Active Directory:: Server Manager Command Line

Active Directory
ServerManagerCmd.exe: server manager command line
compmgmtlauncher: server manager
compmgmt.msc: computer management
dcpromo /adv
Dcpromo /answer:<path_to_answer_file>
Microsoft recommends that you keep the domain naming master and schema master roles on the same computer
The RID master keeps track of all RIDs assigned within its domain and issues
blocks of 500 RIDs to all other domain controllers in the domain so that administrators
can create accounts.
 When you create a new tree or child domain in an existing forest, the server you are promoting must be
able to contact the domain naming master, or the promotion will fail.
 . If you need to modify the schema, the server you are working from must be able to contact the schema
master. This includes the installation or configuration of server applications such as Exchange Server that
add classes or attributes to the schema.
 . Client computers running pre-Windows 2000 operating systems must be able to contact the PDC emulator
if users on these computers want to perform account modifications such as password changes.
 . The PDC emulator ensures that clocks on all computers in the domain remain synchronized. You can also
configure another domain controller with GTIMESERV to ensure clock synchronization.
 . When creating new users or groups, you must be able to contact the infrastructure master to ensure that
conflicting changes are not occurring elsewhere in the domain. Remember that this server also tracks
changes in group membership that can cross domains, and that these changes cannot occur if the
infrastructure master is unavailable.
 . When creating new user, group, or computer accounts, the server on which you are performing these tasks
must have RIDs available. When this server exhausts its pool of RIDs, it must be able to contact the RID
master, or you won’t be able to create additional new accounts.
Run the Adprep /forestprep command on the schema master.

Run the Adprep /domainprep command on the infrastructure master.
Active Directory and DNS

In Windows Server 2008, DNS stores its zone data in one or more application directory partitions, each of which is
an AD DS partition that contains application-specific data (in this case, DNS) that needs to be replicated throughout
specified portions of the forest.
You can integrate either primary or stub zones with AD DS. You cannot create an Active Directory–integrated
secondary zone.
The SRV resource records for a domain controller are important in enabling clients to
locate the domain controller. The Netlogon service on domain controllers registers this resource record whenever a
domain controller is restarted. You can also reregister a domain controller’s SRV resource records by restarting this
service from the Services branch of Server Manager or by typing net start netlogon. An exam question might ask you how
to troubleshoot the nonregistration of SRV resource records.
Active Directory Sites and Replication
After you have configured your sites and their associated subnets, you can install a new domain controller directly to its desired
site. The Active Directory Installation Wizard offers a Select a Site page that lists all sites you have configured for the domain to
which you are installing a new domain controller.
Active Directory creates site link bridges for all site links you have configured. Each site link bridge is a chain of
site links that enables any two domain controllers to communicate directly with each other, whether or not they are
directly connected with a site link. To begin, all site links for a single transport protocol (IP or SMTP) are included
in one site link bridge for that
protocol. This is known as automatic site link bridging or transitive site links.
The cost of a site link bridge is the sum of the costs of all links contained within the site link bridge. However, you must ensure
that each site link in the bridge has at least one site in common with another site link in the bridge; otherwise, you cannot
compute costs for the site link bridge, and such a bridge serves no real purpose
bridgehead server is the domain controller designated by each site’s Knowledge Consistency Checker (KCC) to take
control of intersite replication. The bridgehead server receives information replicated from other sites and replicates
it to its site’s other domain controllers. It ensures that the greatest portion of replication occurs within sites rather
than between them.
Intersite Topology Generator
The ISTG is a single domain controller in each site that the KCC uses to build its intersite replication topology. It
considers the cost of intersite connections and checks whether any domain controllers have been added to or
removed from each site. Using this information, the KCC then adds or removes connection objects to optimize
replication as needed. If the forest is operating at either the Windows Server 2003 or Windows Server 2008 native
forest functional level, the KCC uses an improved randomized process to determine the bridgehead servers used by
each site for intersite replication.
Domain partition—This contains all domain-specific information, such as user, computer, and group accounts.
This partition is replicated to all domain controllers in its domain but is not replicated to other domains in the forest.
. Configuration partition—This contains forestwide configuration information. This partition is replicated to all
domain controllers in the forest.
. Schema partition—Contains all schema objects and attributes. This partition is replicated from the schema master
to all other domain controllers in the forest.
. Application directory partitions—As introduced in Chapter 2, “Active Directory and DNS,” these partitions
contain application-specific (such as DNS) information that is replicated to specific domain controllers in the forest.
Global catalog—As introduced in Chapter 1, the global catalog contains partial information on all objects in each
domain that is replicated to all global catalog servers in the forest
Active Directory replicates all data in these partitions to the specified domain controllers in the domain so that every
domain controller has an up-to-date copy of this information. By default, any domain controller can replicate data to
any other domain controller; this process is known as multimaster replication. A
read-only domain controller (RODC) can receive updated information from another domain controller (inbound
replication), but it cannot replicate information to other servers. If your domain is spread across more than one site, a
single domain controller in each site known as a bridgehead server replicates
information to bridgehead servers in other sites; other domain controllers in each site replicate information to
domain controllers in their own site only.
Configuring Additional Active Directory Roles
AD LDS
You can use the ldifde command from an administrative command prompt to import data from a legacy application
or file. Open a command prompt and type the following:
Ldifde –I –f <filename> -s <servername>:<port> -a <username> <domain> <password>
To install the AD LDS roleon server core, type the following command:
start /w ocsetup DirectoryServices-ADAM-ServerCore
To install an AD LDS instance, you must have a text-based answer file that you can create in Notepad. Figure 4.12
shows a sample answer file. Type the following command:
%systemroot%\ADAM\adaminstall.exe /answer:<path_to_answer_file>
Active Directory Rights Management Services

(AD RMS)
Read-Only Domain Controllers
Remember that before you install an RODC, you must ensure that the forest functional level is at least Windows Server
2003 and that the PDC emulator is running Windows Server 2008. Also remember that you must run the Adprep
/rodcprep utility on the schema master unless all domain controllers in the domain are running Windows Server 2008. An
exam question might trick you into other alternatives such as having
the forest functional level at Windows Server 2008.
Keep in mind that this is a simple means of extending administrative access to a local user without granting him the
ability to manage other domain controllers in the domain.
Active Directory Objects

and Trusts
Group Types
Windows Server 2008 provides two group types:
. Security groups—You can use these groups for assigning rights and permissions to users. You can also use them
for distribution purposes, such as email lists. These group types have security information, such as unique security
identifiers (SID), assigned to them.
. Distribution groups—You can use these groups for distribution purposes, such as email lists. These groups do not
possess SIDs and cannot be assigned permission to resources.
# These are the attributes for Bob Wilson.
DN: cn=Bob Wilson,OU=engineering,dc=examcram,dc=com
CN: Bob Wilson
DisplayName: Bob Wilson
GivenName: Bob
Sn: Wilson
ObjectClass: user
SAMAccountName: BobW
UserPrincipalName: BobW@examcram.com
TelephoneNumber: 555-678-4321
PhysicalDeliveryOfficeName: 7th Floor, SE Corner
Ldifde –I –f filename.ldf
Dn,cn,objectClass,sAMAccountName,userPrincipalName,teletphoneNumber
“cn=Bob Wilson,OU=engineering,dc=examcram,dc=com”, Bob Wilson,user,
➥BobW,BobW@examcram.com,555-678-9876
“cn=Clara Perkins,OU=sales,dc=examcram,dc=com”, Clara Perkins,user,
➥ClaraP,ClaraP@examcram.com,555-678-4321
“cn=Vista1,OU=engineering,dc=examcram,dc=com”,Vista1,computer,Vista1,,,
Csvde –I –f filename.csv
Dsadd user UserDN –fn FirstName –le LastName –display DisplayName

➥-pwd {password | *} –samid SAMName –tel PhoneNumber –disabled {yes | no}
Dsadd group GroupDN –fn FirstName –secgrp {yes | no} –scope {l |g |u}
➥-samid SAMName –memberof Group … -members member …
. dsmod—Modifies objects
. dsrm—Removes objects
. dsmove—Moves objects to another container within the domain
. dsget—Provides information about objects
. dsquery—Displays objects matching search criteria
A user principal name (UPN) is a logon name formatted in a manner similar to that of an email address, such as
user1@examcram.com.

Active Directory:: Server Manager Command Line

Uploaded by

Copyright:

Available Formats

Active Directory:: Server Manager Command Line

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Active Directory:: Server Manager Command Line

Uploaded by

Copyright:

Available Formats

Active Directory

ServerManagerCmd.exe: server manager command line

compmgmtlauncher: server manager

compmgmt.msc: computer management

Run the Adprep /forestprep command on the schema master.

Active Directory and DNS

Configuring Additional Active Directory Roles

Active Directory Rights Management Services

Active Directory Objects

Dsadd user UserDN –fn FirstName –le LastName –display DisplayName

You might also like