Mcts 70-640 Windows Server 2008 Active Directory, Configuring - Vocabulary Terms

Front 1

Account Lockout

Back 1

A series of policy settings that locks a user out of an account after a predetermined member of incorrect attempts at entering a password has occurred. This increases security by foiling random dictionary-based or brute-force password hack attempts.

Front 2

Account partner

Back 2

In AD FS an organization that has been granted access to a resource partner's web based application. Users in the account partner can access the application without the need for a separate user account in the resource partner's domain.

Front 3

Account Policies

Back 3

A series of settings in Group Policy that determine the characteristics of an acceptable password as well as account lockout settings and Kerberos settings

Front 4

Active Directory Administrative Center

Back 4

A new Active Directory snap-in in Windows Server 2008 R2 that enables the administration of most Active Directory functions from a single console.

Front 5

ADAM

Back 5

Active Directory Application Mode

A standalone mode of Active Directory-enabled application in their own directory, with its own schema, independently of the main corporate Active Directory Database.

Front 6

AD FS

Back 6

Active Directory Federation Services

A set of technologies in Windows Server 2008 that enables partner companies to access Active Directory resources across the Internet in a trusted manner, without having to have user accounts in the resource domain.

Front 7

AD LDS

Back 7

Active Directory Lightweight Directory Services

An update to ADAM that provides directory services for directory-enables applications on Windows networks without the need for deploying additional domain or domain controllers

Front 8

ADMT

Back 8

Active Directory Migration Tool

A utility that enables you to move objects such as users, groups, and computers between Active Directory Domains in the same or different Forests.

Front 9

Active Directory Recycle Bin

Back 9

A new feature of AD DS in Windows Server 2008 R2 that enables you to recover deleted objects without the need to perform a restore operation.

Front 10

AD RMS

Back 10

Active Directory Rights Management Services

A directory service that uses a certification base to confirm the identity of users of information on the network, thereby enabling you to create and work with rights protected information, and ensure that only authorized users have access to these items.

Front 11

ADSI

Back 11

Active Directory Service Interfaces

A directory Service model implemented as a set of COM interfaces. ADSI allows Windows applications to access Active Directory, often through ActiveX interfaces such as VBScript.

Front 12

Active Directory - Integrated Zone

Back 12

A DNS zone that is hosted on a domain controller and stored in one or more AD DS application directory partitions

Front 13

AD LDS Instances

Back 13

A single running copy of the AD LDS directory service which includes a separate directory data store, a unique service name, and a unique service description

Front 14

Administrative Templates

Back 14

The section of Group Policy from which administrators can configure settings that are applied to uses' desktops, specify programs that users can run, and so on. Then apply changes to a client computer Registry settings.

Front 15

ADMX Central Store

Back 15

The new storage location in Windows Server 2008 that considerably reduces the quantity of storage space required for GPO maintenance, especially in large domain with many OUs and many linked GPOs

Front 16

adprep

Back 16

A utility that prepares a Windows 2000 or Windows Server 2003 forest or domain for receiving domain controllers running windows server 2008. It has several parameters, the most important of which are forestprep, which prepares the forest and domanprep, which prepairs the domain.

Front 17

ADSI Edit

Back 17

A utility that enables you to view and edit information about any AD DS or AD LDS object, including schema and configuration data.

Front 18

AGDLP

Back 18

An acronym that strands for Microsoft's recommendation of placing Accounts into Global Groups, then placing these groups into Universal Groups, then placing these groups into Domain Local Groups, and finally granting Permissions to the domain local groups.

Front 19

AGUDLP

Back 19

An acronym that stands for Microsoft's recommendation of placing Accounts into Global Groups, then placing these groups into Domain Local groups and finally granting Permissions t the domain local groups.

Front 20

application directory partition

Back 20

A partitioned section of active directory that is replicated only to specified domain controllers. Application data partitions are used by applications (in particular, DNS) to store their application- specific data.

Front 21

assigned applications

Back 21

through the software Installation Utility in Group Policy, Administrators can assign applications to users and computers. Assigned applications are always available to the user, even if the user attempts to uninstall them. Applications assigned to a computer will automatically be installed in the next restart.

Front 22

attribute

Back 22

The basic unit of a object, an attribute is a single property contained in the schema that through its values define the object. For example, an attribute of a standard user can account is the account name

Front 23

Auditpol.exe

Back 23

A command-line tool that enables you to configure audit policy settings and directory service auditing subcategories

Front 24

Authentication Scope

Back 24

The range within the AD DS will authenticate a user from another domain. When defining a trust relationship, you can use this option to restrict the level of access external users will have when accessing resources in a trusted domain.

Front 25

Authoritative Restore

Back 25

A type of AD DS restore operation in which restored objects will replace updated objects in the directory. This process increases the restored object's update sequence number (USN) by 100,000, making it higher than the current object's USN.

Front 26

AIA

Back 26

Authority Information Access

A certificate extension that points to a URLs at which you can retrieve issuing CAs certificate.

Front 27

autoenrollment

Back 27

The ability to automatically enroll users and commuters for certificates, and renew expired certificates without intervention.

Front 28

BitLocker

Back 28

A feature of Windows Server 2008 and Windows 7 that enables you to encrypt the entire contents of any hard drive partition on your computer. It is useful for protecting sensitive data on computers such as laptops or branch office domain controllers that are susceptible to theft.

Front 29

Block Inheritance

Back 29

A Group Policy setting that prevents a child container from applying GPS setting linked to higher containers. For example, you can use Block Inheritance at the organizational unit (OU) level so that only OU-level policies are applied.

Front 30

Bridgehead server

Back 30

The contact point for the exchange of directory information between Active Directory sites

Front 31

Built-In account

Back 31

A user account that is created by default when windows is installed on a computer . An example is the local Administrator account.

Front 32

Certificate

Back 32

A method of granting access to a user based o unique identification. Certificate represents a distinctive way to establish a user's identity and credentials. They originate from a certification authority (CA).

Front 33

Certification Authority (CA)

Back 33

A Trusted Authority either within a network or a third-party company that manages security credentials, retrieve existing certificates, and renew expired certificates. Each CA that is installed on a server has web pages that uses can access to submit basic and advanced certificates

Front 34

Certificate Enrollment

Back 34

The process by which users and computers can be given permissions to make requests for certificates, retrieve existing certificates, and renew expired certificates. Each CA that is installed on a server has web pages that users can access to submit basic and advanced certificate requests

Front 35

CRL

Back 35

Certificate Revocation List

A document published by a CA that list certificates that have been usued but are no longer valid. By default the CA publishes the CRL on a weekly basis.

Front 36

Certificate Stores

Back 36

Places where certificates are stored, which are located in a protected area of the registry. A series of certificate stores can exist for each user, computer, and service

Front 37

Certificate Template

Back 37

Provided by AD CS to simplify the process of requesting and issuing certificates for various purposes. Each template contains the rules and settings that must be in place to create a certificate if a certain type. Certificate templates are available only on enterprise root and subordinate CAs

Front 38

Claim

Back 38

In AD FS, a statement made by a server about a client, such as its name, identity key group, privilege or capability. You can enable specific claim types that are accepted by the account partner, and claims fail to match these types will be rejected. Claim types can include identity claims, group claims, or custom claims, and identity claims can include UPN claims, email claims, and common name claims.

Front 39

Claim Mapping

Back 39

In AD FS, the act of processing incoming claims to the resource application hosted by the resource federation service

Front 40

class

Back 40

A series of attributes associated with each schema object. The attributes associated with each class are defined by a classSchema Object in the schema

Front 41

Conditional Forwarding

Back 41

The relaying of DNS request for a zone information for specific domains from one server to another one, when the first server is unable to process the request.

Front 42

Connection Object

Back 42

An Active Directory object stored on domain controllers that is used to represent inbound replication links. Domain Controllers create their own connection objects for intrasite replication links. Domain controllers create their own connection objects for intrasite replication through the Knowledge Consistency Checker (KCC), whereas only a single domain controller in a site creates connection objects for intersite replication through the Intersite Topology Generator

Front 43

Container

Back 43

An object in Active Directory that is capable of holding other objects. An example of a container would be the Users folder in Active Directory Users and Computers.

Front 44

Credetial Caching

Back 44

The storing of limited set of passwords on an RODC. You can configure credential caching to store only those passwords of users authorized to log on at a given RODC.

Front 45

CDP

Back 45

CRL Distribution Point

A certificate extension that indicates URL Locations where a CRL can be retrieved Multiple HTTP, FTP, FILE or LDAP locations

Front 46

CSVDE

Back 46

A utility that imports comma-separated tect files into the AD DS database. You can use this utility to automate the bulk creation of user of group accounts.

Front 47

Data Collector Set

Back 47

Binary Files that save performance statistics for later viewing and analysis in the Performance Monitor snap-in; you can also export them to spreadsheet or database programs for later analysis

Front 48

dcdiag

Back 48

Also called the Domain Controller Diagnostic tool, this tool analyzes the condition of domain controllers. The output of this tool informs you of any problems, thereby assisting you in troubleshooting domain controllers.

Front 49

dcpromo

Back 49

The command-line utility ised to promote a Windows Server 2008 system to a domain controller. dcpromo could also be used to demote a domain controller to a member server

Front 50

delta CRL

Back 50

A CRL that includes the list of certificates revoked since the issuance of the most recent complete (base) CRL. It use optimizes bandwidth usage in situations where certificates are frequently revoked.

Front 51

DSRM

Back 51

Directory Services Restore Mode

A special version of Safe Mode in which a domain controller is restarted as a standalone server. The directory database is rendered offline so that you can perform operations such as restoring the AD DS database

Front 52

DFS

Back 52

Distributed File System
A Windows Server 2008 service that allows resources from multiple server location to be presented through Active Directory as a continuous set of files and folders, resulting in greater ease of use of network resources for users.

Front 53

DNS Notify

Back 53

A process in which the master DNS server for a zone notifies secondary servers of changes so the the secondary servers can check to determine whether they need to initiate a zone transfer

Front 54

dnscmd

Back 54

A command-line tool that can perform most of the DNS server administrative tasks in Windows Server 2008

Front 55

DNSSEC

Back 55

Domain Name System Security Extensions

A suit of DNS extensions that add security to the DNS protocol by providing origin authority, data integrity, and authenticated denial of existence. It enables DNS servers to use digital signatures to validate response from other servers and resolvers.

Front 56

DC

Back 56

Domain Controller

A server that is capable of performing authentication. In Windows Server 2008, a domain controller holds a copy of the Active Directory database.

Front 57

Domain Function Level

Back 57

Windows Server 2008 R2 Domain can operate at one of four functional levels: Windows 2000 native, Windows Server 2003 native, Windows Server 2008, or the Windows Server 2008 R2 functional level. Each functional level has different tradeoffs between features and limitations

Front 58

Domain Local Group

Back 58

A domain Local Group can contain other domain local groups from its own domain as well as global groups from any domain in the forest. A domain local group can be used to assign permissions for resources located in the same domain as the group.

Front 59

DNS

Back 59

Domain Name System

A hierarchical name-resolution system that resolves host names into IP address, and vice versa. DNS also makes it possible for the distributed Active Directory Database to function by allowing clients to query the location of services in the forest and domain.

Front 60

Domain Naming Master

Back 60

One of the two forestwide flexible single master operations (FSMO) roles, the domain naming mast's job to ensure domain name uniqueness within a forest.

Front 61

Domain User Account

Back 61

A user account that is stored in the ADDS database. It permits a user to log on to any computer in the domain in which it is located or a trusted domain

Front 62

Dsadd

Back 62

A command line tool that enables you to add objects such as users, groups, contracts, or computers to the ADDS database

Front 63

DDNS

Back 63

Dynamic DNS

An extension of DNS that allows Windows 2000 and later computers to automatically register their A records with DNS at the time they obtain an IP address from a DHCP Server.

Front 64

DHCP

Back 64

Dynamic Host Configuration Protocol

A service that enables an administrator to specify a range of valid IP addresses to be used on a network, as well as exclusion IP addresses that should not be assigned (for example, if they already statically assigned elsewhere). These addresses are automatically given out to computers configured to use DHCP as they boot up on the network, this saving the administrator from having to configure static IP address on each individual network device

Front 65

Enforced

Back 65

A group Policy setting available to GPMC that enforces the application of a GPO to all lower-level policy is applied to all OU in the domain regardless o settings in OU-based GPOs

Front 66

Enrollment Agent

Back 66

A user who has been issued a special certificate that grants the owner of the certificate authority to enroll users into advanced security and issue certificates on behalf of the users.

Front 67

Enterprise CA

Back 67

A CA is integrated with AD DS. En replication and require that users be authenticted

Front 68

Event Viewer

Back 68

A Microsoft Management Console (MMC) snap-in that enables an administrator to vire an/or archieve event logs on a Windows 2000/XP/2003/Vista/Windows7/Server 2008 computer. You can monitor information about application, security, system, DNS, and Active Directory

Front 69

External Trust

Back 69

In AD FS, a relationship between two organizations that allows for access to web-based applications without establishing an external or forest trust between the organizations' domains