Deploy and Manage AD DS practice questions

Add the branch office users to the Enterprise Admins group.

Why wrong: Membership in the Enterprise Admins group provides broad permissions across the entire forest but does not specifically address the local caching of credentials on an RODC. Over-privileging users for the sake of branch office authentication introduces significant security risks and violates the principle of least privilege required for secure Active Directory environments.

Modify the Denied RODC Password Replication Group to include the branch users.

Why wrong: Adding users to the Denied RODC Password Replication Group explicitly prevents their passwords from being cached on the RODC hardware. This would worsen the problem by ensuring that authentication always requires a connection to a writable domain controller, making branch office users entirely dependent on the availability of the WAN link to log in.

Enable the 'Store password using reversible encryption' policy for the users.

Why wrong: Reversible encryption stores passwords in a format that is essentially the same as clear text, which is a significant security vulnerability. This setting is intended for specific legacy application requirements and has no direct relationship with how Read-Only Domain Controllers cache credentials or manage password replication policies across branch office network boundaries.

The source domain controller is currently offline for maintenance.

Why wrong: If the source domain controller were offline, you would typically see an error like 1722 (The RPC server is unavailable) or 58 (The specified server cannot perform the requested operation). Error 8452 is more specific to the internal state of the replication engine and the validity of the naming context being requested.

There is a significant time difference between the two domain controllers.

Why wrong: Time synchronization issues usually result in Kerberos authentication failures, leading to errors like 'Access is denied' or specific time-skew messages. While time is critical for Active Directory health, it does not typically manifest as a 'preempted' replication operation error, which is reserved for lower-level directory service synchronization interruptions.

The KCC has not yet run to create the initial replication topology.

Why wrong: If the Knowledge Consistency Checker (KCC) had not run, there would be no replication links to report errors on in the first place. The presence of a 'Last error' in the showrepl output implies that a link exists and an attempt was made, but the process was interrupted by a configuration change.

User GPOs linked to the user's OU are ignored completely.

Why wrong: This statement describes 'Replace' mode, not 'Merge' mode. In 'Replace' mode, the user's normal GPO list is discarded in favor of the computer's GPOs. In 'Merge' mode, the user's original GPOs are still processed first, ensuring that their standard settings are applied before the computer-specific overrides take effect.

Computer settings from the user's OU are applied to the kiosk.

Why wrong: Group Policy processing never applies computer settings from a user's OU to a computer object. Computer settings are only derived from the GPOs linked to the OU where the computer object itself resides. Loopback processing only affects how user configuration settings are gathered and applied during the user's interactive login.

DC01.fabrikam.com

Why wrong: According to the exhibit, DC01 holds the Domain Naming Master role, which is responsible for managing the addition and removal of domains in the forest. While it is a critical forest-wide role, it has no authority over schema modifications, and any attempt to extend the schema while targeting this DC will fail.

Any domain controller in the forest root domain.

Why wrong: Schema modifications are not a general capability of all domain controllers. While every DC holds a read-only copy of the schema, only the specific DC designated as the Schema Master can perform write operations. Targeting an arbitrary DC in the root domain will not satisfy the architectural requirement for schema write access.

The Infrastructure Master for the forest root domain.

Why wrong: The Infrastructure Master is responsible for updating cross-domain object references and does not play a role in schema management. Using this DC for a schema extension is incorrect, as its specialized function is unrelated to the underlying directory definitions that the schema extension utility needs to modify and replicate forest-wide.

Active Directory Federation Services (AD FS)

Why wrong: AD FS provides its own single sign-on experience through federation and does not use the specific 'Seamless SSO' feature of Azure AD Connect. While AD FS allows for a similar user experience, the 'Seamless SSO' checkbox in Azure AD Connect is technically designed for environments that do not want to maintain AD FS infrastructure.

Certificate-based authentication

Why wrong: Certificate-based authentication is a distinct method that uses X.509 certificates to verify identity. It does not utilize the Kerberos-based logic that defines Azure AD's Seamless SSO feature. While it is a secure form of authentication, it is managed and configured separately from the Seamless SSO synchronization settings in Azure AD Connect.

Cloud-only authentication

Why wrong: Cloud-only authentication is for accounts that exist only in Azure AD and have no on-premises presence. Seamless SSO is specifically designed to bridge the gap between an on-premises Active Directory domain and Azure AD, making it irrelevant for accounts that do not have a corresponding on-premises identity to authenticate against.

Run the New-ADServiceAccount cmdlet with the -DNSHostName parameter.

Why wrong: The `New-ADServiceAccount` cmdlet is the primary tool for creating the gMSA object in Active Directory. Specifying the `-DNSHostName` and `-PrincipalsAllowedToRetrieveManagedPassword` parameters ensures the account is correctly identified and that the designated web servers have the legal authority to request and use the account's password from the domain controllers.

Install the Active Directory Certificate Services role on a domain controller.

Why wrong: While certificates are used for many security tasks, gMSAs do not rely on Active Directory Certificate Services (AD CS) for their functionality. They use the Key Distribution Service and Kerberos for password management and authentication, making the installation of a Certificate Authority unnecessary for the deployment and operation of managed service accounts.

Raise the domain functional level to Windows Server 2022.

Why wrong: gMSAs were introduced with Windows Server 2012, and the minimum functional level required is Windows Server 2012. There is no requirement to raise the level to Windows Server 2022 to use gMSAs, and doing so would be an unnecessary and disruptive change for an organization only seeking to improve service account security.

The policy applied to GroupA because 50 is a higher value.

Why wrong: In Active Directory precedence logic for PSOs, a higher numerical value actually indicates a lower priority. Therefore, the policy with a precedence of 50 is considered less significant than a policy with a precedence of 10, and it will be ignored if both are applied to the same user simultaneously.

Both policies will be merged, and the most restrictive settings will apply.

Why wrong: Unlike Group Policy settings which can merge, Fine-Grained Password Policies do not merge. Only one Password Settings Object (PSO) can be effective for a user at any given time. Active Directory uses a strict tie-breaking logic based on precedence values and GUIDs to select exactly one policy to enforce.

The Default Domain Policy will take precedence over both.

Why wrong: Fine-Grained Password Policies are designed specifically to override the Default Domain Policy for targeted users or groups. If a valid PSO is applied to a user, it will always take precedence over the domain-wide password settings, regardless of the numerical precedence values assigned to the individual PSOs themselves.

Modify the Default Domain Controllers Policy to disable credential caching globally for all domain controllers.

Why wrong: Modifying the Default Domain Controllers Policy affects read-write domain controllers and alters standard domain-wide security settings rather than specifically targeting the password replication policy mechanism required for managing branch office RODC credential caching behaviors effectively.

Set the registry key on the RODC to block all outbound replication traffic from the primary domain controller.

Why wrong: Blocking outbound replication traffic stops the domain controller from receiving vital directory updates, schema changes, and object modifications from replication partners, causing severe synchronization failures across the entire distributed Active Directory forest.

Deploy the RODC using an unattend XML file that specifies read-only authentication filtering parameters.

Why wrong: Unattend XML answer files are used during automated operating system deployments and initial installations, but they cannot dynamically manage or modify Active Directory password replication policy configurations after the domain controller has been successfully promoted.

Verify that the forest functional level is currently set to at least Windows Server 2016.

Why wrong: Before transitioning to higher forest functional levels, the environment must meet baseline operating system requirements. All legacy domain controllers running older operating systems must be completely removed or upgraded to prevent functional level promotion blocks.

Run the Dcpromo utility on all remaining domain controllers to purge residual replication metadata.

Why wrong: The Dcpromo utility was deprecated and removed starting with Windows Server 2012. Modern domain controller promotion and demotion tasks are executed natively through Server Manager or specialized Active Directory PowerShell deployment cmdlets.

Modify the RID Master operations master role to reside exclusively on a read-only domain controller.

Why wrong: Operations master roles such as the Relative ID Master require read-write database capabilities and cannot be hosted on read-only domain controllers, which lack the ability to write direct modifications to the directory database.

PDC Emulator

Why wrong: The PDC Emulator is a domain-wide role responsible for password changes and time synchronization within a single domain. While vital for domain operations, it does not manage the addition of new domains or the uniqueness of domain names across the entire Active Directory forest structure.

RID Master

Why wrong: The RID Master allocates sequences of relative identifiers to domain controllers within a specific domain to ensure unique SIDs for new objects. Like the PDC Emulator, this is a domain-level role and does not govern forest-wide operations such as adding or naming new domains.

Schema Master

Why wrong: The Schema Master is a forest-wide role that controls all updates and modifications to the Active Directory schema. While it does not directly manage domain names, it is the other forest-level role that must be carefully managed and moved before any domain controller holding it is decommissioned.

Infrastructure Master

Why wrong: The Infrastructure Master is responsible for updating cross-domain object references within its own domain. It is a domain-specific role and, in a single-domain forest or a forest where every DC is a Global Catalog, its specific duties are minimal compared to forest-wide operations master roles.

The Global Catalog contains every attribute of every object in the forest.

Why wrong: This is incorrect because the Global Catalog only stores the Partial Attribute Set (PAS), which includes the most commonly used attributes for searching and authentication. Storing every attribute for every object across all domains would significantly increase the size of the database and replication traffic.

The Schema Master and Global Catalog roles must be on separate servers.

Why wrong: There is no technical requirement to separate the Schema Master role from a Global Catalog server. In fact, in many smaller environments, the first domain controller in the forest holds all FSMO roles and is also the first Global Catalog server without any performance or functional issues.

RODCs cannot be configured as Global Catalog servers.

Why wrong: Read-Only Domain Controllers (RODCs) can indeed be configured as Global Catalog servers. This is highly recommended for branch offices with multiple domains, as it allows the RODC to provide local search and group membership resolution without relying on a writeable domain controller over a WAN link.

Select the 'Critical Replication Only' checkbox during promotion.

Why wrong: This option allows the promotion to complete after replicating only the essential data needed for the DC to function. The remaining non-critical data, such as application partitions or the Global Catalog, can then replicate in the background, allowing the DC to become operational more quickly under bandwidth constraints.

Set the replication schedule of the site link to 'Never'.

Why wrong: Setting a site link schedule to 'Never' would completely prevent the domain controller from ever synchronizing its database with the rest of the forest. This would leave the new DC in an unusable and inconsistent state, failing to provide any authentication services to the remote office.

Manually copy the C:\Windows\NTDS folder from an existing DC.

Why wrong: Manually copying the NTDS folder is not a supported method for deploying a domain controller and will likely lead to database corruption or a failure to boot. The database must be prepared using the ntdsutil tool to ensure it is in a consistent state for the IFM process.

The Active Directory Administrative Center (ADAC).

Why wrong: ADAC is a GUI-based tool designed for managing objects like users and groups after the domain is already established. It does not provide features for the initial installation or promotion of domain controllers, making it unsuitable for the automation of a large-scale server deployment project.

The dcpromo.exe command-line tool.

Why wrong: The dcpromo.exe tool is deprecated and has been removed from newer versions of Windows Server starting with Windows Server 2012. It should not be used for modern deployments; instead, administrators are required to use PowerShell or the Server Manager deployment wizard for all promotion tasks.

Group Policy Preferences.

Why wrong: Group Policy Preferences are used to manage settings on computers that are already members of a domain. They cannot be used to promote a standalone server to a domain controller, as the server must already be part of the Active Directory infrastructure to receive and process GPOs.

It allows you to modify and save changes back to the backup file.

Why wrong: The dsamain tool mounts the database in a read-only state. It is designed for data recovery and comparison, not for editing historical records. Any changes needed must be performed on the live production database after identifying the necessary data from the mounted historical snapshot.

It creates a temporary writeable domain controller for testing.

Why wrong: Dsamain does not create a full domain controller. It merely exposes the database via LDAP on a custom port. It cannot process logons, participate in replication, or run typical DC services, making it a lightweight diagnostic tool rather than a functional server replacement for testing.

It automatically repairs corruption in the production database.

Why wrong: Dsamain is a viewing and data extraction tool, not a repair utility. If the production database is corrupt, tools like ntdsutil for integrity checks or a full restore from a known good backup are required. Dsamain has no mechanism to inject or fix data in the live environment.

Perform a graceful transfer of the role using Active Directory Domains and Trusts.

Why wrong: Graceful transfers require both the source and destination domain controllers to be online and communicating. Since the original hardware has failed and is unrecoverable, the GUI-based transfer tool will fail because it cannot contact the existing role holder to hand over the metadata and authority for the Domain Naming Master role.

Restore the failed domain controller from a system state backup to new hardware.

Why wrong: Restoring a domain controller from a system state backup is a complex recovery process that might not be the most efficient way to restore role functionality. While possible, seizing the role to an existing healthy domain controller is the standard administrative response for FSMO recovery to minimize downtime for critical forest-wide directory operations.

Raise the Forest Functional Level to Windows Server 2022 to automate role recovery.

Why wrong: Raising the Forest Functional Level provides new features and security enhancements but does not include any mechanism for the automated recovery or reassignment of FSMO roles. Manual intervention through seizure or transfer remains the only way to relocate these roles when a domain controller fails or is retired from the environment.

Install the Active Directory Certificate Services role.

Why wrong: Active Directory Certificate Services is used for managing public key infrastructure and issuing digital certificates. While it is important for security, it is not a prerequisite for the creation or operation of Group Managed Service Accounts, which rely on the Key Distribution Service and specific Active Directory schema attributes instead.

Raise the domain functional level to Windows Server 2019.

Why wrong: While gMSAs require a minimum schema version and functional level, they were introduced in Windows Server 2012. Raising the domain functional level to Windows Server 2019 is not a requirement for using gMSAs, as the feature is fully supported on much older functional levels that are still commonly found in production.

Enable the Active Directory Recycle Bin.

Why wrong: The Active Directory Recycle Bin is a feature used to recover deleted objects without restoring from backup. Although it is a best practice for general Active Directory management, it has no technical relationship with the functionality or deployment of Group Managed Service Accounts for securing services and scheduled tasks.

Run the New-ADServiceAccount cmdlet.

Why wrong: The New-ADServiceAccount cmdlet is the primary tool used to create the gMSA object in Active Directory. This command allows administrators to define the account name, DNS host name, and the security principals that are authorized to retrieve the password, which is essential for the service to run on the cluster.

The promotion will fail because every domain must have at least one Global Catalog.

Why wrong: While it is true that a domain needs at least one Global Catalog for proper operation, the promotion of an individual server does not require it to be a GC. As long as another Global Catalog exists in the domain or forest, the promotion of a non-GC domain controller will proceed without errors.

The domain controller will be promoted as a Read-Only Domain Controller.

Why wrong: The Global Catalog role and the Read-Only Domain Controller role are distinct configurations. To promote a server as an RODC, the -ReadOnlyReplica parameter must be used. Setting -NoGlobalCatalog to true simply prevents the GC role from being installed, regardless of whether the DC is writable or read-only.

The domain controller will not be able to replicate with other sites.

Why wrong: Replication is a core function of all domain controllers and is not dependent on the server being a Global Catalog. A domain controller that is not a GC will still replicate its own domain's naming context and the configuration and schema partitions with all other domain controllers in the forest normally.

Forest-wide authentication

Why wrong: Forest-wide authentication automatically grants all users in the trusted forest the ability to authenticate to all resources within the local forest. This setting is inappropriate for this scenario because it fails to meet the security requirement of restricting access to only a single file server, potentially exposing other sensitive resources to the external users.

Domain-wide authentication

Why wrong: Domain-wide authentication is used for external trusts rather than forest trusts and grants users in the trusted domain access to all resources in the local domain. It does not provide the granular, object-level control required to restrict authentication to a single server while blocking access to the rest of the forest environment.

SID Filtering

Why wrong: SID Filtering is a security mechanism that removes unauthorized Security Identifiers from an authentication token to prevent privilege escalation attacks across trusts. While it is an essential part of trust security, it does not control the scope of which servers or resources a user is permitted to authenticate against in the trusting forest.

The Schema Master role must be held by a domain controller running Windows Server 2022.

Why wrong: While the Schema Master must be reachable to update the forest level, it does not specifically require the latest version of Windows Server 2022. As long as the Schema Master meets the minimum requirement of Windows Server 2016, the forest level can be raised successfully without necessitating an upgrade to the absolute newest OS.

You must disable the Active Directory Recycle Bin before raising the level.

Why wrong: The Active Directory Recycle Bin is a feature that is actually enhanced or maintained by higher functional levels, and there is no requirement to disable it during a level transition. In fact, many organizations raise their functional level specifically to enable the Recycle Bin, which requires at least the Windows Server 2008 R2 level.

The forest must be configured for DFSR replication for the SYSVOL share.

Why wrong: While migrating from FRS to DFSR is highly recommended and eventually required for modern Windows Server versions, it is technically a prerequisite for raising the functional level to Windows Server 2019, not 2016. Therefore, while it is a best practice for health and performance, it is not a hard block for the 2016 level.

Install-WindowsFeature AD-Domain-Services

Why wrong: This cmdlet is used only to install the necessary binary files and management tools for the Active Directory Domain Services role on the server. It does not perform the actual promotion of the server to a domain controller or configure the Active Directory database, which are separate steps required for a functional DC.

Add-Computer -DomainName 'contoso.com'

Why wrong: The Add-Computer cmdlet is designed to join a standalone server or workstation to an existing Active Directory domain as a member. It does not install directory services or promote the machine to a domain controller role, making it insufficient for the task of expanding the domain's infrastructure and identity management capabilities.

Set-ADDomain -Identity 'contoso.com' -InfrastructureMaster

Why wrong: This cmdlet is used to modify the properties of an existing Active Directory domain, such as changing the Infrastructure Master or other domain-wide settings. It has no capability to install the AD DS role or promote a new server, as its primary purpose is the management of existing domain objects and roles.