Table of Contents

Introduction     xx
PART I:  INSTALLING AND CONFIGURING ACTIVE DIRECTORY DOMAIN SERVICES
Chapter 1  Introducing Active Directory 2016     3
“Do I Know This Already?” Quiz     3
Foundation Topics     7
Identity and Active Directory 2016     7
Active Directory Domain Services (AD DS)     9
    Object     9
    Containers and Organizational Units     10
    Domains     11
    Domain Trees and Forests     11
Group Policy Objects (GPOs)     12
Active Directory Federation Services (AD FS)     13
    Identity Federation     13
    Claims-Based Authentication     14
    Single Sign-On (SSO)     14
Active Directory Certificate Services (AD CS)     14
Active Directory Rights Management Services (AD RMS)     15
    AD RMS Clients     15
    AD RMS Server     16
Exam Preparation Tasks     16
    Review All Key Topics     16
    Complete Tables and Lists from Memory     17
    Define Key Terms     17
    End-of-Chapter Review Questions     18
Chapter 2  Installing and Configuring Domain Controllers     21
“Do I Know This Already?” Quiz     21
Foundation Topics     26
Installing a New Forest     26
    Planning the Domain     26
    Installing AD DS from Server Manager     27
    Promoting the Server to Domain Controller     30
Adding or Removing a Domain Controller from a Domain     33
    Multimaster Replication and FSMO Roles     33
    Forest and Domain Functional Levels     35
    Adding a New Domain Controller to an Existing Domain     35
    Demoting a Server from Domain Controller     38
Upgrading a Domain Controller     39
Installing AD DS on a Server Core Installation     41
    Installing AD DS with PowerShell     41
    Promoting a Server to Domain Controller with PowerShell     42
Installing a Domain Controller with Install from Media (IFM)     44
    Creating the Media for Installation     44
    Deploying a Domain Controller Using IFM     46
Installing and Configuring a Read-Only Domain Controller (RODC)     47
Configuring Domain Controller Cloning     50
    Requirements to Clone a Virtual Domain Controller     51
    Creating DCCloneConfig.xml     51
    Exporting and Importing the Cloned DC     54
Resolving DNS SRV Record Registration Issues     54
Configuring a Global Catalog Server     55
Transferring and Seizing Operations Master Roles     55
Exam Preparation Tasks     58
    Review All Key Topics     58
    Complete Tables and Lists from Memory     59
    Define Key Terms     59
    End-of-Chapter Review Questions     59
Chapter 3  Creating and Managing Active Directory Users and Computers     63
“Do I Know This Already?” Quiz     63
Foundation Topics     67
Creating, Copying, Configuring, and Deleting Users and Computers     67
    Creating and Configuring a New User     67
    Creating and Configuring a New Computer     71
    Copying Users     73
    Configuring Templates     75
    Deleting Objects     76
Automating the Creation of Active Directory Accounts     77
    Working with Users     78
    Working with Computers     82
Performing Bulk Active Directory Operations     83
    Comma Separated Value Data Exchange (csvde)     84
    LDAP Data Interchange Format Data Exchange (ldifde)     86
Configuring User Rights     87
Implementing Offline Domain Join     90
Managing Inactive and Disabled Accounts     92
    Automating Unlocking of Disabled Accounts Using Windows PowerShell     93
    Automating Password Resets Using Windows PowerShell     94
Exam Preparation Tasks     94
    Review All Key Topics     95
    Complete Tables and Lists from Memory     95
    Define Key Terms     96
    End-of-Chapter Review Questions     96
Chapter 4  Creating and Managing Active Directory Groups and Organizational Units     99
“Do I Know This Already?” Quiz     99
Foundation Topics     103
Creating, Copying, Configuring, and Deleting Groups and OUs     103
    Active Directory Groups and Active Directory OUs     103
        Organizational Units     103
        Groups     105
        Group Types     105
        Group Scope     106
    Working with Active Directory Groups     107
    Working with Active Directory OUs     109
    Automate Groups and OUs with PowerShell     111
    Converting Group Scope and Type     114
Configuring Group Nesting     115
    IGDLA     115
    Enumerating Group Membership     117
Delegating the Creation and Management of Groups and OUs     118
Managing Group Membership Using Group Policy     122
Managing Default Active Directory Containers     124
Exam Preparation Tasks     125
    Review All Key Topics     125
    Complete Tables and Lists from Memory     126
    Define Key Terms     126
    End-of-Chapter Review Questions     126
PART II:  MANAGING AND MAINTAINING ACTIVE DIRECTORY DOMAIN SERVICES
Chapter 5  Configuring Service Authentication and Account Policies     131
“Do I Know This Already?” Quiz     131
Foundation Topics     135
Creating and Configuring Service Accounts     135
    Service Accounts     136
    Managed Service Accounts     139
    Group Managed Service Accounts (gMSAs)     142
    Virtual Service Accounts     143
Configuring Kerberos Constrained Delegation (KCD)     144
    Constrained Delegation     145
    Managing Service Principal Names (SPNs)     147
Configuring Default Domain Account Policies     149
    Configuring Domain and Local User Password Policy Settings     150
    Configuring Account Lockout Policy Settings     151
    Configuring Kerberos Policy Settings Within Group Policy     153
Configuring and Applying Password Settings Objects (PSOs)     155
    PSO Precedence     155
    Creating PSOs     156
    Delegating Password Settings Management     158
Exam Preparation Tasks     159
    Review All Key Topics     160
    Complete Tables and Lists from Memory     160
    Define Key Terms     161
    End-of-Chapter Review Questions     161
Chapter 6  Maintaining Active Directory     165
“Do I Know This Already?” Quiz     165
Foundation Topics     169
Configuring Active Directory Snapshots     169
    NTDSUTIL Snapshot Menu     169
    Creating and Mounting a Snapshot     169
    Hosting a Snapshot     171
Backing Up and Restoring Active Directory and SYSVOL     173
    Backing Up Active Directory     173
    Restoring Active Directory     174
    Nonauthoritative Restore     175
    Authoritative Restore     178
Configuring and Restoring Objects by Using the Active Directory Recycle Bin     179
Managing Active Directory Offline     181
    Performing Offline Defragmentation of an Active Directory Database     182
Cleaning Up Metadata     184
Configuring Replication to Read-Only Domain Controllers (RODCs)     185
    Configuring Password Replication Policy (PRP) for RODC     186
Monitoring and Managing Replication     189
    Upgrading SYSVOL Replication to Distributed File System Replication (DFSR)     192
Exam Preparation Tasks     193
    Review All Key Topics     194
    Complete Tables and Lists from Memory     194
    Define Key Terms     195
    End-of-Chapter Review Questions     195
Chapter 7  Configuring Active Directory in a Complex Enterprise Environment     199
“Do I Know This Already?” Quiz     199
Foundation Topics     202
Deploying Windows Server 2016 Domain Controllers Within a Pre-Existing Active Directory Environment     202
    Upgrading Existing Domains and Forests     202
    Configuring Domain and Forest Functional Levels     203
    Configuring Multiple User Principal Name (UPN) Suffixes     205
Configuring Trusts     206
    Configuring Forest, External, Realm, and Shortcut Trusts     207
    Configuring SID Filtering     211
    Configuring Name Suffix Routing     212
Configuring Sites     213
    Configuring Sites and Subnets     214
        Sites     214
        Subnets     216
    Creating and Configuring Site Links     217
    Managing Sites with PowerShell     219
Exam Preparation Tasks     221
    Review All Key Topics     221
    Complete Tables and Lists from Memory     222
    Define Key Terms     222
    End-of-Chapter Review Questions     222
PART III: CREATING AND MANAGING GROUP POLICY
Chapter 8  Creating and Managing Group Policy Objects (GPOs)     225
“Do I Know This Already?” Quiz     225
Foundation Topics     228
Introduction to Group Policy     228
    Creating Group Policy Objects     229
    Configuring GPO Links     230
Managing Starter GPOs     232
Backing Up, Importing, Copying, and Restoring GPOs     234
    Using the Group Policy Management Editor (GPME)     234
    Using PowerShell to Manage GPOs     237
    Creating and Configuring a Migration Table     240
    Resetting Default GPOs     242
Delegating Group Policy Management     243
Detecting Health Issues Using the Group Policy Infrastructure Status Dashboard     245
    Group Policy Infrastructure     245
    Group Policy Infrastructure Status Dashboard     246
Local Group Policies     248
    Configuring Multiple Local Group Policies     248
    Configuring a Central Store     250
Exam Preparation Tasks     251
    Review All Key Topics     251
    Complete Tables and Lists from Memory     252
    Define Key Terms     252
    End-of-Chapter Review Questions     252
Chapter 9  Configuring Group Policy Processing     255
“Do I Know This Already?” Quiz     255
Foundation Topics     258
Configuring Processing Order, Precedence, and Blocking of Inheritance     258
    Processing Order and Precedence     258
    Blocking of Inheritance     260
Configuring Security Filtering and Windows Management Instrumentation (WMI) Filtering     261
    Security Filtering     261
    WMI Filtering     263
    Loopback Processing     265
Client-Side Processing     266
    Configure and Manage Slow Link Processing and Group Policy Caching     267
    Configure Client-Side Extension (CSE) Behavior     268
    Force a Group Policy Update     269
Exam Preparation Tasks     271
    Review All Key Topics     271
    Complete Tables and Lists from Memory     272
    Define Key Terms     272
    End-of-Chapter Review Questions     272
Chapter 10  Configuring Group Policy Settings     275
“Do I Know This Already?” Quiz     275
Foundation Topics     277
Configuring Software Installation     277
Configuring Folder Redirection     279
Configuring Scripts     281
Configuring Administrative Templates     284
    Importing a Custom Administrative Template File     285
    Configuring Property Filters for Administrative Templates     286
Exam Preparation Tasks     288
    Review All Key Topics     288
    Complete Tables and Lists from Memory     289
    Define Key Terms     289
    End-of-Chapter Review Questions     290
Chapter 11  Configuring Group Policy Preferences     293
“Do I Know This Already?” Quiz     293
Configuring Control Panel Settings     295
    Configuring Printer Preferences     296
    Configuring Power Options     298
    Configuring Internet Explorer Settings     299
    Configuring Item-Level Targeting     301
Configuring Windows Settings     303
    Configuring Custom Registry Settings     304
    Defining Network Drive Mappings     306
    Configuring File and Folder Deployment     308
    Configuring Shortcut Deployment     310
Exam Preparation Tasks     312
    Review All Key Topics     312
    Complete Tables and Lists from Memory     313
    Define Key Terms     313
    End-of-Chapter Review Questions     313
PART IV:  IMPLEMENTING ACTIVE DIRECTORY CERTIFICATION SERVICES
Chapter 12  Installing and Configuring Active Directory Certificate Services     317
“Do I Know This Already?” Quiz     317
Foundation Topics     320
Installing Active Directory Integrated Enterprise Certificate Authority     320
    Installing AD CS on a Server     320
    Configuring AD CS on a Server     322
    Installing Offline Root and Subordinate CAs     328
Configuring Certificate Revocation List Distribution Points     328
    Creating New CRL Distribution Points (CDPs)     329
    Installing and Configuring Online Responders     331
Configuring CA Backup, Recovery, and Administrative Role Separation     336
    Configuring CA Backup and Recovery     336
    Administrative Role Separation     337
Exam Preparation Tasks     339
    Review All Key Topics     339
    Complete Tables and Lists from Memory     340
    Define Key Terms     340
    End-of-Chapter Review Questions     340
Chapter 13  Managing Certificates     343
“Do I Know This Already?” Quiz     343
Foundation Topics     346
Managing Certificate Templates     346
    Enabling Certificate Templates     346
    Creating New Templates     348
Managing Certificate Deployment, Validation, Revocation, and Renewal     349
    Manual Enrollment     350
    CA Web Enrollment     351
    Revoking Certificates     354
Managing Certificate Autoenrollment Using Group Policies     355
Configuring Key Archival and Recovery     358
Exam Preparation Tasks     363
    Review All Key Topics     363
    Complete Tables and Lists from Memory     364
    Define Key Terms     364
    End-of-Chapter Review Questions     364
PART V:  IMPLEMENTING IDENTITY FEDERATION AND ACCESS SOLUTIONS
Chapter 14  Installing and Configuring Active Directory Federation Services     367
“Do I Know This Already?” Quiz     367
Foundation Topics     370
Implementing Claims-Based Authentication     370
    Installing a Standalone AD FS Server     370
    Installing an AD FS Server Farm     376
Configuring Authentication     378
    Configuring Authentication Policies     378
    Configuring Multi-Factor Authentication     380
Implementing and Configuring Device Registration     381
Integrating AD FS with Microsoft Passport     384
Configuring AD FS to Enable Authentication of Users Stored in LDAP Directories     385
Exam Preparation Tasks     388
    Review All Key Topics     388
    Complete Tables and Lists from Memory     389
    Define Key Terms     389
    End-of-Chapter Review Questions     390
Chapter 15  Implementing Web Application Proxy     393
“Do I Know This Already?” Quiz     393
Foundation Topics     395
Installing and Configuring Web Application Proxy     395
    Installing Web Application Proxy     395
    Implementing WAP in Pass-Through Mode     397
Implementing WAP as AD FS Proxy     399
Exam Preparation Tasks     405
    Review All Key Topics     405
    Complete Tables and Lists from Memory     405
    Define Key Terms     405
    End-of-Chapter Review Questions     406
Chapter 16  Installing and Configuring Active Directory Rights Management Services     409
“Do I Know This Already?” Quiz     409
Foundation Topics     412
Installing an Active Directory Rights Management Services Server     412
    Installing AD RMS     412
    Configuring AD RMS     414
    Managing AD RMS Service Connection Point     416
Managing AD RMS Templates and Exclusion Policies     418
    AD RMS Policy Templates     418
    Configuring Exclusion Policies     422
Backing Up and Restoring AD RMS     423
Exam Preparation Tasks     427
    Review All Key Topics     427
    Complete Tables and Lists from Memory     427
    Define Key Terms     428
    End-of-Chapter Review Questions     428
Chapter 17  Final Preparation     431
Tools for Final Preparation     431
    Pearson Cert Practice Test Engine and Questions on the Website     431
        Accessing the Pearson Test Prep Software Online     432
        Accessing the Pearson Test Prep Software Offline     432
    Customizing Your Exams     433
    Updating Your Exams     434
    Premium Edition     435
    Memory Tables     435
    Chapter-Ending Review Tools     435
Suggested Plan for Final Review/Study     436
Summary     436
PART VI:  APPENDICES
Appendix A  Answers to the “Do I Know This Already?” Quizzes and End-of-Chapter Review Questions     439
Glossary of Key Terms     461
Index     473

Elements Available on the Book Website
Appendix B Memory Tables
Appendix C Memory Tables Answer Key
Appendix D Study Planner