FSMO Roles - Flexible Single Master Operation

FSMO-Flexible single master operation

By Default while creating a new domain in the forest,the first domain holds these Five roles

  

SCHEMA MASTER and DOMAIN NAMING MASTER are forest wide roles

These two roles will be available in one DC in the Forest

SCHEMA MASTER

•   Admin cannot add modify or extend Schema
•    Some softwares such as Exchange server and SCCM will expand the Schema to fit more information
•  Changes made in the schema cannot be reversed
•  Schema master role failure can be identified only when we try to update or extend Schema

DOMAIN NAMING MASTER

•          This role supports to add or remove a domain in the forest
•          This role is responsible to ensure that  while creating a new domain ,it verifies if the name is already present in the forest

RID Relative Identifier  MASTER

•          The roles allocates RID pool
•          Every object in the active directiory has SID-Security Identifier
•          SID is a unique number which active directory uses to identify the object
•          When display name is changed for a user, this change will not affect SID ,windows display the name associated to the SID
•          The SID will be lost if the User or object is deleted
•          SID will not change if there are two users inthe same name
•          SID numbers have RID wich are alloted by RID master
•          Domain ask for more RID from RID master before brfore they run out
•          If RID MASTER is down it will not affect you organisation,No new objects will be created in the active directory

PDCEmulator-primary domain control emulator

Time Sync:-

•          This role is responsibe for keeping the time accurate in the domain
•          The other domain controllers will sync their time with the DC which holds PDC emulator

For this reason the clock in the PDC Emulator should be accurate

Password Changing:-

•          When a password is changed in the domain, the password is replicated to the PDC  using urjent replication
•          When incorrect password is given to a domain controller,the domain contacts the PDC,pdc has the final authority to say if the user is allowed or not

DFS Changes:-

•          If you are using distributed file system DFS,PDC allows to keep DFS updated and Consistent
•          When Changes are made to DFS these changes are made in PDC emulator

·                             This can be disabled ,for PDC not reqired for DFS changes

Group policy

•          When you modify Group Policy,the group policy editor  will automatically defaults to the pdc emulator and make the changes there

INFRASTRUCTURE MASTER

•          Its tracks object moves,renames and deletes
•          It also updates multi doamin reference in the active directory  when changes occur, When infrastucture master finds a change in the domain it will refer to global catalog which will be always up-to-date ,since the infrastructure manager  thinks the change has already been made it will not notify other domain controller the change occured.
•          To fix the problem ensure then  all DC’s are Global catlog server or the DC which holds Infrastructure master should not be a GC server

Active Directory And domain Interview Questions - Part 3

1) What is Schema?

1. All domain in forest has something in common and that is SCHEMA

2. SCHEMA  defines the Active Directory Database

3. SCHEMA determines what can be saved in the database and the structure of the database

4. Each domain has each copy of database but the schema determines its Design

5. Schema is shared between all domains in the Forest

6. When changes are made to schema , these changes are relicated to every domain in the forest 

2) What is a tree?

  A domain controller sharing the same name space by its child server  form a tree

  For eg: logon.com is root domain and study.logon.com is child server this form a tree

3) What is a Forest?

Two or more domain connected by trust relation which are having different namespace comes under forest. Each forest has its own schema and own database

For Eg: logon.com and login.com are connected by trust then it comes under forest. A user from logon.com can acess the a resource of login.com

4) Which protocol is used by ADS for time sync. between PC's?

SNTP (Simple network time protocol)

5) What is the ISTG?

Intersite Topology Generator (ISTG), which is responsible for the connections among the sites. By Default the first Server has this role. 

6) How do you view all the GlobalCatlog’s in the forest?

Expand acitve directory user and computer----domain controller----select domain controller–Right click – Properties – ntds setting----there will be check box for global catalog.

7) What is tombstone period ?

After deleting an object in AD the objects will not be deleted permanently. It will be remain 60 days by default .After 60 days object will be deleted permanently from all Dc’s.

8)what are the port numbers for Kerberos, LDAP and Global catalog

Kerberos – 88, LDAP – 389, Global Catalog – 3268 

9) What are the different types of partitions present in AD?
Active directory is divided into three partitions
Configuration Partition—replicates entire forest
Schema Partition—replicates entire forest
Domain Partition—replicate only in domain

10) Can GC Server and Infrastructure place in single server If not explain why ?
No, As Infrastructure master does the same job as the GC. It does not work together.

Which is service in your windows is responsible for replication of Domain controller to another domain controller.

Active Directory and Domain Interview Qestions- Part 2

1) What is difference between Server 2003 vs 2008?
1. Virtualization. (Windows Server 2008 introduces Hyper-V (V for Virtualization) but only on 64bit versions. More and more companies are seeing this as a way of reducing hardware costs by running several 'virtual' servers on one physical machine.)
2. Server Core (provides the minimum installation required to carry out a specific server role, such as for a DHCP, DNS or print server)
3. Better security.
4. Role-based installation.
5. Read Only Domain Controllers (RODC).
6. Enhanced terminal services.
7. PowerShell - Microsoft's command line shell and scripting language has proved popular with some server administrators.
8. IIS 7 .
9. Bitlocker - System drive encryption can be a sensible security measure for servers located in remote branch offices. >br> The main difference between 2003 and 2008 is Virtualization, management. 2008 has more in-build components and updated third party drivers.

2) What are the requirements for installing AD on a new server?
1. An NTFS partition with enough free space.
2. An Administrator's username and password.
3. The correct operating system version.
4. A NIC Properly configured TCP/IP (IP address, subnet mask and - optional - default gateway).
5. A network connection (to a hub or to another computer via a crossover cable) .
6. An operational DNS server (which can be installed on the DC itself) .
7. A Domain name that you want to use .
8. The Windows 2000 or Windows Server 2003 CD media (or at least the i386 folder) .

3) How can you forcibly remove AD from a server

    Demote the server using dcpromo /forceremoval, then remove the metadata from Active directory using ndtsutil. 

4) What is difference between Server 2003 vs 2008?
1. Virtualization. (Windows Server 2008 introduces Hyper-V (V for Virtualization) but only on           64bit versions. More and more companies are seeing this as a way of reducing hardware

    costs by running several 'virtual' servers on one physical machine.) 

2. Server Core (provides the minimum installation required to carry out a specific server role, such     as for a DHCP, DNS or print server)
3. Better security.
4. Role-based installation.
5. Read Only Domain Controllers (RODC).
6. Enhanced terminal services.
7. PowerShell - Microsoft's command line shell and scripting language has proved popular with         some server administrators.
8. IIS 7 .
9. Bitlocker - System drive encryption can be a sensible security measure for servers located in              remote branch offices. >br> The main difference between 2003 and 2008 is  Virtualization,              management. 2008 has more in-build components and updated third party drivers.

5) How do you view replication properties for AD partitions and DCs?

    By using replication monitor .Go to start > run > type replmon

6) What is KCC ?

1. Knowledge Consistency Checker (KCC)

2. When site and sitelinks are  configured kcc will automatically make connection between sites for.

3. If network goes down kcc will reconfigure the connection between the site to ensure active directory replication will happen.

4. kcc runs in the background doesnot need to be configured manually

7) What are the processes involved in the FRS?

    FRS is File replication service which is responsible for replicating Sysvol folder and the DFS

Information

8) Which protocol does FRS uses for directory replication?

    RPC over IP for inter-site and intra-site and uses port no 135.

9) What is the physical and logical structure of AD

 Active directory physical structure is a hierarchal structure which fallows  Forests—Trees—Domains—Child Domains—Grand Child—etc

Active directory is logically divided into 3 partitions

1.Configuration partition 2. Schema Partition 3. Domain partition 

10) What System State backup contains ?
     Contains Startup files,
     Registry
     Com + Registration Database
     Memory Page file
     System files
    AD information
    Cluster Service information
    SYSVOL Folder

Active directory and Domain Interview Questions - Part 1

This summary is not available. Please click here to view the post.