CCNA Deploy and Manage AD DS Questions

Deploying domain controllers on Azure VMs requires specific configuration to prevent database corruption and ensure consistent identity services. This includes using a static private IP address to prevent DNS failures, placing the NTDS database on a non-caching data disk to ensure write integrity, and using a separate virtual disk rather than the OS drive.

Domain controllers run the operating system version installed on them, but the domain and forest functional levels determine which features are available across the entire environment. A new Windows Server 2022 DC can join a 2012 R2 forest, but it will operate within the constraints of that lower functional level.

The error code 1722 (The RPC server is unavailable) typically indicates a network connectivity issue or a service failure on the source domain controller. In the context of Active Directory replication, this often points to a firewall blocking RPC traffic, a failure of the DNS to resolve the source DC's name, or the RPC service being stopped.

The PDC Emulator is the authoritative server for password changes and the primary target for password resets within a domain. In the provided exhibit, DC1 holds the PDC Emulator role. If DC1 is offline or experiencing issues, password-related tasks will fail or show inconsistencies, making it the primary suspect for troubleshooting.

In a multi-domain forest, a domain controller needs to contact a Global Catalog to determine Universal Group membership during logon. If a GC is not available locally and the WAN link is down, logons fail. Enabling Universal Group Membership Caching allows a standard DC to cache these memberships, enabling successful logons during outages without the overhead of hosting a full GC.

The Active Directory Recycle Bin is the most efficient tool for recovering deleted objects because it preserves all physical and logical attributes of the object, including its distinguished name and group memberships. Once enabled, it eliminates the need for authoritative restores from backups, which require taking a domain controller offline into Directory Services Restore Mode.

Standalone Managed Service Accounts (sMSAs) were introduced to simplify service account management by automating password rotations and SPN handling. Unlike traditional service accounts, sMSAs are tied to a single computer and do not require administrative intervention for password updates, significantly reducing the risk of service outages due to expired credentials or human error.

The Active Directory Recycle Bin is the most efficient way to recover deleted objects because it preserves all attributes and the original Distinguished Name. Unlike traditional backups, it does not require a reboot into Directory Services Restore Mode (DSRM), making it the ideal choice for rapid recovery in modern environments.

Group Managed Service Accounts (gMSAs) require a minimum domain functional level and a specific root key for the Key Distribution Service (KDS). The KDS root key is used by domain controllers to generate the passwords for gMSAs, and it must be created once per forest to enable the service.

The 'IS_GC' flag in the DSA Options section of commands like 'repadmin /showrepl' indicates that the domain controller is functioning as a Global Catalog server. This is a critical piece of information for troubleshooting logon issues and ensuring that universal group memberships can be resolved locally.

Active Directory determines which Fine-Grained Password Policy to apply based on the precedence value of the Password Settings Objects. In this hierarchy, the PSO with the lower numeric value takes precedence. Therefore, a PSO with a precedence of 20 will override a PSO with a precedence of 50 when a user is a member of multiple groups.

Raising the forest functional level is a significant administrative task that enables advanced features but requires strict adherence to versioning rules. All domain controllers in every domain within the forest must be running a version of Windows Server that is equal to or higher than the target functional level, and all individual domains must already be at that target level.

Selective authentication is a security feature used in forest trusts to restrict the scope of authentication for users from a trusted forest. Unlike forest-wide authentication, which allows users to authenticate to any resource in the trusting forest, selective authentication requires administrators to manually grant the 'Allowed to Authenticate' permission on specific computer objects for the external users or groups.

A one-way forest trust with selective authentication is the most secure way to connect two forests. The 'one-way' aspect limits the direction of trust, while 'selective authentication' prevents trusted users from automatically being part of the 'Authenticated Users' group on resources in the trusting domain.

Active Directory site links are logical paths that represent the network connectivity between different sites. By configuring the schedule on a site link, administrators can precisely control when replication traffic is allowed to traverse the WAN. This is a fundamental skill for managing multi-site topologies where bandwidth is limited or expensive during specific times of day.

By default, RODCs do not store user passwords. To allow a user to log on when the WAN link is unavailable, their credentials must be cached locally. This is achieved by adding the user or their group to the 'Allowed RODC Password Replication Group' or modifying the RODC's Password Replication Policy.

Deploying a Read-Only Domain Controller is the recommended strategy for branch offices where physical security cannot be guaranteed. This approach ensures that only a subset of user credentials is cached locally based on the Password Replication Policy, significantly reducing the impact of a physical server theft while still providing local authentication services for users at the site.

Active Directory uses site link costs to determine the most efficient path for replication. When 'Bridge all site links' is enabled (the default), Active Directory can calculate a transitive path between sites that are not directly connected. The total cost is the sum of the costs of the individual links that make up the path.

The Delegation of Control Wizard in Active Directory Users and Computers (ADUC) is designed for granting specific, limited permissions to users or groups over specific portions of the directory. This follows the principle of least privilege by allowing tasks to be offloaded to non-administrators without granting full Domain Admin rights.

Modern Windows Server administration emphasizes automation through PowerShell. To promote a server to a domain controller, the ADDSDeployment module provides specific cmdlets that replace the legacy dcpromo utility. These cmdlets handle the configuration of the database, logs, SYSVOL paths, and the necessary directory partition replicates from existing domain controllers in the environment.

Error 1256 indicates that the remote system is unavailable, which usually points to a network connectivity issue or a failure of the source domain controller (DC2). Troubleshooting should focus on physical connectivity, firewall rules, or the operational status of DC2 to ensure it can communicate with DC1 over the network.

To view the contents of a past Active Directory database, you first use ntdsutil to mount the snapshot or recovered database file. Then, you use dsamain to expose that database as an LDAP directory service on a custom port. Once dsamain is running, standard tools like Active Directory Users and Computers can connect to that specific port.

The Relative Identifier (RID) Master is responsible for allocating pools of RIDs to all domain controllers in a domain. When a DC exhausts its local pool and the RID Master is unavailable, it cannot create new security principals. In cases of permanent or long-term failure, the role must be seized to a healthy DC to restore functionality.

Fine-Grained Password Policies (FGPP) allow administrators to apply different password and account lockout settings to different sets of users or groups within a single domain. This eliminates the need for multiple domains just to enforce varying security requirements, which was a significant limitation in older versions of Windows Server.