Mcts 70-640 - Microsoft Official Course Chapter 5 Study Guide - Managing Comuter Accounts

Front 1

In workgroup __________ is the authority for authentication

Back 1

SAM

(Microsoft, 2011 p. 5-5)

Front 2

In a domain, ___________________ is the authority for authentication

Back 2

Active Directory

(Microsoft, 2011 p. 5-5)

Front 3

Computers have _______________________ with the domain.

Back 3

Trust relationship.

(Microsoft, 2011 p. 5-5)

Front 4

You must have ________ in active directory services that allow you to join a computer to the domain.

Back 4

permissions

(Microsoft, 2011 p. 5-6)

Front 5

In order to change the domain or workbook you ___________________________.

Back 5

Must be a member of the local administrators group.

(Microsoft, 2011 p. 5-6)

Front 6

If you don't join a computer to an existing object ___________________ happens?

Back 6

Windows will create a computer object in the default computer container.

(Microsoft, 2011 p. 5-6)

Front 7

The default Computers container is a ________________,not an _______________________.

Back 7

container

organizationalUnit object

(Microsoft, 2011 p. 5-7)

Front 8

Cannot link __________ to a container

Back 8

GPOs

(Microsoft, 2011 p. 5-7)

Front 9

Cannot create _____________ in a container

Back 9

sub-OUs

(Microsoft, 2011 p. 5-7)

Front 10

Servers are usually subdivided by ______________

Back 10

server role

(Microsoft, 2011 p. 5-7)

Front 11

Client Computers are usually subdivided by ________________

Back 11

Region

(Microsoft, 2011 p. 5-7)

Front 12

CN

Back 12

Computer Name

(Microsoft, 2011 p. 5-7)

Front 13

When you create a domain the _________________________ is created by default

Back 13

Computers Container

(Microsoft, 2011 p. 5-7)

Front 14

The computers container is __________________________

Back 14

An object of the Container Class.

(Microsoft, 2011 p. 5-7)

Front 15

Most organizations create at least two OUs for Computer Objects: What are they

Back 15

1. one to host computer accounts for client computers - desktops, laptops and other user systems

2. for servers

(Microsoft, 2011 p. 5-7)

Front 16

How do you divide Organizational Units

Back 16

Divide OUs based first on administration,then to facilitate configuration with Group Policy

(Microsoft, 2011 p. 5-7)

Front 17

Prestage

Back 17

Pre-create

Create a computer in the correct OU

(Microsoft, 2011 p. 5-8)

Front 18

How do you create (prestage) a computer?

Back 18

Right-click the OU and choose New  Computer


(Microsoft, 2011 p. 5-7)

Front 19

Computer name and Computer Name (pre-Windows 2000) should _____________________

Back 19

be the same

(Microsoft, 2011 p. 5-10)

Front 20

prestaging

Back 20

The process you complete to create a computer to an account before joining the computer to the domain is called prestaging the account

(Microsoft, 2011 p. 5-10)

Front 21

The System Properties dialog box or window prompts for __________________

Back 21

Domain Credentials
and
Requires Restart

(Microsoft, 2011 p. 5-11)

Front 22

By prestaging a computer object, you fulfill the first two requirements for joining a computer to the domain

Back 22

1. The computer object exists

2. you have specified who has permissions to join a computer with the same name to the domain.

(Microsoft, 2011 p. 5-11)

Front 23

Once Prestaging is complete a local administrator of the computer can change the computer's _____________________ and _______________________________

Back 23

1. change the computers domain membership

2. enter the specified domain credentials to successfully complete the process.

(Microsoft, 2011 p. 5-11)

Front 24

When does group policy apply to the computer after joining the domain?

Back 24

Immediately

(Microsoft, 2011 p. 5-13)

Front 25

How to configure the default container in PowerShell

Back 25

redircmp "DN of OU for new computer objects"

(Microsoft, 2011 p. 5-13)

Front 26

How many domains can users join?

Back 26

10

(Microsoft, 2011 p. 5-13)

Front 27

What is the first problem with the windows prestaging process?

Back 27

First, the computer account created automatically by Windows is placed in the default computer container, which is not where the computer object belongs in most enterprises.

(Microsoft, 2011 p. 5-13)

Front 28

What is the second problem with the windows prestaging process?

Back 28

Second, you must move the computer from the default computer container into the correct OU, which is an extra step that is often forgotten.

(Microsoft, 2011 p. 5-13)

Front 29

What is the third problem with Windows prestaging process?

Back 29

Third, any domain user can also do this - no domain-level administrative permissions are required. Any user can join any computer to the domain if you don't manage and secure the process. Because a computer object is security principle, and because the creator of a computer object owns the object and can change its attributes, this exposes a potential security vulnerability.

(Microsoft, 2011 p. 5-13)

Front 30

DC

Back 30

Domain

(Microsoft, 2011 p. 5-13)

Front 31

What is the default computer container called?

Back 31

Computers (CN=Computers,DC=Domain)

(Microsoft, 2011 p. 5-13)

Front 32

What command is used to redirect the default computer container

Back 32

redircmp.exe

(Microsoft, 2011 p. 5-14)

Front 33

If a computer joins the domain without a prestaged computer account, and you apply some baseline GPO policies what happens to the group?

Back 33

The new settings affect all the computers

(Microsoft, 2011 p. 5-14)

Front 34

The creator of an object by default has has permissions to _________________

Back 34

join the computer to the domain.

(Microsoft, 2011 p. 5-14)

Front 35

WHy would you close the loophole?

Back 35

so that nonadministrative users cannot join machines to the domain

Front 36

You should change the ms-DS-MachineAccountQuoya to

Back 36

0

(Microsoft, 2011 p. 5-13)

Front 37

CSVDE

Back 37

Comma Separated Value Discretionary Exchange

Import (create) or export computer accounts

(Microsoft, 2011 p. 5-17)

Front 38

LDIFDE

Back 38

Lightweight Directory Access Protocol Data Interchange Format (LDIF)

Import(create), modify, or export computer accounts

(Microsoft, 2011 p. 5-17)

Front 39

DSadd

Back 39

- Create computer accounts and set initial properties
- import and automate the creation of computer objects

(Microsoft, 2011 p. 5-17)

Front 40

NetDom

Back 40

- Create computer accounts

- join machines to a domain

(Microsoft, 2011 p. 5-17)

Front 41

Windows PowerShell with Active Directory Module

Back 41

Create and manage computer accounts

(Microsoft, 2011 p. 5-17)

Front 42

Scripts can allow you to provision computer objects, that is

Back 42

to perform business logic such as the enforcement of computer naming conventions

Front 43

PowerShell Command for CSVDE.exe

Back 43

csvde -i -f filename [-k]

(Microsoft, 2011 p. 5-17)

Front 44

csvde

what is -i

Back 44

Import (default mode is export) -> ->

(Microsoft, 2011 p. 5-18)

Front 45

csvde

what is -k

Back 45

Continue past errors (such as Objects Already Exists)

(Microsoft, 2011 p. 5-18)

Front 46

When importing computers with CSVDE ______________________________________

Back 46

Include userAccountControl column (set to 4096) and sAMAccountName column (set to computername$)

(Microsoft, 2011 p. 5-18)

Front 47

What is the breakdown of csvde [i] [-f "filename"] [-k]

Back 47

the i option specifies immport mode-without it, the default mode of CSVDE is export. The -f option identifies the file name to import from or export to. The -k option is useful during import operations because it instructs CSVDE to ignore errors, including "object already exists," constraint violation," and "attribute or value already exist."

(Microsoft, 2011 p. 5-18)

Front 48

Comma-deliminated files can be created, modified, and opened with tools as familiar as __________________

Back 48

- notepad
- MS Excell
- others

(Microsoft, 2011 p. 5-18)

Front 49

The first line of the comma-denominated files means?

Back 49

it defines the attributes by their LDAP attribute names. Each object follows, one per line, and must contain exactly the attributes listed on the first line.

(Microsoft, 2011 p. 5-18)

Front 50

When importing computers be sure to include an attribute set to ____ to be sure the computer can join the account.

Back 50

4096

(Microsoft, 2011 p. 5-18)

Front 51

LDIFDE.exe

Back 51

ldifde [-i] [-f filename] [-k]

(Microsoft, 2011 p. 5-19)

Front 52

ldifde [-i] [-f filename] [-k]

What does te -i mean?

Back 52

Import - the default mode is export

(Microsoft, 2011 p. 5-19)

Front 53

ldifde [-i] [-f filename] [-k]

What does the -k mean?

Back 53

Continue past errors (including objects already exist)

(Microsoft, 2011 p. 5-19)

Front 54

What format do the LDIFDE.exe import data files in the LDAP?

Back 54

Data Interchange Format (LDIF)

(Microsoft, 2011 p. 5-19)

Front 55

What are LDIF files?

Back 55

They are text files within which operations are specified by a block of lines separated by a blank line. Each operation begins with the DN attribute of the object that is the target of the operation. The next line, changeType, specifies the type of operation: add, modify or delete.

(Microsoft, 2011 p. 5-19)

Front 56

What is change type

Back 56

specifies type of operation

- Change
- Modify
- Delete

(Microsoft, 2011 p. 5-19)

Front 57

Basic syntax of LDIFDE command

Back 57

ldifde [-i] [-f "Filename"] [-k]

(Microsoft, 2011 p. 5-19)

Front 58

If you do not use -k on LDFDE what happens when it encounters errors?

Back 58

It Stops!

(Microsoft, 2011 p. 5-20)

Front 59

DSAdd

Back 59

creates objects in Active Directory

dsadd computer Computer DN

(Microsoft, 2011 p. 5-21)

Front 60

DSadd In Active Directory PowerShell

Back 60

New-ADComputer -SamAccountName DESKTOP123 -Path 'OU=Client Computers,DC=contoso,DC=com'

(Microsoft, 2011 p. 5-21)

Front 61

To create objects in Active Directory simply type ___________

Back 61

dsadd computer ComputerDN

(Microsoft, 2011 p. 5-21)

Front 62

DN

Back 62

Distinguished Name

(Microsoft, 2011 p. 5-21)

Front 63

CN=Desktop123,OU=NYC,OU=client Computers, DC=contoso,DC=com is an exaple of ____________________

Back 63

where computerDN is the distinguished name (DN) of the comuputer

(Microsoft, 2011 p. 5-21)

Front 64

If the computer's DN includes a space, surround the entire DN with quotation marks.

The DSadd computer command can take the following options after the DN option

Back 64

-samid ComputerName

-desc Description

-loc Location

(Microsoft, 2011 p. 5-21)

Front 65

New-ADComputer -SamAccountName DESKTOP123 -Path 'OU=Client Computers,DC=Contoso,DC=com' is what?

Back 65

PowerShell command in Windows Server 2008 R2 to create a new computer account in AD DS

(Microsoft, 2011 p. 5-21)

Front 66

For full explanation of the parameters that you can pass to New-ADComputer, at the Active Directory module command prompt, type _____________________________

Back 66

Get -Help New-ASComputer -detailed then press enter

(Microsoft, 2011 p. 5-21)

Front 67

NetDom and Powershell

-create an account

Back 67

netdom add ComputerName /domain:DomainName [/ou:'OUDN]
[/ UserD:DomainUsername /PasswordD:DomainPassword]

(Microsoft, 2011 p. 5-22)

Front 68

NetDom and PowerShell

- Join the domain (and if necessary, create am account)

Back 68

netdom join MachineName /Domain:DomainName
[/OU: 'OUDN']

[/UserD:DomainUserName][/PasswordD: {DomainPassword|*} ]

[/User0:LocalIsername] [/Password0:{LocalPassword|*}] [/securePasswordPrompy]
[/REBoot[:TimeInSecinds}}

(Microsoft, 2011 p. 5-22)

Front 69

What does the command netdom add ComputerName /domain:DomainName [/ou:'OUDN'] [/userD:DomainUsername /PasswordD:DomainPassword} mean?

Back 69

This command creates the commputer account for ComputerName in the domain indicated by the /domain option, using the credentials specified by /IserD and /PasswordD. The /ou option causes the object to be created in the OU specified by the organizational unit distinguished name (OUDN) following the option, If no OUDN is supplied, the computer account is created in the default computer container. The user credentials must, of course, have permissions to create computer objects.

(Microsoft, 2011 p. 5-22`)

Front 70

/reboot

Back 70

causes the system to reboot after joining the domain

(Microsoft, 2011 p. 5-23)

Front 71

/SecurePasswordPrompt

Back 71

displays a popup for credentials when "is specified for either/PasswordO or /PasswordD.

(Microsoft, 2011 p. 5-23)

Front 72

Description Attribute

Back 72

Describes the attribute

(Microsoft, 2011 p. 5-32)

Front 73

Location Attribute

Back 73

- used by location-aware applications such as Search for Printers

example: US\WA|SEA\HQ\Building33\Floor3\Q04\1531

(Microsoft, 2011 p. 5-32)

Front 74

Managed By Attribute

Back 74

- Link user who is the primary user of the computer

-Link to Group that is responsible for the computer (servers)

(Microsoft, 2011 p. 5-32)

Front 75

Member of Attribute

Back 75

- Groups: Group Policy Filtering, software deployment

(Microsoft, 2011 p. 5-32)

Front 76

dsmond computer attribute

Back 76

"ComputerDN" [-desc "description"] [-loc "Location"]

(Microsoft, 2011 p. 5-32)

Front 77

What attribute does this PowerShell Command represent Set-ADComputer LON-SRV1 -Managedby 'CN=SQL Administrator 01,OU=UserAccounts,OU=Managed,DC=Contoso,DC=com'

Back 77

ManagedBy attribute

(Microsoft, 2011 p. 5-32)

Front 78

What are the ways to move a computer in Active Directory?

Back 78

- Drag and Drop
- Right Click the Computer

(Microsoft, 2011 p. 5-34)

Front 79

What does this PowerShell command do? dsmove ObjectDN [-newname NewName] [-newparent ParentDN]

Back 79

Moves a computer

(Microsoft, 2011 p. 5-34)

Front 80

What PowerShell command is used to rename a computer?

Back 80

-newname NewName

(Microsoft, 2011 p. 5-34)

Front 81

What PowerShell command is used to move a computer to the OU specified by the ParentDN?

Back 81

newparent ParentDN

(Microsoft, 2011 p. 5-34)

Front 82

Using windows with pipelining

Back 82

get-ADComputer | Move-ADobject

(Microsoft, 2011 p. 5-34)

Front 83

DSMove command

Back 83

allows you to move a computer object or any other object.

(Microsoft, 2011 p. 5-34)

Front 84

what are 3 scenarios where a channel can be broken?

Back 84

1. Reinstalling computer, even with the same name, generates a new SID and password

2.Restoring a computer from an old backup, or rolling back a computer to an old snapshot

3.Computer and domain disagree about what the password is

(Microsoft, 2011 p. 5-36)

Front 85

Every computer is Active Directory Domains maintains a computer account with

Back 85

- use name (sAMAccountName)
- password

(Microsoft, 2011 p. 5-36)

Front 86

LSA

Back 86

Local Security Authority

This is how the computer stores its passwords

(Microsoft, 2011 p. 5-36)

Front 87

LSA changes its password

Back 87

every 30 days or so

(Microsoft, 2011 p. 5-36)

Front 88

Why is the secure channel broken after reinstalling the operating system on a workstation?

Back 88

The workstation is unable to authenticate, even though the technician used the same computer name, because the new installation generated a new SID and because the new computer does not know the computer account password in the domain, it does not belong to the domain and cannot authenticate to the domain.

(Microsoft, 2011 p. 5-36)

Front 89

Why is the secure channel broken when a computer is completely restored from backup and is unable to authenticate?

Back 89

It is likely that the computer changed its password with the domain after the backup operation. Computers change their passwords every 30 days, and active directory remembers the current and previous password in the domain, it does not belong to the domain and cannot authenticate to the domain.

(Microsoft, 2011 p. 5-36)

Front 90

Why is the secure channel broke when a computers LSA secret gets out of synchronization with the password known by the domain?

Back 90

You can think of this as the computer forgetting its password; although it did not forget its password, it just disagrees with the domain over what the password really is. When this happens, the computer cannot authenticate and the secure channel cannot be created.

(Microsoft, 2011 p. 5-36)

Front 91

Event log errors include

Back 91

-password
-mistrust
-secure channel
-relationship with the domain or domain controller
-missing computer account in Active Directory

(Microsoft, 2011 p. 5-37)

Front 92

When resetting a computer account, DO NOT

Back 92

simply remove a computer from the domain and rejoin

- Create new account: new SID, lost group membership

(Microsoft, 2011 p. 5-38)

Front 93

What are the options for resetting the secure channel?

Back 93

1. Active Directory Users and Computers

2. DSMod*

3. NETDom

4. NLTest

5. Windows PowerShell
(Microsoft, 2011 p. 5-38)

Front 94

Resetting the secure channel for Active Directory Users and Computers

Back 94

- Right-click the computer, and then click Reset Account

- Requires the computer to rejoin the domain and restart

(Microsoft, 2011 p. 5-38)

Front 95

Resetting the secure channel for DSMod*

Back 95

dsmod computer "ComputerDN" -reset

(Microsoft, 2011 p. 5-38)

Front 96

Resetting the secure channel for NetDom

Back 96

netdom reset MachineName /domain DomainName /User0 UserName /Password0 {Password | *}

(Microsoft, 2011 p. 5-38)

Front 97

Resetting the secure channel for NLTest

Back 97

nltest /server:ServerName /sc_reset:DOMAIN\Domain Controller

Front 98

Resetting the secure channel in windows PowerShell

Back 98

Test-ComputerSecureChannel -Repair

(Microsoft, 2011 p. 5-38)

Front 99

What must you do when the secure channel fails?

Back 99

You must reset the secure channel

(Microsoft, 2011 p. 5-38)

Front 100

How do you rename a computer in Active Directory?

Back 100

Use system Properties of the computer to rename the computer and its account correctly

(Microsoft, 2011 p. 5-40)

Front 101

How do you rename a computer in NetDom

Back 101

netdom renamecomputer MachineName /Newname:NewName [/User0:LocalUsername] [/Password0:{LocalPassword|*} ] [/UserD:DomainUsername} {/PasswordD:{DomainPassword|*} ] [/SecurePasswordPrompt] [/REBoot[:TomeInSecoonds] ]

(Microsoft, 2011 p. 5-40)

Front 102

How do you rename a computer in Windows PowerShell

Back 102

ReName-Computer

(Microsoft, 2011 p. 5-40)

Front 103

Why would you disable a computer?

Back 103

- user will be offline for an extended time

- Prevents secure channel from being established, so users who do not have cached credentials on the computer cannot log on

(Microsoft, 2011 p. 5-42)

Front 104

How do you enable and disable a computer in Active Directory?

Back 104

Right Click Computer
-> Click Enable or Disable

(Microsoft, 2011 p. 5-42)

Front 105

How do you enable or disable a computer is DSMod?

Back 105

dsmod computer ComputerDN -disabled yes

dsmod computer ComputerDN -disabled no

(Microsoft, 2011 p. 5-42)

Front 106

How do you delete and Recycle computer user accounts in Active Directory?

Back 106

Right click the computer
-> click delete

(Microsoft, 2011 p. 5-43)

Front 107

How do you delete a computer with DSR?

Back 107

dsrm ObjectDN

(Microsoft, 2011 p. 5-43)

Front 108

When replacing or reinstalling a computer , if computer will play the same role, what should you do?

Back 108

Reset the computer account, instead of deleting it

(Microsoft, 2011 p. 5-43)

Front 109

Why do you reset a computer account instead of deleting it?

Back 109

It preserves all attributes of a computer, including SID and group memberships.

(Microsoft, 2011 p. 5-43)

Front 110

How do you delete an object from the command prompt

Back 110

dsrm Object DN

(Microsoft, 2011 p. 5-43)

Front 111

dsrm Object DN

Back 111

Where objectDN is the distinguished name of the comuter, such as "CN=Desktop154 OU=NYC,OU=Client Computers,DC=contoso.DC=com."Again, you will be prompted to confirm the deletion.

(Microsoft, 2011 p. 5-43)

Front 112

What is resetting a computer?

Back 112

Resetting a computer account resets its passwords,m but maintains all of the computer onject's properties. With a reset password, the account becomes, in effect, availiable for use. ANy computer can then join the domain using that account, including the upgraded system. In effect, available for use. Any computer can then join the account, assigning it to a new piece of hardware. you can even rename the account. The SID and group memberships remain the same.

(Microsoft, 2011 p. 5-44)

Front 113

What is an Offline Domain?

Back 113

An Offline Domain Join allows a client to fully achieve a domain-joined state without ever having communicated with a domain controller.

(Microsoft, 2011 p. 5-50)

Front 114

When is a trust relationship established between a computer and a domain?

Back 114

as soon as the network connection with a domain controller is established.


(Microsoft, 2011 p. 5-50)

Front 115

What are the requirements of an offline domain?

Back 115

- No function or domain functional level requirements

- No Windows Server 2008 R2 domain Controllers required

- The computer being joined must be Windows 7 client or a Windows Server 2008 R2 member


(Microsoft, 2011 p. 5-50)

Front 116

When would you benefit from the Offline Domain Join feature

Back 116

when deploying virtual machines. offline Domain Join makes it possible for you to join the virtual machine to the domain when they initially start following the operating system installation. No additional restart is required to complete the domain join. This can significantly reduce the overall time required for wide-scaled computer virtual machine deployments.


(Microsoft, 2011 p. 5-50)

Front 117

What is the process for Performing an Offline Domain Join

Back 117

(Microsoft, 2011 p. 5-5)

Front 118

Prerequisites for performing Offline Join

Back 118

- Run Windows 7 or Windows Server 2008 R2

this must occur on both the computer joining domain and computer running Djoin.exe

(Microsoft, 2011 p. 5-51)

Front 119

base-64-encoded metadata blob that is created by the provisioning command contains very sensitive data and should be treated just as securely as ______________

Back 119

plain text

(Microsoft, 2011 p. 5-52)

Front 120

Unattend.xml file

Back 120

you can perform an unattended domain join during operation installation by providing information that is relevant to the domain join by using deployment tools such as Windows System Image Manager

(Microsoft, 2011 p. 5-52)

Front 121

Best Practices Related to Computer Account Management

Back 121

1. Always provision a computer account before joining computers to a domain and place them in appropriate OU.

2. Redirect the default Computer Container to another location.

3. Reset the computer account, instead of just doing a disjoin and rejoin.

4. Integrate the Offline Domain Join Functionality with unattended Installations
(Microsoft, 2011 p. 5-57)

Front 122

Windows PowerShell with Active Directory Module

Back 122

New Administrative utility for Active Directory based on Windows PowerShell

Front 123

Offline Domain Join

Back 123

New Feature in Windows Server 2008 R2 and Windows 7 that allows you to join machines to domain even when they don't have network connection to domain controller.

(Microsoft, 2011 p. 5-57)