client access.

3.

To prepare for the next lab.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-33

Task 1: Configure and distribute a Connection Manager Administration Kit profile


1.

Switch to LON-CL2.

2.

From Control Panel, install the RAS Connection Manager Administration Kit (CMAK) feature.

3.

From Administrative Tools, open the Connection Manager Administration Kit.

4.

Complete the Connection Manager Administration Kit Wizard using defaults except where stated
below:
a.

Select the Target Operating System page: Windows Vista or above

b.

Create or Modify a Connection Manager profile page: New profile

c.

Specify the Service Name and the File Name page:

Service name: Adatum Pilot VPN

File name: Adatum

d.

Specify a Realm Name page: Do not add a realm name to the user name

e.

Add Support for VPN Connections page:

f.

Phone book from this profile: enabled

VPN server name or IP address: 10.10.0.1

Create or Modify a VPN Entry page: Edit the listed VPN entry. On the Security tab:

g.

VPN strategy: Only use Layer Two Tunneling Protocol (L2TP).

Add a Custom Phone Book page: Automatically download phone book updates deselected.

5.

Open Windows Explorer and navigate to C:\Program Files\CMAK\Profiles


\Windows Vista and above\Adatum.

6.

Double-click Adatum.exe, and complete the Adatum Pilot VPN Wizard:


o

7.

Make this connection available for: All users

In the connection window, click Cancel.

Task 2: Verify client access


1.

Sign out of LON-CL2.

2.

Sign in as Adatum\April with the password of Pa$$w0rd.

3.

Open Network Connections.

4.

Test the Adatum Pilot VPN connection. Use the following credentials:
o

User name: Adatum\April

Password: Pa$$w0rd

To prepare for the next lab

When you are finished the lab, revert all virtual machines back to their initial state.

Results: After this exercise, you should have successfully distributed a CMAK profile, and tested VPN
access.

Lesson 5

Configuring DirectAccess

MCT USE ONLY. STUDENT USE PROHIBITED

7-34 Configuring and Troubleshooting Remote Access

Organizations often rely on VPN connections to provide remote users with secure access to data and
resources on the corporate network. VPN connections are easy to configure and are supported by
different clients. However, VPN connections must first be initiated by the user, and could require
additional configuration on the corporate firewall. In addition, VPN connections usually enable remote
access to the entire corporate network. Moreover, organizations cannot effectively manage remote
computers unless they are connected. To overcome such limitations in VPN connections, organizations
can implement DirectAccess to provide a seamless connection between the internal network and the
remote computer on the Internet. With DirectAccess, organizations can manage remote computers more
effectively, because they are effectively considered part of the corporate network.

Lesson Objectives
After completing this lesson, you will be able to:

Discuss complexities of typical VPN connections.

Describe DirectAccess.

Describe the components required to implement DirectAccess.

Explain how to use the Name Resolution Policy Table.

Explain how DirectAccess works for internally connected clients.

Explain how DirectAccess works for externally connected clients.

List the DirectAccess prerequisites.

Explain how to configure DirectAccess.

Complexities of Managing VPNs


Many organizations rely on VPN connections to
provide their users with secure remote access to
resources on the internal corporate network.
These VPN connections must often be configured
manually, which can present interoperability issues
in situations when the users are using multiple
different VPN clients. Additionally, VPN
connections can pose the following problems:

Users must initiate the VPN connections.

The connections may require multiple steps


to initiate, and the connection process can
take several seconds or more.

Firewalls can pose additional considerations. If not properly configured on the firewall, VPN
connections may fail, or worse, may inadvertently enable remote access to the entire corporate
network.

Troubleshooting failed VPN connections can often be a significant portion of Help Desk calls for
many organizations.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-35

VPN connected computers are not easily managed. VPNbased remote client computers present a
challenge to IT professionals, because these computers might not connect to the internal network for
weeks at a time, preventing them from downloading Group Policy Objects (GPOs) and software
updates.

Extending the Network to the Remotely-Connected Computers and Users

To overcome these limitations in traditional VPN connections, organizations can implement DirectAccess
to provide a seamless connection between the internal network and the remote computer on the Internet.
With DirectAccess, organizations can more easily manage remote computers, because they are always
connected.

What Is DirectAccess?
The DirectAccess feature in Windows Server 2012
enables seamless remote access to intranet
resources without first establishing a user-initiated
VPN connection. The DirectAccess feature also
ensures seamless connectivity to the application
infrastructure for internal users and remote users.
Unlike traditional VPNs that require user
intervention to initiate a connection to an
intranet, DirectAccess enables any IPv6-capable
application on the client computer to have
complete access to intranet resources.
DirectAccess also enables you to specify resources
and client-side applications that are restricted for remote access.

Organizations can benefit from DirectAccess by providing a way in which IT staff can manage remote
computers as they would manage local computers. Using the same management and update servers,
you can ensure that remote computers are always up-to-date and in compliance with your security and
system health policies. You can also define more detailed access control policies for remote access when
compared with defining access control policies in VPN solutions.
DirectAccess offers the following features:

Connects automatically to the corporate intranet when connected to the Internet.

Uses various protocols, including HTTPS, to establish IPv6 connectivityHTTPS is typically allowed
through firewalls and proxy servers.

Supports selected server access and end-to-end IPsec authentication with intranet network servers.

Supports end-to-end authentication and encryption with intranet network servers.

Supports management of remote client computers.

Allows remote users to connect directly to intranet servers.

DirectAccess also provides the following benefits:

Always-on connectivity. Whenever the user connects the client computer to the Internet, the client
computer is also connected to the intranet. This connectivity enables remote client computers to
access and update applications more easily. It also makes intranet resources always available, and
enables users to connect to the corporate intranet from anywhere and anytime, thereby improving
their productivity and performance.

MCT USE ONLY. STUDENT USE PROHIBITED

7-36 Configuring and Troubleshooting Remote Access

Seamless connectivity. DirectAccess provides a consistent connectivity experience, regardless of


whether the client computer is local or remote. This allows users to focus more on productivity and
less on connectivity options and process. This consistency can reduce training costs for users, with
fewer support incidents.

Bidirectional access. You can configure DirectAccess in a way that the DirectAccess clients have
access to intranet resources and you can also have access from the intranet to those DirectAccess
clients. Therefore, DirectAccess can be bidirectional. This ensures that the client computers are always
updated with recent security updates, the domain Group Policy is enforced, and there is no difference
whether the users are on the corporate intranet or on the public network. This bidirectional access
also results in:
o

Decreased update time

Increased security

Decreased update miss rate

Improved compliance monitoring

Manage-out Support. The Manage-out Support feature is new in Windows Server 2012, and it
provides the ability to enable only remote management functionality in the DirectAccess client. This
new sub-option of the DirectAccess client configuration wizard automates the deployment of policies
that are used for managing the client computer. Manage-out support does not implement any policy
options that allow users to connect to the network for file or application access. Manage-out support
is unidirectional, and provides incoming-only access for administration purposes only.

Improved security. Unlike traditional VPNs, DirectAccess offers many levels of access control to
network resources. This tighter control allows security architects to precisely control remote users
who access specified resources. You can use a granular policy to specifically define which user can
use DirectAccess, and the location from which the user can access it. IPsec encryption is used for
protecting DirectAccess traffic so that users can ensure that their communication is safe.

Integrated solution. DirectAccess fully integrates with Server and Domain Isolation and NAP solutions,
resulting in the seamless integration of security, access, and health requirement policies between the
intranet and remote computers.

Components of DirectAccess
To deploy and configure DirectAccess, your
organization must support the following
infrastructure components:

DirectAccess server

DirectAccess clients

Network location server

Internal resources

AD DS domain

Group Policy

PKI (Optional for the internal network)

Domain Name System (DNS) server

NAP server

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-37

DirectAccess Server

The DirectAccess server can be any Windows Server 2012 server that you join to a domain, and which
accepts connections from DirectAccess clients and establishes communication with intranet resources. This
server provides authentication services for DirectAccess clients, and acts as an IPsec tunnel mode endpoint
for external traffic. The new Remote Access server role allows centralized administration, configuration,
and monitoring for both DirectAccess and VPN connectivity.
Compared with previous implementation in Windows Server 2008 R2, the new DirectAccess Wizard-based
setup simplifies DirectAccess management for small and medium organizations. The wizard does this by
removing the need for full PKI deployment and removing the requirement for two consecutive public
IPv4 addresses for the physical adapter that is connected to the Internet. In Windows Server 2012, the
DirectAccess setup wizard detects the actual implementation state of the DirectAccess server, and selects
the best deployment automatically. This hides the complexity of manually configuring IPv6 transition
technologies from the administrator.

DirectAccess Clients
DirectAccess clients can be any domain-joined computer that is running Windows 8 Enterprise,
Windows 7 Enterprise, or Windows 7 Ultimate.
Note: With off-premise provisioning, you can join a Windows 8 Enterprise client computer
in a domain without connecting the client computer in your internal premises.

The DirectAccess client computer connects to the DirectAccess server by using IPv6 and IPsec. If a native
IPv6 network is not available, then the client establishes an IPv6-over-IPv4 tunnel by using 6to4 or
Teredo. Note that the user does not have to be logged on to the computer for this step to complete.

If a firewall or proxy server prevents the client computer that is using 6to4 or Teredo from connecting
to the DirectAccess server, the client computer automatically attempts to connect by using the IP-HTTPS
protocol, which uses a SSL connection to ensure connectivity. The client has access to the Name
Resolution Policy Table (NRPT) rules and Connection Security tunnel rules.

Network Location Server

DirectAccess clients use the network location server (NLS) to determine their location. If the client
computer can connect with HTTPS, then the client computer assumes it is on the intranet and disables
DirectAccess components. If the NLS is not contactable, the client assumes it is on the Internet. The NLS
server is installed with the web server role.
Note: The URL for the NLS is distributed by using GPO.

Internal Resources

You can configure any IPv6capable application that is running on internal servers or client computers to
be available for DirectAccess clients. For older applications and servers, including those that are not based
on Windows operating systems and have no IPv6 support, Windows Server 2012 now includes native
support for protocol translation (NAT64) and name resolution (DNS64) gateway to convert IPv6
communication from DirectAccess client to IPv4 for the internal servers.
Note: As in the past, this functionality can also be achieved with Microsoft Forefront
Unified Access Gateway. Likewise, as in past versions, these translation services do not support
sessions initiated by internal devices, only requests originating from IPv6 DirectAccess clients.

Active Directory Domain

MCT USE ONLY. STUDENT USE PROHIBITED

7-38 Configuring and Troubleshooting Remote Access

You must deploy at least one Active Directory domain, running at a minimum Windows Server 2003
domain functional level. Windows Server 2012 DirectAccess provides integrated multiple domain support,
which allows client computers from different domains to access resources that may be located in different
trusted domains.

Group Policy

Group Policy is required for the centralized administration and deployment of DirectAccess settings. The
DirectAccess Setup Wizard creates a set of GPOs, and settings for DirectAccess clients, the DirectAccess
server, and selected servers.

PKI

PKI deployment is optional for simplified configuration and management. DirectAccess in Windows Server
2012 enables client authentication requests to be sent over a HTTPSbased Kerberos proxy service that is
running on the DirectAccess server. This eliminates the need for establishing a second IPsec tunnel
between clients and domain controllers. The Kerberos proxy will send Kerberos requests to domain
controllers on behalf of the client.
However, for a full DirectAccess configuration that allows NAP integration, two-factor authentication,
and force tunneling, you still need to implement certificates for authentication for every client that will
participate in DirectAccess communication.

DNS Server

When using ISATAP, you must use at least Windows Server 2008 R2, Windows Server 2008 Service Pack 2
(SP2) or newer, or a non-Microsoft DNS server that supports DNS message exchanges over ISATAP.

NAP Servers

NAP is an optional component of the DirectAccess solution that allows you to provide compliance
checking and enforce security policy for DirectAccess clients over the Internet. DirectAccess in Windows
Server 2012 provides the ability to configure NAP health check directly from the setup user interface,
instead of manually editing the GPO as is required with DirectAccess in Windows Server 2008 R2.

What Is the Name Resolution Policy Table?


To separate Internet traffic from intranet traffic
in DirectAccess, both Windows Server 2012 and
Windows 8 include the NRPT. NRPT is a feature
that allows DNS servers to be defined per DNS
namespace, rather than per interface.
The NRPT stores a list of rules. Each rule defines a
DNS namespace and configuration settings that
describe the DNS clients behavior for that
namespace.
When a DirectAccess client is on the Internet,
each name query request is compared against the
namespace rules stored in the NRPT.

If a match is found, the request is processed according to the settings in the NRPT rule.

If a name query request does not match a namespace listed in the NRPT, the request is sent to the
DNS servers that are configured in the TCP/IP settings for the specified network interface.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-39

DNS settings are configured depending on the client location:

For a remote client computer, the DNS servers are typically the Internet DNS servers that are
configured through the ISP.

For a DirectAccess client on the intranet, the DNS servers are typically the intranet DNS servers that
are configured through DHCP.

Single-label names, for example, http://internal, typically have configured DNS search suffixes appended
to the name before they are checked against the NRPT.
If no DNS search suffixes are configured, and if the single-label name does not match any other singlelabel name entry in the NRPT, the request is sent to the DNS servers that are specified in the clients
TCP/IP settings.

Namespacesfor example, internal.adatum.comare entered into the NRPT, followed by the DNS servers
to which requests matching that namespace should be directed. If an IP address is entered for the DNS
server, all DNS requests are sent directly to the DNS server over the DirectAccess connection; you need
not specify any additional security for such configurations. However, if a name is specified for the DNS
server (such as dns.adatum.com) in the NRPT, the name must be publicly resolvable when the client
queries the DNS servers specified in its TCP/IP settings.
The NRPT allows DirectAccess clients to use intranet DNS servers for name resolution of internal resources,
and Internet DNS for name resolution of other resources. Dedicated DNS servers are not required for
name resolution. DirectAccess is designed to prevent the exposure of your intranet namespace to the
Internet.
Some names need to be treated differently with regards to name resolution; these names should not be
resolved by using intranet DNS servers. To ensure that these names are resolved with the DNS servers
specified in the clients TCP/IP settings, you must add them as NRPT exemptions.
NRPT is controlled through Group Policy. When the computer is configured to use NRPT, the name
resolution mechanism uses the following in order:

The local name cache

The hosts file

NRPT

Then the name resolution mechanism finally sends the query to the DNS servers that are specified in the
TCP/IP settings.

How DirectAccess Works for Internal Clients


An NLS is an internal network server that hosts
an HTTPS-based URL. DirectAccess clients try to
access a NLS URL to determine if they are located
on the intranet or on a public network. The
DirectAccess server can also be the NLS. In some
organizations where DirectAccess is a businesscritical service, the NLS should be highly available.
Generally, the web server on the NLS does not
have to be dedicated to just supporting
DirectAccess clients.

MCT USE ONLY. STUDENT USE PROHIBITED

7-40 Configuring and Troubleshooting Remote Access

It is critical that the NLS be available from each company location, because the behavior of the
DirectAccess client depends on the response from the NLS. Branch locations may require a separate NLS
at each branch location to ensure that the NLS remains accessible even when there is a link failure
between branches.

How DirectAccess Works for Internal Clients


The DirectAccess connection process happens automatically, without requiring user intervention.
DirectAccess clients use the following process to connect to intranet resources:
1.

The DirectAccess client tries to resolve the Fully Qualified Domain Name (FQDN) of the NLS URL.
Because the FQDN of the NLS URL corresponds to an exemption rule in the NRPT, the DirectAccess
client instead sends the DNS query to a locally configured (intranet-based) DNS server. The intranetbased DNS server resolves the name.

2.

The DirectAccess client accesses the HTTPS-based URL of the NLS, during which process it obtains the
certificate of the NLS.

3.

Based on the CRL distribution points field of the NLS certificate, the DirectAccess client checks the
CRL revocation files in the CRL distribution point to determine if the NLS certificate has been revoked.

4.

Based on an HTTP response code 200 in the response DirectAccess client determines the success of
the NLS URL (successful access and certificate authentication and revocation check). The DirectAccess
client switches to domain firewall profile and ignores the DirectAccess policies and assumes it is in
internal network until next network change happens.

5.

The DirectAccess client computer attempts to locate and sign in to the AD DS domain by using its
computer account.
Because the client no longer references any DirectAccess rules in the NRPT for the rest of the
connected session, all DNS queries are sent through interface-configured (intranet-based) DNS
servers. With the combination of network location detection and computer domain logon, the
DirectAccess client configures itself for normal intranet access.

6.

Based on the computers successful logon to the domain, the DirectAccess client assigns the domain
(firewall network) profile to the attached network.

By design, the DirectAccess Connection Security tunnel rules are scoped for the public and private firewall
profiles, and they are disabled from the list of active connection security rules.
The DirectAccess client has successfully determined that it is connected to its intranet, and does not use
DirectAccess settings (NRPT rules or Connection Security tunnel rules). The DirectAccess client can now
access intranet resources normally. It can also access Internet resources through normal means, such as a
proxy server.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-41

How DirectAccess Works for External Clients


When a DirectAccess client starts, the DirectAccess
client tries to reach the URL address specified for
NLS, and assumes that it is not connected to the
intranet because it cannot communicate with NLS.
Instead, the DirectAccess client starts to use NRPT
and connection security rules. The NRPT has
DirectAccessbased rules for name resolution, and
connection security rules define DirectAccess
IPsec tunnels for communication with intranet
resources. Internet-connected DirectAccess clients
use the following high-level steps to connect to
intranet resources:

The DirectAccess client first attempts to access the NLS.

Then, the client attempts to locate a domain controller.

Finally, the client attempts to access intranet resources, and then Internet resources.

DirectAccess Client Attempts to Access the Network Location Server


The DirectAccess client attempts to access the NLS as follows:
1.

The client tries to resolve the FQDN of the NLS URL. Because the FQDN of the NLS URL corresponds
to an exemption rule in the NRPT, the DirectAccess client does not send the DNS query to a locally
configured (Internet-based) DNS server. An external Internet-based DNS server would not be able to
resolve the name.

2.

The DirectAccess client processes the name resolution request as defined in the DirectAccess
exemption rules in the NRPT.

3.

Because the NLS is not found on the same network on which the DirectAccess client is currently
located, the DirectAccess client applies a public or private firewall network profile to the attached
network.

4.

The Connection Security tunnel rules for DirectAccess, scoped for the public and private profiles,
provide the public or private firewall network profile.

The DirectAccess client uses a combination of NRPT rules and connection security rules to locate and
access intranet resources across the Internet through the DirectAccess server.

DirectAccess Client Attempts to Locate a Domain Controller

After determining its network location, the DirectAccess client attempts to locate and sign in to a domain
controller. This process creates an IPsec tunnel or infrastructure tunnel by using the IPsec tunnel mode
and ESP to the DirectAccess server. The process is as follows:
1.

The DNS name for the domain controller matches the intranet namespace rule in the NRPT, which
specifies the IPv6 address of the intranet DNS server. The DNS client service constructs the DNS name
query that is addressed to the IPv6 address of the intranet DNS server, and then forwards it to the
DirectAccess clients TCP/IP stack for sending.

2.

Before sending the packet, the TCP/IP stack checks to determine if there are Windows Firewall
outgoing rules or connection security rules for the packet.

3.

MCT USE ONLY. STUDENT USE PROHIBITED

7-42 Configuring and Troubleshooting Remote Access

Because the destination IPv6 address in the DNS name query matches a connection security rule
that corresponds with the infrastructure tunnel, the DirectAccess client uses Authenticated IP (AuthIP)
and IPsec to negotiate and authenticate an encrypted IPsec tunnel to the DirectAccess server. The
DirectAccess client (both the computer and the user) authenticates itself with its installed computer
certificate and its Microsoft Windows NT LAN Manager (NTLM) credentials, respectively.

Note: AuthIP enhances authentication in IPsec by adding support for user-based


authentication with Kerberos v5 or SSL certificates. AuthIP also supports efficient protocol
negotiation and usage of multiple sets of credentials for authentication.
4.

The DirectAccess client sends the DNS name query through the IPsec infrastructure tunnel to the
DirectAccess server.

5.

The DirectAccess server forwards the DNS name query to the intranet DNS server. The DNS name
query response is sent back to the DirectAccess server, and then back through the IPsec infrastructure
tunnel to the DirectAccess client.

Subsequent domain logon traffic goes through the IPsec infrastructure tunnel. When the user on the
DirectAccess client logs on, the domain logon traffic goes through the IPsec infrastructure tunnel.

DirectAccess Client Attempts to Access Intranet Resources


The first time that the DirectAccess client sends traffic to an intranet location that is not on the list of
destinations for the infrastructure tunnel (such as an internal website), the following process occurs:
1.

The application or process that attempts to communicate constructs a message or payload, and then
hands it off to the TCP/IP stack for sending.

2.

Before sending the packet, the TCP/IP stack checks to determine if there are Windows Firewall
outgoing rules or connection security rules for the packet.

3.

Because the destination IPv6 address matches the connection security rule that corresponds with the
intranet tunnel (which specifies the IPv6 address space of the entire intranet), the DirectAccess client
uses AuthIP and IPsec to negotiate and authenticate an additional IPsec tunnel to the DirectAccess
server. The DirectAccess client authenticates itself with its installed computer certificate and the user
accounts Kerberos credentials.

4.

The DirectAccess client sends the packet through the intranet tunnel to the DirectAccess server.

5.

The DirectAccess server forwards the packet to the intranet resources. The response is sent back to
the DirectAccess server and back through the intranet tunnel to the DirectAccess client.

Any subsequent intranet access traffic that does not match an intranet destination in the infrastructure
tunnel connection security rule goes through the intranet tunnel.

DirectAccess Client Attempts To Access Internet Resources

When the user or a process on the DirectAccess client attempts to access an Internet resource (such as an
Internet web server), the following process occurs:
1.

The DNS client service passes the DNS name for the Internet resource through the NRPT. There are
no matches. The DNS client service constructs the DNS name query that is addressed to the IP
address of an interface-configured Internet DNS server, and hands it off to the TCP/IP stack for
sending.

2.

Before sending the packet, the TCP/IP stack checks to determine if there are Windows Firewall
outgoing rules or connection security rules for the packet.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-43

3.

Because the destination IP address in the DNS name query does not match the connection security
rules for the tunnels to the DirectAccess server, the DirectAccess client sends the DNS name query
normally.

4.

The Internet DNS server responds with the IP address of the Internet resource.

5.

The user application or process constructs the first packet to send to the Internet resource. Before
sending the packet, the TCP/IP stack checks to determine if there are Windows Firewall outgoing
rules or connection security rules for the packet.

6.

Because the destination IP address in the DNS name query does not match the connection security
rules for the tunnels to the DirectAccess server, the DirectAccess client sends the packet normally.

Any subsequent Internet resource traffic that does not match a destination in either the infrastructure
Internet tunnel or connection security rules is sent and received normally.

Like the connection process, accessing the domain controller and intranet resources is also a very similar
process, because both of these processes are using NRPT tables to locate appropriate DNS server to
resolve the name queries. The difference is the IPsec tunnel that is established between the client and
DirectAccess server. When accessing the domain controller, all the DNS queries are sent through the IPsec
infrastructure tunnel, and when accessing intranet resources, a second IPsec (intranet) tunnel is
established.

Prerequisites for Implementing DirectAccess


Requirements for DirectAccess Server
To deploy DirectAccess, you need to ensure that
your server meets the following hardware and
network requirements:

The server must be joined to an AD DS


domain.

The server must have Windows Server 2012 or


Windows Server 2008 R2 operating system
installed.

The Windows Server 2012 that will be


installed as the DirectAccess server can have a single network adapter installed, which is connected to
the intranet and published over Microsoft Forefront Threat Management Gateway (TMG) 2010 or
Microsoft Forefront Unified Access Gateway (UAG) 2010 for Internet connection. In the deployment
scenario where DirectAccess is installed on an Edge server, it needs to have two network adapters:
one that is connected to the internal network, and one that is connected to the external network. An
edge server is any server that resides on the edge between two or more networks, typically a private
network and Internet.

Implementation of DirectAccess in Windows Server 2012 does not require two consecutive static,
public IPv4 addresses be assigned to the network adapter.

You can circumnavigate the need for an additional public address by deploying Windows Server 2012
DirectAccess behind a NAT device, with support for a single or multiple interfaces. In this
configuration, only IP over HTTPS (IP-HTTPS) is deployed, which allows a secure IP tunnel to be
established using a secure HTTP connection.

MCT USE ONLY. STUDENT USE PROHIBITED

7-44 Configuring and Troubleshooting Remote Access

On the DirectAccess server, you can install the Remote Access role to configure DirectAccess settings
for the DirectAccess server and clients, and to monitor the status of the DirectAccess server. The
Remote Access Wizard provides you with the option to configure only DirectAccess, only VPN, or
both scenarios on the same server that is running Windows Server 2012. This was not possible in
Windows Server 2008 R2 deployment of DirectAccess.

For Load Balancing Support, Windows Server 2012 has the ability to use NLB (up to 8 nodes) to
achieve high availability and scalability for both DirectAccess and RAS.

Requirements for DirectAccess Client


To deploy DirectAccess, you also need to ensure that the client computer meets certain requirements:

The client computer should be joined to an Active Directory domain.

With the new 2012 DirectAccess scenario you can offline provision Windows 8 client computers for
domain membership without requiring the computer to be on premises.

The client computer can be loaded with Windows 8 Enterprise, Windows 7 Enterprise, Windows 7
Ultimate, Windows Server 2012, or Windows Server 2008 R2. You cannot deploy DirectAccess on
clients running Windows Vista, Windows Server 2008, or other older versions of the Windows
operating systems.

Infrastructure Requirements
The following are the infrastructure requirements to deploy DirectAccess:

AD DS. You must deploy at least one Active Directory domain. Workgroups are not supported.

Group Policy. You need Group Policy for centralized administration and deployment of DirectAccess
client settings. The DirectAccess Setup Wizard creates a set of GPOs and settings for DirectAccess
clients, DirectAccess servers, and management servers.

DNS and domain controller. You must have at least one domain controller and at least one DNS
server running Windows Server 2012, Windows Server 2008 SP2, or Windows Server 2008 R2.

PKI. If you have only Windows 8 client computers, you do not need a PKI. Windows 7 client
computers require a more complex setup and therefore require a PKI.

IPsec policies. DirectAccess utilizes IPsec policies that are configured and administered as part of
Windows Firewall with Advanced Security.

ICMPv6 Echo Request traffic. You must create separate inbound and outbound rules that allow
ICMPv6 Echo Request messages. The inbound rule is required to allow ICMPv6 Echo Request
messages, and must be scoped to all profiles. The outbound rule to allow ICMPv6 Echo Request
messages must be scoped to all profiles, and is only required if the Outbound block is turned on.
DirectAccess clients that use Teredo for IPv6 connectivity to the intranet use the ICMPv6 message
when establishing communication.

IPv6 and transition technologies. IPv6 and the transition technologies must be available for use on the
DirectAccess server. For each DNS server that is running Windows Server 2008 or Windows Server
2008 R2, you need to remove the ISATAP name from the global query block list.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-45

Configuring DirectAccess
To configure DirectAccess, perform the
following steps:
1.

2.

Configure AD DS and DNS requirements:


o

Create a security group in AD DS, and


add all client computer accounts that will
be accessing the intranet through
DirectAccess.

Configure both internal and external DNS


servers with appropriate host names and
IP addresses.

Configure the PKI environment:


o

3.

Add and configure the Certificate Authority server role, create the certificate template and CRL
distribution point, publish the CRL list, and distribute the computer certificates. This is not needed
if you launch the setup from the Getting Started Wizard.

Configure the DirectAccess server:


o

Install Windows Server 2012 on a server computer with one or two physical network adapters
(depending on the DirectAccess design scenario).

Join the DirectAccess server to an Active Directory domain.

Install the Remote Access role, and configure the DirectAccess server so that it is one of the
following:

The DirectAccess server is on the perimeter network with one network adapter that is
connected to the perimeter network, and at least one other network adapter that is
connected to the intranet. In this deployment scenario, the DirectAccess server is placed
between a front-end firewall and back-end firewall.

The DirectAccess server is published by using TMG, UAG, or other third-party firewalls. In this
deployment scenario, DirectAccess is placed behind a front-end firewall and it has one
network adapter connected to internal network.

The DirectAccess server is installed on an edge server (typically front end firewall) with one
network adapter that is connected to the Internet, and at least one other network adapter
that is connected to the intranet.

An alternative design is that the DirectAccess server has only one network interface, not two. For this
design, perform the following steps:
o

Verify that the ports and protocols that are needed for DirectAccess and ICMP Echo Request are
enabled in the firewall exceptions and opened on the perimeter and Internet-facing firewalls.

The DirectAccess server in simplified implementation can use a single public IP address in
combination with Kerberos Proxy services for client authentication against domain controllers.
For two-factor authentication and integration with NAP, you need to configure at least two
consecutive public, static IPv4 addresses that are externally resolvable through DNS. Ensure that
you have an IPv4 address available, and that you have the ability to publish that address in your
externally-facing DNS server.

If you have disabled IPv6 on clients and servers, you must re-enable IPv6, because it is required
for DirectAccess.

4.

MCT USE ONLY. STUDENT USE PROHIBITED

7-46 Configuring and Troubleshooting Remote Access

Install a web server on the DirectAccess server to enable DirectAccess clients to determine if they
are inside or outside the intranet. You can install this web server on a separate internal server for
determining the network location.

Based on the deployment scenario, you need to designate one of the server network adapters as
the Internet-facing interface (in deployment with two network adapters), or publish the
DirectAccess server that is deployed behind NAT, for Internet access.

On the DirectAccess server, ensure that the Internet-facing interface is configured to be either a
Public or a Private interface, depending on your network design. Configure the intranet interfaces
as domain interfaces. If you have more than two interfaces, ensure that no more than two
classification types are selected.

Configure the DirectAccess clients, and test intranet and Internet access:
o

Verify that DirectAccess group policy has been applied, and certificates have been distributed to
client computers.

Test whether you can connect to the DirectAccess server from an intranet.

Test whether you can connect to the DirectAccess server from the Internet.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-47

Lab B: Configuring DirectAccess


Scenario

Because A. Datum Corporation has expanded, many of the employees are now frequently out of the
office, either working from home or traveling. A. Datum wants to implement a remote access solution
for its employees so they can connect to the corporate network while they are away from the office.
Although the VPN solution that you implemented provides a high level of security, business management
is concerned about the complexity of the environment for end users. In addition, IT management is
concerned that they are not able to manage the remote clients effectively. To address these issues, A.
Datum has decided to implement DirectAccess on client computers that are running Windows 8.
As a senior network administrator, you are required to deploy and validate the DirectAccess deployment.
You will configure the DirectAccess environment, and validate that the client computers can connect to
the internal network when operating remotely.

Objectives
After completing this lab, you will be able to:

Configure the server infrastructure to deploy DirectAccess.

Configure the DirectAccess clients.

Validate the DirectAccess implementation.

Lab Setup

Virtual machines

20411B-LON-DC1
20411B-LON-SVR1
20411B-LON-RTR
20411B-LON-CL1

User Name

Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:


o

User name: Adatum\Administrator

Password: Pa$$w0rd

5.

Perform steps 2 through 4 for 20411B-LON-SVR1 and 20411B-LON-RTR.

6.

Do not start 20411B-LON-CL1 until directed to do so.

Exercise 1: Configuring the DirectAccess Infrastructure


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

7-48 Configuring and Troubleshooting Remote Access

You decided to implement DirectAccess as a solution for remote client computers that are not able to
connect through VPN. In addition, you want to address management problems, such as GPO application
for remote client computers. For this purpose, you will configure the prerequisite components of
DirectAccess, and configure the DirectAccess server.
The main tasks for this exercise are as follows:
1.

Configure Active Directory Domain Services (AD DS) and Domain Name System (DNS).

2.

Configure certificates.

3.

Configure internal resources.

4.

Configure the DirectAccess server.

Task 1: Configure Active Directory Domain Services (AD DS) and Domain Name
System (DNS)
1.

2.

Create a security group for DirectAccess client computers by performing the following steps:
a.

Switch to LON-DC1.

b.

Open the Active Directory Users and Computers console, and create an Organizational Unit
(OU) named DA_Clients OU.

c.

Within that OU, create a Global Security group named DA_Clients.

d.

Modify the membership of the DA_Clients group to include LON-CL1.

e.

Close Active Directory Users and Computers.

Configure firewall rules for ICMPv6 traffic by performing the following steps:
a.

Open the Group Policy Management Console, and then open Default Domain Policy.

b.

In the Group Policy Management Editor, navigate to Computer Configuration


\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security
\Windows Firewall with Advanced Security.

c.

Create a new inbound rule with the following settings:

d.

e.

Rule Type: Custom

Protocol type: ICMPv6

Specific ICMP types: Echo Request

Name: Inbound ICMPv6 Echo Requests

Create a new outbound rule with the following settings:

Rule Type: Custom

Protocol type: ICMPv6

Specific ICMP types: Echo Request

Action: Allow the connection

Name: Outbound ICMPv6 Echo Requests

Close both the Group Policy Management Editor and the Group Policy Management Console.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-49

3.

Create required DNS records by performing the following steps:


a.

Open the DNS Manager console, and then create new host records with the following settings:

Name: nls

Name: crl

b.
4.

IP Address: 172.16.0.21

IP Address: 172.16.0.1

Close the DNS Manager console.

Remove ISATAP from the DNS global query block list by performing the following steps:
a.

Open a command prompt window, type the following command, and then press Enter:
dnscmd /config /globalqueryblocklist wpad

5.

6.

b.

Ensure that the Command completed successfully message displays.

c.

Close the command prompt window.

Switch to LON-RTR and configure the DNS suffix by performing the following steps:
a.

In the Local Area Connection Properties dialog box, in the Internet Protocol Version 4
(TCP/IPv4) dialog box, add the Adatum.com DNS suffix.

b.

Close the Local Area Connection Properties dialog box.

Configure the Local Area Connection 2 properties as follows:


a.

Change the Local Area Connection 2\ Internet Protocol Version 4 (TCP/IPv4) configuration
using the following configuration settings:

IP address: 131.107.0.2

Subnet mask: 255.255.0.0

Task 2: Configure certificates


1.

Configure the CRL distribution settings by performing the following steps:


a.

Switch to LON-DC1, and open the Certification Authority console.

b.

Configure Adatum-LON-DC1-CA certification authority with the following extension settings:

Add Location: http://crl.adatum.com/crld/

Variable: CAName, CRLNameSuffix, DeltaCRLAllowed

Location: .crl

Select the following:

Include in CRLs. Clients use this to find Delta CRL locations

Include in the CDP extension of issued certificates

Do not restart Certificate Services.

Add Location: \\LON-RTR\crldist$\

Variable: CaName, CRLNameSuffix, DeltaCRLAllowed

Location: .crl

2.

Include in CRLs. Clients use this to find Delta CRL locations

Include in the CDP extension of issued certificates

c.

Restart Certificate Services.

d.

Close the Certificate Authority console.

To duplicate the web certificate template and configure appropriate permission by performing the
following steps:
a.

3.

Select the following:

In the Certificate Templates console, in the contents pane, duplicate the Web Server template by
using the following options:

Template display name: Adatum Web Server Certificate

Request Handling: Allow private key to be exported

Authenticated Users permissions: under Allow, click Enroll

b.

Close the Certificate Templates console.

c.

In the Certification Authority console, choose to issue a New Certificate Template and select the
Adatum Web Server Certificate template.

d.

Restart the Certification Authority.

e.

Close the Certification Authority console.

Configure computer certificate auto-enrollment by performing the following steps:


a.

On LON-DC1, open the Group Policy Management Console.

b.

In the Group Policy Management Console, navigate to Forest: Adatum.com


\Domains\Adatum.com.

c.

Edit the Default Domain Policy.

d.

In the Group Policy Management Editor, navigate to Computer Configuration


\Policies\Windows Settings\Security Settings\Public Key Policies.

e.

Under Automatic Certificate Request Settings, configure Automatic Certificate Request to


issue the Computer certificate.

f.

Close both the Group Policy Management Editor and the Group Policy Management Console.

Task 3: Configure internal resources


1.

MCT USE ONLY. STUDENT USE PROHIBITED

7-50 Configuring and Troubleshooting Remote Access

Request a certificate for LON-SVR1 by performing the following steps:


a.

On LON-SVR1, open a command prompt, type the following command, and then press Enter:
gpupdate /force

b.

At the command prompt, type the following command, and then press Enter:
mmc

2.

Add the Certificates snap-in for Local computer.

3.

In the console tree of the Certificates snap-in, navigate to Certificates (Local Computer)
\Personal\Certificates, and request a new certificate.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-51

4.

Under Request Certificates, select Adatum Web Server Certificate with the following setting:
o

Subject name: Under Common name, type nls.adatum.com

5.

In the details pane of the Certificates snap-in, verify that a new certificate with the name
nls.adatum.com was enrolled with Intended Purposes of Server Authentication.

6.

Close the console window. When you are prompted to save settings, click No.

7.

To change the HTTPS bindings, perform the following steps:


a.

Open Internet Information Services (IIS) Manager.

b.

In the Internet Information Services (IIS) Manager console, navigate to and click Default Web
site.

c.

Configure Site Bindings by selecting nls.adatum.com for SSL Certificate.

d.

Close the Internet Information Services (IIS) Manager console.

Task 4: Configure the DirectAccess server


1.

Obtain required certificates for LON-RTR by performing the following steps:


a.

Switch to LON-RTR.

b.

Open a command prompt, and refresh group policy by typing the following command:
gpupdate /force

c.

Open the Microsoft Management Console by typing mmc at a command prompt.

d.

Add the Certificates snap-in for Local computer.

e.

In the Certificates snap-in, in the Microsoft Management Console , request a new certificate with
the following settings:

f.
2.

3.

Certificate template: Adatum Web Server Certificate

Common name: 131.107.0.2

Friendly name: IP-HTTPS Certificate

Close the Microsoft Management Console.

Create CRL distribution point on LON-RTR by performing the following steps:


a.

Switch to Server Manager.

b.

In Internet Information Services (IIS) Manager, create new virtual directory named CRLD, and
assign c:\crldist as a home directory.

c.

Enable directory browsing and the allow double escaping feature.

Share and secure the CRL distribution point by performing the following step:
Note: You perform this step to assign permissions to the CRL distribution point.
o

In the details pane of Windows Explorer, right-click the CRLDist folder, click Properties, and then
grant Full Control Share and NTFS permissions.

4.

Publish the CRL to LON-RTR by performing the following steps:

Note: This step makes the CRL available on the edge server for Internet-based DirectAccess
clients.

5.

MCT USE ONLY. STUDENT USE PROHIBITED

7-52 Configuring and Troubleshooting Remote Access

a.

Switch to LON-DC1.

b.

Start the Certification Authority console.

c.

In the console tree, open Adatum-LON-DC1-CA, right-click Revoked Certificates, point to All
Tasks, and then click Publish.

Complete the DirectAccess Setup Wizard on LON-RTR by performing the following steps:
a.

On LON-RTR, open Server Manager.

b.

In Server Manager, in Tools, select Routing and Remote Access.

c.

In Routing and Remote Access, disable the existing configuration, and close the console.

d.

In Server Manager console, start the Remote Management console, click Configuration, and
start the Enable DirectAccess Wizard.

Note: If you get an error at this point, restart LON-RTR, sign in as Adatum\administrator,
and then restart from c).
e.

Complete the wizard with following settings:

Network Topology: Edge is selected

131.107.0.2 is used by clients to connect to the Remote Access server.

f.

In the Remote Access Management console, under Step 1, click Edit.

g.

Add the DA_Clients group.

h.

Clear the Enable DirectAccess for mobile computers only check box.

i.

Remove the Domain Computers group.

j.

In the Remote Access Management console details pane, under Step 2, click Edit.

k.

On the Network Topology page, verify that Edge is selected, and type 131.107.0.2.

l.

On the Network Adapters page, verify that CN=131.107.0.2 is used as a certificate to


authenticate IP-HTTPS connection.

m. On the Authentication page, click Use computer certificates, click Browse, and then click
Adatum Lon-Dc1 CA.
n.

On the VPN Configuration page, click Finish.

In details pane of the Remote Access Management console, under Step 3, click Edit.

p.

On the Network Location Server page, click The network location server is deployed on a
remote web server (recommended), and in the URL of the NLS, type https://nls.adatum.com,
and then click Validate.

q.

Ensure that URL is validated.

r.

On the DNS page, examine the values, and then click Next.

s.

In the DNS Suffix Search List, click Next.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-53

t.

On the Management page, click Finish.

u.

In the Remote Access Management console details pane, review the setting for Step 4.

v.

In Remote Access Review, click Apply.

w. Under Applying Remote Access Setup Wizard Settings, click Close.


6.

Update Group Policy settings on LON-RTR by performing the following step:


o

Open the command prompt, and type the following commands, pressing Enter after each line:
gpupdate /force
Ipconfig

Note: Verify that LON-RTR has an IPv6 address for Tunnel adapter IPHTTPSInterface
starting with 2002.

Results: After completing this exercise, you will have configured the DirectAccess infrastructure.

Exercise 2: Configuring the DirectAccess Clients


Scenario

After you configured the DirectAccess server and the required infrastructure, you must configure
DirectAccess clients. You decide to use Group Policy to apply DirectAccess settings to the clients and for
certificate distribution.
The main tasks for this exercise are as follows:
1.

Configure DirectAccess Group Policy settings.

2.

Verify client computer certificate distribution.

3.

Verify internal connectivity to resources.

Task 1: Configure DirectAccess Group Policy settings


1.

Start LON-CL1, and then sign in as Adatum\Administrator with the password of Pa$$w0rd. Open a
command prompt window, and then type the following commands, pressing Enter at the end of each
line:
gpupdate /force
gpresult /R

2.

Verify that DirectAccess Client Settings GPO is displayed in the list of the Applied Policy objects for
the Computer Settings.

Task 2: Verify client computer certificate distribution


1.

On LON-CL1, open the Certificates MMC.

2.

Verify that a certificate with the name LON-CL1.adatum.com displays with Intended Purposes of
Client Authentication and Server Authentication.

3.

Close the console window without saving it.

Task 3: Verify internal connectivity to resources

MCT USE ONLY. STUDENT USE PROHIBITED

7-54 Configuring and Troubleshooting Remote Access

1.

On LON-CL1, open Windows Internet Explorer from the Desktop, and in the address bar, type
http://lon-svr1.adatum.com/. The default IIS 8 web page for LON-SVR1 displays.

2.

In Internet Explorer, go to https://nls.adatum.com/. The default IIS 8 web page for LON-SVR1
displays.

3.

Open a Windows Explorer window, in the address bar, type \\Lon-SVR1\Files, and then press Enter.
A window with the contents of the Files shared folder will display.

4.

Close all open windows.

Results: After completing this exercise, you will have configured the DirectAccess clients.

Exercise 3: Verifying the DirectAccess Configuration


Scenario

When client configuration is completed, it is important to verify that DirectAccess works. You do this by
moving the DirectAccess client to the Internet, and trying to access internal resources.
The main tasks for this exercise are as follows:
1.

Move the client computer to the Internet virtual network.

2.

Verify connectivity to the DirectAccess server.

3.

Verify connectivity to the internal network resources.

4.

To prepare for the next module.

Task 1: Move the client computer to the Internet virtual network


1.

Switch to LON-CL1.

2.

Change the network adapter configuration to the following settings:


o

IP address: 131.107.0.10

Subnet mask: 255.255.0.0

Default gateway: 131.107.0.2

3.

Disable and then re-enable the Local Area Network network adapter.

4.

Close the Network Connections window.

5.

On your host, in Hyper-V Manager, right-click 20411B-LON-CL1, and then click Settings. Change
the Legacy Network Adapter to be on the Private Network 2 network, and then click OK.

Task 2: Verify connectivity to the DirectAccess server


1.

On LON-CL1, open a command prompt, and type the following command:


ipconfig

2.

Notice that the returned IP address starts with 2002. This is IP-HTTPS address.

3.

At the command prompt, type the following command, and then press Enter:
Netsh name show effectivepolicy

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 7-55

4.

At the command prompt, type the following command, and then press Enter:
powershell

5.

At the Windows PowerShell command-line interface, type the following command, and then press
Enter:
Get-DAClientExperienceConfiguration

Note: Notice the DirectAccess client settings.

Task 3: Verify connectivity to the internal network resources


1.

Switch to Internet Explorer, and go to http://lon-svr1.adatum.com/. You should see the default IIS
8 web page for LON-SVR1.

2.

Open Windows Explorer, in the address bar, type \\LON-SVR1\Files, and then press Enter.

3.

A folder window with the contents of the Files shared folder should display.

4.

At a command prompt, type the following command, and then press Enter:
ping lon-dc1.adatum.com

5.

Verify that you are receiving replies from lon-dc1.adatum.com.

6.

At the command prompt, type the following command, and then press Enter:
gpupdate /force

7.

Close all open windows.

8.

Switch to LON-RTR.

9.

Start the Remote Access Management console, and review the information on Remote Client
Status.

Note: Notice that LON-CL1 is connected via IP-HTTPS. In the Connection Details pane, in
the bottom-right of the screen, note the use of Kerberos for the Machine and the User.
10. Close all open windows.

To prepare for the next module

When you finish the lab, revert the virtual machines to their initial state.

Results: After completing this exercise, you will have verified the DirectAccess configuration.

Module Review and Takeaways


Tools
Tool

Use for

Where to find it

Services.msc

Managing Windows services

Administrative Tools
Launch from Run

Gpedit.msc

Editing the local Group Policy

Launch from Run

Mmc.exe

Creating and managing the Microsoft Management


Console

Launch from Run

Gpupdate.exe

Managing Group Policy application

Run from a command-line

MCT USE ONLY. STUDENT USE PROHIBITED

7-56 Configuring and Troubleshooting Remote Access

MCT USE ONLY. STUDENT USE PROHIBITED


8-1

Module 8
Installing, Configuring, and Troubleshooting the Network
Policy Server Role
Contents:
Module Overview

8-1

Lesson 1: Installing and Configuring a Network Policy Server

8-2

Lesson 2: Configuring RADIUS Clients and Servers

8-6

Lesson 3: NPS Authentication Methods

8-12

Lesson 4: Monitoring and Troubleshooting a Network Policy Server

8-20

Lab: Installing and Configuring a Network Policy Server

8-25

Module Review and Takeaways

8-29

Module Overview

The Network Policy Server (NPS) role in Windows Server 2012 provides support for the Remote
Authentication Dial-In User Service (RADIUS) protocol, and can be configured as a RADIUS server or
proxy. Additionally, NPS provides functionality that is essential for the implementation of Network Access
Protection (NAP). To support remote clients and to implement NAP, it is important that you know how to
install, configure, and troubleshoot NPS.

Objectives
After completing this module, you will be able to:

Install and configure NPS.

Configure RADIUS clients and servers.

Explain NPS authentication methods.

Monitor and troubleshoot NPS.

Lesson 1

Installing and Configuring a Network Policy Server


NPS is implemented as a server role in Windows Server 2012. While installing the NPS role, you
must decide whether to use NPS as a RADIUS server, RADIUS proxy, or a NAP policy server. After the
installation, you can configure the NPS role by using various tools. You must understand how to install
and configure the NPS role in order to support your RADIUS infrastructure.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the NPS role service.

Explain how to install NPS.

Describe the tools used to configure an NPS.

Explain how to configure general NPS settings.

What Is a Network Policy Server?


NPS enables you to create and enforce
organization-wide network access policies for
client health, connection request authentication,
and connection request authorization. You also
can use NPS as a RADIUS proxy to forward
connection requests to NPS or other RADIUS
servers that you configure in remote RADIUS
server groups.
You can use NPS to centrally configure
and manage network-access authentication,
authorization, and client health policies with any
combination of the following three functions:

RADIUS server

RADIUS proxy

NAP policy server

RADIUS Server

MCT USE ONLY. STUDENT USE PROHIBITED

8-2 Installing, Configuring, and Troubleshooting the Network Policy Server Role

NPS performs centralized connection authentication, authorization, and accounting for wireless,
authenticating switch, and dial-up and virtual private network (VPN) connections. When using NPS as
a RADIUS server, you configure network access servers, such as wireless access points and VPN servers,
as RADIUS clients in NPS. You also configure network policies that NPS uses to authorize connection
requests, and you can configure RADIUS accounting so that NPS logs accounting information to log files
on the local hard disk or in a Microsoft SQL Server database.
NPS is the Microsoft implementation of a RADIUS server. NPS enables the use of a heterogeneous set
of wireless, switch, remote access, or VPN equipment. You can use NPS with the Routing and Remote
Access service, which is available in Windows 2000 and more recent versions of Windows Server.

When an NPS server is a member of an Active Directory Domain Services (AD DS) domain, NPS uses
AD DS as its user-account database and provides single sign-on (SSO), which means that users utilize the

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-3

same set of credentials for network-access control (authenticating and authorizing access to a network) as
they do to access resources within the AD DS domain.
Organizations that maintain network access, such as Internet service providers (ISPs), have the challenge
of managing a variety of network-access methods from a single administration point, regardless of the
type of network-access equipment they use. The RADIUS standard supports this requirement. RADIUS is
a client-server protocol that enables network-access equipment, used as RADIUS clients, to submit
authentication and accounting requests to a RADIUS server.
A RADIUS server has access to user-account information, and can verify network-access authentication
credentials. If the users credentials are authentic, and RADIUS authorizes the connection attempt, the
RADIUS server then authorizes the users access based on configured conditions, and logs the networkaccess connection in an accounting log. Using RADIUS allows you to collect and maintain the networkaccess user authentication, authorization, and accounting data in a central location, rather than on each
access server.

RADIUS Proxy
When using NPS as a RADIUS proxy, you configure connection request policies that indicate which
connection requests that the NPS server will forward to other RADIUS servers and to which RADIUS
servers you want to forward connection requests. You also can configure NPS to forward accounting
data for logging by one or more computers in a remote RADIUS server group.

With NPS, your organization also can outsource remote-access infrastructure to a service provider, while
retaining control over user authentication, authorization, and accounting.
You can create different NPS configurations for the following solutions:

Wireless access

Organization dial-up or VPN remote access

Outsourced dial-up or wireless access

Internet access

Authenticated access to extranet resources for business partners

NAP Policy Server

When you configure NPS as a NAP policy server, NPS evaluates statements of health (SoHs) sent by NAPcapable client computers that attempt to connect to the network. NPS also acts as a RADIUS server when
it is configured with NAP, performing authentication and authorization for connection requests. You can
configure NAP policies and settings in NPS, including system health validators (SHVs), health policy, and
remediation server groups that allow client computers to update their configuration to become compliant
with your organizations network policy.
Windows 8 and Windows Server 2012 include NAP, which helps protect access to private networks by
ensuring that client computers are configured in accordance with the organizations network health
policies before they can connect to network resources. Additionally, NAP monitors client computer
compliance with administrator-defined health policy while the computer is connected to the network.
NAP autoremediation allows you to ensure that noncompliant computers are updated automatically,
bringing them into compliance with health policy so that they can connect successfully to the network.
System administrators define network health policies, and then create these policies by using NAP
components that either NPS provides, depending on your NAP deployment, or that third-party
companies provide.
Health policies can include software requirements, security-update requirements, and requiredconfiguration settings. NAP enforces health policies by inspecting and assessing the health of client
computers, restricting network access when client computers are deemed unhealthy, and remediating
unhealthy client computers for full network access.

Demonstration: Installing the Network Policy Server Role


This demonstration shows how to:

Install the NPS role.

Register NPS in AD DS.

Demonstration Steps
Install the NPS Role
1.

Switch to LON-DC1.

2.

Open Server Manager, and add the Network Policy and Access Services role.

3.

Close Server Manager.

Register NPS in AD DS
1.

Open the Network Policy Server console.

2.

Register the server in AD DS.

3.

Leave the Network Policy Server window open.

Tools for Configuring a Network Policy Server


After you install the Network Policy Server role,
you can open the NPS Administrative tool on
the Administrative Tools menu, or you can
add the snap-in to create a custom Microsoft
Management Console (MMC) tool. You also can
use netsh commands to manage and configure
the NPS role.
The following tools enable you to manage the
Network Policy and Access Services server role:

MCT USE ONLY. STUDENT USE PROHIBITED

8-4 Installing, Configuring, and Troubleshooting the Network Policy Server Role

NPS MMC snap-in. Use the NPS MMC to


configure a RADIUS server, a RADIUS proxy,
or a NAP technology.

Netsh commands for NPS. The netsh commands for NPS provide a command set that is fully
equivalent to all configuration settings that are available through the NPS MMC snap-in. You can run
netsh commands manually at the netsh prompt or in administrator scripts.

One example of using netsh is that after you install and configure NPS, you can save the
configuration by using the netsh nps show config > path\file.txt command. You then save the NPS
configuration with this command each time that you make a change.

Windows PowerShell. You also can use Windows PowerShell Cmdlets to configure and manage a
Network Policy Server.
For example, to export the NPS configuration, you can use the Export-NpsConfiguration -Path
<filename> cmdlet.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-5

Demonstration: Configuring General NPS Settings


This demonstration shows how to:

Configure a RADIUS server for VPN connections.

Save the configuration.

Demonstration Steps
Configure a RADIUS server for VPN connections
1.

In the Network Policy Server console, launch the Configure VPN or Dial-Up Wizard.

2.

Add LON-RTR as a RADIUS client.

3.

Use a shared secret of Pa$$word for authentication between the RADIUS client and the NPS server.

4.

Select Microsoft Encrypted Authentication version 2 (MS-CHAPv2) for authentication.

Save the configuration


1.

Open Windows PowerShell.

2.

Use the Export-NpsConfiguration -Path lon-dc1.xml command to save the configuration.

3.

Examine this configuration with notepad.

Lesson 2

Configuring RADIUS Clients and Servers

MCT USE ONLY. STUDENT USE PROHIBITED

8-6 Installing, Configuring, and Troubleshooting the Network Policy Server Role

RADIUS is an industry-standard authentication protocol that many vendors use to support the exchange
of authentication information between elements of a remote-access solution. To centralize your
organizations remote-authentication needs, you can configure NPS as a RADIUS server or a RADIUS
proxy. While configuring RADIUS clients and servers, you must consider several factors, such as the
RADIUS servers that will authenticate connection requests from RADIUS clients and the ports that RADIUS
traffic will use.

Lesson Objectives
After completing this lesson, you will be able to:

Describe a RADIUS client.

Describe a RADIUS Proxy.

Explain how to configure a RADIUS client.

Describe the use of a connection request policy.

Describe and configure connection-request processing for a RADIUS proxy environment.

Explain how to create a new connection request policy.

What Is a RADIUS Client?

A network access server (NAS) is a device that


provides some level of access to a larger network.
An NAS using a RADIUS infrastructure also is a
RADIUS client, originating connection requests
and accounting messages to a RADIUS server for
authentication, authorization, and accounting.
Client computers, such as wireless laptop
computers and other computers that are running
client-operating systems, are not RADIUS clients.
RADIUS clients are network access servers
including wireless access points, 802.1X
authenticating switches, VPN servers, and dial-up
serversbecause they use the RADIUS protocol to communicate with RADIUS servers such as NPS servers.
To deploy NPS as a RADIUS server, a RADIUS proxy, or a NAP policy server, you must configure RADIUS
clients in NPS.

RADIUS Client Examples


Examples of network access servers include the following:

Network access servers that provide remote access connectivity to an organization network or the
Internet, such as a computer that is running the Windows Server 2012 operating system, and the
Routing and Remote Access service that provides either traditional dial-up or VPN remote access
services to an organizations intranet.

Wireless access points that provide physical-layer access to an organizations network by using
wireless-based transmission and reception technologies.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-7

Switches that provide physical-layer access to an organizations network, using traditional local area
network (LAN) technologies, such as the Ethernet.

NPS-based RADIUS proxies that forward connection requests to RADIUS servers that are members of
a remote RADIUS server group that you configure on the RADIUS proxy, or other RADIUS proxies.

What Is a RADIUS Proxy?


You can use NPS as a RADIUS proxy to route
RADIUS messages between RADIUS clients
(network access servers) and RADIUS servers that
perform user authentication, authorization, and
accounting for the connection attempt.
When you use NPS as a RADIUS proxy, NPS is a
central switching or routing point through which
RADIUS access and accounting messages flow.
NPS records information in an accounting log
about forwarded messages.
You can use NPS as a RADIUS proxy when:

You are a service provider who offers outsourced dial, VPN, or wireless network-access services to
multiple customers.
Your NAS sends connection requests to the NPS RADIUS proxy. Based on the user names realm
portion in the connection request, the NPS RADIUS proxy forwards the connection request to a
RADIUS server that the customer maintains, and can authenticate and authorize the connection
attempt.

You want to provide authentication and authorization for user accounts that are not members of the
domain in which the NPS server is a member, or of a domain that has a two-way trust with the NPS
servers member domain.
This includes accounts in untrusted domains, one-way trusted domains, and other forests. Instead of
configuring your access servers to send their connection requests to an NPS RADIUS server, you can
configure them to send their connection requests to an NPS RADIUS proxy. The NPS RADIUS proxy
uses the realm-name portion of the user name, and then forwards the request to an NPS server in
the correct domain or forest. Connection attempts for user accounts in one domain or forest can be
authenticated for NAS in another domain or forest.

You want to perform authentication and authorization by using a database that is not a Windows
account database.

In this case, NPS forwards connection requests that match a specified realm name to a RADIUS server,
which has access to a different database of user accounts and authorization data. An example of
another user database is SQL databases.

You want to process a large number of connection requests. In this case, instead of configuring
your RADIUS clients to attempt to balance their connection and accounting requests across multiple
RADIUS servers, you can configure them to send their connection and accounting requests to an
NPS RADIUS proxy.

The NPS RADIUS proxy dynamically balances the load of connection and accounting requests across
multiple RADIUS servers, and it increases processing of large numbers of RADIUS clients and
authentications each second.

MCT USE ONLY. STUDENT USE PROHIBITED

8-8 Installing, Configuring, and Troubleshooting the Network Policy Server Role

You want to provide RADIUS authentication and authorization for outsourced service providers and
minimize intranet firewall configuration.

An intranet firewall is between your intranet and your perimeter network (the network between your
intranet and the Internet). By placing an NPS server on your perimeter network, the firewall between
your perimeter network and intranet must allow traffic to flow between the NPS server and multiple
domain controllers.

When replacing the NPS server with an NPS proxy, the firewall must allow only RADIUS traffic to flow
between the NPS proxy and one or multiple NPS servers within your intranet.

Demonstration: Configuring a RADIUS Client


This demonstration shows how to configure a RADIUS client.

Demonstration Steps
1.

Open Routing and Remote Access.

2.

Disable the existing configuration.

3.

Reconfigure LON-RTR as a VPN Server with the following information:

4.

Public interface: Local Area Connection 2

The VPN server allocates addresses from the pool: 172.16.0.100 to 172.16.0.110

Option to configure the server with: Yes, setup this server to work with a RADIUS server.

Primary RADIUS server: LON-DC1

Secret: Pa$$w0rd

Start the VPN service.

What Is a Connection Request Policy?


Connection request policies are sets of conditions
and settings that allow network administrators
to designate which RADIUS servers perform
authentication and authorization of connection
requests that the NPS server receives from RADIUS
clients. You can configure connection-request
policies to designate which RADIUS servers to use
for RADIUS accounting.
Note: When you deploy NAP by using
the VPN or 802.1X enforcement methods with
Protected Extensible Authentication Protocol
(PEAP) authentication, you must configure PEAP authentication in the connection request policy
even when connection requests are processed locally.

You can create a series of connection request policies so that some RADIUS request messages sent from
RADIUS clients are processed locally (NPS is a RADIUS server) and other types of messages are forwarded
to another RADIUS server (NPS is a RADIUS proxy).

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-9

With connection request policies, you can use NPS as a RADIUS server or as a RADIUS proxy, based on a
variety of factors, including:

The time of day and day of the week.

The realm name in the connection request.

The connection type that you are requesting.

The RADIUS clients IP address.

Conditions

Connection request policy conditions are one or more RADIUS attributes that are compared to the
attributes of the incoming RADIUS access-request message. If multiple conditions exist, NPS enforces the
policy only if all of the conditions in the connection-request message and in the connection request
policy match.

Settings
Connection request policy settings are a set of properties that are applied to an incoming RADIUS
message. Settings consist of the following groups of properties:

Authentication

Accounting

Attribute manipulation

Advanced

Default Connection Request Policy


When you install NPS, a default connection request policy is created with the following conditions:

Authentication is not configured.

Accounting is not configured to forward accounting information to a remote RADIUS server group.

Attribute manipulation is not configured with rules that change attributes in forwarded connection
requests.

Forwarding Request is turned on, which means that the local NPS server authenticates and authorizes
connection requests.

Advanced attributes are not configured.

The default connection request policy uses NPS as a RADIUS server. To configure an NPS server to act as
a RADIUS proxy, you also must configure a remote RADIUS server group. You can create a new remote
RADIUS server group while you are creating a new connection request policy with the New Connection
Request Policy Wizard. You either can delete the default connection request policy or verify that the
default connection request policy is the last policy processed.
Note: If NPS and the Routing and Remote Access service are installed on the same
computer, and you configure the Routing and Remote Access service for Windows authentication
and accounting, it is possible for Routing and Remote Access service authentication and
accounting requests to be forwarded to a RADIUS server. This can occur when Routing and
Remote Access service authentication and accounting requests match a connection request
policy that is configured to forward them to a remote RADIUS server group.

Configuring Connection-Request Processing


The default connection request policy uses NPS as
a RADIUS server, and processes all authentication
requests locally.

Considerations for Configuring


Connection-Request Processing
When configuring connection-request processing,
consider the following:

MCT USE ONLY. STUDENT USE PROHIBITED

8-10 Installing, Configuring, and Troubleshooting the Network Policy Server Role

To configure an NPS server to act as a


RADIUS proxy and forward connection
requests to other NPS or RADIUS servers,
you must configure a remote RADIUS server
group, and then add a new connection request policy that specifies conditions and settings that the
connection requests must match.

You can use the New Connection Request Policy Wizard to create a new remote RADIUS server group
when you create a new connection-request.

If you do not want the NPS server to act as a RADIUS server and process connection requests locally,
you can delete the default connection request policy.

If you want the NPS server to act as both a RADIUS server (processes connection requests locally) and
as a RADIUS proxy (forwards some connection requests to a remote RADIUS server group), then you
should add a new policy, and verify that the default connection request policy is the last policy
processed.

Ports for RADIUS and Logging


By default, NPS listens for RADIUS traffic on ports 1812, 1813, 1645, and 1646 for Internet Protocol
version 6 (IPv6) and IPv4 for all installed network adapters.
Note: If you disable either IPv4 or IPv6 on a network adapter, NPS does not monitor
RADIUS traffic for the uninstalled protocol.

The values of 1812 for authentication and 1813 for accounting are RADIUS standard ports defined in RFCs
2865 and 2866. However, by default, many access servers use ports 1645 for authentication requests and
1646 for accounting requests. When you are deciding on what port numbers to use, make sure that you
configure NPS and the access server to use the same port numbers. If you do not use the RADIUS default
port numbers, you must configure exceptions on the firewall for the local computer to enable RADIUS
traffic on the new ports.

Configuring NPS UDP Port Information

You can use the following procedure to configure the User Datagram Protocol (UDP) ports that NPS uses
for RADIUS authentication and accounting traffic.
Note: To complete this procedure, you must be a member of the Domain Admins group,
the Enterprise Admins group, or the Administrators group on the local computer.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-11

To configure NPS UDP port information by using the Windows interface:


1.

Open the NPS console.

2.

Right-click Network Policy Server, and then click Properties.

3.

Click the Ports tab, and then examine the settings for ports. If your RADIUS authentication and
RADIUS accounting UDP ports vary from the provided default values (1812 and 1645 for
authentication, and 1813 and 1646 for accounting), type your port settings in Authentication and
Accounting.

Note: To use multiple port settings for authentication or accounting requests, separate the
port numbers with commas.

Demonstration: Creating a Connection Request Policy


This demonstration shows how to create a VPN connection request policy.

Demonstration Steps
1.

On LON-DC1, switch to the Network Policy Server console.

2.

View the existing Connection Request Policies. The wizard created these automatically when you
specified the NPS role of this server.

3.

Create a new Connection Request Policy with the following settings:

4.

Type of network access server: Remote Access Server (VPN-Dial up)

Condition: NAS Port Type as Virtual (VPN)

Other settings: default values

Assign the new policy the highest priority.

Lesson 3

NPS Authentication Methods

MCT USE ONLY. STUDENT USE PROHIBITED

8-12 Installing, Configuring, and Troubleshooting the Network Policy Server Role

NPS authenticates and authorizes a connection request before allowing or denying access when users
attempt to connect to your network through network access servers, also known as RADIUS clients, such
as wireless access points, 802.1X authenticating switches, dial-up servers, and VPN servers..
Because authentication is the process of verifying the users or computers identity that is attempting to
connect to the network, NPS must receive proof of identity from the user or computer in the form of
credentials.
Some authentication methods implement the use of password-based credentials. The network access
server then passes these credentials to the NPS server, which verifies the credentials against the user
accounts database.

Other authentication methods implement the use of certificate-based credentials for the user, the client
computer, the NPS server, or some combination. Certificate-based authentication methods provide strong
security and are recommended over password-based authentication methods.
When you deploy NPS, you can specify the required type of authentication method for access to your
network.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the password-based authentication methods for an NPS server.

Describe how certificates are used to provide authentication for network clients.

Describe the types of certificates that are needed for various authentication methods.

Describe how to deploy certificates for PEAP and EAP.

Password-Based Authentication Methods


Each authentication method has advantages and
disadvantages in terms of security, usability, and
breadth of support. However, password-based
authentication methods do not provide strong
security, and we do not recommend them. We
recommend that you use a certificate-based
authentication method for all network access
methods that support certificate use. This is
especially true for wireless connections, for which
we recommend the use of PEAP-MS-CHAP v2 or
PEAP-TLS.

The authentication method you require is


determined by the configuration of the network access server, the client computer, and network policy on
the NPS server. Consult your access server documentation to determine which authentication methods are
supported.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-13

You can configure NPS to accept multiple authentication methods. You also can configure your network
access servers, also called RADIUS clients, to attempt to negotiate a connection with client computers by
requesting the use of the most secure protocol first, then the next most secure, and so on, down to the
least secure. For example, the Routing and Remote Access service tries to negotiate a connection by using
the following protocols in the order shown:
1.

Extensible Authentication Protocol (EAP)

2.

MS-CHAP v2

3.

MS-CHAP

4.

Challenge Handshake Authentication Protocol (CHAP)

5.

Shiva Password Authentication Protocol (SPAP)

6.

Password Authentication Protocol (PAP)

When EAP is chosen as the authentication method, the negotiation of the EAP type occurs between the
access client and the NPS server.

MS-CHAP Version 2

MS-CHAP v2 provides stronger security for network access connections than MS-CHAP, its predecessor.
MS-CHAP v2 is a one-way encrypted password, mutual-authentication process that works as follows:
1.

The authenticator (the network access server or the NPS server) sends a challenge to the access client
that consists of a session identifier and an arbitrary challenge string.

2.

The access client sends a response that contains:

3.

4.

The user name.

An arbitrary peer-challenge string.

A one-way encryption of the received challenge string, the peer-challenge string, the session
identifier, and the users password.

The authenticator checks the clients response, and then sends back a response that contains:
o

An indication of the connection attempts success or failure.

An authenticated response based on the sent challenge string, the peer-challenge string, the
clients encrypted response, and the users password.

The access client verifies the authentication response and, if correct, uses the connection. If the
authentication response is not correct, the access client terminates the connection.

MS-CHAP
MS-CHAP, also known as MS-CHAP version 1, is a nonreversible, encrypted password-authentication
protocol.
The challenge handshake process works as follows:
1.

The authenticator (the network access server or the NPS server) sends a challenge to the access client
that consists of a session identifier and an arbitrary challenge string.

2.

The access client sends a response that contains the user name and a nonreversible encryption of the
challenge string, the session identifier, and the password.

3.

The authenticator checks the response and, if valid, authenticates the users credentials.

Note: If you use MS-CHAP, MS-CHAP v2, or EAP-TLS as the authentication protocol, then
you can use Microsoft Point-to-Point Encryption (MPPE) to encrypt the data that was sent on the
Point-to-Point Protocol (PPP) or Point-to-Point Tunneling Protocol (PPTP) connection.
MS-CHAP v2 provides stronger security for network access connections than MS-CHAP. You should
consider using MS-CHAP v2 instead of MS-CHAP.

CHAP
The CHAP is a challenge-response authentication protocol that uses the industry-standard Message
Digest 5 (MD5) hashing scheme to encrypt the response.
Various vendors of network access servers and clients use CHAP. A server that is running Routing and
Remote Access supports CHAP, so access clients that require CHAP are authenticated. Because CHAP
requires the use of a reversibly-encrypted password, you should consider using another authentication
protocol, such as MS-CHAP v2.

Additional Considerations
When implementing CHAP, consider the following:

When users passwords expire, CHAP does not provide the ability for them to change passwords
during the authentication process.

Verify that your network access server supports CHAP before you enable it on an NPS servers
network policy. For more information, refer to your NAS documentation.

You cannot use MPPE with CHAP.

PAP

MCT USE ONLY. STUDENT USE PROHIBITED

8-14 Installing, Configuring, and Troubleshooting the Network Policy Server Role

PAP uses plaintext passwords and is the least secure authentication protocol. It typically is negotiated
if the access client and network access server cannot negotiate a more secure authentication method.
When you enable PAP as an authentication protocol, user passwords are sent in plaintext form. Anyone
capturing the packets of the authentication process can read the password easily, and then use it to gain
unauthorized access to your intranet. We highly discourage the use of PAP, especially for VPN
connections.

Unauthenticated Access

With unauthenticated access, user credentials (a user name and password) are not required. Although
there are some situations in which unauthenticated access is useful, in most cases, we do not recommend
that you deploy unauthenticated access to your organizations network.

When you enable unauthenticated access, users can access your network without sending user credentials.
Additionally, unauthenticated access clients do not negotiate the use of a common authentication
protocol during the connection establishment process, and they do not send NPS a user name or
password.
If you permit unauthenticated access, clients can connect without being authenticated if the
authentication protocols that are configured on the access client do not match the authentication
protocols that are configured on the network access server. In this case, the use of a common
authentication protocol is not negotiated, and the access client does not send a user name and password.
This circumstance creates a serious security problem. Therefore, unauthenticated access should not be
allowed on most networks.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-15

Using Certificates for Authentication


Certificates are digital documents that certification
authorities (CAs) issue, such as Active Directory
Certificate Services (AD CS) or the VeriSign public
CA. You can use certificates for many purposes,
such as code signing and securing email
communication. However, with NPS, you use
certificates for network access authentication
because they provide strong security for
authenticating users and computers, and
eliminate the need for less secure, passwordbased authentication methods.
NPS servers use EAP-TLS and PEAP to perform
certificate-based authentication for many types of network access, including VPN and wireless
connections.

Authentication Methods

Two authentication methods, when you configure them with certificate-based authentication types, use
certificates: EAP and PEAP. With EAP, you can configure the authentication type TLS (EAP-TLS), and with
PEAP, you can configure the authentication types TLS (PEAP-TLS) and MS-CHAP v2 (PEAP-MS-CHAP v2).
These authentication methods always use certificates for server authentication. Depending on the
authentication type that you configure with the authentication method, you also might use certificates
for user authentication and client computer authentication.
Note: Using certificates for VPN connection authentication is the strongest form of
authentication available in Windows Server 2008 R2. You must use certificates for IPsec
authentication on VPN connections that are based on Layer Two Tunneling protocol over
Internet protocol security (L2TP/IPsec). PPTP connections do not require certificates, although
you can configure PPTP connections to use certificates for computer authentication when you
use EAP-TLS as the authentication method. For wireless clients (computing devices with wireless
network adapters, such as your portable computer or personal digital assistant), use PEAP with
EAP-TLS and smart cards or certificates for authentication.
Note: You can deploy certificates for use with NPS by installing and configuring the AD CS
server role.

Mutual Authentication

When you use EAP with a strong EAP type (such as TLS with smart cards or certificates), the client and
the server use certificates to verify their identities to each other, which is known as mutual authentication.
Certificates must meet specific requirements to allow the server and the client to use them for mutual
authentication.

One such requirement is that the certificate is configured with one or more purposes in Extend Key Usage
(EKU) extensions that correlate to the certificate use. For example, you must configure a certificate that
you use for a clients authentication with the Client Authentication purpose. Similarly, you must configure
a certificate that you use for a servers authentication with the Server Authentication purpose. When you
use certificates for authentication, the authenticator examines the client certificate, seeking the correct
purpose object identifier in EKU extensions. For example, the object identifier for the Client
Authentication purpose is 1.3.6.1.5.5.7.3.2. When you use a certificate for client computer authentication,
this object identifier must be present in the EKU extensions of the certificate or authentication will fail.

Certificate Templates

MCT USE ONLY. STUDENT USE PROHIBITED

8-16 Installing, Configuring, and Troubleshooting the Network Policy Server Role

Certificate Templates is an MMC snap-in that enables customization of certificates that AD CS issues.
Customization possibilities include how certificates are issued and what the certificates contain, including
their purposes. In Certificate Templates, you can use a default template, such as the Computer template,
to define the template that the CA uses to assign certificates to computers. You also can create a
certificate template and assign purposes to it in EKU extensions. By default, the Computer template
includes the Client Authentication purpose and the Server Authentication purpose in EKU extensions.

The certificate template that you create can include any purpose for which you will use the certificate.
For example, if you use smart cards for authentication, you can include the Smart Card Logon purpose as
well as the Client Authentication purpose. When using NPS, you can configure NPS to check certificate
purposes before granting network authorization. NPS can check additional EKUs and Issuance Policy
purposes, also known as Certificate Policies.
Note: Some non-Microsoft CA software might contain a purpose named All, which
represents all possible purposes. This is indicated by a blank (or null) EKU extension. Although All
is intended to mean all possible purposes, you cannot substitute the All-purpose for the Client
Authentication purpose, the Server Authentication purpose, or any other purpose that is related
to network access authentication.

Required Certificates for Authentication


The following table details the certificates that are
required to deploy each of the listed certificatebased authentication methods successfully.

Certificate
CA certificate in
the Trusted Root
Certification
Authorities
certificate store for
the Local
Computer and
Current User

Required for EAP-TLS and


PEAP-TLS?
Yes. The CA certificate is
enrolled automatically for
domain member
computers. For nondomain
member computers, you
must import the certificate
manually into the certificate
store.

Required for PEAP-MSCHAP v2?


Yes. This certificate is
enrolled automatically
for domain member
computers. For
nondomain member
computers, you must
import the certificate
manually into the
certificate store.

Details

For PEAP-MS-CHAP
v2, this certificate is
required for mutual
authentication
between client and
server.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-17

Certificate

Required for EAP-TLS and


PEAP-TLS?

Required for PEAP-MSCHAP v2?

Details

Client computer
certificate in the
certificate store of
the client

Yes. Client computer


certificates are required
unless user certificates are
distributed on smart cards.
Client certificates are
enrolled automatically for
domain member
computers. For nondomain
member computers, you
must import the certificate
manually or obtain it with
the Web-enrollment tool.

No. User
authentication is
performed with
password-based
credentials, not
certificates.

If you deploy user


certificates on smart
cards, client
computers do not
need client
certificates.

Server certificate in
the certificate store
of the NPS server

Yes. You can configure


AD CS to autoenroll server
certificates to members of
the RAS and IAS servers
group in AD DS.

Yes. In addition to
using AD CS for server
certificates, you can
purchase server
certificates from other
CAs that client
computers already
trust.

The NPS server sends


the server certificate
to the client
computer. The client
computer uses the
certificate to
authenticate the NPS
server.

User certificate on
a smart card

AD CS to auto-enroll server
certificates to members of
the RAS and IAS servers
group in AD DS.

No. User
authentication is
performed with
password-based
credentials, not
certificates.

For EAP-TLS and


PEAP-TLS, if you do
not auto-enroll client
computer certificates,
user certificates on
smart cards are
required.

The Institute of Electrical and Electronics Engineers, Inc. (IEEE) 802.1X authentication provides
authenticated access to 802.11 wireless networks and wired Ethernet networks. 802.1X provides support
for secure EAP types, such as TLS with smart cards or certificates. You can configure 802.1X with EAP-TLS
in a variety of ways.

If you configure the Validate server certificate option on the client, the client authenticates the server by
using its certificate. Client computer and user authentication is accomplished by using certificates from
the client certificate store or a smart card, providing mutual authentication.
With wireless clients, you can use PEAP-MS-CHAP v2 as the authentication method. PEAP-MS-CHAP v2 is
a password-based user authentication method that uses TLS with server certificates. During PEAP-MSCHAP v2 authentication, the NPS server supplies a certificate to validate its identity to the client (if the
Validate server certificate option is configured on the Windows 8 client). Client computer and user
authentication is accomplished with passwords, which eliminates some of the difficulty of deploying
certificates to wireless client computers.

Deploying Certificates for PEAP and EAP


All certificates that you use for network access
authentication with EAP-TLS and PEAP must meet
the requirements for X.509 certificates and work
for connections that use Secure Sockets LayerTransport Layer Security (SSL/TLS). After this
minimum requirement is met, both client and
server certificates have additional requirements.

Minimum Server Certificate


Requirements
You can configure clients to validate server
certificates by using the Validate server certificate
option within the authentication protocols
properties. With PEAP-MS-CHAP v2, PEAP-TLS, or EAP-TLS as the authentication method, the client
accepts the server authentication attempt when the certificate meets the following requirements:

The Subject name contains a value. If you issue a certificate to your NPS server that has a blank
Subject, the certificate is not available to authenticate your NPS server. To configure the certificate
template with a Subject name:
a.

Open Certificate Templates.

b.

In the details pane, right-click the certificate template that you want to change, and then click
Properties.

c.

Click the Subject Name tab, and then click Build from this Active Directory information.

d.

In Subject name format, select a value other than None.

MCT USE ONLY. STUDENT USE PROHIBITED

8-18 Installing, Configuring, and Troubleshooting the Network Policy Server Role

The computer certificate on the server chains to a trusted root CA, and does not fail any of the checks
that CryptoAPI performs and that the remote access or network policies specify.

The NPS or VPN server computer certificate is configured with the Server Authentication purpose in
EKU extensions (the object identifier for Server Authentication is 1.3.6.1.5.5.7.3.1).

The server certificate is configured with a required algorithm value of RSA. To configure the required
cryptography setting:

a.

Open Certificate Templates.

b.

In the details pane, right-click the certificate template that you want to change, and then click
Properties.

c.

Click the Cryptography tab. In Algorithm name, click RSA. Ensure that Minimum key size is
set to 2048.

The Subject Alternative Name (SubjectAltName) extension, if you use it, must contain the servers fully
qualified domain name (FQDN). To configure the certificate template with the Domain Name System
(DNS) name of the enrolling server:
a.

Open Certificate Templates.

b.

In the details pane, right-click the certificate template that you want to change, and then click
Properties.

c.

Click the Subject Name tab, and then click Build from this Active Directory information.

d.

In Include this information in alternate subject name, select DNS name.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-19

With PEAP and EAP-TLS, NPS servers display a list of all installed certificates in the computer certificate
store, except the following:

Certificates that do not contain the Server Authentication purpose in EKU extensions.

Certificates that do not contain a subject name.

Registry-based and smart card-logon certificates.

Minimum Client Certificate Requirements

With EAP-TLS or PEAP-TLS, the server accepts the client authentication attempt when the certificate meets
the following requirements:

An enterprise CA issued the client certificate or it is mapped to an Active Directory user or computer
account.

The user or computer certificate on the client chains to a trusted-root CA; the certificate includes
the Client Authentication purpose in EKU extensions (the object identifier for Client Authentication
is 1.3.6.1.5.5.7.3.2); and fails neither the checks that CryptoAPI performs, which the remote access or
network policies specify, nor the Certificate object identifier checks that the NPS network policies
specify.

The 802.1X client does not use registry-based certificates that are either smart card-logon or
password-protected certificates.

For user certificates, the Subject Alternative Name (SubjectAltName) extension in the certificate
contains the user principal name (UPN). To configure the UPN in a certificate template:

a.

Open Certificate Templates.

b.

In the details pane, right-click the certificate template that you want to change, and then click
Properties.

c.

Click the Subject Name tab, and then click Build from this Active Directory information.

d.

In Include this information in alternate subject name, select User principal name (UPN).

For computer certificates, the Subject Alternative Name (SubjectAltName) extension in the certificate
must contain the clients FQDN, also known as the DNS name. To configure this name in the
certificate template:
a.

Open Certificate Templates.

b.

In the details pane, right-click the certificate template that you want to change, and then click
Properties.

c.

Click the Subject Name tab, and then click Build from this Active Directory information.

d.

In Include this information in alternate subject name, select DNS name.

With PEAP-TLS and EAP-TLS, clients display a list of all installed certificates in the Certificates snap-in, with
the following exceptions:

Wireless clients do not display registry-based and smart card-logon certificates.

Wireless clients and VPN clients do not display password-protected certificates.

Certificates that do not contain the Client Authentication purpose in EKU extensions.

Lesson 4

MCT USE ONLY. STUDENT USE PROHIBITED

8-20 Installing, Configuring, and Troubleshooting the Network Policy Server Role

Monitoring and Troubleshooting a Network Policy Server


You can monitor NPS by configuring and using logging for events, and user authentication and
accounting requests. Event logging enables you to record NPS events in the system and security event
logs. You can use request logging for connection analysis and billing purposes. The information that the
log files collect is useful for troubleshooting connection attempts and for security investigation.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the methods for monitoring NPS.

Describe how to configure log file properties.

Describe how to configure SQL Server logging in NPS.

Describe how to configure NPS events to be recorded in Event Viewer.

Methods Used to Monitor NPS


The two types of accounting, or logging, that you
can use to monitor NPS are:

Event logging for NPS. You can use event


logging to record NPS events in the system
and security event logs. You use this primarily
for auditing and troubleshooting connection
attempts.

Logging user authentication and accounting


requests. You can log user authentication and
accounting requests to log files in text format
or database format, or you can log to a stored
procedure in a SQL Server database. Use
request logging primarily for connection analysis and billing purposes, and as a security investigation
tool, because it enables you to identify an attackers activity.

To make the most effective use of NPS logging:

Turn on logging (initially) for authentication and accounting records. Modify these selections after
you determine what is appropriate for your environment.

Ensure that you configure event logging with sufficient capacity to maintain your logs.

Back up all log files on a regular basis, because they cannot be recreated when damaged or deleted.

Use the RADIUS Class attribute to track usage and simplify identification of which department or
user to charge for usage. Although the Class attribute, which is generated automatically, is unique for
each request, duplicate records might exist in cases where the reply to the access server is lost and the
request is re-sent. You might need to delete duplicate requests from your logs to track usage
accurately.

To provide failover and redundancy with SQL Server logging, place two computers that are running
SQL Server on different subnets. Use the SQL Server Create Publication Wizard to set up database
replication between the two servers. For more information, refer to the SQL Server documentation.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-21

Note: To interpret logged data, view the information on the Microsoft TechNet website:
Interpret NPS Database Format Log Files
http://go.microsoft.com/fwlink/?LinkID=214832&clcid=0x409

Logging NPS Accounting


You can configure NPS to perform RADIUS
accounting for user authentication requests,
Access-Accept messages, Access-Reject messages,
accounting requests and responses, and periodic
status updates. You can use this procedure to
configure the log files where you want to store
the accounting data.

Considerations for Configuring


Accounting for NPS
The following list provides more information
about configuring NPS accounting:

To send the log file data for collection by another process, you can configure NPS to write to a
named pipe. To use named pipes, set the log file folder to \\.\pipe or \\ComputerName\pipe. The
named pipe server program creates a named pipe called \\.\pipe\iaslog.log to accept the data. In the
Local File Properties dialog box, in Create a new log file, select Never (unlimited file size) when
you use named pipes.

To create the log file directory, use system environment variables (instead of user variables),
such as %systemdrive%, %systemroot%, and %windir%. For example, the following path, using the
environment variable %windir%, locates the log file at the system directory in the subfolder
\System32\Logs (that is, %windir%\System32\Logs\).

Switching log-file formats does not cause a new log to be created. If you change log file formats,
the file that is active when the change occurs will contain a mixture of the two formats. Records at the
logs start will have the previous format, and records at the logs end will have the new format.

If you are administering an NPS server remotely, you cannot browse the directory structure. If you
need to log accounting information to a remote server, specify the log file name by typing a Universal
Naming Convention (UNC) name, such as \\MyLogServer\LogShare.

If RADIUS accounting fails due to a full hard-disk drive or other causes, NPS stops processing
connection requests, which prevents users from accessing network resources.

NPS enables you to log to a SQL Server database in addition to, or instead of, logging to a local file.

Note: If you do not supply a full path statement in Log File Directory, the default path
is used. For example, if you type NPSLogFile in Log File Directory, the file is located at
%systemroot%\System32\NPSLogFile.

Configuring Log File Properties


To configure log file properties by using the Windows interface, perform the following tasks:
1.

Open the Network Policy Server MMC snap-in.

2.

In the console tree, click Accounting.

3.

In the details pane, click Change Log File Properties.

MCT USE ONLY. STUDENT USE PROHIBITED

8-22 Installing, Configuring, and Troubleshooting the Network Policy Server Role

4.

In Log File Properties, on the Log File tab, in Directory, type the location where you want to store
NPS log files. The default location is the systemroot\System32\LogFiles folder.

5.

In Format, select from DTS Compliant, ODBC (Legacy), and IAS (Legacy).

6.

To configure NPS to start new log files at specified intervals, click the interval that you want to use:

7.

For heavy transaction volume and logging activity, click Daily.

For lesser transaction volumes and logging activity, click Weekly or Monthly.

To store all transactions in one log file, click Never (unlimited file size).

To limit the size of each log file, click When log file reaches this size, and then type a file size,
after which a new log is created. The default size is 10 megabytes (MB).

To configure NPS to delete log files automatically when the disk is full, click When disk is full delete
older log files. If the oldest log file is the current log file, it is not deleted.

Note: To complete this procedure, you must be a member of the Domain Admins group,
the Enterprise Admins group, or the Administrators group on the local computer.

Configuring SQL Server Logging


You can configure NPS to perform RADIUS
accounting to a SQL Server database. You can use
this procedure to configure logging properties
and the connection to the running SQL Server
that stores your accounting data. The SQL Server
database can be on the local computer or on a
remote server.
Note: NPS formats accounting data as an
XML document that it sends to the report_event
stored procedure in the SQL Server database that
you designate in NPS. For SQL Server logging to
function properly, you must have a stored procedure named report_event in the SQL Server
database that can receive and parse the XML documents from NPS.

Configuring SQL Server Logging in NPS


To configure SQL Server logging in NPS using the Windows interface, perform the following tasks:
1.

Open the Network Policy Server MMC snap-in.

2.

In the console tree, click Accounting.

3.

In the details pane, click Change SQL Server Logging Properties. The SQL Server Logging
Properties dialog box opens.

4.

In Log the following information, select the information that you want to log:
o

To log all accounting requests, select Accounting requests.

To log authentication requests, select Authentication requests.

To log periodic status, such as interim accounting requests, select Periodic accounting status.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-23

To log periodic status, such as interim authentication requests, select Periodic authentication
status.

5.

To configure the number of concurrent sessions that you want to allow between the NPS server and
the SQL Server database, type a number in Maximum number of concurrent sessions.

6.

To configure the SQL Server data source, click Configure. The Data Link Properties dialog box
opens. On the Connection tab, specify the following:

7.

To specify the servers name on which the database is stored, type or select a name in Select or
enter a server name.

To specify the authentication method with which to sign in to the server, click Use Windows NT
integrated security, or click Use a specific user name and password, and then type your
credentials in User name and Password.

To allow a blank password, select Blank password.

To store the password, select Allow saving password.

To specify to which database to connect on the computer that is running SQL Server, click Select
the database on the server, and then select a database name from the list.

To test the connection between the NPS server and the computer that is running SQL Server, click
Test Connection.

Note: To complete this procedure, you must be a member of the Domain Admins group,
the Enterprise Admins group, or the Administrators group on the local computer.

Configuring NPS Events to Record in the Event Viewer


You can configure NPS event logging to record
connection-request failure and success events in
the Event Viewer system log.

Configuring NPS Event Logging


To configure NPS event logging by using the
Windows interface, perform the following tasks:
1.

Open the Network Policy Server (NPS)


snap-in.

2.

Right-click NPS (Local), and then click


Properties.

3.

On the General tab, select each of the following options, as required, and then click OK:
o

Rejected authentication requests

Successful authentication requests

Note: To complete this procedure, you must be a member of the Domain Admins group or
the Enterprise Admins group.

Using the event logs in Event Viewer, you can monitor NPS errors and other events that you configure
NPS to record.

MCT USE ONLY. STUDENT USE PROHIBITED

8-24 Installing, Configuring, and Troubleshooting the Network Policy Server Role

NPS records connection-request failure events in the System and Security event logs by default.
Connection-request failure events consist of requests that NPS rejects or discards. Other NPS
authentication events are recorded in the Event Viewer system sign in the basis of settings that you
specify in the NPS snap-in. Therefore, the Event Viewer security log might record some events containing
sensitive data.

Connection-Request Failure Events


Although NPS records connection-request failure events by default, you can change the configuration
according to your logging needs. NPS rejects or ignores connection requests for a variety of reasons,
including the following:

The RADIUS message is not formatted according to RFCs 2865 or 2866.

The RADIUS client is unknown.

The RADIUS client has multiple IP addresses and has sent the request on an address other than the
one that you define in NPS.

The message authenticator (also known as a digital signature) that the client sent is invalid because
the shared secret is invalid.

NPS was unable to locate the user names domain.

NPS was unable to connect to the user names domain.

NPS was unable to access the user account in the domain.

When NPS rejects a connection request, the information in the event text includes the user name, access
server identifiers, the authentication type, the name of the matching network policy, the reason for the
rejection, and other information.

Connection Request Success Events


Although NPS records connection request success events by default, you can change the configuration
according to your logging needs.

When NPS accepts a connection request, the information in the event text includes the user name, access
server identifiers, the authentication type, and the name of the first matching network policy.

Logging Schannel Events


Secure channel (Schannel) is a security support provider (SSP) that supports a set of Internet security
protocols, such as SSL and TLS. These protocols provide identity authentication and secure, private
communication through encryption.

Logging of client-certificate validation failures is a secure channel event and is not enabled on the NPS
server, by default. You can enable additional secure channel events by changing the following registry key
value from 1 (REG_DWORD type, data 0x00000001) to 3 (REG_DWORD type, data 0x00000003):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\EventLoggi
ng

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-25

Lab: Installing and Configuring a Network Policy Server


Scenario

A. Datum is a global engineering and manufacturing company with its head office in London, UK. An IT
office and data center is located in London, to support the London office and other locations. A. Datum
has recently deployed a Windows Server 2012 server and client infrastructure.

A. Datum is expanding its remote-access solution to the entire organization. This will require multiple VPN
servers that are located at different points to provide connectivity for its employees. You are responsible
for performing the tasks necessary to support these VPN connections.

Objectives
After completing this lab, you will be able to:

Install and configure NPS to support RADIUS.

Configure and test a RADIUS client.

Lab Setup
Estimated Time: 60 minutes

Virtual Machines

20411B-LON-DC1
20411B-LON-RTR
20411B-LON-CL2

User Name

Adatum\Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:

5.

User name: Adatum\Administrator

Password: Pa$$w0rd

Perform steps 2 through 4 for 20411B-LON-RTR and 20411B-LON-CL2.

Exercise 1: Installing and Configuring NPS to Support RADIUS


Scenario

You have been tasked with installing an NPS into the existing infrastructure to be used for RADIUS
services. In this exercise, you will configure the RADIUS server with appropriate templates to help manage
any future implementations. You also need to configure Accounting to log authentication information to
a local text file on the server.

The main tasks for this exercise are as follows:


1.

Install and configure the Network Policy Server.

2.

Configure NPS Templates.

3.

Configure RADIUS accounting.

Task 1: Install and configure the Network Policy Server

MCT USE ONLY. STUDENT USE PROHIBITED

8-26 Installing, Configuring, and Troubleshooting the Network Policy Server Role

1.

Switch to LON-DC1.

2.

Sign in as Adatum\Administrator with the password Pa$$w0rd.

3.

Using Server Manager, install the Network Policy and Access Services role by using default values
to complete the installation wizard.

4.

Open the Network Policy Server console, and then register the server in Active Directory.

5.

Leave the Network Policy Server console open.

Task 2: Configure NPS Templates


1.

2.

3.

Create a new Shared Secrets template with the following properties:


o

Name: Adatum Secret

Shared secret: Pa$$w0rd

Create a new RADIUS Clients template with the following properties:


o

Friendly name: LON-RTR

Address (IP or DNS): LON-RTR

Shared Secret: Use Adatum Secret template.

Leave the Network Policy Server console open.

Task 3: Configure RADIUS accounting


1.

In the Network Policy Server console, launch the Accounting Configuration Wizard.

2.

Choose the Log to a text file on the local computer option, and then use the default values to
complete the wizard.

3.

Leave the Network Policy Server console open.

Results: After this exercise, you should have enabled and configured NPS to support the required
environment.

Exercise 2: Configuring and Testing a RADIUS Client


Scenario
You need to configure a server as a VPN server and a RADIUS client, including the client configuration,
and then you need to modify the Network Policy settings.
The main tasks for this exercise are as follows:
1.

Configure a RADIUS client.

2.

Configure a network policy for RADIUS.

3.

Test the RADIUS configuration.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-27

Task 1: Configure a RADIUS client


1.

Create a RADIUS Client by using the following properties:


o

Template: LON-RTR

2.

Leave the console open, and then switch to LON-RTR.

3.

Logon as Adatum\Administrator with the password Pa$$w0rd.

4.

Open Routing and Remote Access, and Disable Routing and Remote Access.

5.

Select Configure and Enable Routing and Remote Access.

6.

Reconfigure LON-RTR as a VPN Server:


o

Local Area Connection 2 is the public interface

The VPN server allocates addresses from the pool: 172.16.0.100 > 172.16.0.110

The server is configured with the option Yes, setup this server to work with a RADIUS server.

Primary RADIUS server: LON-DC1

Secret: Pa$$w0rd

The VPN service starts.

Task 2: Configure a network policy for RADIUS


1.

Switch to LON-DC1.

2.

Switch to the Network Policy Server console.

3.

Disable the two existing network policies. These would interfere with the processing of the policy that
you are about to create.

4.

Create a new Network Policy by using the following properties:


o

Policy name: Adatum VPN Policy

Type of network access server: Remote Access Server(VPN-Dial up)

Condition: NAS Port Type = Virtual (VPN)

Permission: Access granted

Authentication methods: default

Constraints: default

Settings: default

Task 3: Test the RADIUS configuration


1.

Switch to LON-CL2 and sign in as Adatum\Administrator with the password Pa$$w0rd.

2.

Create a new VPN connection with the following properties:


o

Internet address to connect to: 10.10.0.1

Destination name: Adatum VPN

Allow other people to use this connection: true

3.

4.

MCT USE ONLY. STUDENT USE PROHIBITED

8-28 Installing, Configuring, and Troubleshooting the Network Policy Server Role

After you have created the VPN, modify its settings by viewing the properties of the connection, and
then selecting the Security tab. Use the following settings to reconfigure the VPN:
o

Type of VPN: Point to Point Protocol (PPTP)

Authentication: Allow these protocols =Microsoft CHAP Version 2 (MS-CHAP v2)

Test the VPN connection. Use the following credentials:


o

User name: Adatum\Administrator

Password: Pa$$w0rd

Results: After this exercise, you should have deployed a VPN server, and then configured it as a RADIUS
client.

To prepare for the next module


When you are finished the lab, revert all virtual machines to their initial state. To do this, perform the
following steps:
1.

On the host computer, start Hyper-V Manager.

2.

In the Virtual Machines list, right-click 20411B-LON-CL2, and then click Revert.

3.

In the Revert Virtual Machines dialog box, click Revert.

4.

Repeat steps 2 and 3 for 20411B-LON-RTR and 20411B-LON-DC1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 8-29

Module Review and Takeaways


Review Questions
Question: How can you make the most effective use of the NPS logging features?
Question: What consideration must you follow if you choose to use a nonstandard port
assignment for RADIUS traffic?
Question: Why must you register the NPS server in Active Directory?

Tools
Tool

Use for

Where to find it

Network Policy
Server

Managing and creating Network Policy

Network Policy Server on the


Administrative Tools menu

Netsh commandline tool

Creating administrative scripts for


configuring and managing the Network
Policy Server role

In a Command Prompt window,


type netsh c nps to administer
from a command prompt

Event Viewer

Viewing logged information from


application, system, and security events

Event Viewer on the Administrative


Tools menu

MCT USE ONLY. STUDENT USE PROHIBITED

MCT USE ONLY. STUDENT USE PROHIBITED


9-1

Module 9
Implementing Network Access Protection
Contents:
Module Overview

9-1

Lesson 1: Overview of Network Access Protection

9-2

Lesson 2: Overview of NAP Enforcement Processes

9-7

Lesson 3: Configuring NAP

9-14

Lesson 4: Monitoring and Troubleshooting NAP

9-19

Lab: Implementing NAP

9-23

Module Review and Takeaways

9-29

Module Overview

Your network is only as secure as the least-secure computer attached to it. Many programs and tools exist
to help you to secure your network-attached computers, such as antivirus or malware detection software.
However, if the software on some of your computers is not up to date, or not enabled or configured
correctly, then these computers continue to pose a security risk.
Computers that remain within the office environment and always connect to the same network are
relatively easy to keep configured and updated. Computers that connect to different networks, especially
unmanaged networks, are less easy to control. For example, it is difficult to control laptop computers that
users use to connect to customer networks or public Wi-Fi hotspots. Furthermore, unmanaged computers
that are seeking to connect remotely to your network, such as users connecting from their home
computers, also pose a challenge.
Network Access Protection (NAP) enables you to create customized health-requirement policies to
validate computer health before allowing access or communication. Additionally, NAP updates compliant
computers automatically to ensure their ongoing compliance, and can limit the access of noncompliant
computers to a restricted network until they become compliant.

Objectives
After completing this module, you will be able to:

Describe how NAP can help protect your network.

Describe the various NAP enforcement processes.

Configure NAP.

Monitor and troubleshoot NAP.

Lesson 1

Overview of Network Access Protection

MCT USE ONLY. STUDENT USE PROHIBITED

9-2 Implementing Network Access Protection

NAP is a policy-enforcement platform that is built into the Windows 8, Windows 7, Windows Vista,
Windows XP with Service Pack 3 (SP3), Windows Server 2008, Windows Server 2008 R2, and Windows
Server 2012 operating systems. You can use NAP to protect network assets more strongly by enforcing
compliance with system-health requirements. NAP provides the necessary software components to help
ensure that computers connected or connecting to your network remain manageable so they do not
become a security risk to your enterprises network and other attached computers.
Understanding the functionality and limitations of NAP will help you protect your network from the
security risks posed by noncompliant computers.

Lesson Objectives
After completing this lesson, you will be able to:

Explain how you can use NAP to enforce computer health requirements.

Describe the scenarios in which you would use NAP.

Describe the NAP enforcement methods.

Describe the architecture of a NAPenabled network infrastructure.

What Is Network Access Protection?


NAP provides components and an application
programming interface (API) that can help enforce
compliance with your organizations healthrequirement policies for network access or
communication.
NAP enables you to create solutions for validating
computers that connect to your networks, and
provide needed updates or access to requisite
health-update resources. Additionally, NAP
enables you to limit the access or communication
of noncompliant computers.
You can integrate NAPs enforcement features
with software from other vendors or with custom programs.

It is important to remember that NAP does not protect a network from malicious users. Rather, it helps
you maintain the health of your organizations networked computers automatically, which in turn
helps maintain your networks overall integrity. For example, if a computer has all of the software and
configuration settings that the health policy requires, the computer is compliant and will have unlimited
network access. However, NAP does not prevent an authorized user with a compliant computer from
uploading a malicious program to the network or engaging in other inappropriate behavior.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-3

How to Use NAP


You can use NAP in three distinct ways:

To validate the health state. When a computer attempts to connect to the network, NAP validates
the computers health state against the health-requirement policies that the administrator defines.
You also can define what to do if a computer is not compliant. In a monitoring-only environment, all
computers have their health state evaluated, and NAP logs the compliance state of each computer for
analysis. In a limited access environment, computers that comply with the health-requirement policies
have unlimited network access. Computers that do not comply with health-requirement policies
could find their access limited to a restricted network.

To enforce health-policy compliance. You can help ensure compliance with health-requirement
policies by choosing to update noncompliant computers automatically with missing software
updates or configuration changes through management software, such as Microsoft System Center
Configuration Manager. In a monitoring-only environment, NAP will ensure that computers update
their network access before they receive required updates or configuration changes. In a limited
access environment, noncompliant computers have limited access until the updates and configuration
changes are complete. In both environments, computers that are compatible with NAP can become
compliant automatically and you can define exceptions for computers that are not NAP compatible.

To limit network access. You can protect your networks by limiting the access of noncompliant
computers. You can base limited network access on a specific amount of time, or on what resources
that the noncompliant computer can access. In the latter case, you define a restricted network that
contains health update resources, and the limited access will last until the noncompliant computer
comes into compliance. You also can configure exceptions so that computers that are not compatible
with NAP do not have limited network access.

NAP Scenarios
NAP provides a solution for the common
scenarios, such as roaming laptops, desktop
computers, visiting laptops, and unmanaged
computers. Depending on your needs, you can
configure a solution to address any or all of these
scenarios for your network.

Roaming Laptops

Portability and flexibility are two primary


advantages of a laptop, but these features also
present a system health threat. Users frequently
connect their laptops to other networks. While
users are away from your organization, their
laptops might not receive the most recent software updates or configuration changes. Additionally,
exposure to unprotected networks, such as the Internet, could introduce security-related threats to
the laptops. NAP allows you to check any laptops health state when it reconnects to the organizations
network, whether through a virtual private network (VPN), a Windows 8 DirectAccess connection, or the
workplace network connection.

Desktop Computers

MCT USE ONLY. STUDENT USE PROHIBITED

9-4 Implementing Network Access Protection

Although users typically do not take their desktop computers out of your companys buildings, they still
can present a threat to your network. To minimize this threat, you must maintain these computers with
the most recent updates and required software. Otherwise, these computers are at risk of infection from
websites, email, files from shared folders, and other publicly accessible resources. You can use NAP to
automate health state checks to verify each desktop computers compliance with health-requirement
policies. You can check log files to determine which computers do not comply. Additionally, by using
management software, you can generate automatic reports and automatically update noncompliant
computers. When you change health-requirement policies, you can configure NAP to provision
computers automatically with the most recent updates.

Visiting Laptops

Organizations frequently need to allow consultants, business partners, and guests to connect to their
private networks. The laptops that these visitors bring into your organization might not meet system
health requirements and can present health risks. NAP enables you to determine which visiting laptops
are noncompliant and limit their access to restricted networks. Typically, you would not require or provide
any updates or configuration changes for visiting laptops. You can configure Internet access for visiting
laptops, but not for other organizational computers that have limited access.

Unmanaged Home Computers

Unmanaged home computers that are not a member of the companys Active Directory domain
can connect to a managed company network through VPN. Unmanaged home computers provide an
additional challenge because you cannot physically access these computers. Lack of physical access makes
enforcing compliance with health requirements, such as the use of antivirus software, more difficult.
However, NAP enables you to verify the health state of a home computer every time it makes a VPN
connection to the company network, and to limit its access to a restricted network until it meets system
health requirements.

NAP Enforcement Methods


Components of the NAP infrastructure, known
as enforcement clients and enforcement servers,
require health-state validation, and enforce
limited network access for noncompliant
computers. Windows 8, Windows 7, Windows
Vista, Windows XP with SP3, Windows Server
2008, Windows Server 2008 R2, and Windows
Server 2012 include NAP support for the following
network-access or communication methods:

IPsec-protected traffic. Internet Protocol


security (IPsec) enforcement confines
communication to compliant computers after
they connect successfully and obtain a valid IP address configuration. IPsec enforcement is the
strongest form of limited network access or communication in NAP.

Institute of Electrical and Electronics Engineers (IEEE) 802.1Xauthenticated network connections. IEEE
802.1X enforcement requires that a computer is compliant to obtain unlimited network access
through an IEEE 802.1Xauthenticated network connection. Examples of this type of network
connection include an authenticating Ethernet switch or an IEEE 802.11 wireless access point (AP).

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-5

Remote access VPN connections. VPN enforcement requires that a computer is compliant to obtain
unlimited network access through a remote access VPN connection. For noncompliant computers,
network access is limited through a set of IP packet filters that the VPN server applies to the VPN
connection.

DirectAccess connections. DirectAccess connections require that a computer is compliant to obtain


unlimited network access through a DirectAccess server. For noncompliant computers, network access
is limited to the set of computers that are defined as infrastructure servers by using the infrastructure
tunnel. Compliant computers can create the separate intranet tunnel that provides unlimited access
to intranet resources. DirectAccess connections use IPsec enforcement.

Dynamic Host Configuration Protocol (DHCP) address configurations. DHCP enforcement requires
that a computer is compliant to obtain an unlimited access Internet Protocol version 4 (IPv4) address
configuration from a DHCP server. For noncompliant computers, network access is restricted with an
IPv4 address configuration that limits access to the restricted network.

These network access or communication methods, or NAP enforcement methods, are useful separately or
together for limiting noncompliant computer access or communication. A server that is running Network
Policy Server (NPS) in Windows Server 2012 acts as a health policy server for all of these NAP enforcement
methods.

NAP Platform Architecture


The following table describes the components of a
NAP-enabled network infrastructure.

Components
NAP clients

NAP enforcement
points

Description
These computers support the NAP platform for communication and for
validation prior to network access of a systems health.

These are computers or network-access devices that use NAP or that you
can use with NAP to require evaluation of a NAP clients health state, and
then provide restricted network access or communication. NAP
enforcement points use a NPS that is acting as a NAP health policy server to
evaluate the health state of NAP clients, whether to allow network access or
communication, and the set of remediation actions that a noncompliant
NAP client must perform.
NAP enforcement points include the following:
o Health Registration Authority (HRA). A computer that runs Windows
Server 2012 and Internet Information Services (IIS), and that obtains
health certificates from a certification authority (CA) for compliant
computers.

Components

Description

MCT USE ONLY. STUDENT USE PROHIBITED

9-6 Implementing Network Access Protection

o VPN server. A computer that runs Windows Server 2012 and Routing and
Remote Access, and that enables remote access VPN intranet
connections through remote access.
o DHCP server. A computer that runs Windows Server 2012 and the DHCP
Server service, and that provides automatic IPv4 address configuration
to intranet DHCP clients.
o Network access devices. These are Ethernet switches or wireless access
points that support IEEE 802.1X authentication.
NAP health policy
servers

These are computers that run Windows Server 2012 and the NPS service, and
that store health-requirement policies and provide health-state validation for
NAP. NPS is the replacement for the Internet Authentication Service (IAS), and
the Remote Authentication Dial-In User Service (RADIUS) server and proxy
that Windows Server 2003 provides.
NPS also acts as an authentication, authorization, and accounting (AAA) server
for network access. When acting as an AAA server or NAP health policy server,
NPS typically runs on a separate server for centralized configuration of
network access and health-requirement policies. The NPS service also runs on
NAP enforcement points, based on Windows Server 2012, that do not have a
built-in RADIUS client, such as an HRA or a DHCP server. However, in these
configurations, the NPS service is acting as a RADIUS proxy to exchange
RADIUS messages with a NAP health policy server.

Health requirement
servers

These computers provide the current system health state for NAP health
policy servers. An example of these would be a health requirement server for
an antivirus program that tracks the latest version of the antivirus signature
file.

AD DS

This Windows directory service stores account credentials and properties, and
stores Group Policy settings. Although not required for health-state validation,
Active Directory is required for IPsec-protected communications, 802.1Xauthenticated connections, and remote access VPN connections.

802.1X devices

Authenticating Ethernet switch or an IEEE 802.11 wireless AP.

Restricted network

This is a separate logical or physical network that contains:


o Remediation servers. These computers contain health update resources
that NAP clients can access to remediate their noncompliant state.
Examples include antivirus signature distribution servers and software
update servers.
o NAP clients with limited access. These computers are placed on the
restricted network when they do not comply with health-requirement
policies.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-7

Lesson 2

Overview of NAP Enforcement Processes

When a client attempts to access or communicate on the network, it must present its system health
state or proof-of-health compliance. If a client cannot prove that it is compliant with system-health
requirements, such as that it has the latest operating system and antivirus updates installed, then you
can limit its access to, or communication on, the network to a restricted network that contains server
resources. You can restrict this access until you remedy the health-compliance issues. After the updates
install, the client requests access to the network or attempts the communication again. If compliant, the
client receives unlimited access to the network or the communication is allowed.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the general NAP enforcement processes.

Discuss IPsec enforcement.

Describe 802.1x enforcement.

Explain VPN enforcement.

Discuss DHCP enforcement.

NAP Enforcement Processes


Whatever form of NAP enforcement you select,
many of the client-server communications are
common. The following points summarize these
communications:

Between a NAP client and a HRA


The NAP client sends its current system
health state to the HRA and requests a health
certificate. If the client is compliant, the HRA
sends a health certificate to the NAP client. If
the client is noncompliant, the HRA sends
remediation instructions to the client.

Between a NAP client and a remediation server

Although the NAP client has unlimited intranet access, it accesses the remediation server to ensure
that it remains compliant. If the NAP client has limited access, it communicates with the remediation
server to become compliant, based on instructions from the NAP health policy server.

Between an HRA and a NAP health policy server

The HRA sends RADIUS messages to the NAP health policy server that contains the NAP clients
system health state. The NAP health policy server sends RADIUS messages to indicate that the NAP
client has:
o

Unlimited access because it is compliant. Based on this response, the HRA obtains a health
certificate, and then sends it to the NAP client.

Limited access until it performs a set of remediation functions. Based on this response, the HRA
does not issue a health certificate to the NAP client.

Between an 802.1X network access device and a NAP health-policy server


The 802.1X network access device sends RADIUS messages to transfer Protected Extensible
Authentication Protocol (PEAP) messages that are sent by an 802.1X NAP client. The NAP health
policy server sends RADIUS messages to:

Indicate that the 802.1X client has unlimited access because it is compliant.

Indicate a limited access profile to place the 802.1X client on the restricted network until it
performs a set of remediation functions.

Send PEAP messages to the 802.1X client.

Between a VPN server and a NAP health policy server


The VPN server sends RADIUS messages to transfer PEAP messages that are sent by a VPN-based
NAP client. The NAP health policy server sends RADIUS messages to:

MCT USE ONLY. STUDENT USE PROHIBITED

9-8 Implementing Network Access Protection

Indicate that the VPN client has unlimited access because it is compliant.

Indicate that the VPN client has limited access through a set of IP packet filters that are applied
to the VPN connection.

Send PEAP messages to the VPN client.

Between a DHCP server and a NAP health policy server

The DHCP server sends the NAP health policy server RADIUS messages that contain the DHCP clients
system health state. The NAP health policy server sends RADIUS messages to the DHCP server to
indicate that the DHCP client has:

Unlimited access because it is compliant.

Limited access until it performs a set of remediation functions.

Between a NAP health policy server and a health requirement server:


When you are performing network access validation for a NAP client, the NAP health policy server
might have to contact a health requirement server to obtain information about the current
requirements for system health.

Communication Based on the Type of Enforcement


Depending upon the type of enforcement selected, the following communication occurs:

Between a NAP client and an 802.1X network access device


The NAP client performs authentication of the 802.1X connection, and then provides its current
system health state to the NAP health policy server.
The NAP health policy server provides either remediation instructions (because the 802.1X client is
noncompliant) or indicates that the 802.1X client has unlimited network access.
NAP routes these messages through the 802.1X network access device.

Between a NAP client and a VPN server


The NAP client that acts as a VPN client indicates its current system health state to the NAP health
policy server.
The NAP health policy server responds with messages to provide either remediation instructions
(because the VPN client is noncompliant), or to indicate that the VPN client has unlimited intranet
access.
NAP routes these messages through the VPN server.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-9

Between a NAP client and a DHCP server


The NAP client, also the DHCP client, communicates with the DHCP server to obtain a valid IPv4
address configuration and to indicate its current system health state.

The DHCP server allocates an IPv4 address configuration for the restricted network, and then provides
remediation instructions (if the DHCP client is noncompliant), or it allocates an IPv4 address
configuration for unlimited access (if the DHCP client is compliant).

IPsec Enforcement
With IPsec enforcement, a computer must be
compliant to initiate communications with other
compliant computers. Because IPsec-based
NAP enforcement uses IPsec, you can define
requirements for protected communications
with compliant computers based on one of the
following communications characteristics:

IP address

Transmission Control Protocol (TCP) port


number

User Datagram Protocol (UDP) port number

IPsec enforcement restricts communication to compliant computers after they have connected
successfully and obtained a valid IP address configuration. IPsec enforcement is the strongest form of
limited network access or communication in NAP.

The components of IPsec enforcement consist of an HRA that is running Windows Server 2012 and an
IPsec enforcement client in one of the following operating systems:

Windows XP Service Pack 3

Windows Vista

Windows 7

Windows 8

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

The HRA obtains X.509 certificates for NAP clients when the clients prove that they are compliant. These
health certificates then authenticate NAP clients when they initiate IPsec-protected communications with
other NAP clients on an intranet.

IPsec enforcement limits communication for IPsec-protected NAP clients by dropping incoming
communication attempts sent from computers that cannot negotiate IPsec protection by using health
certificates. Unlike 802.1X and VPN enforcement, in which enforcement occurs at the network entry point,
each individual computer performs IPsec enforcement. Because you can take advantage of IPsec policy
settings, the enforcement of health certificates can be done for any of the following:

All computers in a domain

Specific computers on a subnet

A specific computer

A specific set of TCP or UDP ports

A set of TCP or UDP ports on a specific computer

Considerations for IPsec enforcement


When selecting an IPsec NAP enforcement method, consider the following points:

MCT USE ONLY. STUDENT USE PROHIBITED

9-10 Implementing Network Access Protection

IPsec enforcement is more complex to implement than other enforcement methods, because it
requires an HRA and a CA.

No additional hardware is required to implement IPsec enforcement. There is no need to upgrade


switches or Wireless Application Protocols (WAPs), which you would have to do if you select 802.1X
enforcement.

You can implement IPsec enforcement in any environment.

IPsec enforcement is very secure and difficult to circumvent.

You can configure IPsec to encrypt communication for additional security.

IPsec enforcement is applied to IPv4 and IPv6 communication.

802.1x Enforcement
With 802.1X enforcement, a computer must
be compliant to obtain unlimited network
access through an 802.1X-authenticated network
connection, such as to an authenticating Ethernet
switch or an IEEE 802.11 wireless AP.

For noncompliant computers, network access is


limited through a restricted access profile that
the Ethernet switch or wireless AP places on the
connection. The restricted access profile can
specify either IP packet filters, or a virtual local area
network (VLAN) identifier (ID) that corresponds to
the restricted network. 802.1X enforcement imposes
health policy requirements every time a computer attempts an 802.1X-authenticated network connection.
802.1X enforcement also monitors the health status of the connected NAP client actively, and then applies
the restricted access profile to the connection if the client becomes noncompliant.
The components of 802.1X enforcement consist of NPS in Windows Server 2012 and an EAP Host
enforcement client in Windows 8, Windows 7, Windows Vista, Windows XP Service Pack 3, Windows
Server 2008, Windows Server 2008 R2, and Windows Server 2012. 802.1X enforcement provides strong
limited network access for all computers that access the network through an 802.1X-authenticated
connection.

To implement 802.1X enforcement, you must ensure that the network switches or wireless APs support
802.1X authentication. The switches or wireless APs then act as an enforcement point for NAP clients. The
health status of the client is sent as part of the authentication process.
When a computer is noncompliant, the switch places the computer on a separate VLAN or uses packet
filters to restrict access to only remediation servers.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-11

Considerations for 802.1X enforcement


When considering the 802.1X NAP enforcement method, consider the following points:

The switch or wireless AP that connects with the client enforces noncompliant computer isolation.
This makes it very difficult to circumvent, and therefore very secure.

Use 802.1X enforcement for internal computers. This type of enforcement is appropriate for local area
network (LAN) computers with both wired and wireless connections.

You cannot use 802.1X enforcement if your switches and wireless APs do not support the use of
802.1X for authentication.

VPN Enforcement
VPN enforcement imposes health-policy
requirements every time that a computer
attempts to obtain a remote access VPN
connection to the network. VPN enforcement
also actively monitors the health status of the
NAP client, and applies the restricted networks
IP packet filters to the VPN connection if the client
becomes noncompliant.
The components of a VPN enforcement consist
of NPS in Windows Server 2012 and a VPN
enforcement client that is part of the remote
access client in:

Windows 8

Windows 7

Windows Vista

Windows XP SP3

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

VPN enforcement provides strong limited network access for all computers that access the network
through a remote access VPN connection. VPN enforcement uses a set of remote-access IP packet filters
to limit VPN client traffic, so that it can reach only the resources on the restricted network. The VPN server
applies the IP packet filters to the IP traffic that it receives from the VPN client, and silently discards all
packets that do not correspond to a configured packet filter.

Considerations for VPN enforcement


When considering the VPN NAP enforcement method, consider the following points:

VPN enforcement is best suited in situations in which you are using VPN already. It is unlikely that
you will implement VPN connections on an internal network to use VPN enforcement.

Use VPN enforcement to ensure that staff members connecting from home computers are not
introducing malware to your network. Users often do not maintain their home computers correctly,
and they can represent a high risk. Many users do not have antivirus software, or do not apply
Windows updates regularly.

MCT USE ONLY. STUDENT USE PROHIBITED

9-12 Implementing Network Access Protection

Use VPN enforcement to ensure that roaming laptops are not introducing malware to your network.
Roaming laptops are more susceptible to malware than computers directly on the corporate network,
because they may be unable to download virus updates and Windows updates from outside the
corporate network. They also are more likely to be in environments where malware is present.

DHCP Enforcement
DHCP enforces health-policy requirements
every time that a DHCP client attempts to lease
or renew an IP address configuration. DHCP
enforcement also actively monitors the NAP
clients health status and, if the client becomes
noncompliant, renews the IPv4 address
configuration for access only to the restricted
network.
The components of DHCP enforcement consist
of a DHCP Enforcement service that is part of the
DHCP Server service in Windows Server 2012 and
a DHCP enforcement client that is part of the
DHCP Client service in:

Windows 8

Windows 7

Windows Vista

Windows XP SP3

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Because DHCP enforcement relies on a limited IPv4 address configuration that a user who has
administrator-level access can override, it is the weakest form of limited network access in NAP.

DHCP address configuration limits network access for the DHCP client through its IPv4 routing table.
DHCP enforcement sets the DHCP Router option value to 0.0.0.0, so the noncompliant computer does not
have a configured default gateway. DHCP enforcement also sets the subnet mask for the allocated IPv4
address to 255.255.255.255 so that there is no route to the attached subnet.
To allow the noncompliant computer to access the restricted networks remediation servers, the DHCP
server assigns the Classless Static Routes DHCP option. This option contains host routes to the restricted
networks computers, such as the Domain Name System (DNS) and remediation servers. The result of
DHCP limited network access is a configuration and routing table that allows connectivity only to specific
destination addresses that correspond to the restricted network. Therefore, when an application attempts
to send to a unicast IPv4 address other than those supplied by the Classless Static Routes option, the
TCP/IP protocol returns a routing error.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-13

Considerations for DHCP enforcement


When considering the DHCP NAP enforcement method, consider the following points:

DHCP enforcement is easy to implement, and can apply to any computer with a dynamic IP address.

DHCP enforcement is easy to circumvent. A client can circumvent DHCP enforcement by using a
static IP address. Additionally, a noncompliant computer could add static host routes to reach servers
that are not remediation servers.

DHCP enforcement is not possible for IPv6 clients. If computers on your network use IPv6 addresses
to communicate, DHCP enforcement is ineffective.

Lesson 3

Configuring NAP

MCT USE ONLY. STUDENT USE PROHIBITED

9-14 Implementing Network Access Protection

If you want your NAP deployment to work optimally, it is important that you understand what each of
the NAP components does, and how they interact to protect your network. If you want to protect your
network by using NAP, you need to understand the configuration requirements for the NAP client, as well
as how to configure NPS as a NAP health policy server, configure health policies and network policies, and
configure the client and server settings. It also is important to test the NAP before using it.

Lesson Objectives
After completing this lesson, you will be able to:

Describe System Health Validators (SHVs).

Explain the use of a health policy.

Discuss the use of remediation server groups.

Describe the NAP client-configuration requirements.

Explain how to enable and configure NAP.

What Are System Health Validators?


System Health Agents (SHAs) and System
Health Validators (SHVs) are NAP infrastructure
components that provide health-state status
and validation. Windows 8 includes a Windows
Security Health Validator SHA that monitors the
Windows Security Center settings. Windows Server
2012 includes a corresponding Windows Security
Health Validator SHV.

The design of NAP makes it very flexible and


extensible, and it can interoperate with any
vendors software that provides SHAs and
SHVs that use the NAP API. An SHV receives a
statement of health (SoH), and then compares the system health-status information in the SoH with the
required system health state. For example, if the SoH is from an antivirus SHA, and it contains the last
version number for the virus-signature file, then the corresponding antivirus SHV can check with the
antivirus health requirement server for the latest version number to validate the NAP clients SoH.

The SHV returns a SoH response (SoHR) to the NAP Administration Server. The SoHR can contain
remediation information about how the corresponding SHA on the NAP client can meet current systemhealth requirements. For example, the SoHR that the antivirus SHV sends could instruct the NAP clients
antivirus SHA to request the latest version, by name or IP address, of the antivirus signature file from a
specific antivirus signature server.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-15

What Is a Health Policy?


Health policies consist of one or more SHVs and
other settings that you can use to define clientcomputer configuration requirements for the
NAP-capable computers that attempt to connect
to your network.
When NAP-capable clients attempt to connect
to the network, the client computer sends a
SoH to the NPS. The SoH is a report of the client
configuration state, and NPS compares the SoH to
the requirements that the health policy defines. If
the client configuration state does not match the
requirements that the health policy defines, then
depending on the NAP configuration, NAP:

Rejects the connection request.

Places the NAP client on a restricted network, where it can receive updates from remediation servers
that bring the client into compliance with health policy. After the NAP client achieves compliance and
resubmits its new health state, NPS enables it to connect.

Allows the NAP client to connect to the network despite its noncompliance with health policy.

You can define NPS client-health policies by adding one or more SHVs to the health policy.

After you configure a health policy with one or more SHVs, you can add it to the Health Policies condition
of a network policy that you want to use to enforce NAP, when client computers attempt connection to
your network.

What Are Remediation Server Groups?


A remediation server group is a list of restricted
network servers that provide resources that
bring noncompliant NAP-capable clients into
compliance with your defined client health policy.
A remediation server hosts the updates that a
NAP agent can use to bring noncompliant client
computers into compliance with health policy, as
NPS defines. For example, a remediation server
can host antivirus signatures. If a health policy
requires that client computers have the latest
antivirus definitions, then the following work
together to update noncompliant computers:

An antivirus SHA

An antivirus SHV

An antivirus policy server

The remediation server

NAP Client Configuration


Remember these basic guidelines when you
configure NAP clients:

Some NAP deployments that use Windows


Security Health Validator require that you
enable Security Center. Security Center is not
included with Windows Server 2008, Windows
Server 2008 R2, or Windows Server 2012.

You must enable the Network Access


Protection Client service when you deploy
NAP to NAP-capable client computers.

You must configure the appropriate NAP


enforcement clients on the NAP-capable computers.

Enable Security Center in Group Policy

MCT USE ONLY. STUDENT USE PROHIBITED

9-16 Implementing Network Access Protection

You can use the Enable Security Center in the Group Policy procedure to enable Security Center on NAPcapable clients by using Group Policy. Some NAP deployments that use Windows Security Health
Validator require Security Center.
Note: To complete this procedure, you must be a member of the Domain Admins group,
the Enterprise Admins group, or the Administrators group on the local computer.
To enable Security Center in Group Policy:
1.

Open the Group Policy Management console.

2.

In the console tree, double-click Local Computer Policy, double-click Computer Configuration,
double-click Administrative Templates, double-click Windows Components, and then double-click
Security Center.

3.

Double-click Turn on Security Center (Domain PCs only), click Enabled, and then click OK.

Enable the Network Access Protection Service on Clients

You can use the Enable the Network Access Protection Service on Clients procedure to enable and
configure NAP service on NAP-capable client computers. When you deploy NAP, enabling this service is
required.
Note: To complete this procedure, you must be a member of the Domain Admins group,
the Enterprise Admins group, or the Administrators group on the local computer.
To enable the Network Access Protection service on client computers:
1.

Open Control Panel, click System and Security, click Administrative Tools, and then double-click
Services.

2.

In the services list, scroll down to, and double-click, Network Access Protection Agent.

3.

In the Network Access Protection Agent Properties dialog box, change Startup Type to
Automatic, and then click OK.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-17

Enable and Disable NAP Enforcement Clients

You can use the Enable and Disable NAP Enforcement Clients procedure to enable or disable one or more
NAP enforcement clients on NAP-capable computers. These clients can include:

DHCP Enforcement Client

Remote Access Enforcement Client

EAP Enforcement Client

IPsec Enforcement Client (also used for DirectAccess connections)

Terminal Services Gateway (TS Gateway) Enforcement Client

To enable and disable NAP Enforcement Clients:


1.

Open the NAP Client Configuration console (NAPCLCFG.MSC).

2.

Click Enforcement Clients. In the details pane, right-click the enforcement client that you want to
enable or disable, and then click Enable or Disable.

Note: To perform this procedure, you must be a member of the Administrators group on
the local computer, or you must have been delegated the appropriate authority. If the computer
is joined to a domain, members of the Domain Admins group might be able to perform this
procedure. As a security best practice, consider performing this procedure by using the Run as
command.

Demonstration: Configuring NAP


This demonstration shows how to:

Install the NPS server role.

Configure NPS as a NAP health policy server.

Configure health policies.

Configure network policies for compliant computers.

Configure network policies for noncompliant computers.

Configure the DHCP server role for NAP.

Configure client NAP settings.

Test NAP.

Demonstration Steps
Install the NPS server role
1.

Switch to LON-DC1, and sign in as a domain administrator.

2.

Open Server Manager, and then install the Network Policy and Access Services role.

Configure NPS as a NAP health policy server


1.

Open the Network Policy Server console.

2.

Configure the Windows Security Health Validator to require that all Windows 8 computers are
running a firewall.

Configure health policies

MCT USE ONLY. STUDENT USE PROHIBITED

9-18 Implementing Network Access Protection

1.

Create a health policy called Compliant in which the condition is that Client passes all SHV checks.

2.

Create another health policy called Noncompliant in which the condition is that Client fails one or
more SHV checks.

Configure network policies for compliant computers


1.

Disable the two existing network policies. These would interfere with the processing of the policies
you are about to create.

2.

Create a new network policy called Compliant-Full-Access that has a condition of the Compliant
health policy. Computers are granted unrestricted access.

Configure network policies for noncompliant computers

Create a new network policy called Noncompliant-Restricted that has a condition of the
Noncompliant health policy. Computers are granted restricted access.

Configure the DHCP server role for NAP


1.

Open the DHCP console.

2.

Modify the properties of the IPv4 scope to support Network Access Protection.

3.

Create a new DHCP policy that allocates appropriate DHCP scope options to noncompliant
computers. These options assign a DNS suffix of restricted.Adatum.com.

Configure client NAP settings


1.

Enable the DHCP Quarantine Enforcement Client on LON-CL1.

2.

Start the Network Access Protection Agent service.

3.

Use the local Group Policy Management console to enable the Security Center.

4.

Reconfigure LON-CL1 to obtain an IP address from a DHCP server.

Test NAP
1.

Verify the obtained configuration by using ipconfig.

2.

Disable and stop the Windows Firewall service.

3.

In the System Tray area, click the Network Access Protection pop-up warning. Review the
information in the Network Access Protection dialog box. Click Close.

4.

Verify the obtained configuration by using ipconfig.

5.

Notice that the computer has a subnet mask of 255.255.255.255 and a DNS Suffix of
restricted.Adatum.com. Leave all windows open.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-19

Lesson 4

Monitoring and Troubleshooting NAP

Troubleshooting and monitoring NAP is an important administrative task because of different technology
levels, including varied expertise and prerequisites, for each NAP enforcement method. Trace logs are
available for NAP, but are disabled by default. These logs serve two purposes: troubleshooting and
evaluating a networks health and security.

Lesson Objectives
After completing this lesson, you will be able to:

Describe how NAP tracing can help monitor and troubleshoot NAP.

Explain how to configure NAP Tracing.

Troubleshoot NAP with Netsh.

Use the NAP event log to troubleshoot NAP.

What Is NAP Tracing?


Aside from the preceding general guidelines,
you can use the NAP Client Configuration
console to configure NAP tracing. Tracing
records NAP events in a log file, and is useful for
troubleshooting and maintenance. Additionally,
you can use tracing logs to evaluate your
networks health and security. You can configure
three levels of tracing: Basic, Advanced, and
Debug.
Enable NAP tracing when:

Troubleshooting NAP problems.

Evaluating the overall health and security of your organizations computers.

In addition to trace logging, you can view NPS accounting logs. These logs could contain useful NAP
information. By default, NPS accounting logs are located in %systemroot%\system32\logfiles.
The following logs might contain NAP-related information:

IASNAP.LOG. This contains detailed data about NAP processes, NPS authentication, and NPS
authorization.

IASSAM.LOG. This contains detailed data about user authentication and authorization.

Demonstration: Configuring NAP Tracing

Two tools are available for configuring NAP tracing. The NAP Client Configuration console is part of the
Windows user interface, and netsh is a command-line tool.

Using the Windows User Interface


You can use the Windows user interface to enable or disable NAP tracing and to specify the level of
recorded detail by performing the following steps:
1.

Open the NAP Client Configuration console by running napclcfg.msc.

2.

In the console tree, right-click NAP Client Configuration (Local Computer), and then click
Properties.

3.

In the NAP Client Configuration (Local Computer) Properties dialog box, select Enabled or
Disabled.

Note: To perform this procedure, you must be a member of the Administrators group on
the local computer, or you must have been delegated the appropriate authority. As a security
best practice, consider performing this operation by using the Run As command.
4.

MCT USE ONLY. STUDENT USE PROHIBITED

9-20 Implementing Network Access Protection

If Enabled is chosen, under Specify the level of detail at which the tracing logs are written, select
Basic, Advanced, or Debug.

Using a Command-Line Tool


To use a command-line tool to enable or disable NAP tracing and specify the level of recorded detail,
perform the following steps:
1.

Open an elevated command prompt.

2.

To enable or disable NAP tracing, do one of the following:


o

To enable NAP tracing and configure for basic or advanced logging, type: netsh nap client set
tracing state=enable level =[advanced or basic]

To enable NAP tracing for debug information, type: netsh nap client set tracing state=enable
level =verbose

To disable NAP tracing, type: netsh nap client set tracing state=disable

Note: To perform this procedure, you must be a member of the Administrators group on
the local computer, or you must have been delegated the appropriate authority. As a security
best practice, consider performing this operation by using the Run As command.

Viewing Log Files

To view the log files, navigate to the %systemroot%\tracing\nap directory, and then open the particular
trace log that you want to view.

Demonstration
This demonstration shows how to:

Configure tracing from the GUI.

Configure tracing from the command line.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-21

Demonstration Steps
Configure tracing from the GUI
1.

On LON-CL1, open the NAPCLCFG [NAP Client Configuration (Local Computer)] console.

2.

From the NAP Client Configuration (Local Computer) properties, enable Advanced tracing.

Configure tracing from the command line

At the command prompt, type netsh nap client set tracing state = enable, and then press Enter.

Troubleshooting NAP
You can use the following tools to troubleshoot
NAP.

Netsh Commands
Use the netsh NAP command to help
troubleshoot NAP issues. The following command
displays the status of a NAP client, including the
following:

Restriction state

Status of enforcement clients

Status of installed SHAs

Trusted server groups that have been configured


netsh NAP client show state

The following command displays the local configuration settings on a NAP client, including:

Cryptographic settings

Enforcement client settings

Settings for trusted server groups

Client tracing settings that have been configured


netsh NAP client show config

The following command displays the Group Policy configuration settings on a NAP client, including:

Cryptographic settings

Enforcement client settings

Settings for trusted server groups

Client tracing settings that have been configured


netsh NAP client show group

Troubleshooting NAP with Event Logs


NAP services record NAP-related events into the
Windows event logs. To view these events, open
Event Viewer, select Custom Views, select Server
Roles, and then select Network Policy and
Access Services. The following events provide
information about NAP services that are running
on an NPS server:

Event ID 6272. Network Policy Server granted


access to a user.
Occurs when a NAP client authenticates
successfully, and, depending on its health
state, obtains full or restricted access to the
network.

Event ID 6273. Network Policy Server denied access to a user.


Occurs when an authentication or authorization problem arises, which is associated with a reason
code.

Event ID 6274. Network Policy Server discarded the request for a user.
Occurs when a configuration problem arises, or if the RADIUS client settings are incorrect or NPS
cannot create accounting logs.

Event ID 6276. Network Policy Server quarantined a user.


Occurs when the client access request matches a network policy that is configured with a NAP
enforcement setting of Allow limited access.

Event ID 6277. Network Policy Server granted access to a user, but put it on probation because the
host did not meet the defined health policy.

MCT USE ONLY. STUDENT USE PROHIBITED

9-22 Implementing Network Access Protection

Occurs when the client access request matches a network policy that is configured with a NAP
enforcement setting of Allow full network access for a limited time when the date specified in
the policy has passed.

Event ID 6278. Network Policy Server granted full access to a user because the host met the defined
health policy.
Occurs when the client access request matches a network policy that is configured with a NAP
enforcement setting of Allow full network access.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-23

Lab: Implementing NAP


Scenario

A. Datum is a global engineering and manufacturing company with its head office in London, UK. An IT
office and data center in London support head office and other locations. A. Datum has recently deployed
a Windows Server 2012 server and client infrastructure.
To help increase security and compliance requirements, A. Datum is required to extend their VPN
solution to include NAP. You need to establish a way to verify and, if required, automatically bring client
computers into compliance whenever they connect remotely by using the VPN connection. You will
accomplish this goal by using NPS to create system health-validation settings, network and health
policies, and configuring NAP to verify and remediate client health.

Objectives
After completing this lab, you will be able to:

Configure NAP components.

Configure VPN access.

Configure the client settings to support NAP.

Lab Setup
Estimated Time: 60 minutes

Virtual Machines

20411B-LON-DC1
20411B-LON-RTR
20411B-LON-CL2

User Name

Adatum\Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:

5.

User name: Adatum\Administrator

Password: Pa$$w0rd

Perform steps 2 through 4 for 20411B-LON-CL2 and 20411B-LON-RTR.

Exercise 1: Configuring NAP Components


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

9-24 Implementing Network Access Protection

As the first step in implementing compliance and security, you should configure NAP components, such as
certificate requirements, health and network policies, and connection-request policies.
The main tasks for this exercise are as follows:
1.

Configure server and client certificate requirements.

2.

Configure health policies.

3.

Configure network policies.

4.

Configure connection request polices for VPN.

Task 1: Configure server and client certificate requirements


1.

Switch to the LON-DC1 virtual server.

2.

Open the Certification Authority tool.

3.

In the Certificate Templates Console, open the properties of the Computer certificate template.

4.

On the Security tab, grant the Authenticated Users group the Allow Enroll permission.

5.

Restart the Certification Authority.

6.

Close the Certification Authority tool.

Task 2: Configure health policies


1.

Switch to the LON-RTR computer.

2.

Create a management console by running mmc.exe.

3.

Add the Certificates snap-in with the focus on the local computer account.

4.

Navigate to the Personal certificate store and Request New Certificate.

5.

On the Select Certificate Enrollment Policy page, click Active Directory Enrollment Policy, and
then click Next.

6.

Enroll the Computer certificate that is listed.

7.

Close the console, and do not save the console settings.

8.

Using Server Manager, install the NPS Server with the following role services:
o

9.

Network Policy Server

Open the Network Policy Server console.

10. Under Network Access Protection, open the Default Configuration for the Windows Security
Health Validator.
11. On the Windows 8/Windows 7/Windows Vista tab, clear all check boxes except A firewall is
enabled for all network connections.
12. Create a health policy with the following settings:
o

Name: Compliant

Client SHV checks: Client passes all SHV checks

SHVs used in this health policy: Windows Security Health Validator

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-25

13. Create a health policy with the following settings:


o

Name: Noncompliant

Client SHV checks: Client fails one or more SHV checks

SHVs used in this health policy: Windows Security Health Validator

Task 3: Configure network policies


1.

Disable all existing network policies.

2.

Configure a new network policy with the following settings:

3.

Name: Compliant-Full-Access

Conditions: Health Policies, Compliant

Access permissions: Access granted

Settings: NAP Enforcement, Allow full network access

Configure a new network policy with the following settings:


o

Name: Noncompliant-Restricted

Conditions: Health Policies, Noncompliant

Access permissions: Access granted

Settings: NAP Enforcement, Allow limited access is selected and Enable auto-remediation of
client computers is not selected.

IP Filters: IPv4 input filter

Destination network: 172.16.0.10/255.255.255.255

IPv4 output filter:


Source network: 172.16.0.10/255.255.255.255

Task 4: Configure connection request polices for VPN


1.

Disable existing connection request policies.

2.

Create a new Connection Request Policy with the following settings:


o

Policy name: VPN connections

Type of network access server: Remote Access Server (VPN-Dial up)

Conditions, Tunnel type: L2TP, SSTP, and PPTP

Authenticate requests on this server: Enabled

On the Specify Authentication Methods page, perform the following:


a.

Select Override network policy authentication settings.

b.

Add Microsoft: Protected EAP (PEAP).

c.

Add Microsoft: Secured password (EAP-MSCHAP v2).

d.

Edit Microsoft: Protected EAP (PEAP) to ensure that Enforce Network Access Protection
is enabled.

Results: After this exercise, you should have installed and configured the required NAP components,
created the health and network policies, and created the connection request policies.

Exercise 2: Configuring VPN Access


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

9-26 Implementing Network Access Protection

After configuring NAP, you will configure a VPN server, and then enable the PING protocol through the
firewall for testing purposes.
The main tasks for this exercise are as follows:
1.

Configure a VPN server.

2.

Allow PING for testing purposes.

Task 1: Configure a VPN server


1.

On LON-RTR, open Routing and Remote Access.

2.

Disable Routing and Remote Access.

3.

Select Configure and Enable Routing and Remote Access.

4.

Use the following settings to complete configuration:


a.

Select Remote access (dial-up or VPN).

b.

Select the VPN check box.

c.

Select the interface called Public, and clear the Enable security on the selected interface by
setting up static packet filters check box.

d.

Under IP Address Assignment, From a specified range of addresses: 172.16.0.100 to


172.16.0.110

e.

Complete the process by accepting defaults when you receive a prompt, and by clicking OK to
confirm any messages.

5.

In the Network Policy Server, click the Connection Request Policies node, and verify that the
Microsoft Routing and Remote Access Service Policy is disabled. This was created automatically
when Routing and Remote Access was enabled.

6.

Close Network Policy Server management console, and then the Routing and Remote Access console.

Task 2: Allow PING for testing purposes


1.

On LON-RTR, open Windows Firewall with Advanced Security.

2.

Create an inbound rule with the following properties:

3.

Type: Custom

All programs

Protocol type: Choose ICMPv4 and then click Customize

Specific ICMP types: Echo Request

Default scope

Action: Allow the connection

Default profile

Name: ICMPv4 echo request

Close the Windows Firewall with Advanced Security console.

Results: After this exercise, you should have created a VPN server and configured inbound
communications.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-27

Exercise 3: Configuring the Client Settings to Support NAP


Scenario

In this exercise, you will enable a client VPN to connect to the Adatum network. You then will enable and
configure the required client-side NAP components.
The main tasks for this exercise are as follows:
1.

Enable a client NAP enforcement method.

2.

Establish a VPN connection.

Task 1: Enable a client NAP enforcement method


1.

Switch to the LON-CL2 computer.

2.

Run the NAP Client Configuration tool (napclcfg.msc).

3.

Under Enforcement Clients, enable the EAP Quarantine Enforcement Client.

4.

Close the NAP Client Configuration tool.

5.

Run services.msc, and then configure the Network Access Protection Agent service for automatic
startup.

6.

Start the service.

7.

Close the services console.

8.

Open the Local Policy Editor (gpedit.msc), and then enable the Local Computer Policy
/Computer Configuration/Administrative Templates/Windows Components
/Security Center/Turn on Security Center (Domain PCs only) setting.

9.

Close the Local Group Policy Editor.

Task 2: Establish a VPN connection


1.

2.

On LON-CL2, create a new VPN connection with the following properties:


o

Internet address to connect to: 10.10.0.1

Destination name: Adatum VPN

Allow other people to use this connection: Enable

After you have created the VPN, modify its settings by viewing the properties of the connection, and
then selecting the Security tab. Use the following settings to reconfigure the VPN:
o

Authentication type: Microsoft: Protected EAP (PEAP) (encryption enabled)

Properties of this authentication type:

Validate server certificate: Enable

Connect to these servers: Disable

Authentication method: Secured password (EAP-MSCHAP v2)

Enable Fast Reconnect: Disable

Enforce Network Access Protection: Enable

3.

Test the VPN connection:


o

In the Network Connections window, connect Adatum VPN connection.

View the details of the Windows Security Alert. Verify that the correct certificate information is
displayed, and then click Connect.

MCT USE ONLY. STUDENT USE PROHIBITED

9-28 Implementing Network Access Protection

4.

At the command prompt, run ipconfig /all to verify that the System Quarantine State is Not
Restricted.

5.

Ping 172.16.0.10.

6.

Disconnect the Adatum VPN.

7.

Switch to LON-RTR.

8.

Open Network Policy Server.

9.

In the Default Configuration of the Windows Security Health Validator, enable the Restrict access for
clients that do not have all available security updates installed option on the Windows
8/Windows 7/Windows Vista page.

10. Switch back to LON-CL2, and then reconnect the VPN.


11. Run the ipconfig /all command to verify that the System Quarantine State is Restricted.
12. Disconnect the VPN.

Results: After this exercise, you should have created a new VPN connection on LON-CL2, and have
enabled and tested NAP on LON-CL2.

To prepare for the next module


When you are finished the lab, revert all virtual machines to their initial state. To do this, perform the
following steps:
1.

On the host computer, start Hyper-V Manager.

2.

In the Virtual Machines list, right-click 20411B-LON-CL2, and then click Revert.

3.

In the Revert Virtual Machines dialog box, click Revert.

4.

Repeat steps 2 and 3 for 20411B-LON-RTR and 20411B-LON-DC1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 9-29

Module Review and Takeaways


Review Questions
Question: What are the three main client configurations that you need to configure for most
NAP deployments?
Question: You want to evaluate the overall health and security of the NAP enforced
network. What do you need to do to start recording NAP events?
Question: On a client computer, what steps must you perform to ensure that its health is
assessed?

Tools
Tool

Use For

Where to find it

Services

Enable and configure the NAP


service on client computers.

Click Start, click Control Panel, click System


and Maintenance, click Administrative
Tools, and then double-click Services.

Netsh nap

Using netsh, you can create scripts


to configure a set of NAP
automatically, and display the
configuration and status of the NAP
client service.

Open a command window with administrative


rights, and then type netsh c nap. You can
type help to get a full list of available
commands.

Group
Policy

Some NAP deployments that use


Windows Security Health Validator
require that Security Center is
enabled.

Enable the Turn on Security Center


(Domain PCs only) setting in the Computer
Configuration/Administrative Templates
/Windows Components/Security Center
sections of Group Policy.

MCT USE ONLY. STUDENT USE PROHIBITED

MCT USE ONLY. STUDENT USE PROHIBITED


10-1

Module 10
Optimizing File Services
Contents:
Module Overview

10-1

Lesson 1: Overview of FSRM

10-2

Lesson 2: Using FSRM to Manage Quotas, File Screens, and Storage Reports

10-7

Lesson 3: Implementing Classification and File Management Tasks

10-16

Lab A: Configuring Quotas and File Screening Using FSRM

10-22

Lesson 4: Overview of DFS

10-26

Lesson 5: Configuring DFS Namespaces

10-33

Lesson 6: Configuring and Troubleshooting DFS-R

10-37

Lab B: Implementing DFS

10-41

Module Review and Takeaways

10-45

Module Overview

The files on your servers are constantly changing with content being added, removed, and modified.
The Windows Server 2012 File and Storage Services server role is designed to help administrators in an
enterprise environment manage the continually growing and changing amount of data. When storage
requirements change and the data being stored changes as well, you need to manage an increasingly
larger and complex storage infrastructure. Therefore, to meet the needs of your organization, you need
understand and control how the existing storage resources are used.
This module introduces you to File Server Resource Manager (FSRM) and Distributed File System (DFS),
two technologies that you can use to address and manage these issues.

Objectives
After completing this module, you will be able to:

Describe FSRM.

Use FSRM to manage quotas, file screens, and storage reports.

Implement classification and file management tasks.

Describe DFS.

Configure DFS namespaces.

Configure and troubleshoot DFS Replication.

Lesson 1

Overview of FSRM
FSRM is a set of tools that allow you to understand, control, and manage the quantity and type of data
stored on your servers. Using FSRM, you can place quotas on storage volumes, screen files and folders,
generate comprehensive storage reports, control the file classification infrastructure, and use file
management tasks to perform scheduled actions on sets of files. These tools help you monitor existing
storage resources, and aid in planning and implementing future policy changes.

Lesson Objectives
After completing this lesson, you will be able to:

Describe common capacity management challenges.

Describe the features available within FSRM.

Explain how to install and configure the FSRM role service.

Understanding Capacity Management Challenges


Capacity management is a proactive process of
determining the current and future capacity needs
for your enterprise's storage environment. As the
size and complexity of the data increases, the
need for capacity management also increases.
To effectively meet the storage needs of your
organization, you need to track how much
storage capacity is available, how much storage
space you need for future expansion, and how
you are using the environments storage.

Key Capacity Management Challenges


Capacity management brings with it the following
key challenges:

MCT USE ONLY. STUDENT USE PROHIBITED

10-2 Optimizing File Services

Determining existing storage use. To manage your storage environment and ensure that you can
perform the simplest capacity management task, you need to understand your environments current
storage requirements. Knowing how much data is being stored on your servers, what types of data is
being stored, and how that data is currently being used is the benchmark for measuring the various
aspects of capacity management in your environment.

Establishing and enforcing storage use policies. Capacity management includes ensuring that your
storage environment is being used to its full potential. Managing growth is important to ensure that
your storage environment is not overwhelmed by unplanned or unauthorized data storage on your
servers. Modern media data such as audio, video, and graphic files consume a large amount of
storage space and, if left unchecked, the unauthorized storage of these types of files can consume
the storage space that is required for legitimate business use.

Anticipating future requirements. Storage requirements are constantly changing. New projects and
new organizational initiatives require increased storage. New applications and imported data require
additional storage. If you are not able to anticipate or prepare for events like these, your storage
environment may not be able to meet the storage requirements.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-3

Addressing Capacity Management Challenges

To address these key challenges, you need to implement basic capacity management measures to
proactively manage the storage environment and prevent challenges from becoming problems. The
following is a list of capacity management measures that you can use to proactively manage your storage
environment:

Analyze how storage is being used. The first step in capacity management is analyzing the current
storage environment. Accurate analysis begins with proper tools that provide usable and organized
information regarding the current state of your storage environment.

Define storage resource management policies. A robust set of policies are necessary to maintain
the current storage environment and ensure that storage growth happens in a manageable and
predictable way. Preventing unauthorized files from being saved to your servers, ensuring that data is
stored in the right location, and ensuring that users have the required storage are a few of the key
areas your capacity management policies may address.

Implement policies to manage storage growth. After implementing capacity management policies,
you need to have an effective tool to ensure that the policies that are established are technically
enforced. Quotas that are placed on a users data storage must be maintained, restricted files must be
prevented from being saved, and business files must be stored in the proper locations.

Implement a system for reporting and monitoring. Establish a reporting and notification system to
inform you of how policies are enforced. These reports should be in addition to reports regarding the
general state of your capacity management system and data storage situation.
Question: What capacity management challenges have you experienced or are you
experiencing in your environment?

What Is FSRM?
FSRM is a role service of the File Services role in
Windows Server 2012. You can install it as part of
the File Services role by using Server Manager.
Then, you can use the FSRM console to manage
FSRM on your server. FSRM is intended to act as a
capacity management solution for your Windows
Server 2012 server. It provides a robust set of tools
and capabilities that allow you to effectively
manage and monitor your servers storage
capacity.
FSRM contains five components that work
together to provide a capacity management
solution.

Quota Management

Quota management is a component that allows you to create, manage, and obtain information about
quotas that are used to set storage limits on volumes or folders (and its contents). By defining notification
thresholds, you can send email notifications, log an event, run a command or script, or generate reports
when users approach or exceed a quota. Quota management also allows you to create and manage quota
templates to simplify the quota management process.

File Screening Management

MCT USE ONLY. STUDENT USE PROHIBITED

10-4 Optimizing File Services

File screening management is a component that allows you to create, manage, and obtain information
about file screens. You can use this information to prevent specific file types from being stored on a
volume or folder, or to notify you when users are storing these types of files are. When users attempt to
save unauthorized files, file screening can block the process and notify the administrators to allow for
proactive management.
Like quota management, file screening management allows you to create and manage file screen
templates to simplify file screening management. You can also create file groups that allow you to
manage which file types may be blocked or allowed.

Storage Reports Management

Storage reports management is a component that allows you to schedule and configure storage reports.
These reports provide information regarding the components and aspects of FSRM including:

Quota usage.

File screening activity.

Files that may negatively affect capacity management, such as large files, duplicate files, or
unused files.

List and filter files according to owner, file group, or a specific file property.

Note: Storage reports can be run based on a schedule, or you can generate them on
demand.

Classification Management

Classification Management is a component that allows you to create and manage classification properties
that you can then assign to files. You can assign property values to files by using classification rules, which
can be applied on demand or based on a schedule. Classification allows you categorize and manage files
by using a wide array of properties to identify and group your files.

File Management Tasks

With the file management tasks component, you can schedule and configure specific tasks, which can
automate the application or expiration of custom commands, allowing for automated file management
procedures. File management tasks leverage the capabilities of classification management to allow you to
delete old files or move files to a specific location based on a file property (file name or file type).
Note: Volumes that FSRM manages must be formatted by using the NTFS file system. FSRM
is included with Windows Server 2003 Service Pack 1 (SP1) and newer.

Demonstration: How to Install and Configure FSRM


You can install FSRM in Windows 2012 by adding the FSRM role service within the File and Storage
Services role.
FSRM has several configuration options that apply globally to all FSRM components.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-5

You can access these options by using the following steps:


1.

Open the File Server Resource Manager console.

2.

In the left pane, right-click the root File Server Resource Manager node, and then click Configure
Options.

FSRM Options

In the File Server Resource Manager Options properties dialog box, several tabs allow you to configure
various aspects of FSRM. The following tabs are available on the File Server Resource Manager Options
properties dialog box:

Email Notifications tab. This tab allows you to provide the name or address of an SMTP server name,
along with other details that FSRM will use to send email notifications.

Notification Limits tab. Notification limits allow you to specify a time period that FSRM will wait
between sending notifications to avoid excessive notifications from a repeatedly exceeded quota or
unauthorized file detection. It allows you set separate values for email notifications, entries recorded
to the event log, commands being run, or reports being generated. The default value for each is 60
minutes.

Storage Reports tab. This tab allows you to configure and view the default parameters for any existing
storage reports. Report Locations tab. This tab allows you to view and modify the location in which the
following three different types of storage reports are stored: incident reports, scheduled reports, and
on demand reports. By default, each category is stored in its own folder: %systemdrive%\Storage
Reports.

Note: If FSRM generates a large number of storage reports, you may want to relocate the
storage report folders to another physical volume to decrease disk input/output (I/O) load on
your system volume. You may also want to change the location if the size of your storage reports
causes a capacity issue on your system volume.

File Screen Audit tab. On this tab, a single check box allows to enable or disable the recording of file
screening activity to the auditing database. You can view the resulting file screening activity when you
run the File Screening Audit report from Storage Reports Management.

Automatic Classification tab. This tab allows you to provide a schedule that governs the automatic
classification of files. Within the tab, you can specify which logs to generate, and if and how to
generate a report of the classification process.

Access-Denied Assistance tab. This tab enables you to provide a customized message when FSRM
prevents a file-level operation as a result of a quota management of file screening management
restriction.

Managing FSRM

Management of a server running FSRM typically happens locally, through the FSRM Microsoft
Management Console (MMC) console. However, there are other options available for managing a server
running FSRM.

Managing FRSM by using Windows PowerShell

Windows PowerShell 3.0 contains new cmdlets for managing FSRM that extend management capabilities
to all aspects of FSRM. The FileServerResourceManager module for Windows PowerShell is installed on a
Windows Server 2012 computer automatically, when you install the FSRM role service.

MCT USE ONLY. STUDENT USE PROHIBITED

10-6 Optimizing File Services

The Windows PowerShell3.0 cmdlets replace the functionality previously supplied by the FSRM command
line executables dirquota.exe, filescrn.exe, and storrpt.exe. While these executables are still present in
Windows Server 2012, they have been deprecated and will be removed in a future version of Windows
Server. Therefore, you should create any management solutions involving command line tasks using the
Windows PowerShell cmdlets.

To see a complete list of available FSRM cmdlets, run the following command from a Windows PowerShell
command-line interface:
Get-Command Module FileServerResourceManager

Managing FSRM Remotely

You can connect remotely to another server that is running FSRM by using the FSRM console. From there,
you manage FSRM in the same way that you manage resources on your local computer.
To manage FSRM remotely by using the FSRM console:

Ensure that both servers are running Windows Server 2008 R2 or newer, and have FSRM installed.

Enable the Remote File Server Resource Manager Management exception from within Windows
Firewall manually, either through the Control Panel, or by using Group Policy.

Allow Remote Procedure Call (RPC) traffic through any firewalls between the two servers.

Sign in to the local computer with an account that is a member of the local Administrators group on
the remote computer.

You also can run the FRSM Windows PowerShell cmdlets remotely by using Window PowerShell remoting
capabilities.
In this demonstration, you will see how to:

Install the FSRM role service.

Specify FSRM configuration options.

Manage FSRM by using Windows PowerShell.

Demonstration Steps
Install the FSRM role service
1.

Sign in to LON-SVR1 as Adatum\Administrator with the password Pa$$w0rd.

2.

Open Server Manager.

3.

Install the File Server Resource Manager role service within the File and Storage Services role.

Specify FSRM configuration options


1.

Open the File Server Resource Manager console.

2.

Open the File Server Resource Manager Options window for the local instance of File Server
Resource Manager.

3.

Enable file screen auditing.

Manage FSRM by using Windows PowerShell

From a Windows PowerShell command prompt, run the following command:


set-FSRMSetting -SMTPServer server1 -AdminEmailAddress fileadmin@adatum.com FromEmailAddress fileadmin@adatum.com

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-7

Lesson 2

Using FSRM to Manage Quotas, File Screens, and Storage


Reports

Data is the core component of your server infrastructure. Under most circumstances, the server
infrastructure provides the data that is contained in the files on the server, to your users or applications.

Whether files are added to your servers by users or applications, quota management can help you ensure
that users and applications use the only the amounts of space allotted to them. File screens in FSRM can
help you to control the file types that can be stored within your file and storage infrastructure, and
storage reports enable you to provide detailed reporting on quota management, file screening, and
several other aspects of FSRM functionality.

Lesson Objectives
After completing this lesson, you will be able to:

Describe quota management.

Describe quota templates.

Explain how to monitor quota usage.

Describe file screening management.

Describe file groups.

Describe file screen templates and file screen exceptions.

Describe storage reports.

Describe a report task.

Explain how to use FSRM to manage quotas, file screens, and generate storage reports.

What Is Quota Management?


In FSRM, quota management allows you to limit
the disk space that is allocated to a volume or
folder. The quota limit applies to the entire folder
subtree.
Using quotas, you can manage capacity
restrictions in a variety of ways. For example, you
can use a quota to ensure that individual users do
not consume excessive amounts of storage with
their home drives, or to limit the amount of space
consumed by multimedia files in a particular
folder.

Quota Types
You can create two different types of quotas within quota management:

A hard quota prevents users from saving files after the space limit is reached, and it generates
notifications when the volume of data reaches each configured threshold.

A soft quota does not enforce the quota limit, but it generates configured notifications.

Quota Notifications

MCT USE ONLY. STUDENT USE PROHIBITED

10-8 Optimizing File Services

To determine what happens when the quota limit approaches, you configure notification thresholds. For
each threshold that you define, you can send email notifications, log an event, run a command or script,
or generate storage reports. For example, you might want to notify the administrator and the user when
a folder reaches 85 percent of its quota limit, and then send another notification when the quota limit is
reached. In some cases, you might want to run a script that raises the quota limit automatically when a
threshold is reached.

Creating Quotas

When you create a quota on a volume or a folder, you can base the quota on a quota template or use
custom properties. Whenever possible, base a quota on a quota template. You can reuse a quota template
to create additional quotas, and it simplifies ongoing quota maintenance.
FSRM can also generate quotas automatically. When you configure an auto-apply quota, you apply a
quota template to a parent volume or folder. Then, a quota that is based on the template is created for
each of the existing subfolders, and a quota is generated automatically for each new subfolder that is
created. You can also create quotas using the Windows PowerShell cmdlet, New-FSRMQuota.

What Are Quota Templates?


FSRM quota templates give you flexibility in
creating, using, and managing templates for
quotas. A quota template defines a space limit,
the quota type (hard or soft), and a set of
notifications to be generated when the quota limit
is approached or exceeded.
Quota templates simplify the creation and
maintenance of quotas. Using a quota template,
you can apply a standard storage limit and a
standard set of notification thresholds to many
volumes and folders on servers throughout your
organization.

Template-Based Quota Updating


If you base your quotas on a template, you can update all quotas that are based on the template by
editing that template. This feature simplifies the process of updating quota properties by providing a
central point where IT administrators can make all changes.

For example, you can create a User Quota template that you use to place a 200 megabyte (MB) limit on
the personal folder of each user. For each user, you would then create a quota based on the User Quota
template, and then assign it to the users folder. If you decide later to allow each user additional space on
the server, you only change the space limit in the User Quota template, and then choose to update each
quota that is based on that quota template.

Quota Template Examples


FSRM provides several quota templates. For example:

You can use the 200 MB Limit Reports to User template to place a hard 200 MB limit on the personal
folder of each user, and then send storage reports to users who exceed the quota.

For some folders, you might want to use the 200 MB Limit with 50 MB Extension template to grant a
one-time 50 MB quota extension to users who exceed the 200 MB quota limit.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-9

Other default templates are designed for monitoring disk usage through soft quotas, such as the
Monitor 200 GB Volume Usage template and the Monitor 500 MB Share template. When you use
these templates, users can exceed the quota limit, but email and event log notifications are generated
when they do so.

Monitoring Quota Usage


In addition to the information in the notifications
sent by quotas, you can find about quota usage
in a variety of ways. You can view the quotas in
quota management within the FSRM console,
generate a Quota Usage report, or create soft
quotas for monitoring the overall disk usage. You
can also use a Windows PowerShell cmdlet.

Quota Usage Report


Use the Quota Usage report to identify quotas
that may soon be reached or exceeded, so that
you can take the appropriate action. Generating
a Quota Usage report will be covered in greater
detail in the Managing Storage Reports lesson.

Templates for Monitoring Disk Usage

To monitor the overall disk usage, you can create soft quotas for volumes or shares. FSRM provides the
following default templates that you can use (or adapt) for this purpose.

Monitor 200 GB Volume Usage

Monitor 500 MB Share

Windows PowerShell

You can use the Get-FSRMQuota cmdlet to view FSRM quotas that exist on the server, along with the
statistics for each quota.

What Is File Screening Management?


File Screening Management allows you to create
file screens to block types of file from being saved
on a volume or in a folder tree. A file screen
affects all folders in the designated path. You use
file groups to control the types of files that file
screens manage. For example, you might create a
file screen to prevent users from storing audio and
video files in their personal folders on the server.
Like all components of FSRM, you can choose to
generate email or other notifications when a file
screening event occurs.

File Screen Types


You can configure a file screen as either active or passive:

MCT USE ONLY. STUDENT USE PROHIBITED

10-10 Optimizing File Services

Active screening prevents users from saving unauthorized file types on the server, and generates
configured notifications when they attempt to do so.

Passive screening sends configured notifications to users who are saving specific file types, but it does
not prevent users from saving those files.

File Screening Management Considerations

To simplify file screen management, you can base your file screens on file screen templates, which will be
covered later in this lesson.

For additional flexibility, you can configure a file screen exception in a subfolder of a path where you have
created a file screen. When you place a file screen exception on a subfolder, you allow users to save file
types there that would otherwise be blocked by the file screen applied to the parent folder. You can also
create file screens in Windows PowerShell by using the New-FSRMFileScreen cmdlet.
Note: A file screen does not prevent users and applications from accessing files that were
saved to the path before the file screen was created, regardless of whether the files are members
of blocked file groups.

What Are File Groups?


Before you begin working with file screens,
you must understand the role of file groups in
determining which files are screened. You use a
file group to define a namespace for a file screen
or a file screen exception, or to generate a Files by
File Group storage report.

File Group Characteristics


A file group consists of a set of file name patterns,
which are grouped as files to include, and files to
exclude:

Files to include: Files to which the file group


applies.

Files to exclude: Files to which the file group does not apply.

For example, an Audio Files file group might include the following file name patterns:

Files to include: *.mp*: Includes all audio files created in the current and future MPEG formats (MP2,
MP3, and so forth).

Files to exclude: *.mpp: Excludes files created in Microsoft Project (.mpp files), which would otherwise
be included by the *.mp* inclusion rule.

FSRM provides several default file groups, which you can view in File Screening Management by clicking
the File Groups node. You can define additional file groups or change the files to include and exclude.
Any change that you make to a file group affects all existing file screens, templates, and reports to which
the file group has been added.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-11

Note: For convenience, you can modify file groups when you edit the properties of a file
screen, file screen exception, file screen template, or the Files by File Group report. Note that any
changes that you make to a file group from these property sheets affect all items that use that
file group.

What Are a File Screen Templates and File Screen Exceptions?


You use file screen templates and file screen
exceptions to expand the capabilities of file
screening management in FSRM.

File Screen Templates


To simplify file screen management, you can
create your file screens based on file screen
templates. A file screen template defines the
following:

File groups to block

Screening types to perform

Notifications to be generated

You can configure two screening types in a file screen template. Active screening does not allow users to
save any files related to the selected file groups that you configure with the template. Passive screening
allows users to save files, but provides notifications for monitoring.
FSRM provides several default file screen templates, which you can use to block audio and video files,
executable files, image files, and email files, to meet common administrative needs. To view the default
templates, in the File Server Resource Manager console tree, click the File Screen Templates node.

By creating file screens exclusively from templates, you can centrally manage your file screens by updating
the templates instead of individual file screens.
Note: You create file screens from file screen templates, just as you create quotas from
quota templates.

File Screen Exceptions

Occasionally, you need to allow exceptions to file screening. For example, you might want to block
video files from a file server, but you need to allow your training group to save video files for their
computer-based training. To allow files that other file screens are blocking, create a file screen exception.

A file screen exception is a special type of file screen that overrides any file screening that would
otherwise apply to a folder, and all its subfolders in a designated exception path. That is, it creates an
exception to any rules derived from a parent folder. To determine which file types the exception will allow,
file groups are assigned.
You create file screen exceptions by specifically choosing the Create File Screen Exception from the File
Screens node under File Screening Management in FSRM.
Note: File screen exceptions always override file screens with conflicting settings. Therefore,
you must plan and implement file screen exceptions carefully.

What Are Storage Reports?


FSRM can generate reportscalled storage
reportsthat help you understand file usage on
your storage server. You can use storage reports
to monitor disk usage patterns (by file type or
user), identify duplicate files and dormant files,
track quota usage, and audit file screening.
From the Storage Reports Management node,
you can create report tasks, which you then use
to schedule one or more periodic reports, or you
can generate reports on demand. For on-demand
and scheduled reports, current data is gathered
before the report is generated. Reports can also
be generated automatically to notify you when a user exceeds a quota threshold, or saves an
unauthorized file.

Storage Report Types


The following table describes each storage report that is available.
Report

Description

MCT USE ONLY. STUDENT USE PROHIBITED

10-12 Optimizing File Services

Duplicate Files

This report lists files that appear to be duplicates (files with the same size and
last modified time). Use this report to identify and reclaim disk space that is
wasted due to duplicate files. This is the only report that is not configurable.

File Screening Audit

This report lists file screening events that have occurred on the server for a
specific number of days. Use this report to identify users or applications that
violate screening policies.

Files by File Group

This report lists files that belong to specific file groups. Use this report to
identify file group usage patterns and file groups that occupy large amounts
of disk space. This can help you determine which file screens to configure on
the server.

Files by Owner

This report lists files that are grouped by file owners. Use this report to
analyze usage patterns on the server, and to identify users who use large
amounts of disk space.

Files by Property

This report lists files by the values of a particular classification property. Use
this report to observe file classification usage patterns.

Folders by Property

This report lists folders by the value of a particular secure classification


property. Use this report to observe folder classification patterns.

Large Files

This report lists files that are of a specific size or larger. Use this report to
identify files that are consuming the most disk space on the server. This can
help you quickly reclaim large quantities of disk space.

Least Recently
Accessed Files

This report lists files that are not accessed for a specific number of days. This
can help you identify seldom-used data that can be achieved and removed
from the server.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-13

Report

Description

Most Recently
Accessed Files

This report lists files that are accessed within a specified number of days. Use
this report to identify frequently used data that must be kept highly available.

Quota Usage

This report lists quotas for which the quota usage is higher than a specified
percentage. Use this report to identify quotas with high usage levels so that
you can take appropriate action.

Configuring Report Parameters

Except for the Duplicate Files report, all reports have configurable report parameters that determine
the content in the report. Parameters vary with the type of report. For some reports, you can use report
parameters to select the volumes and folders on which to report, set a minimum file size to include, or
restrict a report to files owned by specific users.

Saving Reports

Regardless of how you generate a report, or whether you choose to view the report immediately, the
report is saved on the disk. Incident reports are saved in the Dynamic HTML (DHTML) format. You can
save scheduled and on-demand reports in DHTML, HTML, XML, CSV, and text formats.
Scheduled reports, on-demand reports, and incident reports are saved in separate folders within a
designated report repository.

By default, the reports are stored in the subdirectories of the %Systemdrive%\StorageReports\ folder. To
change the default report locations, in the File Server Resource Manager Options dialog box, on the
Report Locations tab, specify where to save each type of storage report.

What Is a Report Task?


A report task is a set of storage management
reports that run based on a schedule.
The report task specifies which reports to
generate, what parameters to use, and which
volumes and folders to report on. The report task
also reports on how often to generate the reports,
and in which file formats to save them.
When you schedule a set of reports, the
reports are saved automatically in the report
repository. You can also have the reports emailed
automatically to a group of administrators.
You can schedule report tasks by using the following steps from within FSRM.
1.

Click the Storage Reports Management node.

2.

Right-click Storage Reports Management, and then click Schedule a New Report Task. You also
can click Schedule a New Report Task in the Actions pane.

Note: To minimize the impact of report processing on server performance, generate


multiple reports on the same schedule so that the data is gathered only once.

Generating On Demand Reports

MCT USE ONLY. STUDENT USE PROHIBITED

10-14 Optimizing File Services

During daily operations, you may want to generate reports on demand to analyze the different aspects of
the current disk usage on the server. Before the reports are generated, current data is gathered.
When you generate reports on demand, the reports are saved in the report repository, but no report task
is created for later use. You can view the reports immediately after they are generated, or you can send
the reports to a group of administrators by email.
To generate reports on demand:
1.

Click the Storage Reports Management node.

2.

Right-click Storage Reports Management, and then click Generate Reports Now (or in the Actions
pane, click Generate Reports Now).

Note: When generating an on-demand report, you can wait for the reports to be
generated and then immediately display them. If you choose to open the reports immediately,
you must wait while the reports generate. Processing time varies, depending on the types of
reports and the data scope.

Demonstration: Using FSRM to Manage Quotas and File Screens, and to


Generate On-Demand Storage Reports
In this demonstration, you will see how to:

Create a quota.

Test a quota.

Create a file screen.

Test a file screen.

Generate a storage report.

Demonstration Steps
Create a quota
1.

Sign in to LON-SVR1 as Adatum\Administrator with the password Pa$$w0rd.

2.

Open Server Manager.

3.

Open the File Server Resource Manager console.

4.

Create a quota based on the 100 MB Limit on the E:\Labfiles\Mod10\Data folder.

Test a quota
1.

Open Windows PowerShell.

2.

Create a new, 130 MB file in the E:\Labfiles\Mod10\Data folder by using the following command:
fsutil file createnew largefile.txt 130000000

3.

Close Windows PowerShell.

Create a file screen

In File Server Resource Manager, create a new file screen based on the Block Image Files
file-screen template for E:\Labfiles\Mod10\Data.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-15

Test a file screen


1.

Open Microsoft Windows Explorer.

2.

Navigate to E:\Labfiles\Mod10.

3.

Create a new bitmap (.bmp) image named testimage.

4.

Copy the testimage, and then paste it into the E:\Labfiles\Mod10\Data folder.

5.

View and close the error window.

6.

Close the Windows Explorer window.

Generate a storage report


1.

Generate an on-demand report for Large Files on drive E.

2.

View and close the html report.

3.

Close File Server Resource Manager.

Lesson 3

Implementing Classification and File Management Tasks

MCT USE ONLY. STUDENT USE PROHIBITED

10-16 Optimizing File Services

Most applications manage files based on the directory in which they are contained. This leads to
complicated file layouts that require attention from administrators. Such layout can also lead to frustration
among the users. In Windows Server 2012, Classification Management and File Management tasks enable
administrators to manage groups of files based on various file and folder attributes. With Classification
Management and File Management tasks, you can automate file and folder maintenance tasks such as
cleaning up stale data, or protecting sensitive information.
In this lesson, you will learn how Classification Management and File Management tasks work together to
make it easier for you to manage and organize the files and folders on your servers.

Lesson Objectives
After completing this lesson, you will be able to:

Describe classification management.

Describe classification properties.

Describe a classification rule.

Explain how to configure classification management.

Identify considerations for using file classification.

Describe file management tasks.

Explain how to configure file management tasks.

What Is Classification Management?


To reduce the cost and risk associated with data
management, the File Classification infrastructure
uses a platform that allows administrators to
classify files and apply policies based on that
classification. The storage layout is unaffected
by data management requirements, and the
organization can adapt more easily to a changing
business and regulatory environment.
Classification Management is designed to ease the
burden and management of data that is spread
out in your organization. Using Classification
Management, you can classify files in a variety of
ways. In most scenarios, you perform classification manually. In Windows Server 2012, the File
Classification Infrastructure feature allows organizations to convert these manual processes into
automated policies. You can specify file management policies based on a files classification, and can
apply corporate requirements for managing data based on business value. You can also modify the
policies easily, and can use tools that support classification to manage files.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-17

You can use file classification to perform the following actions:


1.

Define classification properties and values, which can be assigned to files by running classification
rules.

2.

Create, update, and run classification rules. Each rule assigns a single predefined property and value
to files within a specified directory, based on installed classification plug-ins.

When running a classification rule, you can reevaluate files that are already classified. You can choose to
overwrite existing classification values or add the value to properties that support multiple values.

What Are Classification Properties?


Classification properties are used to assign values
to files. There are many property types from which
you can choose. You can define these properties
based on the needs of your organization.
Classification properties are assigned to files that
use classification rules, which are discussed in the
next topic.
The following table defines the available property
types, and the policy that is applied when a file is
reclassified:

Property type

Description

Yes/No

A Boolean property that can have a value of either YES or NO. When multiple
values are combined, a NO value overwrites a YES value.

Date-Time

A simple date and time property. When multiple values are combined,
conflicting values prevent reclassification.

Number

A simple number property. When multiple values are combined, conflicting


values prevent reclassification.

Multiple Choice
List

A list of values that can be assigned to a property. More than one value can
be assigned to a property at a time. When multiple values are combined, each
value in the list is used.

Ordered List

A list of fixed values. Only one value can be assigned to a property at a time.
When multiple values are combined, the value highest in the list is used.

String

A simple string property. When multiple values are combined, conflicting


values prevent reclassification.

Multi-string

A list of strings that can be assigned to a property. More than one value can
be assigned to a property at a time. When multiple values are combined, each
value in the list is used.

What Is a Classification Rule?


A classification rule assigns a Classification
Property to a file system object. A classification
rule includes information detailing when to assign
a classification property to a file.

Key Classification Rule Properties


To define the behavior of a classification rule, ask
yourself the following questions:

MCT USE ONLY. STUDENT USE PROHIBITED

10-18 Optimizing File Services

Is the rule enabled? On the classification


rule Properties page, on the Rule Settings
tab, the Enabled check box allows you to
specifically disable or enable the classification
rule.

What is the scope of the rule? On the Rule Settings tab, the Scope parameter allows you to select a
folder or folders to which the classification rule will apply. When the rule is run, it processes and
attempts to classify all file system objects within this location.

What classification mechanism will the rule use? On the classification rule Properties page, on the
rules Classification tab, you must choose a classification method that the rule will use to assign the
classification property. By default, there are two methods from which you can choose:
o

Folder Classifier. The folder classifier mechanism assigns properties to a file based on the files
folder path.

Content Classifier. The content classifier searches for strings or regular expressions in files. This
means that the content classifier classifies a file based on the textual contents of the file, such as
whether it contains a specific word, phrase, numeric value, or type.

What property will the rule assign? The main function of the classification rule is to assign a property
to a file object based on how the rule applies to that file object. On the Classification tab, you must
specify a property and the specific value that the rule will assign to that property.

What additional classification parameters will be used? The core of the rules logic lies in the
additional classification parameters. Clicking the Advanced button on the Classification tab opens
the Additional Classification Parameters window. Here, you can specify additional parameters
including strings or regular expressionsthat if found in the file system object, will cause the rule to
apply itself. For example, this parameter could be the phrase Social Security Number or any number
with the format 000-00-000. If this parameter is found, then the classification parameter will apply a
YES value for a Confidential classification property to the file. This classification could then be
leveraged to perform some tasks on the file system object, such as moving it to a secure location.

A classification parameter can be one of the following three types:

RegularExpression. Match a regular expression by using the Microsoft .NET syntax. For example,
\d\d\d will match any three-digit string.

StringCaseSensitive. Match a case-sensitive string. For example, Confidential will only match
Confidential and not confidential or CONFIDENTIAL.

String. Match a string, regardless of case. Confidential will match Confidential, confidential, and
CONFIDENTIAL.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-19

Classification Scheduling

You can run classification rules in two ways: on-demand, or based on a schedule. Either way you choose,
each time you run classification, it uses all rules that you have left in the Enabled state.

Configuring a schedule for classification allows you to specify a regular interval at which file classification
rules will run, ensuring that your servers files are regularly classified and up to date with the latest
classification properties.

Demonstration: How to Configure Classification Management


This demonstration shows how to:

Create a classification property.

Create a classification rule.

Modify the classification schedule.

Demonstration Steps
Create a Classification Property
1.

Open File Server Resource Manager, and expand the Classification Management node.

2.

Using the Classification Properties node, create a new Classification Property named
Confidential, with the Yes/No property type.

Create a Classification Rule


1.

Using the Classification Rules node, create a new Classification Rule named Confidential Payroll
Documents.

2.

Configure the rule to classify documents with a value of Yes for the Confidential classification
property, if the file contains the string expression PAYROLL.

Modify the Classification Schedule


1.

Create a classification schedule that runs every Sunday at 8:30 AM.

2.

Using the Classification Rule node, manually run Classification With All Rules Now, and view the
report.

Considerations for Using File Classification


Although Classification Management provides
a powerful mechanism to catalog, categorize,
and classify your file system objects, you should
consider certain factors when dealing with
Classification Management.

How Classification Properties Are Stored


Classification properties are stored in an alternate
data stream, which is a feature of NTFS. If a file
moves within NTFS, the alternate data streams
move with the file, but they do not appear in the

files contents. In Microsoft Office applications, the classification properties are also stored within file
formats as custom document properties or server document properties.

How Movement Affects Classification Properties

MCT USE ONLY. STUDENT USE PROHIBITED

10-20 Optimizing File Services

When moving a file from one NTFS file system to another, if you use a standard mechanism such as Copy
or Move, the file retains its classification properties. However, if you move a file to a non-NTFS file system,
regardless of how you move the file, file classification properties are not retained. If the file is the product
of a Microsoft Office application, then the classification properties remain attached, regardless of how the
file is moved.

Classification Management Process in Windows Server

Classification properties are available only to servers running Windows Server 2008 R2 or newer. However,
Microsoft Office documents will retain classification property information in Document Properties, which
is viewable regardless of the operating system being used.

Conflicting Classification Rules


At times, classification rules can conflict. When this happens, the file classification infrastructure will
attempt to combine properties. The following behaviors will occur when conflicting classification rules
arise:

For Yes or No properties, a YES value takes priority over a NO value.

For ordered list properties, the highest property value takes priority.

For multiple choice properties, the property sets are combined into one set.

For multiple string properties, a multistring value is set that contains all the unique strings of the
individual property values.

For other property types, an error occurs.

Classification Management Cannot Classify Certain Files

File Classification Infrastructure will not identify individual files within a container, file such as a .zip or .vhd
file. In addition, File Classification Infrastructure will not allow content classification for the contents of
encrypted files.

What Are File Management Tasks?


File management tasks automate the
process of finding subsets of files on a server,
and then applying simple commands to them
on a scheduled basis. Files are identified by
classification properties that have been assigned
to the file by a classification rule.
File management tasks include a file expiration
command, and you can also create custom tasks.
You can define files that will be processed by a file
management task through the following
properties:

Location

Classification properties

Creation time

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-21

Modification time

Last accessed time

File name

You also can configure file management tasks to notify file owners of any impending policy that will be
applied to their files.

File Expiration Tasks

File expiration tasks automatically move all files that match certain criteria to a specified expiration
directory, where an administrator can then back up those files and delete them. When you run a file
expiration task, a new directory is created within the expiration directory. The new directory is grouped
by the server name on which the task was run, and it is named according to the name of the file
management task and the time it was run. When an expired file is discovered, it is moved into the new
directory, while preserving its original directory structure.

Custom File Management Tasks

Expiration is not always a desired action to be performed on files. File management tasks allow you to run
custom commands. Using the Custom Commands dialog box, you can run an executable file, script, or
other custom command to perform an operation on the files within the scope of the file management
task.
Note: You configure custom tasks by selecting the Custom type on the Action tab of the
Create File Management Task window.

Demonstration: How to Configure File Management Tasks


In this demonstration, you will see how to:

Create a file management task.

Configure a file management task to expire documents.

Demonstration Steps
Create a File Management Task
1.

Open File Server Resource Manager, and then expand the File Management Tasks node.

2.

Create a file management task named Expire Confidential Documents with a scope of
E:\Labfiles\Mod10\Data.

Configure a File Management Task to expire documents


1.

On the Action tab, configure the task for file expiration to E:\Labfiles\Mod10\Expired.

2.

Add a condition that Confidential equals Yes.

3.

Run the File Management Task, and then view the report.

MCT USE ONLY. STUDENT USE PROHIBITED

10-22 Optimizing File Services

Lab A: Configuring Quotas and File Screening Using FSRM


Scenario

A. Datum Corporation is a global engineering and manufacturing company with a head office based in
London, United Kingdom. An IT office and data center in London support the London location and other
locations. A. Datum has recently deployed a Windows Server 2012 server and client infrastructure.

Each network client within the Adatum domain is provided with a server-based home folder that is used
to store personal documents or files that are works-in-progress. It has come to your attention that home
folders are becoming quite large, and may contain file types such as .MP3 files that are not approved due
to corporate policy. You decide to implement FSRM quotas and file screening to help address this issue.

Objectives
After completing this lab, you will be able to:

Configure FSRM quotas.

Configure file screening and generate a storage report.

Lab Setup
Estimated Time: 30 minutes

Virtual Machine(s)

20411B-LON-DC1
20411B-LON-SVR1

User Name

Administrator

Password

Pa$$w0rd

For this lab, you will use the available virtual machine environment. Before you begin the lab, you must
complete the following steps:
1.

On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.

2.

In Hyper-V Manager, click 20411B-LON-DC1, and in the Actions pane, click Start.

3.

In the Actions pane, click Connect. Wait until the virtual machine starts.

4.

Sign in using the following credentials:

5.

User name: Adatum\Administrator

Password: Pa$$w0rd

Perform steps 2 through 4 for 20411B-LON-SVR1.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-23

Exercise 1: Configuring FSRM Quotas


Scenario

To control the size of home folders, you are implementing FSRM quotas. Each home folder is limited to
100 MB. To ensure that administrators are made aware of home folders that are running out of space, an
event is written to the event log when a user exceeds 85 percent of their storage quota so that it can be
tracked by administrators.
The main tasks for this exercise are as follows:
1.

Create a quota template.

2.

Configure a quota based on the quota template.

3.

Test that the quota is functional.

Task 1: Create a quota template


1.

On LON-SVR1, from Server Manager, install the File Server Resource Manager.

2.

In the File Server Resource Manager console, use the Quota Templates node to configure a template
that sets a hard limit of 100 MB on the maximum folder size.

3.

Configure the template to record an event in the Event Log when the folder reaches 85 percent and
100 percent capacity.

Task 2: Configure a quota based on the quota template


1.

Use the File Server Resource Manager console and the Quotas node to create a quota on the
E:\Labfiles\Mod10\Users folder by using the quota template that you created in Task 1.

2.

Configure the quota to auto apply on existing and new subfolders.

3.

Create an additional folder named Max in the E:\Labfiles\Mod10\Users folder, and ensure that the
new folder is listed in the quotas list in File Server Resource Manager.

Task 3: Test that the quota is functional


1.

Open a Windows PowerShell window, and use the following commands to create a file in the
E:\Labfiles\Mod10\Users\Max folder. Press Enter after each line:
E:
cd \Labfiles\Mod10\Users\Max
fsutil file createnew file1.txt 89400000

2.

Check the Event Viewer for an Event ID of 12325.

3.

Test that the quota works by attempting to create a file that is 16,400,000 bytes, and then
press Enter:
fsutil file createnew file2.txt 16400000

4.

Notice that the file cannot be created. The message returned from Windows references disk space,
but the file creation fails because it would surpass the quota limit. Close the Windows PowerShell
window.

5.

Close all open windows on LON-SVR1.

Results: After completing this exercise, you should have configured an FSRM quota.

Exercise 2: Configuring File Screening and Storage Reports


Scenario

MCT USE ONLY. STUDENT USE PROHIBITED

10-24 Optimizing File Services

Managers are concerned that large media files are being stored in home folders, which violates corporate
policy. Managers want to prevent media files such as video, audio, and graphics files from being saved.
You need to implement file screening to prevent media files from being stored in home folders. However,
you have also been made aware that several users store Microsoft Project files with the extension.mpp in
their home directories. You must ensure that the file screen you create does not restrict the storage of
these files.
You have also been asked to provide a report to your manager documenting any attempts to save
restricted media files on LON-SVR1.
The main tasks for this exercise are as follows:
1.

Create a file screen.

2.

Create a file group.

3.

Test the file screen.

4.

Generate an on-demand storage report.

5.

To prepare for the next lab.

Task 1: Create a file screen


1.

On LON-SVR1, open File Server Resource Manager.

2.

Create a File Screen based on the Block Audio and Video Files file screen template for the
E:\Labfiles\Mod10\Users directory.

Task 2: Create a file group


1.

On LON-SVR1, open the File Server Resource Manager Configuration Options dialog box, and on
the File Screen Audit tab enable the Record file screening activity in auditing database option.

Note: This step allows recording of file screening events. These recordings will supply data
for a File Screen Audit report, which will be run later in this exercise.
2.

3.

Create a new File Group with the following properties:


o

File group name: MPx Media Files

Files to include: *.mp*

Files to exclude *.mpp

Modify the Block Audio and Video Files template to only use the MPx Media Files file group.

Task 3: Test the file screen


1.

On the taskbar, click the Windows Explorer shortcut.

2.

Create a new text document in E:\Labfiles\Mod10, and then rename it as musicfile.mp3.

3.

Copy musicfile.mp3 into E:\Labfiles\Mod10\Users. You will be notified that the system was unable
to copy the file.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-25

Task 4: Generate an on-demand storage report


1.

Open the File Services Resource Manager console.

2.

Right-click Storage Reports Management, select Generate Reports Now, and then provide the
following parameters:
o

Generate only the File Screening Audit report

Report on E:\Labfiles\Mod10\Users

3.

Review the generated reports in Windows Internet Explorer.

4.

Close all open windows on LON-SVR1.

To prepare for the next lab

When you finish the lab, do not shut down the virtual machines. You will need them for the next lab.

Results: After completing this exercise, you will have configured file screening and storage reports in
FSRM.

Lesson 4

Overview of DFS

MCT USE ONLY. STUDENT USE PROHIBITED

10-26 Optimizing File Services

You can use DFS to meet the challenges of managing data for branch offices by providing fault-tolerant
access and wide area network (WAN)friendly replication of files that are located throughout an
enterprise.

Lesson Objectives
After completing this lesson, you will be able to:

Describe DFS.

Describe DFS namespaces.

Describe DFS Replication.

Describe how DFS namespaces and DFS replication work.

Describe data deduplication.

Describe scenarios where DFS can be used.

Explain how to install the DFS role.

What Is DFS?
To access a file share, users typically require the
Universal Naming Convention (UNC) name to
access the shared folder content. Many large
organizations have hundreds of file servers that
are dispersed geographically throughout an
organization. This introduces a number of
challenges for users who are trying to find and
access files efficiently.

Through the use of a namespace, DFS can simplify


the UNC folder structure. In addition, DFS can
replicate the virtual namespace and the shared
folders to multiple servers within the organization.
This can ensure that the shares are located as close as possible to users, thereby providing an additional
benefit of fault tolerance for the network shares.
DFS includes two technologies that are implemented as role services:

DFS Namespace (DFS-N). Allows administrators to group shared folders that are located on different
servers into one or more logically structured namespaces. Each namespace appears to users as a
single shared folder with a series of subfolders. The subfolders typically point to shared folders that
are located on various servers in multiple geographical sites throughout the organization.

DFS-R. A multimaster replication engine that synchronizes files between servers for local and WAN
network connections. DFS Replication supports replication scheduling, bandwidth throttling, and uses
remote differential compression (RDC) to update only the portions of files that have changed since
the last replication. You can use DFS Replication in conjunction with DFS namespaces or as a
standalone file replication mechanism.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-27

What Is a DFS Namespace?


DFS namespaces enable a virtual representation
of shared folder structures. You can create either
a domain-based or standalone namespace. Each
type has different characteristics.

Domain-Based Namespace
A domain-based namespace can be used when:

Namespace high availability is required, which


is accomplished by replicating the namespace
to multiple namespace servers.

You need to hide the name of the namespace


servers from users. This also makes it easier to
replace a namespace server or migrate the namespace to a different server. Users will then access the
\\domainname\namespace format as opposed to the \\servername\share format.

If you choose to deploy a domain-based namespace, you will also need to choose whether to use the
Microsoft Windows 2000 Server mode or the Windows Server 2008 mode. Windows Server 2008 mode
provides additional benefits such as support for access-based enumeration, and it increases the number of
folder targets from 5,000 to 50,000. With access-based enumeration, you can also hide folders that users
do not have permission to view.
To use Windows Server 2008 mode, the following requirements must be met:

The Active Directory forest must be at Windows Server 2003 or higher forest functional level.

The Active Directory domain must be at the Windows Server 2008 domain functional level.

All namespace servers must be Windows Server 2008.

Standalone Namespace
A standalone namespace is used when:

An organization has not implemented Active Directory Domain Services (AD DS).

An organization does not meet the requirements for a Windows Server 2008 mode, a domain-based
namespace, and there are requirements for more than 5,000 DFS folders. Standalone DFS namespaces
support up to 50,000 folders with targets.

An organization is hosting a DFS namespace in a failover cluster.

What Is DFS Replication?


DFS-R provides a way to keep folders
synchronized between servers across wellconnected and limited bandwidth connections.
Take note of the following key points related to
DFS-R:

MCT USE ONLY. STUDENT USE PROHIBITED

10-28 Optimizing File Services

DFS-R uses Remote Differential Compression


(RDC). RDC is a client-server protocol that
can be used to efficiently update files over a
limited bandwidth network. RDC detects data
insertions, removals, and rearrangements in
files, enabling DFS-R to replicate only the
changed file blocks when files are updated.
RDC is only used for files that are 64 kilobytes (KB) or larger by default. DFS-R also supports cross-file
RDC, which allows DFS-R to use RDC, even when a file with the same name does not exist at the
client. Cross-file RDC can determine files that are similar to the file that needs to be replicated, and it
uses blocks of similar files that are identical to the replicating file to minimize the amount of data that
needs to be replicated.

DFS-R uses a hidden staging folder to stage a file before sending or receiving it. Staging folders act as
caches for new and changed files to be replicated from sending members to receiving members. The
sending member begins staging a file when it receives a request from the receiving member. The
process involves reading the file from the replicated folder and building a compressed representation
of the file in the staging folder. After it has been constructed, the staged file is sent to the receiving
member; if RDC is used, only a fraction of the staging file might be replicated. The receiving member
downloads the data and builds the file in its staging folder. After the file download completes on
the receiving member, DFS-R decompresses the file and installs it into the replicated folder. Each
replicated folder has its own staging folder, which by default is located under the local path of the
replicated folder in the DfsrPrivate\Staging folder.

DFS-R detects changes on the volume by monitoring the file system update sequence number (USN)
journal and replicates changes only after the file is closed.

DFS-R uses a version vector exchange protocol to determine which files need to be synchronized. The
protocol sends less than 1 KB per file across the network to synchronize the metadata associated with
changed files on the sending and receiving members.

DFS-R uses a conflict resolution heuristic of last writer wins for files that are in conflict (that is, a file
that is updated at multiple servers simultaneously) and earliest creator wins for name conflicts. Files
and folders that lose the conflict resolution are moved to a folder known as the Conflict and Deleted
folder. You can also configure the service to move deleted files to the Conflict and Deleted folder for
retrieval, should the file or folder be deleted. Each replicated folder has its own hidden Conflict and
Deleted folder, which is located under the local path of the replicated folder in the DfsrPrivate
\ConflictandDeleted folder.

DFS-R is self-healing and can automatically recover from USN journal wraps, USN journal loss,
or DFS-R database loss.

DFS-R uses a Windows Management Instrumentation (WMI) provider that provides interfaces to
obtain configuration and monitoring information from the DFS-R service.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-29

How DFS-N and DFS-R Work


Even though DFS-N and DFS-R are separate
role services, you can use them together to
provide high availability and data redundancy.
The following process describes how DFS-N and
DFS-R work together:
1.

User accesses a folder in the virtual


namespace. When a user attempts to access
a folder in a namespace, the client computer
contacts the server that is hosting the
namespace root. The host server can be a
standalone server that is hosting a standalone
namespace, or a domain-based configuration
that is stored in AD DS and then replicated to various locations to provide high availability. The
namespace server sends back to the client computer a referral containing a list of servers that host
the shared folders (called folder targets) that are associated with the folder being accessed. DFS is a
site-aware technology, so client computers can be configured to access namespaces that are within
their site first to ensure the most reliable access.

2.

Client computer accesses the first server in the referral. The client computer caches the referral
information and then contacts the first server in the referral. This referral typically is a server in the
clients own site, unless there is no server located within the clients site. In this case, the administrator
can configure the target priority.

On the slide example, the Marketing folder that is published within the namespace actually contains two
folder targets. One share is located on a file server in New York, and the other share is located on a file
server in London. The shared folders are kept synchronized by DFS-R. Even though multiple servers host
the source folders, this fact is transparent to users, who only access a single folder in the namespace. If
one of the target folders becomes unavailable, users will be redirected to the remaining targets within the
namespace.

What Is Data Deduplication?


In Windows Server 2012, you can enable data
deduplication for nonsystem volumes. Data
deduplication optimizes volume storage by
finding redundant data on a volume, and ensuring
that the data is stored only once on the volume.
This is achieved by storing the data in a single
location, and providing reference to the single
location for other redundant copies of the data.
Data is segmented into 32 KB to 218 KB chunks,
so data deduplication can optimize not only
redundant files, but also portions of files that are
redundant on the volume.
Data deduplication can be implemented in conjunction with DFS-R to provide an even more efficient
storage and replication infrastructure.

How Data Deduplication Works

MCT USE ONLY. STUDENT USE PROHIBITED

10-30 Optimizing File Services

Once a volume has data deduplication enabled, Windows 2012 optimizes the volumes by maintaining the
following components:

Unoptimized files. These include any files that do not meet the file-age criteria for data deduplication.
In order to be optimized by data deduplication, files must remain static for a certain amount of time.
Unoptimized files could include system state files, encrypted files, files smaller than 32 KB, files with
extended attibutes, or files that are in use by other applications.

Optimized files. Optimized files are stored as reparse points. A reparse point contains a pointer to the
locations of the chunk data within the chunk store, so the respective chunks can be retrieved when
required.

Chunk store. Optimized file data is located in the chunk store.

Benefits of Data Deduplication


Data deduplication can help you cope with storage growth in the following areas:

Capacity optimization. Data deduplication enables a server to store more data in less physical disk
space.

Scale and performance. Data deplucation is highly scalable in Windows Server 2012. It can run on
multiple volumes without affecting other services and applications running on the server. Data
deduplication can be throttled to accommodate other heavy workloads on the server, so that no
performance degradation occurs for important server tasks.

Reliability data integrity. Windows Server 2012 uses checksum. Consistency and validation to ensure
that the integrity of data affected by data deduplication remains intact. Data deduplication also
maintains redundant copies of the most frequently used data on a volume to protect against data
corruption.

Bandwidth efficiency. In combination with DFS-R, or other file replication technology such as
BranchCache, data deduplication can greatly reduce the bandwidth consumed replicating file data,
provided that replication partners are also running Windows Server 2012.

Simple optimization management. Windows Server 2012 and Windows PowerShell 3.0 contain
integrated support for data deduplication. Implementation and management within Windows
Server 2012 is done with familiar tools.

Implementing Data Deduplication


Use the following process to implement data deduplication on a server:
1.

Install the Data Deduplication role service for the File Services role.
This can be performed by using the Add Roles and Features Wizard in Server Manager, or by using
the following Windows PowerShell cmdlets:
Import-Module ServerManager
Add-WindowsFeature -name FS-Data-Deduplication
Import-Module Deduplication

2.

Enable data deduplication on one or more volumes.


Within Server Manager, you can right-click a volume and select Configure Data Deduplication,
which opens the Data Deduplication Settings page.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-31

Alternatively, you can use the following Windows PowerShell cmdlet to enable data deduplication (for
the volume E:, in this case):
Enable-DedupVolume E:

3.

Optionally, configure data deduplication jobs for a volume.

By default, built-in jobs are created and scheduled when you enable data deduplication for a volume.
If required, you can manually configure these jobs, or create additional jobs to further manage how
data deduplication functions.
Additional Reading: Data Deduplication Overview
http://go.microsoft.com/fwlink/?linkID=270996

DFS Scenarios
Several key scenarios can benefit from DFS-N and
DFS-R. These scenarios include:

Sharing files across branch offices.

Data collection.

Data distribution.

Sharing Files Across Branch Offices

Large organizations that have many branch offices


often have to share files or collaborate between
these locations. DFS-R can help replicate files
between branch offices or from a branch office to
a hub site. Having files in multiple branch offices also benefits users who travel from one branch office to
another. The changes that users make to their files in one branch office are replicated back to their branch
office.
Note: This scenario is recommended only if users can tolerate some file inconsistencies as
changes are replicated throughout the branch servers. Also, note that DFS-R only replicates a file
after it is closed. Therefore, DFS-R is not recommended for replicating database files or any files
that are held open for long periods of time.

Data Collection

DFS technologies can collect files from a branch office and replicate them to a hub site, thus allowing
the files to be used for a number of specific purposes. Critical data can be replicated to a hub site by using
DFS-R and then backed up at the hub site by using standard backup procedures. This increases the branch
office data recoverability if a server fails, because files will be available in two separate locations and
backed up. Additionally, companies can reduce branch office costs by eliminating backup hardware and
onsite IT personnel expertise. Replicated data can also be used to make branch office file shares fault
tolerant. If the branch office server fails, clients in the branch office can access the replicated data at the
hub site.

Data Distribution

MCT USE ONLY. STUDENT USE PROHIBITED

10-32 Optimizing File Services

You can use DFS-N and DFS-R to publish and replicate documents, software, and other line-of-business
(LOB) data throughout your organization. DFS-N and folder targets can increase data availability and
distribute client load across various file servers.

Demonstration: How to Install the DFS Role


This demonstration shows how to install the DFS Role.

Demonstration Steps
Install the DFS role

Under the File and Storage Management role, install the DFS Namespaces and DFS Replication
role services.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-33

Lesson 5

Configuring DFS Namespaces


Configuring a DFS namespace consists of several tasks, including creating the namespace structure,
creating folders within the namespace, and adding folder targets. You can also choose to perform
additional management tasks, such as configuring the referral order, enabling client fail back, and
implementing DFS-R. This lesson provides information on how to complete these configuration and
management tasks to deploy an effective DFS solution.

Lesson Objectives
After completing this lesson, you will be able to:

Describe the process for deploying namespaces to publish content.

Describe permissions required to create and manage a namespace.

Explain how to create and configure DFS namespaces and folder targets.

Describe the options for optimizing a namespace.

Deploying Namespaces to Publish Content


Most DFS implementations consist primarily
of content that is published within the DFS
namespace. To configure a namespace for
publishing content to users, perform the following
procedures:
1.

Create a namespace.
Use the New Namespace Wizard to create the
namespace from within the DFS Management
console. When a new namespace is created,
you must provide the name of the server that
you want to use as the namespace server, and
namespace name and type (either domainbased or standalone). You can also specify whether the namespace is enabled for Windows
Server 2008 mode.

2.

Create a folder in the namespace.


After you create the namespace, add a folder in the namespace that will be used to contain the
content that you want to publish. During the folder creation, you have the option to add folder
targets, or you can perform a separate task to add, edit, or remove folder targets later.

3.

Add folder targets.

After you create a folder within the namespace, the next task is to create folder targets. The folder
target is a shared folders UNC path on a specific server. You can browse for shared folders on remote
servers and create shared folders as needed. Additionally, you can add multiple folder targets to
increase the folders availability in the namespace. If you add multiple folder targets, consider using
DFS-R to ensure that the content is the same between the targets.

4.

Set the ordering method for targets in referrals.

MCT USE ONLY. STUDENT USE PROHIBITED

10-34 Optimizing File Services

A referral is an ordered list of targets that a client computer receives from the namespace server when
a user accesses a namespace root or folder. When a client receives the referral, the client attempts to
access the first target in the list. If the target is not available, the next target is attempted. By default,
targets in the clients site are always listed first in the referral. You can configure the method for
ordering targets outside the clients site on the Referrals tab of the Namespace Properties dialog box.
You have the choice of configuring the lowest cost, random order, or configuring the ordering
method to exclude targets outside the clients site.
Note: Folders inherit referral settings from the namespace root. You can override the
namespace settings on the Referrals tab of the Folder Properties dialog box by excluding
targets outside the clients site.

Optional Management Tasks


A number of optional management tasks that you can consider include:

Set target priority to override referral ordering. You can have a specific folder target that you want
everyone to use from all site locations, or a specific folder target that should be used last among all
targets. You can configure these scenarios by overriding the referral ordering on the Advanced tab of
the Folder Target Properties dialog box.

Enable client failback. If a client cannot access a referred target, the next target is selected. Client
failback will ensure that clients fail back to the original target after it is restored. You can configure
client failback on the Referrals tab of the Namespace Properties dialog box by selecting the Clients
fail back to preferred targets check box. All folders and folder targets inherit this option. However,
you can also override a specific folder to enable or disable client failback features, if required.

Replicate folder targets using DFS-R. You can use DFS-R to keep the contents of folder targets in sync.
The next topic discusses DFS-R in detail.

Permissions Required to Create and Manage a Namespace


To perform DFS namespace management tasks,
a user either has to be a member of an
administrative group or has to be delegated
specific permission to perform the task. To
delegate the required permissions, right-click
the namespace and then click Delegate
Management Permissions.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-35

The following table describes the groups that can perform DFS administration by default, and the method
for delegating the ability to perform DFS management tasks.
Task

Groups that can perform the


task by default

Delegation method

Create a domain-based
namespace.

Domain admins

Click Delegate Management


Permissions.

Add a namespace server to a


domain-based namespace.

Domain admins

Add users to local administrators


group on the namespace server.

Manage a domain-based
namespace.

Local administrators on each


namespace server

Click Delegate Management


Permissions.

Create a standalone
namespace.

Local administrators on each


namespace server

Add users to local administrators


group on the namespace server.

Manage a standalone
namespace.

Local administrators on each


namespace server

Click Delegate Management


Permissions.

Create a replication group, or


enable DFS-R on a folder.

Domain admins

Add users to local administrators


group on the namespace server.

Demonstration: How to Create Namespaces


This demonstration shows how to:

Create a new namespace.

Create a new folder and folder target.

Demonstration Steps
Create a new namespace
1.

Open the DFS Management console.

2.

Create a domain-based namespace on LON-SVR1 named Research.

Create a new folder and folder target


1.

Create a new folder named Proposals in the \\Adatum.com\Research namespace.

2.

Create a folder target for Proposals that points to \\LON-SVR1\Proposal_docs.

3.

Confirm namespace functionality by navigating to \\Adatum.com\Research, and confirming that


the Proposals folder displays.

Optimizing a Namespace
Namespaces have a number of configuration
options with which you can optimize its usability
and performance.

Rename or Move a Folder


You can rename or move a folder in a namespace.
This allows you to reorganize the hierarchy of
folders to best suit your organizations users. For
example, when your company reorganizes, you
can reorganize the namespace to match the new
structure.

Disable Referrals to a Folder

MCT USE ONLY. STUDENT USE PROHIBITED

10-36 Optimizing File Services

A referral is a list of targets that a client computer receives from a domain controller or namespace server
when the user accesses a root or folder with namespace targets. By disabling a folder targets referral, you
prevent client computers from accessing that folder target in the namespace. This is useful when you are
moving data between servers.

Specify Referral Cache Duration

Clients do not contact a namespace server for a referral each time they access a folder in a namespace;
instead, namespace root referrals are cached. Clients that use a cached referral will renew the cache
duration value of the referral each time a file or folder is accessed using the referral. This means that the
clients will use the referral indefinitely until the clients referral cache is cleared or the client is restarted.
You can customize the referral cache duration. The default is 300 seconds (5 minutes).

Configure Namespace Polling


To maintain a consistent domain-based namespace across namespace servers, namespace servers must
poll AD DS periodically to obtain the most current namespace data. The two modes for namespace
polling are:

Optimize for consistency. Namespace servers poll the primary domain controller (PDC) emulator each
time a namespace change occurs. This is the default.

Optimize for scalability. Each namespace server polls its closest domain controller at periodic intervals.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-37

Lesson 6

Configuring and Troubleshooting DFS-R

To configure DFS-R effectively, it is important to understand the terminology and requirements that are
associated with the feature. This lesson provides information on the specific elements, requirements, and
scalability considerations as they relate to DFS-R. This lesson also provides a process for configuring an
effective replication topology.

Lesson Objectives
After completing this lesson, you will be able to:

Describe replication groups and replicated folders.

Describe the initial replication process.

Explain how to configure DFS-N and DFS-R.

Describe DFS troubleshooting options.

Replication Groups and Replicated Folders


A replication group comprises a set of member
servers that participate in replicating one or more
replicated folders. There are two main types of
replication groups:

Multipurpose replication group. This


replication group helps to configure
replication between two or more servers
for publication, content sharing, or other
scenarios.

Replication group for data collection. This


replication group configures a two-way
replication between two servers, such as a
branch office server and a hub server. This group type is used to collect data from the branch office
server to the hub server. You can then use standard backup software to back up the hub server data.

A replicated folder is synchronized between each member server. Creating multiple replicated folders
within a single replication group helps to simplify the following for the entire group:

Replication Group type

Topology

Hub and spoke configuration

Replication schedule

Bandwidth throttling

The replicated folders that are stored on each member can be located on different volumes in the
member. Replicated folders do not need to be shared folders or part of a namespace, although the DFS
Management snap-in makes it easy to share replicated folders, and optionally, publish them to an existing
namespace.

Replication Topologies
When configuring a replication group, you must define its topology. You can select between the
following:

MCT USE ONLY. STUDENT USE PROHIBITED

10-38 Optimizing File Services

Hub and spoke. To select this option, you require at least three member servers in the replication
group. This topology works well in publication scenarios where data originates at the hub and is
replicated to members at the spokes.

Full mesh. If ten or fewer members are in the replication group, this topology works well, with each
member replicating to all others, as required.

No topology. Choose this option if you want to manually configure a custom topology after creating
the replication group.

Initial Replication Process


When you first configure replication, you choose
a primary member that has the most updated
files to be replicated. This server is considered
authoritative for any conflict resolution that
occurs when the receiving members have files that
are older or newer when compared to the same
files on the primary member.
Consider the following concepts about the initial
replication process:

Initial replication does not begin immediately.


The topology and DFS-R settings must be
replicated to all domain controllers, and each
member in the replication group must poll its closest domain controller to obtain these settings.
Active Directory replication latency and the long polling interval (60 minutes) on each member
determine the amount of time this takes.

Initial replication always occurs between the primary member and its receiving replication partners.
After a member has received all files from the primary member, that member will replicate files to its
receiving partners. In this way, replication for a new replicated folder starts from the primary member
and then progresses out to the other replication group members.

When receiving files from the primary member during initial replication, the receiving members
with files that are not present on the primary member will move those files to their respective
DfsrPrivate\PreExisting folder. If a file is physically identical to a file on the primary member, then
the file is not replicated. If the version of a file on the receiving member is different from the primary
members version, the receiving members version is moved to the Conflict and Deleted folder, and
RDC can be used to download only the changed blocks.

To determine whether files are identical on the primary member and receiving member, DFS-R
compares the files using a hash algorithm. If the files are identical, only minimal metadata is
transferred.

MCT USE ONLY. STUDENT USE PROHIBITED

Administering Windows Server 2012 10-39

After the initialization of the replicated folder, the primary member designation is removed.
(Initialization takes place after all files that exist prior to DFS-R configuration, are added to the DFS-R
database.) That member then is treated like any other member, and its files are no longer considered
authoritative over other members that have completed initial replication. Any member that has
completed initial replication is considered authoritative over members that have not completed initial
replication.

Demonstration: How to Configure DFS-R


In this demonstration, you will see how to:

Create a new folder target for replication.