Windows Server 2008 Active Directory Configuration - Chapter 08

Front 1

Account Lockout Policies

Back 1

A subcategory in the Account Policies category that specifies the number of unsuccessful logon attempts that, if made within a contiguous timeframe, might constitute a potential security threat from an intrruder. An Account Lockout Policy can be set to lock the account in question after a specified number ofinvalid attempts. Additionally, the policy specifies how long the account will remain locked.

Front 2

account logon events

Back 2

Setting that logs events related to successful user logons to a domain.

Front 3

account management events

Back 3

Setting that triggers an event that is written based on changes to account properties and group properties. Log entries written due to this policy setting reflect events related to user or group account creation, deletion, renaming, enabling, or disabling.

Front 4

Audit Policy

Back 4

Th section of GPO Local Policies that enables administrators to log successful and failed security events, such as logon events, account access, and object access.

Front 5

auditing

Back 5

Tracking events that take place on the local computer.

Front 6

disk quotas

Back 6

A setting that limits the amount of space available on the server for user data.

Front 7

Enforce Password History

Back 7

Group Policy setting that indicates the number of passwords that Active Directory should retain in memory before allowing someone to reuse a previously used password.

Front 8

gpupdate.exe

Back 8

A command-line tool used to force a manual Group Policy refresh. Thistool was introduced in Windows Server 2003, and it is used in Windows Server 2003, and it is used in Windows Server 2003 and Windows Server 2008 to replace the secedit/refreshpolicy command that was used in Windows 2000.

Front 9

Kerberos Policies

Back 9

For domain accounts only, this policy enables administrators to configure settings that govern how Active Directory authentication functions.

Front 10

Local Policies

Back 10

Policies that enable administrators to set user privileges on the local computer that govern what users can do on the computer and determine if these actions are tracked within an event log.

Front 11

logon events

Back 11

The setting logs events related to successful user logons on a computer.

Front 12

logon events

Back 12

The setting logs events related to successful user logons on a computer.

Front 13

msDS-PasswordSettings

Back 13

A new object type in Windows Server 2008 that enables the use of Fine-Grained Password Policies. Also know as a Password Setting Object (PSO).

Front 14

Offline Files

Back 14

A separate Group Policy category that can allow files to be available to users, even when users are disconnected from the network.

Front 15

msDS-PasswordSettings

Back 15

A new object type in Windows Server 2008 that enables the use of Fine-Grained Password Policies. Also know as a Password Setting Object (PSO).

Front 16

Password Policies

Back 16

A subcategovy in the Account Policies category that enforces password length, password history and so on. Password Policies can be applied to domain and local user accoutns.

Front 17

Offline Files

Back 17

A separate Group Policy category that can allow files to be available to users, even when users are disconnected from the network.

Front 18

policy change events

Back 18

By default, this policy is set to audit successes in the Default Domain Controllers GPO. Policy change audit log entries are triggered by events such as user rights assignment changes, establishement or removal of trust relationships, IPSec policy agent changes, and grants or removals of system access privileges.

Front 19

Password Policies

Back 19

A subcategory in the Account Policies category that enforces password length, password history, and so on. Password Policies can be applied to domain and local user accounts.

Front 20

policy change events

Back 20

By default, this policy is set to audit successes in the Default Domain Controllers GPO. Policy change audit log entries are triggered by events such as user rights assignment changes, establishment or removal of trust relationsips, IPSec policy agent changes, and grants or removals of system access privileges.

Front 21

refresh interval

Back 21

The available period that each background refresh process that can set to ranges from 0 to 64,800 minutes (45 days).

Front 22

Restricted Groups

Back 22

Policy settings that enables an administrator to specify group membership lists.

Front 23

Security Options

Back 23

A subcategory of the Local Policies setting area of a Group Policy Object that includes security settings related to interactive log on, digital signing of data, restrictions for access to floppy and CD-ROM drives, unsigned driver installation behavior, and logon dialog box behavior.

Front 24

system events

Back 24

Events that rigger a log entry in this category include system startups and shutdowns; system time changes; system event resources exhaustion, such as when an event log is filled an can no longer append entries; security log cleaning; or any event that affects system security or the security log. In the Default Domain Controllers GPO, this setting is set tolog success by default.

Front 25

System Services

Back 25

The category that is used to configure the startup and security settings for services running on a computer.

Front 26

tattooing

Back 26

An Administrative Template setting that continues to apply until it is revised using a policy that overwrites the setting.

Front 27

User Rights Assignment

Back 27

A subcategory of the Local Policies setting area of a Group Policy Object that includes settings for items that pertain to rights needed by users to perform system-related tasks.

Front 28

FGPP

Back 28

Fine-Grained Password Policies

Hint 28

A policy that can be applied to one or more users or groups of users, allowing the administrator to specify a more or less stringent password policy for the subset than the password policy defined for the entire domain.

Front 29

KDC

Back 29

Key Distribution Center

Hint 29

Used to issue Kerberos tickets to users for domain accesss.

Front 30

PSO

Back 30

Password Settings Object

Hint 30

A new object type in Windows Server 2008 that enables the use of Fine-Grained Password Policies. Also know as msDS-PasswordSettings.