Windows Server Pro: Manage and Administer Objective 3: File Services Management – Flashcards

You work as the IT Administrator for a small corporate network. You have four domain controllers in your Main location: *CorpDC*, *CorpDC2*, *CorpDC3*, and *CorpDC4*. During installation, *CorpDC2* and *CorpDC3* were not made global catalog servers. You would like additional global catalog servers. Your task in this lab is to designate *CorpDC2* and *CorpDC3* as global catalog servers. (To answer this question, complete the lab using information below.)

You work as the IT Administrator for a small corporate network. You have a branch site with about 50 employees that is connected to the main site with a WAN link. A single domain controller named *BranchDC2* is configured in the branch location. Because the WAN link is slow and unreliable, you have not configured *BranchDC2* as a global catalog server. You find that when the WAN link goes down, users at the branch location cannot log on to the network. Even when the WAN link is up, users complain that logon is slow. You want to minimize Active Directory traffic across the WAN link, but you also want to let branch users log on to the network even when the WAN link is down. Your task in this lab is to use Active Directory Sites and Services to enable universal group membership caching in the branch office. To do this, edit the *NTDS Site Settings* object for the *Branch2-Site* site. Keep the default caching settings.

You work as the IT Administrator for a small corporate network. When you installed the *CorpDC* domain controller, you created a new domain in a new forest. Since then, you have added additional domain controllers. You would like to move some of the operation master roles to *CorpDC3* to provide role separation. Your task in this lab is to transfer the RID master and the PDC emulator roles to *CorpDC3*. You are currently logged on to the *CorpServer2* computer, which is the Hyper-V host for *CorpDC3*.

As your network has grown, you have added additional domains to the forest root domain. As a result, you would like to modify the operations master configuration on your network. Your task in this lab is to: • Transfer the domain naming master role from *CorpDC* to *CorpDC4*. This means that *CorpDC* will only host the infrastructure master role. • Because you will be creating additional domains in the forest, remove the global catalog from *CorpDC* to follow Microsoft's recommendation to not have the infrastructure master on a global catalog server. You are currently logged on to the *CorpServer2* computer, which is the Hyper-V host for *CorpDC4*.

You work as the IT Administrator for a small corporate network. There are four domain controllers at the main location as follows: *Domain Controller* CorpDC *Role(s)* Infrastructure master *Domain Controller* CorpDC2 *Role(s)* None *Domain Controller* CorpDC3 *Role(s)* PDC emulator, RID master *Domain Controller* CorpDC4 *Role(s)* Domain naming master Lately, you have had some problems creating new User objects in the domain. You suspect that one of your domain controllers has an intermittent problem connecting to the network. All domain controllers are currently working, but you want to prevent future problems of this nature. Your task in this lab is to identify the operations master role that could cause the symptoms explained above, and then transfer that operations master role to the *CorpDC2* domain controller.

You work as the IT Administrator for a small corporate network. Your network currently has a main office and two branch offices. Due to a recent expansion, you will be opening a new branch office. The new office will be part of the main site, and will be connected to the main office with a WAN link. For security reasons, you plan to install a read-only domain controller in the new location. Your task in this lab is to pre-create the RODC account in Active Directory. • Before you begin, create a global security groups named *Branch3-RODC Admins* in the Users container. Members of this group will be able to manage the read-only domain controller at the new location. • Create the following RODC account in the Domain Controllers OU: Branch3-RODC* • Specify your current credentials to complete the installation. • Add the account to the *Main-Site* site. • Make the domain controller a global catalog server and DNS server. • Identify the *Branch3-RODC Admins* group to manage the read-only domain controller.

You work as the IT Administrator for a small corporate network. You would like to back up the System State of your Domain Controllers to ensure a good backup of Active Directory in the event of a disaster. You want to configure regular backups on *CorpDC4*. Your task in this lab is to use Windows Server Backup on *CorpDC4* to do the following: • Create a regular backup schedule for the *CorpDC4* server using the following settings: • Items to back up: *System State* • Backup schedule: *Once a day* at *1:00 AM* • Backup location: *CorpFiles12Backup* • After you have created the schedule, take an immediate backup. Use custom settings as follows: • Items to back up: *System State* and *C: drive*. • Backup location: *CorpFiles12Backup*.

You work as the IT Administrator for a small corporate network. Earlier, you created the *SecureWS* GPO with policy settings intended to apply to workstations in the domain. You defined the policy and linked it to the domain. Now you find that the GPO settings are affecting domain controllers and member servers, but it should only apply to workstations that are in various OUs. Your task in this lab is to modify GPO inheritance to prevent the *SecureWS* GPO from applying to domain controllers and member servers. Complete the following tasks: • Block inheritance on the *Domain Controllers* OU. • Block inheritance on the *Servers* OU. • Enforce the *Default Domain Policy* so it can't be blocked.

You work as the IT Administrator for a small corporate network. Earlier, you created the *SecureWS* GPO with policy settings intended to apply to workstations in the domain. You defined the policy and linked it to the domain. Now you find that the GPO settings are affecting domain controllers. The policy should apply to all other computers, but not domain controllers. Your task in this lab is to modify GPO permissions to prevent the *SecureWS* GPO from applying to domain controllers. • Add the *Domain Controllers* group to the access control list for the GPO. • Deny the *Read* and *Apply group policy* permissions.

You work as the IT Administrator for a small corporate network. The corporate office has directed that a specific set of policies be in place for all Domain Controllers and has provided you with a policy that must be applied. You copied the policy object called *Corp Domain Controllers*, which will be used for the new policies. Complete the following tasks: • Import the corporate policy into the *Corp Domain Controllers*policy object. The policy is located at *CorpFiles08AdminCorpPolicy*. • As you import, make a backup of the current policy settings. store the backup in *CorpFiles12BackupGPOs*. • Copy references directly from the corporate policy. • Link the Corp Domain Controllers policy to the Domain Controllers container and move it first in the Link Order.

You work as the IT Administrator for a small corporate network. Users in the accounting department use a custom software package. You want to use Group Policy to distribute the software so that it is installed on all accounting computers when they start up. You have copied the *AcctMagic.msi* installer package to the *SharedSoftware* directory, which is shared on *CorpFiles12*. Complete the following tasks on the *CorpDC* server: 1. Create a GPO called *Computers-Accounting Software* and link it to the Accounting OU. 2. Configure the GPO to assign the AcctMagic.msi software to all computers. The installer package is located in: *CorpFiles12SharedSoftwareAcctMagic.msi*. Do not change the default name for the software package. 3. Configure the package to be automatically uninstalled when the computer account is moved from the Accounting OU.

You work as the IT Administrator for a small corporate network. You have purchased a site license for a spreadsheet program. You have copied the *Spreadsheet.msi* installer package to the *SharedSoftware* directory, which is shared on *CorpFiles12*. Create the software installation package on *CorpDC* to meet the following requirements: • The software will be installed through a new GPO that is to be named *Spreadsheet Software*. • The software should be available for all users in the Accounting and the Research and Development departments, regardless of which computer they use for logon. • The software should not be installed automatically. It should only be installed when users manually install it through Add or Remove Programs. Create the GPO, configure its settings, and link it to the appropriate object(s) to meet the scenario requirements.

You work as the IT Administrator for a small corporate network. You want to use Group Policy to distribute a database application called *Hot Leads* to all users in the sales department. You have copied the *HotLeads.msi* installer package to the *SharedSoftware* directory, which is shared on *CorpFiles12*. Create the software installation package on *CorpDC* to meet the following requirements: • The software will be installed through a new GPO that is to be named *Hot Leads Software*. • The software should be available only for users in the sales department, regardless of which computer they use for logon. • The software should be installed automatically at logon. • The software should not appear in Add/Remove Programs in the Control Panel. • The software should be uninstalled automatically if the user account moves to a different department. Create the GPO, configure its settings, and link it to the appropriate objects(s) to meet the scenario requirements.

You work as the IT Administrator for a small corporate network. After a security review, you have decided to take steps to improve network security. You are configuring security options using Group Policy on the *CorpDC* server. Complete the following tasks: • Edit the *Default Domain Policy* GPO and configure the following settings: • Prevent logon with the Guest local account by disabling the *Accounts: Guest account status* policy. • Change the local administrator username to *skycaptain* by enabling the *Accounts: Rename administrator account* policy. • Prevent hackers from seeing valid usernames by enabling the *Interactive logon: Do not display last user name* policy. • Prevent an anonymous user from requesting SID on behalf of another user by disabling the *Network access: Allow anonymous SID/Name translation* policy. • Enable the *Network access: Do not allow anonymous enumeration of SAM accounts* policy. • Enable the *Network access: Do not allow anonymous enumeration of SAM accounts and shares* policy. • Edit the *SupportGPO* GPO linked to the Support OU. Configure the following settings: • Prevent the computer from using cached credentials for logon by configuring the *Interactive logon: Number of previous logons to cache* policy to 0. • Prevent the computer from using cached credentials to unlock by enabling the *Interactive logon: Require Domain Controller authentication to unlock workstation* policy. • Prevent users from accessing the network outside designated hours by enabling the *Network security: Force logoff when logon hours expire* policy. • Allow only users who can log on to the system to shut the system down by disabling the *Shutdown: Allow system to be shut down without having to log on* policy. • Because all GPO settings in the *SupportGPO* GPO are in the Computer Configuration portion, disable the User Configuration portion of the GPO.

You work as the IT Administrator for a small corporate network. You are configuring a password policy for the domain. Your task in this lab is to edit the Default Domain Policy on *CorpDC* using Group Policy Management and configure the Account Policy settings to meet the following requirements: • Passwords must be at least 10 characters long. • Passwords must contain uppercase letter, lowercase letter, number, and symbol characters. • Users must change passwords every 90 days. • Users cannot change a new password for at least 14 days. • Any new password must be different than the previous 10 passwords. • If five incorrect passwords are entered within a ten minute interval, lock the account. • Keep accounts locked for 1 hour. Then, unlock the account automatically.

You have recently implemented Account Policies for the domain to configure password and account lockout settings. However, the manager of the Accounting department has requested that her department be assigned a more restrictive policy set. You decide to implement a fine-grained password policy. Your task in this lab is to create a new password settings object with the following settings: • Name: *AccountingPasswords* • Precedence: *1* • Enforce a minimum password length of *12* characters. • Enforce password history with the last *15* passwords remembered. • Password should meet complexity requirements. • Do not store passwords using reversible encryption. • Protect the object from accidental deletion • Enforce a minimum password age of *2* days. • Enforce a maximum password age of *30* days • Enforce an account lockout policy: • Failed attempts allowed: *3* • Reset failed attempt count after *30* minutes • Keep the account locked until an administrator unlocks it • Assign the object to members of the Accounting department *Note*: All users in the Accounting OU are members of the Accounting security group.

You work as the IT Administrator for a small corporate network. As part of your ongoing program to improve security, you would like to implement an audit policy for all workstations. You want to audit for any user who logs on or attempts to log on to a workstation. You also want to audit other critical events recommended by Microsoft. Your task is to configure the following Audit policy settings in the WorkstationGPO on *CorpDC*: Policy Setting Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings Enabled Audit: Shut down system immediately if unable to log security audits Enabled Retention method for security log Enabled: Do not overwrite events (clear log manually) Audit Policies: Account Logon: Audit Credential Validation Success and Failure Audit Policies: Account Management: Audit User Account Management Success and Failure Audit Policies: Account Management: Audit Security Group Management Success and Failure Audit Policies: Account Management: Audit Other Account Management Events Success and Failure Audit Policies: Account Management: Audit Computer Account Management Success Audit Policies: Detailed Tracking: Audit Process Creation Success Audit Policies: Logon-Logoff: Audit Logon Success and Failure Audit Policies: Logon-Logoff: Audit Logoff Success Audit Policies: Policy Change: Audit Authentication Policy Change Success Audit Policies: Policy Change: Audit Audit Policy Change Success and Failure Audit Policies: Privilege Use: Audit Sensitive Privilege Use Success and Failure Audit Policies: System: Audit System Integrity Success and Failure Audit Policies: System: Audit Security System Extension Success and Failure Audit Policies: System: Audit Security State Change Success and Failure Audit Policies: System: Audit IPsec Driver Success and Failure

You work as the IT Administrator for a small corporate network. As part of your ongoing program to improve security, you would like to enable auditing for removable storage devices on all workstations. You want an audit event each time a user accesses or attempts to access a file system object on a removable storage device. Your task is to add Object Access auditing for removable storage to the *WorkstationGPO* policy object on *CorpDC*.

You work as the IT Administrator for a small corporate network. The Sales department would like to make sure that all users of Internet Explorer are using the Corporate intranet website for their home page regardless of which computer they use. You need to enforce these preferences along with a few changes to Internet Explorer security settings. All computers are running Internet Explorer 10. Your task is to configure the following Internet Explorer preference settings in the *SalesGPO*: • Set the Home page to the company intranet: *www.corpnet.local* • Set Internet Explorer to start with the specified homepage • Set the Security level for the Local intranet zone to *Low* • Prevent websites from requesting your physical location.

You are the IT Administrator for a small corporate network. You have noticed that several computer monitors are still on late at night, long after employees have left. You would like to use Group Policy to set consistent power options for computers throughout the company. All workstations are either Windows 7 or Windows 8 and reside in the Workstations OU. Your task is to configure the following Power Option policy settings in the *WorkstationGPO* policy: • Set the policy Action to *Update* • Set the Balanced power plan as the active power plan for all workstations • Set the following Advanced Settings: • *Setting*; Hard disk > Turn off hard disk after *On battery* 60 Minutes *Plugged in* 120 Minutes • *Setting*; Display > Turn off display after *On battery* 30 Minutes *Plugged in* 60 Minutes

You work as the IT Administrator for a small corporate network. The Support department uses a call center application that runs from the network. They would like to make sure that all support computers have a shortcut to this application on the desktop for all users. Your task is to deploy a shortcut to all computers using preference settings in the *SupportGPO* policy object as follows: *Setting* Action; *Value* Update *Setting* Name; *Value* CallStart *Setting* Target Type; *Value* File System Object *Setting* Location; *Value* All Users Desktop *Setting* Target Path; *Value* CorpFiles12CallCenterCallStart.exe

You work as the IT Administrator for a small corporate network. You have configured the *WorkstationGPO* group policy object with all of the settings needed for management of the workstations on your network. To make sure that these settings can't be lost, you would like to make a backup of the GPO. Your task is to create a backup of the *WorkstationGPO* policy object. Save the backup to *CorpFiles12BackupGPOs*.

You work as the IT Administrator for a small corporate network. You have made several changes to the security settings for workstations in the WorkstationGPO policy object. Unfortunately, several of the changes you made did not work as expected. You need to return to settings which you know are good. Your task is to restore the settings of the *WorkstationGPO* from a recent backup in *CorpFiles12BackupGPOs*.

You work as the IT Administrator for a small corporate network. As the company continues to grow, you realize that you will need assistance with managing group policy. You would like to create a group that has the ability to manage group policy so you can assign assistants to the group as needed. Your task in this lab is to delegate group policy management as follows: • Create a Global Security Group called *GPOAdmins* in the Admins container. • Delegate the ability to create Group Policy Objects in the domain to the new *GPOAdmins* group.

You are the IT Administrator for a small corporate network. As your network grows, you need to delegate common administrative tasks. You have defined the following administrative roles: • *PasswordAdmins* will be able to reset passwords for any user in the domain. • *ComputerAdmins* will be able to join computers to the domain for the entire domain. • *GPOLinkAdmins* will be able to manage GPO links for departmental OUs (Accounting, Marketing, Research-Dev, Sales, and Support). Your task in this lab is to delegate administrative roles on *CorpDC* to accomplish the following: • Create Global security groups in the Users container for each of the administrative roles listed. Use the role name for the group name (do not include a space in the group name). • Use the Delegation of Control Wizard to delegate the necessary permissions at the correct level to each group. In the wizard, use the common tasks option for delegating control.

You are the IT Administrator for a small corporate network. Users on your network have started saving music and video files to your file server. These files are using up a lot of resources. You need to prevent these files from being saved to the server and set quotas on users' directories. Your task is to add the role service to the *CorpFiles12* server that will provide you with the required features.

You are the IT Administrator for a small corporate network. Users on your network have started saving a lot of files to the file server. These files are using up a lot of resources. You need to set quotas on the *CorpFiles12* server. Create the following quotas: • Create a Quota Template called *500 MB Hard Limit* with the following properties: • 500 MB Hard quota • Notification e-mail sent to the user at 80% usage • Notification e-mail sent to the user and an event log entry at 90% usage. • Notification e-mail sent to both the user and the Administrator along with an event log entry at 95% usage. • Create a quota on *D:Users* using the properties of the 250 MB Extended Limit* template. • Create a quota on *H:Projects* using the properties of the *Monitor 500 MB Share* template.

You are the IT Administrator for a small corporate network. Users on your network have started saving a lot of files to the file server. These files are using up a lot of resources. You need to create file screens on the *CorpFiles12* server. Create the following file screens: • Create a file screen template called *Monitor Audio and Video* that monitors Audio and Video files. Send an e-mail to the Administrator and write an event to the event log if files matching the screen are saved. • Create a file screen that monitors audio and video files being saved to the *D:Users* directory. Use the *Monitor Audio and Video* template you just created. • Create a file screen that prevents Executable files from being saved to the *H:Projects* directory. Use the *Block Executable Files* template. • Create a file screen exception that allows Executable files in *H:ProjectsProject1Software*.

You are the IT Administrator for a small corporate network. You would like to simplify file access for various departments using the Distributed File System (DFS). Your implementation will be configured as follows: • The *CorpDC2* server will host a domain namespace and several replicated folders. • The server will replicate with other servers running DFS. Your task in this lab is to add the necessary role services to provide the required features. After adding the role services, create the DFS structure as follows: • Create a namespace on server *CorpDC2*. Users will use *CorpNetSharedFiles* to access the namespace. Create the namespace so that you can use access-based enumeration. • Create folders with targets as follows: *Folder name* Accounting. *Target* CorpFiles12Accounting *Folder name* Marketing. *Target* CorpFiles08Marketing *Folder name* Sales. *Target* CorpFiles08Sales

You work as the IT Security Administrator for a small corporate network. You have placed several documents that are used only by administrators in a folder on *CorpServer*. You need to secure the contents of the *C:Admins* folder so that unauthorized users cannot view the documents in the folder. You also need to allow Susan access to the latest password file in the folder. Complete the following tasks: • Encrypt the *C:Admins* folder and all of its contents. • Add the *Susan* user account as an authorized user for the *C:AdminsPasswords.xls* file.

You work as the IT Administrator for a small corporate network. Employees in Branch Office 1 are working on a very sensitive project. Files for the project are store on the *BranchFiles12* server. Management is concerned that if the hard drive in the server were to be stolen, sensitive information could be compromised. As a result, you have been asked to encrypt the entire System volume. The *BranchFiles12* server has a built-in TPM on the motherboard. Your task in this lab is to configure BitLocker drive encryption as follows: • Turn on BitLocker for the *System (C:)* drive. • Turn on and activate the TPM. • Save the recovery key to *CorpFiles12Backup*. • Encrypt the entire drive. • Perform a BitLocker system check. *Note*: To activate the TPM, restart the server and press the *Delete* key to enter setup.