Friday, February 26, 2010

SYSTEM ADMINSTRATIONS

1. Explain hidden shares. Hidden or administrative shares are share names with a dollar sign ($) appended to their names. Administrative shares are usually created automatically for the root of each drive letter. They do not display in the network browse list.
2. How do the permissions work in Windows 2000? What permissions does folder inherit from the parent? When you combine NTFS permissions based on users and their group memberships, the least restrictive permissions take precedence. However, explicit Deny entries always override Allow entries.
3. Why can’t I encrypt a compressed file on Windows 2000? You can either compress it or encrypt it, but not both.
4. If I rename an account, what must I do to make sure the renamed account has the same permissions as the original one? Nothing, it’s all maintained automatically.
5. What’s the most powerful group on a Windows system? Administrators.
6. What are the accessibility features in Windows 2000? StickyKeys, FilterKeys Narrator, Magnifier, and On-Screen Keyboard.
7. Why can’t I get to the Fax Service Management console? You can only see it if a fax had been installed.
8. What do I need to ensure before deploying an application via a Group Policy? Make sure it’s either an MSI file, or contains a ZAP file for Group Policy.
9. How do you configure mandatory profiles? Rename ntuser.dat to ntuser.man
10. I can’t get multiple displays to work in Windows 2000. Multiple displays have to use peripheral connection interface (PCI) or Accelerated Graphics Port (AGP) port devices to work properly with Windows 2000.
11. What’s a maximum number of processors Win2k supports? 2
12. I had some NTFS volumes under my Windows NT installation. What happened to NTFS after Win 2k installation? It got upgraded to NTFS 5.
13. How do you convert a drive from FAT/FAT32 to NTFS from the command line? convert c: /fs:ntfs
14. Explain APIPA. Auto Private IP Addressing (APIPA) takes effect on Windows 2000 Professional computers if no DHCP server can be contacted. APIPA assigns the computer an IP address within the range of 169.254.0.0 through 169.254.255.254 with a subnet mask of 255.255.0.0.
15. How does Internet Connection Sharing work on Windows 2000? Internet Connection Sharing (ICS) uses the DHCP Allocator service to assign dynamic IP addresses to clients on the LAN within the range of 192.168.0.2 through 192.168.0.254. In addition, the DNS Proxy service becomes enabled when you implement ICS.
16. | Describe how the DHCP lease is obtained. It’s a four-step process consisting of (a) IP request, (b) IP offer, © IP selection and (d) acknowledgement.
17. I can’t seem to access the Internet, don’t have any access to the corporate network and on ipconfig my address is 169.254.*.*. What happened? The 169.254.*.* netmask is assigned to Windows machines running 98/2000/XP if the DHCP server is not available. The name for the technology is APIPA (Automatic Private Internet Protocol Addressing).
18. We’ve installed a new Windows-based DHCP server, however, the users do not seem to be getting DHCP leases off of it. The server must be authorized first with the Active Directory.
19. How can you force the client to give up the dhcp lease if you have access to the client PC? ipconfig /release
1)What authentication options do Windows 2000 Servers have for remote clients? PAP, SPAP, CHAP, MS-CHAP and EAP.
2)What are the networking protocol options for the Windows clients if for some reason you do not want to use TCP/IP? NWLink (Novell), NetBEUI, AppleTalk (Apple).
3) What is binding order? The order by which the network protocols are used for client-server communications. The most frequently used protocols should be at the top.
4)How do cryptography-based keys ensure the validity of data transferred across the network? Each IP packet is assigned a checksum, so if the checksums do not match on both receiving and transmitting ends, the data was modified or corrupted.
5)Should we deploy IPSEC-based security or certificate-based security? They are really two different technologies. IPSec secures the TCP/IP communication and protects the integrity of the packets. Certificate-based security ensures the validity of authenticated clients and servers.
6)What is LMHOSTS file? It’s a file stored on a host machine that is used to resolve NetBIOS to specific IP addresses.
7)What’s the difference between forward lookup and reverse lookup in DNS? Forward lookup is name-to-address, the reverse lookup is address-to-name.
8)How can you recover a file encrypted using EFS?
Use the domain recovery agent.
9)Can't enable guest account
A:To enable guest account on w2k/xp, you must logon as administrator.
10))Cannot add a new local user
A:Cause: you are using domain credentials to add a new user on a computer that doesn’t connect to the domain.
11)How Inheritance Affects File and Folder Permissions
A:After you set permissions on a parent folder, new files and subfolders that are created in the folder inherit these permissions. If you do not want the files and folders to inherit permissions, click This folder only in the Apply onto box when you set up special permissions for the parent folder. If you want to prevent only certain files or subfolders from inheriting permissions, right-click the file or subfolder, click Properties, click the Security tab, click Advanced, and then click to clear the Inherit from parent the permission entries that apply to child objects. Include these with entries explicitly defined here check box.
12)If the check boxes are not available, the file or folder has inherited permissions from the parent folder. There are three ways to make changes to inherited permissions:
Make the changes to the parent folder so that the file or folder inherits the permissions.
Click to select the opposite permission (Allow or Deny) to override the inherited permission.
Click to clear the Inherit from parent the permission entries that apply to child objects. Include these with entries explicitly defined here check box. When you do this, you can make changes to the permissions or remove the user or group from the permissions list. However, the file or folder does not inherit permissions from the parent folder.
13)How to access Domain Console without logon the domain
A:Sample issue: I have group policy that is locking down the computer for ALL User, Even the administrator. Now I cant access the domain network from any computers
Solution: Logon as the administrator with the same password of the domain administrator. Then access the AD Users and Computers-Connected to the domain controller. Moved the admin accounts up to the Users OU.
14)How to check the group policy settings and result
A:You can use gpresult.exe which displays the resulting set of policies that were forced on the client for the specified user at logon.1.
15)How to manage inherited permissions
A:By default, Everyone has Full Control for a NTFS folder and the permission is inherited from the root folder on the partition or volume. To block Permissions Inheritance, click to clear the Allow inheritable permissions from parent to propagate to this object check box.
16)How to change the password policy
A:For local computer, go to Local Computer Policy>Computer Configuration>Windows Settings>Security Settings>Account Policies>Password Policy. For domain controller, go to Default Domain Security Setting>Security Settings>Account Policies>Password Policy.
17)How to protect my computer without buying hardware or software firewall?
1. Enable ICF if you have XP or 2003.
2. Enable TCP/IP Security.
3. Enable IPSec Policies.
4. Enable RRAS Packet Filters.
18)Logon script doesn't work
A:Symptoms: the logon script doesn't run when some users logon.
Resolutions: 1. Everyone doesn't have read right to C:\%rootsystem%\system32\repl\script\import.
2. Also check the netlogon under My Computer Manage.
19)One user can't make share, see the shared sign
A:Symptoms: 1. Can't make share folders on your local computer;
2. Can't see shared sign on your local computer;
3. Net share gets "Access denied"
Cause: you don't have permission.
20)The security settings to managing XP Firewall
A:Go to Local Computer Policy\Computer Configurations\Admin Templates\Network\Network Connections\Internet Connection Firewall.
21)Not accessible. You may not have permission to use this network resource?
A:Symptom: Your WinXP, in a peer-to-peer mixed network, may receive the following error when you double-click My Network Places/Computers Near Me: is not accessible. You may not have permission to use this network resource.
Resolution: 1) Enable NetBIOS over TCP/IP on one or more computers in the workgroup. To do that, go to properties of Local Area Connection>properties of Internet Protocol (TCP/IP)>General> Advanced>WINS, check Enable NetBIOS over TCP/IP (If you have a DHCP-assigned IP address, select Use NetBIOS setting from the DHCP server ). 2) Make sure the Computer Browser service is started.
22)The password does not meet the password policy requirement
A:Symptoms: when attempting to create a new account with a password or change the password on 2003 server and the member of computers, you may receive this messages "Windows cannot complete the password change. The password does not meet the password policy requirement. Check the minimum password length, password complexity and password history requirement".
Cause: The default minimum password length is 7 and the password must meet complexity requirement on 2003 domain controller. By default, member of computers follow the password configuration of the their domain controller.
23)The Sharing tab is not visible
A:The sharing tab is not visible if you are logged on to a machine with an account that does not have adequate rights.
24)Understand Allow and Deny permissions
A: 1) Allow permissions are cumulative, so a user's permissions are determined by the cumulative effect of all of the groups to which the user belongs. 2) Deny permissions override Allow permissions. Use caution when you apply Deny permissions.
25)Why can't I have permission button while setup sharing on XP
A:The reason you can't see the permission is because the XP simple file sharing is enabled. To disable simple file sharing, go to windows explorer>tools>folder options>view, uncheck use simple file sharing. Just remember that, after disabling simple file sharing, some users may have
difficulty to access the sharing folders.
26)Why do I get \S-1-51-xxxxx as a user/group name
A:Symptoms: 1. When check the member of a group, it takes long time to open and you may see one or some members are listed as \S-1-51xxxx. 2. When checking the Security of a file or folder, you may see one or more user/groups are listed as \S-1-51-xxxx.
Causes: The workgroup or domain that the users, groups or members are belong to is offline
27)"... not accessible. Logon failure: account current disabled.
Symptom: When browsing a network drive in Windows Explorer, you may receive above error message.

Resolutions: this is cache credentials issue. To fix this problem and cache the credentials, use net use \\computername /user:username command.
28)"... not accessible. Access Denied "
SYMPTOMS: When you attempt to connect to a network share, you may receive the following error message: \\Servername\share is not accessible. Access Denied. If you are accessing a share in another domain, this message may appear even though you have verified that the trust is configured correctly. Also, the share may be visible in Network Neighborhood.
RESOLUTION: This issue may be resolved by verifying that both the share permissions and the NTFS partition permissions are correctly configured for individual user or group access.:

29)"...not available. The server is not configured for transactions"
Use "net share" command on the shared computer to check share status. If there is not a share named "IPC$" in the share list, use "net share ipc$" command to create it.
"A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes made to your profile since you last logged on may not be available"
Resolutions: 1. Check the DNS settings and make sure the client points to correct DNS.
2. Make the computer have correct TCP/IP settings and can ping the domain controller.
30)"Access is denied"
Symptoms: 1. When attempting to create a folder or copy a folder on a network drive, you may receive "Cannot create or replace xxxxx: Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use".
2. When attempting to save a file on a network drive, you may receive "Cannot save or create xxxxx: Access is denied. Make sure the disk you want to save the file on is not full or write-protected or damaged".
Resolutions: go to the properties of the drive>Sharing, add the the user and give Change permission.
2. Make sure everyone has Change permission.
31)"Access Denied" Message When Opening from or Saving to a Network Folder
Symptom: When opening a network folder in Windows Explorer and then try to open a file from or save a file to that folder, the associated program may report a sharing violation, return an "access denied" message, or open the document as read-only. Typically, this problem occurs when you open a network folder and then double-click to open a Microsoft Word or Microsoft Excel file. The document opens as read-only.
Resolution: To fix this problem, go to Windows Explorer, open the network folder that contains the file that you are trying to open or save. On the Tools menu, click Folder Options. Click Use Windows classic folders, and then click OK.
32)"An extended error has occurred" or "Access Denied"
Symptoms: When mapping a network drive using net use or using the net view command to view a different computer in the domain, you may receive: "An extended error has occurred" or "Access Denied" error messages.
Resolutions: 1) This issue may occur if the workstation doesn't synchronize the time with the server. After verifying that basic network connectivity exists, you can force time synchronization on the client computer manually. To do this, run net time /domain /set command.
2) Make sure you have granted enough licenses for clients accessing.
33)" computername is not accessible. No permission to access the resources"
If both win2000/XP and win9x can see the workgroup but only win2000/XP can access a win 2000/XP computer, and win9x gets the above error, check the group name. If they are the same name,
Check these:
1) are you sure the logon user has permission to the shared folder?
2) have you tried to logon using the same user name and password of the accessed win2k/XP computer?
3) the last and risky one, if you enable guest account in the accessed win2000/XP computer, can you access now?
34)Logon unsuccessful: The user name you typed is the same as the user name you logged in with
Cause: it could be the name resolution issue, especially DNS issue.
Logon Message: You do not have access to logon to this session
Symptom: When attempting to logon using the Terminal Services client, you may receive the following error message: "Logon Message: You do not have access to logon to this session".
Resolution: By default, TS connection security setting allows only administrators to log on. To set custom TS connection permissions, go to Terminal Services Configuration>Connections folder. Right-click the connection (RDP-TCP)>Properties>Permissions, add the users or/and groups that needs access to this connection.
35)More Connections Can Be Made At This Time
Symptoms: When attempting access a shared folder on a remote computer, you may receive this message “No more connections can be made at this remote computer at this time because there are already as many connections as the computer can accept” or “This request is not accepted by the network. Try again later”.
Causes: 1) The share that is configured to allows a specific number of connections, and that number of connections has been reached.
2) The 10 user connection limit has been reached if the remote computer is w2k/XP.
3. If you have Per Server licensing, the license limit has been reached
36)"Multiple connections to the server or shared resource are not allowed"
Symptom: when attempting to join a domain, you may receive "Multiple connections to the server or shared resource are not allowed. Please disconnect all previous connections to the server or shared resource and try again."
Resolution: try using net use /d from a command to clear all your mapped connections before joining the domain. You can also disconnect the mapped drive in Windows Explorer by right-click the mapped drive and select disconnection.
37)"Network path not found" in a domain network 1
SYMPTOMS: When trying to join a W2K/XP to a Windows 2000 domain by using he NetBIOS domain name, you are successful but not the FQDN and you may receive one of the following error messages:1) The following error occurred attempting to join domain "example.com": The network location cannot be reached. For information about network troubleshooting, see Windows Help. 2) Network path not found.
RESOLUTION: This issue may occur if the TCP/IP NetBIOS Helper Service is not running on the client computer. To start the TCP/IP NetBIOS Helper Service, go to MMS>Services, double-click TCP/IP NetBIOS Helper Service.
38)"Network path not found" in a domain network 2
Symptom: some w2k/xp can't join the domain randomly. The DNS server is multihomed server..
Resolution: You can find some computer browser errors on the DNS server. Disable one of two NICs will work. More resolutions can be found in browser Issue page.
39)"Network path not found" in a workgroup network - error 53
RESOLUTIONS:
1) Make sure that File and Printer Sharing is enabled on on the shared computer.
2) Make sure that shared machine has something shared.
3) Make sure that you have created the same workgroup and logon the same username if you try to access w2k/xp network.
4) Make sure that you have enabled NetBIOS over TCP/IP if this is a mixed OS network.
40)"Not accessible. You may not have permission to use this network resource"
Symptom: Your WinXP, in a peer-to-peer network, may receive the following error when you double-click My Network Places/Computers Near Me: is not accessible. You may not have permission to use this network resource. Resolution: 1) Enable NetBIOS over TCP/IP on one or more computers in the workgroup. To do that, go to properties of Local Area Connection>properties of Internet Protocol (TCP/IP)>General> Advanced>WINS, check Enable NetBIOS over TCP/IP (If you have a DHCP-assigned IP address, select Use NetBIOS setting from the DHCP server ). 2) Make sure the Computer Browser service is started.
41)"Not enough server storage is available to process this command." error.
SYMPTOMS: When accessing shares on a server from a client, you may receive "Not enough server storage is available to process this command." error. You may receive this message and Event ID: 2011 after you install Norton Antivirus for Windows.
Resolution:
1) The registry value IRPstackSize may be not explicitly present. To increase the value of the parameter, go to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ LanmanServer\Parameters. If the key is not present, choose Add Value in the Registry Editor. The Value Name should be IRPStackSize and the Data Type is REG_DWORD.
2) Remove any unnecessary entries from this value in the registry, HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionPipes.
3) If the machine has a non-zero PagedPoolSize in the Registry, you need to re-set it by going to HKEY_LOCALMACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management and double-click on PagedPoolSize and set to 0.
4) Disable Norton antivirus to see if that will fix the problem.
42)"Not Enough Storage to Complete Operation"
SYMPTOMS: When you try to open the Printers folder, you may receive the following error message "There is not enough storage to complete this operation". This is because the size of the registry has exceeded the maximum size set in the virtual memory settings.
RESOLUTION: Increase the maximum registry size. To do that, go to Start>Control Panel>System>Performance> Change (In Windows 2000, click the Advanced tab, click Performance Options, and then Change). Type a larger value in the Maximum Registry Size box.


43)"No logon server available"
Symptoms: you can ping the server by ip and name but can't map the shared drive by using net use \\ip or \\servername. If you try, you may receive the "No logon server available".
Resolutions: This sounds like cache credential issue. 1) make sure the computers in the same network, the same workgroup/domain and have created the same username. 2) use net to cache the credential. 3) The user profiles may been damaged.


44)"No domain server was available to validate your password"
Symptoms: when trying to logon a domain from win9x, you may receive a message "The following error occurred while loading protocol number 0. Error 38: The computer name you specified is already in use..." and then "No domain server was available to validate your password".
Resolution: 1) make no two host name in the network. 2) check WINS and make sure no one host uses two IPs. If it does, delete all of them and reboot the computer.
45)"No domain server was available..." while the dialup connection is active
Symptom: you have windows 2000 domain controller with DNS, DHCP, WINS and Dialup connection. Whenever the dialup connection is active, none client can't logon and gets a message "No domain server was available to to validate your password. You may not be able to gain access to some network resources"
Resolution: Make sure you don't have "Register this connection's addresses in DNS" checked under TCP/IP Advanced DNS settings. To check this, go to the Properties of the connection> the Properties of the TCP/IP>Advanced>DNS, uncheck "Register this connection's addresses in DNS"
46)Resource: \\computername\IPC$ - An extended error has occurred
Symptoms: When you attempt to connect to w2k/xp computer over the network, you may receive one of the following error messages: "You must supply a password to make this connection: Resource: \\computername\IPC$" -or- "computername An extended error has occurred"
Resolutions: 1. make sure netlogon service is running.
2. Make sure you have created logon ID and password for remote computer logon.
3. Or enable guest account.
47)Remote Procedure call terminated unexpectedly - ...NT authority must shut down your computer in 30 seconds."
Symptoms: 1. Your computer reboots every few minutes without user input.
2. The computer become unresponsive.
3. You may receive "Remote Procedure Call terminated unexpectedly" and ...NT authority must shut down your computer in 30 seconds."
4. There is msblasr.exe running on Task Manager
Cause: "W32.Blaster.Worm" or "MSBlast."
48)RPC Server is Unavailable
Symptoms: When running Replication, Winlogon, Terminal Server, User authentication, enabling trusted relationships, Connecting to domain controllers and trusted domains, you may receive the above error.
Causes: 1. The RPC service may not be started.
2. You are unable to resolve a DNS or NetBIOS name.
3. An RPC channel cannot be established.
49)"Spooler Subsystem Application Needs to Close" - "Operation Could Not Be Completed" Error Messages
Causes: 1. Bad printer driver. 2. New MS update conflicts with the printer driver. 3. ICF conflicts with the printer driver.
50)The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect.
Causes: 1. incorrect password.
2. This behavior may occur if the password for the computer account and the local security authority (LSA) secret are not synchronized.
3. Computer names conflict.
51)This account is the same as the one logged on to the system and that this account was tried before to logon
There is no domain controller available to validate this account.
52)There are currently no logon servers available to service the logon request.
Event ID 5719
Symptoms: 1. In client, you may receive Event ID 5719: "No Windows NT or Windows 2000 Domain Controller is available for domain Domain. The following error occurred: There are currently no logon servers available to service the logon request."
2. In DC, you may receive Event ID 5719: "No Windows NT or Windows 2000 Domain Controller is available for domain chicagotech.net. The following error occurred: There are currently no logon servers available to service the logon request.
3. You logon domain user in a domain network, the mapping logon script displays this message: "There is no domain controller available to validate this account."
4. You use a office laptop to connect the office VPN, when you map a network drive using this command line: net use \\chicagotech\shared /u:chicagotech.net/blin, you may receive this message: "This account is the same as the one logged on to the system and that this account was tried before to logon. There is no domain controller available to validate this account"
Causes: 1.The DC is down.
2. Can't access the DC.
3. The DNS issue.
4. Run out of buffer space in the NetBT datagram buffer.
53)'TCP/IP transport not installed
Causes: 1. TCP/IP is not enabled.
2. Installed too many TCP/IP protocols.
3. Old NIC driver.
4. Winsock issue.

54)"The computer account already exists"
Symptoms: When joining w2k/xp into a domain, you may receive "The computer account already exists". You may be able to ping the computer account, for example ABC, but ping -a ip address (the same ip of ABC) shows different computer name like XYZ.
Resolution: Go to the DNS ad WINS to find and delete the ABC account and wait for while to re-join the domain.
55)The network folder specified is currently mapped using a different user name and password
Symptom: If you use the Map Network Drive Wizard to connect to a network share by using different user credentials and you use the browse functionality to locate the network share, you may receive the following error message: The network folder specified is currently mapped using a different user name and password. To connect using a different user name and password, first disconnect any existing mappings to this network share.
Resolutions: 1. Disconnect the existing mapped drive. 2. Apply latest SP.
56)"The password is incorrect. Try again"
Symptom: While trying to access a win2000/XP computer and type administrator password on Enter Network Password screen in the same peer-to-peer workgroup, you may get Error: The password is incorrect. Try again.
Resolution:
1) You need to setup every user that needs access to the shared folder on every computer they have to connect to. Then give the proper user proper permission to the shared folder.
2) logon the same user and password.
3) as always, you can try to enable a guest account on the accessed machine.
57)"There are no entries on the list"
Symptom: when using net view \\remotecomputer command, you may receive "There are no entries on the list". And you may have a problem to access the remote computer.
Resolution: 1) If there are no file or print shares on the computer, the net view command displays a "There are no entries in the list" message. So, make sure there are file or print shares on the computer. Or to use net share command to check sharing status.
2) Make sure no firewall running because the firewall may block sharing.
3) Make sure client for ms network is enabled.
58)"There is not enough memory available to print your"
If you receive all following message, you may have firewall running on the LAN connection and you should disable it.
59)"computer is not accessible...",
"There was an error writing to \\XP computer for printer..." and "There is not enough memory available to print your document. Quit one or more programs and try again. ..."
Transmit failed, error code 65 or 10050
Symptom: When attempting to verify network connectivity with a remote computer by using the Ping.exe command, you may receive a command-line error message similar to the following: Ping: transmit failed, error code 65 or 10050.
Resolutions: This behavior can occur if the following conditions are true: 1) ICS is enabled; 2) a firewall software is running on the computer; 3) The ZoneLabs program is not correctly configured for ICS. To fix the problem: 1) re-configure ZoneAlarm for ICS. 2) Remove the Zone Labs firewall software from the computer.
60)"Unable to access Computers Near Me" or "Workgroup is not accessible" errors
Symptom: When several Win2000/XP computers are configured as members of a workgroup in a peer-to-peer network environment and you click on Computers Near Me in My Network Places or workgroup name Entire Network, the following error message may appear: "Cannot Access 'Computers Near Me' " or "Workgroup is not accessible" errors.
Resolution: 1) NetBIOS over TCP/IP. To do that, go to the properties of TCP/IP>Advanced>WINS. If you are using a static Internet Protocol (IP) address, click Enable NetBIOS over TCP/IP. If you have a DHCP-assigned IP address, click Use NetBIOS setting from the DHCP server.
2) No Master Browser or too many browsers may cause this issue. Check Browser issue.
61)"Unable to Browse Network"
Symptom: When you attempt to browse your network by opening Entire Network in My Network Places/Network Neighborhood, you may receive the following error message: 62)"Unable to Browse Network."
Check Lists: 1) have you loaded the NIC or is it working?
2) have you loaded common protocol, TCP/IP?
3) does the Computer browser work?
4) have you enable file and printer sharing in the accessed computer?
5) is the workstation service running?
63)"You may not have permission to use this network resource"
Refer to ... is not accessible and "Resource: \\\ipc$"
"You must provide a password to make this connection." and "Resource: \\\ipc$"
Whenever you receive "Enter network password. You must provide a password to make this connection." and "Resource: \\\ipc$", it is permission and workgroup issues.
This behavior can occur for any of the following reasons: 1) The Windows 9x computer is not a client of a domain environment but the Log On To Windows Domain option is enabled. 2) The user name and password you are using to log in to the Windows 9x are not contained in the local user accounts database of the Windows NT/2000/XP computer you are attempting to browse. 3) The Windows 9x host is configured with user-level authentication to a domain.
Resolutions: To resolve this issue, use the appropriate method:
1) Disable the Log On To Windows Domain Option.
2) Log on to the Windows 9x with the local user accounts database of the Windows NT/2000/XP computer you are attempting to browse.
3) Disable User-level Authentication on the Windows 9x.
Windows needs your current credentials to ensure network connectivity
"Windows needs your current credentials to ensure network connectivity. Please lock this computer,
then unlock it using your most recent password or smart card. To lock your computer, press CTRL+ALT+DELETE,
and then press Enter."

Cause: you are logging on mutiple computer using the same logon ID and password while changing th
Network Errors
64)The network request is not supported.
Symptoms: 1. When you type NET ACCOUNTS /SYNC at the command prompt, you may receive either of the following error messages: System error 50 has occurred.
The network request is not supported.
2. After you upgrade your computer to Windows 2000 Service Pack 4 (SP4), you may experience all the following symptoms: Event ID: 20071 - The network request is not supported.
3. When you run a software and the data is located in the remote server.
Resolutions: 1.Make sure the Netlogon service is running correctly on the PDC.
2. If you just upgraded a Windows 2000 SP3 based server to SP4, you may need to reboot it.
3. Make sure you can access the remote resources.
4. Contact the third-party SMB server manufacturer if you have a third-party SMB server, such as DEC Pathworks, Samba or Linux.
65)How to use the net view command to view a list of computer or network resources
The net view command is ever useful network troubleshooting utility. You can use it to displays a list of domains, computers, or shared resources available on a specific computer.
66)To list all shared resources on a domain or workgroup, at the command prompt
type net view.
67)To display the shared resources on a computer,
do net view \\ComputerName where Computer Name is the name of a specific computer whose resources you want to view.
68)When using net view, you may see different messages. The following are some of them and resolutions.
Symptom: net view ip successful but not net view \\computername.
Resolutions: 1) name resolution. 2) cache credential - net use \\computername /user: username. 3) make sure the remote computer is in the same workgroup or domain.
Symptom: If you can net use \\ip but not net use \\computername.
Resolutions: you may just need to cache the credential pointing to the computer name by using net net use \\computername /user: username command.
Symptom: There are no entries in the list.
Resolution: this is because no shared drive or folder. Go to a folder you want to share, right-click>sharing and select sharing.
69)System error 5: access is denied.
Resolutions:1) check permission or 2) need to cache credential: logon the same username and password on both computers or use net net use \\computername /user:username command.
70)System error 51 has occurred.
Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If windows still cannot find the network path, contact your network administrator.
Resolution: enable file and printer sharing.
71)Can't net view computer name - error 52
Symptoms: you can ping a host but not net view it. When using net view \\hostname, you get system error 52 - a duplicate name exists on the network.
Resolutions: there are two host names or alias name (cname) are pointed to the same IP. 1) check the WINS records. 2) check DNS records.

72)Can't ping or net view computer name - error 53
Symptom: if you can ping IP but not computer name, or if you can net view \\IP but not \\computername (error 53). You have name resolution problem.
Resolutions: 1) if it is domain environment, check your WINS. 2) if it is peer-to-peer workgroup, enable NetBIOS over TCP/IP. 3) or add NetBEUI on all your workstations.
Troubleshooting Ping
73)Can't ping another computer because of the ICF
Sometimes, XP's built-in Firewall may enable after running network setup wizard on LAN connections. You can't ping or access the XP computer. To disable the XP firewall on the connection, go to the properties of the Connections, select Advanced, and deselect the firewall.
74)Can't ping outside IP or name
If you can't ping outside IP, make sure you have correct gateway. If you can't ping outside computer name or web name, check the DNS settings.
75)Can't use ping
If you cannot use ping successfully at any point, confirm that:
1)The computer was restarted after TCP/IP was configured.
2) The IP address of the local computer is valid and appears correctly on ipconfig /all.
3) IP routing is enabled and the link between routers is operational.
4) For the security reasons, many organizations block the return of ICMP (ping) packets so that ping or tracert may not be possible to obtain a response.
76)Error code 65, 10043 and 10050, transmit failed
Symptoms: When using ping command, you may receive either of the following: "Transmit failed, error code 65" or "Transmit failed, error code 10050"
Resolutions: make sure your firewall, NAT or router doesn't disable ping and to allow ICMP Echo and Echo Reply packets.
77)Hardware Error
Symptom: when you try to ping an IP, you may receive "hardware error" reply.
Causes: 1. Bad NIC.
2. The cable doesn't plug in.
78)Host is unreachable
Q: When I ping the server using one of the clients it says the host is unreachable. Why?
A: 1) Make sure all machines are on the same local subnet and no routers in between.
2) Check the lmhosts file to make sure that you do not have an outdated file.
79)Ping lists a public IP instead of private IP
Symptom: when you ping a LAN computer like ping chicagotechpc1, you may receive a public ip 64.176.153.103 instead of the computer private IP 192.168.1.100.
Cause: Incorrect DNS settings. For consultants, refer to case 060104RL
80)Receiving a reply from a different IP
Symptoms: when you ping a public IP, you may receive reply from a different IP, for example,
ping 4.2.2.1
Pinging 4.2.2.1 with 32 bytes of data:
Reply from 209.165.105.129: Destination net unreachable.
Causes: If you have incorrect IPSec settings, you may have above mentioned symptom.
81)Cannot view event log after changing administrator password
A:Symptoms: After you changed the administrator password on a 2003 server, you are unable to access some server information like the event logs.
Cause: When using Reset Password on Local Users and Groups, that may cause irreversible loss of information. You should use Ctrl+Alt+Del instead of Reset Password to change administrator password.
82) How do cryptography-based keys ensure the validity of data transferred across the network?
Ans:Each IP packet is assigned a checksum, so if the checksums do not match on both receiving and transmitting ends, the data was modified or corrupted.
83) Should we deploy IPSEC-based security or certificate-based security?
Ans:They are really two different technologies. IPSec secures the TCP/IP communication and protects the integrity of the packets. Certificate-based security ensures the validity of authenticated clients and servers.
84) What is LMHOSTS file?
Ans: It’s a file stored on a host machine that is used to resolve NetBIOS to specific IP addresses.
85) What authentication options do Windows 2000 Servers have for remote clients?
Ans: PAP, SPAP, CHAP, MS-CHAP and EAP.
86)AD communication, including replication, fails on multihomed domain controllers
A:Cause: network adapters on the multihued domain controllers are registering both the inside and outside Internet Protocol (IP) addresses with the DNS server. Replication operations require multiple lookup requests of SRV records. In this case, half of the DNS lookup requests return an IP address that cannot be contacted, and the replication operation fails.
87) Tracert
A:Tracert.exe is a route-tracing utility that you can use to determine the network path to a destination. To determine the path that a packet takes on the network and where that path may be ending.
88)NBTSTAT
A:Nbtstat.exe is a useful tool for troubleshooting NetBIOS name resolution problems. You can use the nbtstat.exe command to remove or correct preloaded entries.
Viewing configuration by using ipconfig /all or winipcfgl
Refreshing configuration by using ipconfig /renew
Managing DNS and DHCP class IDs by using ipconfig
Testing connections by using ping
Troubleshooting hardware addresses by using arp
Troubleshooting NetBIOS names by using nbtstat
Displaying connection statistics by using netstat
Tracing network connections by using tracert
Testing routers by using pathping
Viewing configuration by using ipconfig /all or winipcfg


89)Name 3 differences between Windows 2000 Standard and Windows 2000 Advanced
90))In reference to Windows 2000 DNS, what are resource records -better known as SRV records?
91))What is the current service pack for Windows 2000?
92))Where would I go in Windows 2000 to find out more information in reference to a
service not starting?
Active Directory Services:-
93) If I have 2 servers one at Mumbai & one at U.K on which server u
will place the Global Catlog?
94) Can win Nt & win 2K work in mixed
mode?
95) which dialer you are using in your company?
96) why we get disturbance in IPLC?
97). Broadcast is in which range of IP range?
98) how many IP u can give on 1 LAN card?
99) whats the difference between Router & switch?
100) Can i give the IP starting from 163. in my LAN? If yes then Why? If noThen Why?
101)What is “REGEDIT” ?
102)Port Numbers for the following:-
1)HTTP-80
2)DNS -53
3)POP3-110
4)SMTP-25
5)TCP/IP-6
6)FTP-21
7)DHCP
103) What does PING stand for? What are the error messages in PING command? What does TTL stand for? On which layer does PING work? Which is the protocol that PING uses?
A:A utility to determine whether a specific IP address is accessible. It works by sending a packet to the specified address and waiting for a reply. PING is used primarily to troubleshoot Internet connections. There are many freeware and shareware Ping utilities available for personal computers.
It is often believed that "Ping" is an abbreviation for Packet Internet Groper, but Ping's author has stated that the names come from the sound that sonar makes.
Time to Live- length of time to get the packet returned.
104)What is data link layer in the OSI reference model responsible for? Data link layer is located above the physical layer, but below the network layer. Taking raw data bits and packaging them into frames. The network layer will be responsible for addressing the frames, The physical layer is responsible for retrieving and sending raw data bits.

105) What is a level 0 backup?
106) What is an incremental backup?
107) What steps are required to perform a bare-metal recovery?
108)Name key files or directories on a Windows system that should always be backed up

PORT NUMBERS

FTP 20,21
TELNET 23
SMTP 25
DNS 53
TFTP 69
HTTP 80
KereborsLogons 88
DHCP 67
Bootp 68
POP3 110
NNTP 119
SNTP 123
NetBIOS 137
IMAP4 143
SNMP 161,162
LDAP 389
HTTPS 443
SQL Server 1433
Global Catalog Server 3268
Terminal Service RDP 3389
ICA 1494
IMA 2312

INTERVIEW QUESTION AND ANSWERS

What is the Difference between Win NT and Win 2000?
Ans:

Win NT Win 2000
No concept of Active directory Concept of Active directory
PDC,BDC--(read only copy) DC,ADC--(read ,write copy)
Database stored in SAM(fixed size-40 MB) Database stored in NTDS.DIT(Not fixed)
Not supported RIS Supported RIS

What is the Difference between Win 2000 and Win 2003?
Ans:

Win 2000 Win 2003
Can’t rename the Domain Can rename the Domain
No authorization with DHCP Authorization with DHCP
Can’t create new domain tree in existing forest Can create new domain tree in existing forest


What are the versions in Win 2000?

Ans: win 2000 server and win adv 2000 server and win 2000 Data center server.
What are the versions in Win 2003?

Ans: standard version and enterprise version and web version and data center server
How much RAM, Processor supported by Win 2000 versions?
Ans: 2000Server: 4GBRAM, 4 Processors, 2000Advanced server: 8GB RAM, 8 Processors, data center server: 64 GB RAM, 32 Processors
How much RAM, Processors supported by Win 2003 versions?
Ans: standard – 4Gb , Web- 2 Gb,2 Proce, Enterprise-32 Gb,8 Processors, Data Center – 64 Gb, 32 processors
What is the diff between win 2000server and Advanced server?
Ans: Network load balancing and clustering
Can I rename the win 2003 DC?
Ans: If you have a Windows 2003 DC, you can use the Netdom tool to rename the DC. The Netdom provides a secure and supported methodology to rename one or more domains. You can find the tool from the Windows 2003 installation CD-ROM
What is Privilege mode?
Ans: A protected Memory Space Allocated for the win 2000 kernel that cannot be directly accessed by software applications.
9) In win2000, what is the partition Size, File Size in FAT 16?
Ans: 4 GB partition size and 2 GB File Size.
10) In win2000, what is the partition Size, File Size in FAT 32?
Ans: 2 GB to 2 TB partition size and 4GB file Size
11) In win2000, what is the Partition Size, File Size in NTFS?
Ans: 2 TB Partition size, File size is theoretically 16 Exabytes.
12)what is the difference between FAT and NTFS?
Ans:FAT does not support Data compression and encryption
13) what is the difference between win98 and Windows XP?

Supports Fat16 and Fat32 Supports Fat16 and Fat32,NTFS
No disk quotas Disk quotas
Only Disk compression Supports Data compression and encryption
No remote assistance and remote desktop remote assistance and remote desktop
14)What is System restore?
15)What is the difference between Basic Disk and dynamic Disk?
16)Can you convert dynamic to basic?
17)What is the difference between system restore and last known configuration?
18)What is the difference between remote assistance and remote desktop?
19)What is the difference between IP4.0 and IP 6.0?
20)what is the difference between router and switch?
21)what is the difference between switch and hub?
22) Hub works in which layer?
23) switch works in which Layer?
24) router works in which Layer?
25) Describe all layers?
26)what is the port numbers of FTP,SMTP,Telnet,SMTP,DNS,DHCP,POP3,TFTP,SNTP?

PROFILES
1) What is profile?
Ans: Windows maintains a group of settings for each individual user that logs into he system. This group setting is known as a user ‘profile’.
2) Where are the documents and settings for the roaming profile stored?
Ans: All the documents and environmental settings for the roaming user are stored locally on the system, and, when the user logs off, all changes to the locally stored profile are copied to the shared server folder. Therefore, the first time a roaming user logs on to a new system the logon process may take some time, depending on how large his profile folder is.
3) What is Roaming and Mandatory profile?
Ans: Roaming user profile: A user profile that is copied to a network server so that it can be downloaded each workstation where the user logon
Mandatory profile: A user profile set up by the server administrator that is loaded from the server to the client each times the user logon. Changes that user makes to the profile are not saved
Active directory:
1) What is the organizational unit?
Ans: OU are additional container objects that can store users, computers, groups&other OU’s.
2) What is the use of organizational unit?
Ans: Uses:
1) To control replication traffic
2) To make authentication faster and more efficient.
3) To locate the nearest server providing directory enabled services


3) What is the active directory?
Ans: Active directory is a centralized hierarchical directory database and it’s a directory service which contains information of all user accounts and shared resources on a network.
4) What are the main roles in active directory?
Ans: FSOM stands for flexible Single operation Master
:1)Domain naming master
2)Schema master
3)PDC Emulator
4) RID master
5)Infrastructure master
5) What is the location & file system type where the active directory
Information is installed?
Ans: On NTFS partition, c:\windows\ntds.dit&c:\windows\sysvolv.
6) For the replication between DC&ADC some file are used, what is the location of that Directory?
Ans: c:\windows\sysvolv.
7)What is Kerberos?
Ans: this protocol is an internet standard authentication protocol that provides a higher level of security. More efficient than windows NT LAN Manager
8)What is Win NT LAN Manager (NTLM)?
Ans: This protocol enables users of win95 and win98 and Win NT client’s computers to be authenticated to win 2000 domains. This protocol is only available when win 2000 Active Directory is configured to operate in mixed-mode
9) Which protocol plays the security role for the authentication in 2000&2003?
Ans: KEREBROS
10) What is version of kerebros in 2003 o/s?
Ans: KEREBROS v 5.5
11) What is the protocol used by the active directory to perform it’s function?
Ans: LDAP: Lightweight directory access protocol base on TCP/IP.
12) What is the command, which display the DC? Adc, Member server?
Ans: Net accounts.
13) What is the command to make a server into domain controller in win 2000&2003?
Ans: DCPROMO
14) what is the type of backup is used to take the active directory?
Ans: system state data backup.
15) What command line utility is used on windows 2000 servers domain controllers before they upgrade to plan win2003 domain controllers?
Ans:
1) adprep /forest prep.
(This command must be issued on win 2000server holding schema master role in forest root domain to prepare existing schema to support win2003AD.)
2)adprep /domain prep
(Infrastructure master to be deployed on win 2003 server
Note: adprep tool on win 2003 CD ROM i386 directory


POLICIES :

1) What is group policy?
Ans:
2) Is Win NT supports Group policy?
Ans: NO, Supports only system Policy.
3) What is system policy?
4) What is difference between system policy and group policy?
5) What is policy order?
Ans: Local Group Policy-Site level Policy-Domain level policy-Organizational level policy
6) Will group policy applicable for win 98,win 95 and winNt workstation?
Ans: No, Only applicable for system policy
7) In Win NT, where policies are stored?
Ans: NTCONFIG.POL
8) Suppose your sever is win 2000 and clients are win98and win95 which policy applicable? And where it is stored?
Ans: System policy and policies stored in CONFIG.POL
9) In win 2000, After Assigning policies, which command is to update policies?
Ans: Secedit /refresh policy user-policy/ enforce
Secedit /refresh policy machine-policy/ enforce

10) In win 2003, After Assigning policies, which command is to update policies?
Ans: GPUPDATE
11)what is the order in which group policy is applied?
Ans: Local—Site Level—Domain Level---Organizational Unit

BACKUP:

1)what is user data?
2)what is system state data?
3)what are three primary tasks you can perform using backup?
4)what is emergency repair disk?
5)who can take backup?
6)what are the 2 types of restore you can perform on active directory?
Ans: Authoritative,Non- Authoritative.
7)list 3 win2k tools use to recover a system failure?
8)what is the tool used to create ERD ?
Ans: Backup programme.
9)which type of backup reduce the time In order to take backup daily?
Ans: Incremental backup will take least amount of time.
10)which win2k tool is used to restore of user, data on a DC?
Ans: Backup.
11)what is the command used to add recovery console to the boot loader menu?
Ans: Winnt32 /cmdcons.
12) what is command is used to perform authoritative restore before booting?
Ans: ntdsutil
Authoritative restore
Restore data base
Restore sub tree
13)what is the type of mode in which you try to restore system state data or active directory data base?
Ans: Directory Services restore mode.
14) what is the extension used for a backup file?
Ans: .bkf
15)Name 5 standard types of backups?
Ans: Normal, daily, incremental, differential, copy.
16)Is it possible to backup & restore data on network drive?
Ans: Yes , it is possible.
17)Is it possible to restore system state data on networked pc’s?
Ans: No , It is not possible.
18)what is non authoritative ?
Ans:
19)what is normal backup?
Ans: It is full and complete backup used to backup all selected files and folders. It removes the archive bit form backed up files and folders.
20)what is copy backup?
Ans: A copy backup backs up all selected files and folders .but it does not affect remove or otherwise affect the archive bit.
21) What is incremental?
Ans: It is used to backup all selected files and folders that have changed since last normal backup or incremental backup. It removes archive bit from the backed up file and folders.
It is not cumulative. It takes less time to backup .multiple backup sets are required at the time of restore.
22) What is differential backup?
Ans: It backups all selected files and folders that have changed since last normal backup.
It does not remove the archive bit. It is commulative backup. It takes much time to backup. last backup set is used to restore
23) What is daily backup?
Ans: A daily backup backups all selected files and folders that have changed during the day the back is made.
24) Back utility advanced mode features?
Ans: 1) Backup wizard
2) Restore wizard
3) ERD
25)Backup Wizard
Backup every thing.
Backup selected files, drives.
Only backup system state data.
26) What is non authoritative?
Tape drives & Models
HP DDS3 Dat Tape drive HP DDS3 Dat Tape drive
Model C1537 Model C1537E
SCSI Internal 50 Pin SCSI External 50 Pin
Capacity 12/24 GB Capacity 12/24 GB




Print Management & Administration
1) What is a printer in win2k terminology?
Ans: it is the software interface between win 2k o/s & the device that produces the printer output.
2) Which win2k printing term is defined as a printer that has multiple ports and multiple print devices assigned to it?
Ans: printer Pool
3) Name 3 printer permissions?
Ans: Print, Manage Documents, Manage printers
4) What is EMF?
5) Print Process:
Ans: User starts print process
Using an application ex (Ms word)
Print job (Data & commands to print a document)
Graphical user Interface
Request to drivers
Driver converts file in to EMF or RAW
Backs again into GDI
Win 2k spooler
Determines local or network
Local printer provider Network
Print processor Network local
Print monitor HDD spooler
Communicates Directly to print device Print Processor
Print monitor
Print device
6) What is print spooler?
Ans: printer spooler is a temporary storage area for print jobs waiting to be sent to a print device. Systemroot\system32\spool\printers
7) Who can add printers and manage printer?
Ans: administrators or power users (built in)
8) Adding printer on a remote computer
Ans: start windows explorer>click my network places>entire network>domain or work group>select computer>highlight printer folder> double click printer folder.
9) Adding printers to printer pool
Ans: ports 1) lpt1 2) lpt2 3) lpt3 Enable printer pooling
10) Printer properities
Ans: 99 highest for managers
1 lowest for employees
Note: if managers and employees send print jobs to same print device you can set priorities
11) Print permissions are
Print: send only print jobs to printer
Manage Documents: resume and restart and delete print jobs.
Manage printers: perform all tasks also share printers can change spooler settings and can assign printer permissions.
12)What is a printer?
Ans: printer is software which acts as a interface between the print device and the operating system.
13)What is print device?
Ans: print device is a hardware component which is attached to the system to the print documents.
14)What is local print device?
Ans: print device which is attached to the local system.
15)What is network print device?
Ans:print device which is there in the network.
16) What is print server?
Ans:The computer responsible for managing the print queues for group of printers.
17) What is print queue?
Ans: The collection of print jobs waiting to be printed by a specific printer.

DHCP (Dynamic Host Configuration Protocol) port: 67
1)What is DHCP?
Ans: DHCP is a TCP/IP protocol that provides that provides way to dynamically allocated IP address to computers on the network.
2)Advantages of DHCP?
Ans: Centrally manages IP address allocation
Helps prevent address conflicts
Reduces administrative effort
Help converse IP addresses
3)What is SCOPE?
Ans: It is range of IP Address which is assigned to computers requesting for a Dynamic IP Address.
4)What is authorization?
Ans: It is Security precaution that ensures that only authorized DHCP Servers Can run in the network..
To avoid computers running illegal DHCP Servers in the network.
5) We’ve installed a new Windows-based DHCP server, however, the users do not seem to be getting DHCP leases off of it.
Ans: The server must be authorized first with the Active Directory.
6)How can you force the client to give up the dhcp lease if you have access to the client PC?
Ans: ipconfig /release
7)Cannot find DHCP Server
Ans: Cause: DHCP service is stopped or disable.
8)How to restore or move a DHCP into another computer
Ans:The DHCP database is contained in the Dhcp.mdb file located in the %SystemRoot%\System32\Dhcp folder. The DHCP server uses this file to record and store information concerning active leases and reservations. After you install a new DHCP, you can copy Dhcp.mdb into the above mentioned location.


9) Describe how the DHCP lease is obtained. It’s a four-step process consisting of
Ans(a) IP request, (b) IP offer, © IP selection and (d) acknowledgement.
10) What is super scope?
Ans: the super scope is assigned a range of IP addresses that can be assigned to DHCP clients that reside on multiple subnets.
11) What is multicast scope?
Ans: the multicast scope contains a range of classD multicast IP address ,and is used to assign these addresses to client computers that request them.
12) What is difference between scope and super scope?
Ans: A scope is assigned a range of IP address that can be assigned to DHCP clients that reside on a single subnet. Where the super scope is assigned a range of IP addresses that can be assigned to DHCP clients that reside on multiple subnets.
13) What is BOOTP?
14) What is range of multicast scope?
Ans: Only IP address range from 224.0.0.0 to 239.255.255.255
DNS (Domain Naming Service) port -53
What is the difference between WINS and DNS?
Ans: WINS resolves NETBIOS Names to IP address where DNS resolves Host names to IP address
1)List the types of DNS servers?
Ans: Standard primary, standard secondary, active directory integrated zone, root
4)what is the primary purpose of DNS?
Ans: For host resolution.
5) what is start of authority?
Ans: It contains serial no. , this indicates the modification done to the zone.
6)what is Dynamic DNS?
Ans: Dynamically update the service records
7)what is the maximum character size of DNS?
Ans:63
What is the maximum character size of WINS?
9)what is zone or zone file?
Ans: A zone is a Database for either a DNS domain or for a DNS domain and one or more of it’s Sub domains. This storage database is special text file called zone or zone file.
11)why multiple DNS services are created for the same zone?
Ans: load balancing, fault tolerance.
12)what is caching only server?
Ans: Caching only servers does not stores only zones.it resolves host names
To IP address for client computers and stores the resulting mapping information in it’s cache. this DNS server provides the cached information to the client computer with contacting other DNS servers to resolve the query.
It is the temporary storage of zone information.
13)what is zone transfer?
Ans: The process of copying zone to a standard DNS server is called zone transfer.
14)what is master DNS server?
Ans: As the DNS contains the master copy of the zone information is called Master DNS.
15)what is forwarders?
Ans: The queries of one server will be forwarded to other DNS act as forwarder by internal name resolution.
17)which protocol is supported by DNS server?
Ans: Dynamic Updated protocol.
18)what are four service records?
Ans: _msdcs,_sites,_tcp,_udp
19) what are six service records in win 2003?
Ans: -msdcs: (Microsoft Domain controller service)
It contains the information which domain controller is hosting the zone.
Site: In which site the zone has been configured.
Tcp& Udp: These are two protocols that are responsible for communicating with active directory.
Domain DNS Zones & Forest DNS Zones:
In which domain & Forest, DNS has be configured the information.
19) What is Resource record?
Ans: The entries are in zone is called Resource record. The entry may be host name IP address mapping entry.
20) What is the primary thing you have to do on a DNS server before it starts resolution of host name?
21) When will you configure root DNS server?
Ans: : A root server should be used only when a network is not connected to the internet or when a network is connected to the internet or when a network is connected to the internet by using a proxy server
22)what is forward lookup zone?
Ans:Resolves hostnames to ip address.
23)what is reverse look up zone?
Ans: Resolves ip address to hostnames.
24)what is standard primary zone?
Ans: Standard primary DNS server stores DNS entries(IP address to host mapping and other DNS resource records ) in zone file that is maintained on the server. The primary server maintains the master copy of zone file. When changes need to be the zone they should be made only standard primary server.
25)what is standard secondary zone?
Ans: Standard secondary DNS server stores copies of zones from the standard primary.
26) what is root server?
Ans:Root server contains a copy of a zone for the root domain – either the root domain for the internet, or the root domain for a company private, internal network. the purpose of the root server is to enable other DNS servers on a network to access the second level domains on the internet.
Note: A root server should be used only when a network is not connected to the internet or when a network is connected to the internet or when a network is connected to the internet by using a proxy server
27)what is round robin?
Ans: Round robin is used when multiple servers (such as web servers) have identical configurations and identical host names ,but different IP addresses.
28) can you configure root server to use a forwarder?
Ans: NO.
29)what are Root hints?
Ans:Root hints are server names and ip address combination that point to the root servers located either on the internet or on your organization private network.
Root hint tab contains list of DNS Servers can contract to resolve client DNS queries.
Maintains all the information of 13 root servers.
32)what is Active Directory integrated zone?
Ans: Active directory integrated DNS server just like standard primary except DNS entries stored in active directory data store rather than in a zone file. Active directory supports multi master replication when changes need to be made to the zone. They can be on any active directory –integrated DNS server that containg the zone.
33)what is simple query?
Ans: A simple query is a query that DNS server can resolve without contacting any other DNS servers.
34) what is recursive query?
Ans: a recursive is a query that can’t resolve it self it must be contract one or more additional DNS servers to resolve the query.
35) what is scavenging?
Ans: Scavenging is the process of searching for and Deletes stele resource records in a zone
PTR: Pointer resource record
SRV: Service locator resource record

36)What is SRV?
Ans: Used to map specific service (tcp/ip) to list of servers that provide that service.
37) What is CNAME?
Ans: Alias resource record .used to map an additional host name to the actual name of the host.
38) What is stub zone in 2003?
Ans: stub zone contains the information of Name Server & start of authority. It gives the information in which system, in which server, in which domain DNS has been configured
The properties of DNS in Advanced Tab
(Disable Recursion or disable forwarder)
By default this option is unchecked telling that recursive property
is present.
BIND Secondaries:
The zone transfers between the primary & secondary (replication between primary and secondary) BIND is responsible.
Fail on load if bad zone data:
This option is unchecked telling that even if the zone contains some errors it will be loaded if it is checked the zone will not be loaded.
Enable Round Robin:
If the same zone is present in the same subnet the query will be passed on round robin passion until it gets resolved.
Enable Net Mask ordering:
This option is utilized for DNS Server maintained on multihome pc (A pc having multiple NIC cards) and solving the queries of diff clients subnets
Secure cache against pollution:
It secures the cache information by not storing the information of unauthorized DNS servers.

ADS and DNS ROLES

ADS Roles:
1, Forest Roles 2, Domain Roles
I. Forest Roles:
a. Domain Naming operation Master (DNOM)
It will maintain a unique domain name
Start – programs – admin tools – ads domain & trusts – open ads domain &trusts – set operation master it displays the domain naming operation master.
b. Global catalog master (GCS)
Total information about the domain and partial information of replications.
Start – programs – admin tools –ads sites &services – open services
Open default first site name – open computer name – r+click on ntds settings – go to properties – displays the gcs with checkbox.
c. Schema master
System is having own attributes to enable and disable all this done will be in the schema master.
Start- run – type ‘regsvr32 schemmgnt.dll” display the schema registry information click – ok. After that go to start – run – mmc – click on the add button &select schema , click adding close the folder – ok. It displays the close attributes.

II. Domain Roles
Rid master
Start – programs – admin tools –ads users & computers – open ads users &computers – r+click the domain name & select operation master.
Pdc master
Start – programs – admin tools –ads users & computers – open ads users &computers – r+click the domain name & select operation master.

Infrastructure master

ADS Backup:
Start- programs- accessories – system tools - backup
Backup files are: 1, Ads 2, sys vol 3, boot files (boot.ini) 4. com+reg 5. Registry

Minimum Requirement of ADS:
1, static ip 2, 256 Ram 3, stand alone pc 4, 2003 serve cd

ADS work with LDAP protocols (389)
C:\windows\sysvol:- servers copy of the domains public files
C:\windows\ntds:- ADS database and log files.

ADS versions’: 2000 serve 1.0 2003 server 1.1

In ADS when ever u r creating a user account it will create a unique identifier (sid) this is called security identifier



ADS are having 2 elements:
Logical elements
Domain, Trees, Forest, organization units
Physical elements
Sites and services, domain controller

Classes and Types in win 2003 server

1, standard class 2, Abstract class 3, Auxiliary class 4, 88 class

Crating Application Data part ion:
Run – cmd – ntdsutil - domain management – connection – connect sever
Create NC application directory portions
Delete NC application directory portions
Role Transferring:
Start – programs – Admin tools – ads users & computers – India.com – r+click operation master – rid+pdc, infrastructure.
ADS Database:
NTDS.Dit – 16 mb each user 1 kb max 16 million users
(New technology directory service. Directory information tree
SAM – 40 mb
Group:
A group consist of users accounts, computer & groups it self.
1, domain local group 2, global group 3, universal group
Group policy stored at system root/ sys32.G.P

Domain controller: it contain rewritable copy of the ADS database
Name Space: A collection of resources using common name is called name space
ex: India.com

DNS (DOMAIN NAMING SERVICE - {53} Roles :

Disable Resurrection
Bind secondarys
Fail load if bad zones data
Enable round robin
Enable net mask ordering
Secure cache against pollution
DNS queries:
1, Recursive query - DNS to client
2, Interactive query - DNS to DNS
DNS Zones :
Forward lookup Zone – it resolves ip address to host name
Reverse lookup Zone - it resolves host name to ipaddress

1, Primary Zone 2, Secondary one 3, Stub zone

DNS Managing or trouble shoot:
1, ns lookup
2, ip config/ all
3, Ipconfig/flush dns
4, ipconfig/Display dns
5, ipconfig/event viewer
OSI Layers: {APSTNDP}
1, Application Layer
2, Presentation Layer
3, session Layer
4, Transport Layer
5, Network Layer – Router (Layer 3)
6, Data link Layer – Switch (Layer 2)
7, Physical Layer - Hub (Layer 1 )
TCP/IP Layers { ATIDP} A protocol is a set of rules that governs data communication
1, Application layer
2, Transport Layer
3, Internet Layer
4, Data-link layer
TCP/IP Responsibilities:
Opening and closing sessions
Packet management
Flow control
Error detection and handling
IP Range:
Class A – 0- 127
Class B – 128-191
Class C – 192- 224
Class D – 225-249 – Research and development
Class E – 250-255 - Research and development
System Boot Files:
NTLDR – system procedure
BOOT.ini - Boot configuration
NTDETECT .com – gathering hardware
NTBOOTDD.sys – system devices
NTUSER – user profile
IO.sys
Config.sys
DHCP (Dynamic Host Control Protocol) Backend process {DORA}
D- Discover
O-offer
R- Request
A- Acknowledgement

Backup Types:
1, Normal
2, Incremental
3, Deferential
4, copy
5, Daily
PORT Numbers:
IP – 0 DNS –53 ICP - 1494
DHCP – 67 ICMP – 1
TCP – 6 HTTP – 80
IGRP – 9 EIGRP – 88
UDP - 17 OSPF - 89
FTP – 21 POP3 – 110
TELNET - 23 RPC – 111
SMTP – 25 L2TP - 115
RDP – 27 NNTP - 119
IPV6 - 41 LDAP –389

Private ip - for organization use
Public ip – we have to buy from isp’s

What is the NAT (Network Address Transfer?)
Net is used for difference n/w such as public network to private network, private network to public network.
To binding the ip address private to public ip
Ras: Remote administration server
It provides communication between client and server through telephone line across the world
PPTP – It supports homo genius O.S
L2TP – It supports hetro genius O.S
Private and Public Ip address?
Private ip is come in the form of classes non-routable ip address, these type of address are using with in the organization.
Private ip ‘s used on the internal network
External ip address obtained from an isp, that will allow traffic out to the internet


DNS QUESTIONS

1)List the types of DNS servers?
Ans: Standard primary, standard secondary, active directory integrated zone, root server, caching only, and forwarders, master.

2)what is ttl?
Ans: time to live

3)What is PTR?
Ans: Used to map IP address to their host names. These records only used in reverse lookup zone.

4)what is the primary purpose of DNS?
Ans: For host resolution.

5) what is start of authority?
Ans: It contains serial no. , this indicates the modification done to the zone.

6)what is Dynamic DNS?
Ans: Dynamically update the service records

7)what is the maximum character size of DNS?
Ans:63

9)what is zone or zone file?
Ans: A zone is a Database for either a DNS domain or for a DNS domain and one or more of it’s Sub domains. This storage database is special text file called zone or zone file.

11)why multiple DNS services are created for the same zone?
Ans: load balancing, fault tolerance.

12)what is caching only server?
Ans: Caching only servers does not stores only zones.it resolves host names
To IP address for client computers and stores the resulting mapping information in it’s cache. this DNS server provides the cached information to the client computer with contacting other DNS servers to resolve the query.
It is the temporary storage of zone information.

13)what is zone transfer?
Ans: The process of copying zone to a standard DNS server is called zone transfer.

14)what is master DNS server?
Ans: As the DNS contains the master copy of the zone information is called Master DNS.


15)what is forwarders?
Ans: The queries of one server will be forwarded to other DNS act as forwarder by internal name resolution.

17)which protocol is supported by DNS server?
Ans: Dynamic Updated protocol.

18)what are four service records?
Ans: _msdcs,_sites,_tcp,_udp

19) what are six service records in win 2003?
Ans: -msdcs: (Microsoft Domain controller service)
It contains the information which domain controller is hosting the zone.
Site: In which site the zone has been configured.
Tcp& Udp: These are two protocols that are responsible for communicating with active directory.
Domain DNS Zones & Forest DNS Zones:
In which domain & Forest, DNS has be configured the information.

19)what is Resource record?
Ans: The entries are in zone is called Resource record. The entry may be host name IP address mapping entry.

20)what is the primary thing you have to do on a DNS server before it starts resolution of host name?

21)when will you configure root DNS server?
Ans: : A root server should be used only when a network is not connected to the internet or when a network is connected to the internet or when a network is connected to the internet by using a proxy server
22)what is forward lookup zone?
Ans:Resolves hostnames to ip address.

23)what is reverse look up zone?
Ans: Resolves ip address to hostnames.

24)what is standard primary zone?
Ans: Standard primary DNS server stores DNS entries(IP address to host mapping and other DNS resource records ) in zone file that is maintained on the server. The primary server maintains the master copy of zone file. When changes need to be the zone they should be made only standard primary server.

25)what is standard secondary zone?
Ans: Standard secondary DNS server stores copies of zones from the standard primary.


26) what is root server?
Ans:Root server contains a copy of a zone for the root domain – either the root domain for the internet, or the root domain for a company private, internal network. the purpose of the root server is to enable other DNS servers on a network to access the second level domains on the internet.
Note: A root server should be used only when a network is not connected to the internet or when a network is connected to the internet or when a network is connected to the internet by using a proxy server

27)what is round robin?
Ans: Round robin is used when multiple servers (such as web servers) have identical configurations and identical host names ,but different IP addresses.

28) can you configure root server to use a forwarder?
Ans: NO.

29)what are Root hints?
Ans:Root hints are server names and ip address combination that point to the root servers located either on the internet or on your organization private network.
Root hint tab contains list of DNS Servers can contract to resolve client DNS queries.
Maintains all the information of 13 root servers.

32)what is Active Directory integrated zone?
Ans: Active directory integrated DNS server just like standard primary except DNS entries stored in active directory data store rather than in a zone file. Active directory supports multi master replication when changes need to be made to the zone. They can be on any active directory –integrated DNS server that containg the zone.

33)what is simple query?
Ans: A simple query is a query that DNS server can resolve without contacting any other DNS servers.

34) what is recursive query?
Ans: a recursive is a query that can’t resolve it self it must be contract one or more additional DNS servers to resolve the query.

35) what is scavenging?
Ans: Scavenging is the process of searching for and Deletes stele resource records in a zone
PTR: Pointer resource record
SRV: Service locator resource record



36)What is SRV?
Ans: Used to map specific service (tcp/ip) to list of servers that provide that service.

37) What is CNAME?
Ans: Alias resource record .used to map an additional host name to the actual name of the host.

38) What is stub zone in 2003?
Ans: stub zone contains the information of Name Server & start of authority. It gives the information in which system, in which server, in which domain DNS has been configured
The properties of DNS in Advanced Tab
(Disable Recursion or disable forwarder)
By default this option is unchecked telling that recursive property
is present.
BIND Secondaries:
The zone transfers between the primary & secondary (replication between primary and secondary) BIND is responsible.
Fail on load if bad zone data:
This option is unchecked telling that even if the zone contains some errors it will be loaded if it is checked the zone will not be loaded.
Enable Round Robin:
If the same zone is present in the same subnet the query will be passed on round robin passion until it gets resolved.
Enable Net Mask ordering:
This option is utilized for DNS Server maintained on multihome pc ( A pc Having multiple nic cards ) and solving the queries of diff clients subnets
Secure cache against pollution :
It secures the cache information by not storing the information of unauthorized DNS servers.











DNS TROUBLESHOOTING


50)How to check AD DNS Registration
Ans:You should have four folders with the following names under DNS forward lookup zones are present when DNS is correctly registering the Active Directory DNS records. These folders are labeled:
_msdcs
_sites
_tcp
_udp


51)A Records appear and disappear randomly
Cause: Your DNS zone is configured to query WINS.

52)Can't logon or join the domain
Ans:If DNS is not set up on the Domain controller correctly, domain-wide issues can occur such as replication between domain controllers. If DNS is not set up on the client correctly, the client may experience many networking and internet issues. Unable log on to the domain or join the domain from a workstation or server, and can't access the Internet indicate that you may have DNS settings issues.

53)Can't open an external website using the same network domain name?
Ans:Create a DNS record for pointing to the www with the public IP.


54)What are Common DNS settings mistakes
1.The domain controller is not pointing to itself for DNS resolution on all network interfaces. Especially, when you have multihomed server, the WAN connection may be assign 127.0.0.1 as DNS ip.
2. The "." zone exists under forward lookup zones in DNS.
3. The clients on LAN do not point the DNS to internal DNS server.

55)Can't find server name for ....: No response from server - DNS Request Timed Out?
Ans: Symptom: When running nslookup, you may receive this message: Can't find server name for ....: No response from server
Cause: the DNS server's reverse lookup zones do not contain a PTR record for the DNS server's IP address. Refer to case 0204BL

56)Can't Find Server Name for Address 127.0.0.1 when running nslookup?
Ans:Cause: You don't have a DNS server specified in your TCP/IP Properties. If you have no DNS server configured on your client, Nslookup will. default to the local loopback address.

57)DNS issue with IP Filtering
Ans:Symptoms: you have a windows 2000 server running IIS for public access with 10 public IPs. The router is broken. We would like to enable IP filtering to block all ports except the port 80 for the web, 25 and 110 for the mail. After enabling IP Filtering, the server can't access any web sites, can't ping yahoo.com and nslookup gets time out.
Cause: IP Filtering block the ports fro DNS.

58)"DNS name does not exist."?
Ans:Cause: 1. Incorrect DNS.
2. The netlogon service tries to register the RR before the DNS service is up.

59)DNS on multi homed server?
Ans:It is not recommended to install DNS on a multihomed server. If you do, you should restrict the DNS server to listen only on a selected address.

60)DNS request time out - ip name lookup failed?
Ans:When troubleshooting Outlook 550 5.7.1 relaying denied - ip name lookup failed by using nslookup to resolve host name,

61)you may receive "DNS request time out...*** Request to mail.chicagotech.net time-out.?
Ans:Possible causes: 1. Incorrect DNS settings.
2. Incorrect TCP/IP settings on the DC.
3. Missing PRT on Reverse Lookup Zones.

62)DNS server can't access the Internet?
Ans:Symptoms: You have a domain controller with DNS. The server can ping router and any public IPs. However, the server can't open any web sites.
Resolution: Check the server DNS settings, especially make sure the server points to the internal DNS instead of the ISP DNS or 127.0.0.1.

63)How to register the DNS RR?
Ans:1. Go to DNS Manager to add it manually.
2. Use netlogon, ipconfig and nbtstat command.

64)How to troubleshoot DNS problems?
Ans:To correct DNS settings and troubleshoot DNS problems, you can 1) run nslookup from a command line is the default dns server the one you expect.
2) use ipconfig /all on client to make sure the client point to correct DNS server and the the DC server points to only itself for DNS by its actual tcp/ip address, and make sure no any ISP DNS listed in tcp/ip properties of any W2K/XP.
3) When the machine loads it should register itself with the DNS. If not, use ipconfig /regiesterdns command.
4) Check Event Viewer to see whether the event logs contain any error information. On both the client and the server, check the System log for failures during the logon process. Also, check the Directory Service logs on the server and the DNS logs on the DNS server.
5) Use the nltest /dsgetdc: domainname command to verify that a domain controller can be located for a specific domain. The NLTest tool is installed with the Windows XP support tools.
6) If you suspect that a particular domain controller has problems, turn on the Netlogon debug logging. Use the NLTest utility by typing nltest /dbflag:0x2000ffff at a command prompt. The information is logged in the Debug folder in the Netlogon.log file.
7) Use DC Diagnosis tool, dcdiag /v to diagnose any errors. If you still have not isolated the problem, use Network Monitor to monitor network traffic between the client and the domain controller.

65)How can I verify a computer DNS entries are correctly registered in DNS?
A: You can use the NSLookup tool to verify that DNS entries are correctly registered in DNS. For example, to verify record registration, use the following commands: nslookup computername.domain.com.

66)How to add DNS and WINS into your Cisco VPN server?
Ans:If your VPN client cannot find servers or cannot ping computer name, you may need to add DNS and WINS into your VPN server. For example, to add DNS and WINS on a Cisco Firewall PIX, add vpdn group 1 client configuration DNS server name and vpdn group 1 client configuration wins wins server name..

67)How to clear bad information in Active Directory-integrated DNS
Ans:You may need to clear bad information in Active Directory-integrated if DNS is damaged or if the DNS contains incorrect registration information. To do that, 1) Change the DNS settings to Standard Primary Zone.
2) Delete the DNS zones.
3) Use ipconfig /flushdns command.
4) Recreate the DNS zones.
5) Restart Net Logon service
6)Use ipconfig /registerdns
68)How to ensure that DNS is registering the Active Directory DNS records?
Ans:To ensure that DNS is registering the Active Directory DNS records, to go DNS Management console>Server name>Forward Lookup Zones>Properties, make sure Allow Dynamic Updates is set to Yes and _msdcs, _sites, _tcp and _udp are correctly registering the Active Directory DNS records. If these folders do not exist, DNS is not registering the Active Directory DNS records. These records are critical to Active Directory functionality and must appear within the DNS zone. You should repair the Active Directory DNS record registration.

69): How does the internal DNS resolve names Internet without the ISP's DNS server?
Ans: As long as the "." zone does not exist under forward lookup zones in DNS, the DNS service uses the root hint servers. The root hint servers are well-known servers on the Internet that help all DNS servers resolve name queries.

70)How to reinstall the dynamic DNS in a Windows 2000 Active Directory?
Ans:Under the following situations you may want to reinstall the DDNS in a Windows 2000 Active Directory:
Some weird DNS errors have occurred and clearing DNS information has been unsuccessful.
Services that depend upon DNS, such as, the File Replication service (FRS) and/or Active Directory are failing.
The secondary DNS server doesn't support dynamic updates.
To reinstall the dynamic DNS in a Windows 2000 Active Directory,
1. Clear the DNS information.
2. Clear the Caching Reslover.
3. Point all DNS servers to the first DNS server under TCP/IP properties.
4. Re-add the zones and configure them to be Active Directory integrated.
5. Register your A resource record for DNS as well as your start of authority (SOA).

71)How to repair the DNS record registration
Ans:To repair the Active Directory DNS record registration:
Check for the existence of a Root Zone entry. View the Forward Lookup zones in the DNS Management console. There should be an entry for the domain. Other zone entries may exist. There should not be a dot (".") zone. If the dot (".") zone exists, delete the dot (".") zone. The dot (".") zone identifies the DNS server as a root server. Typically, an Active Directory domain that needs external (Internet) access should not be configured as a root DNS server.
The server probably needs to reregister its IP configuration (by using Ipconfig) after you delete the dot ("."). The Netlogon service may also need to be restarted. Further details about this step are listed later in this article.
Manually repopulate the Active Directory DNS entries. You can use the Windows 2000 Netdiag tool to repopulate the Active Directory DNS entries. Netdiag is included with the Windows 2000 Support tools. At a command prompt, type netdiag /fix.
To install the Windows 2000 Support tools:
Insert the Windows 2000 CD-ROM.
Browse to Support\Tools.
Run Setup.exe in this folder.
Select a typical installation. The default installation path is Systemdrive:\Program Files\Support Tools.
After you run the Netdiag utility, refresh the view in the DNS Management console. The Active Directory DNS records should then be listed.
NOTE: The server may need to reregister its IP configuration (by using Ipconfig) after you run Netdiag. The Netlogon service may also need to be restarted.
If the Active Directory DNS records do not appear, you may need to manually re-create the DNS zone.
After you run the Netdiag utility, refresh the view in the DNS Management console. The Active Directory DNS records should then be listed. Manually re-create the DNS zone:
Still need help, contact consultant Your feedback and contributions to this web site

72)How to configure DNS Forwarders
Ans:To ensure network functionality outside of the Active Directory domain (such as browser requests for Internet addresses), configure the DNS server to forward DNS requests to the appropriate Internet service provider (ISP) or corporate DNS servers. To configure forwarders on the DNS server:
Start the DNS Management console.
Right-click the name of the server, and then click Properties.
Click the Forwarders tab.
Click to select the Enable Forwarders check box.
NOTE: If the Enable Forwarders check box is unavailable, the DNS server is attempting to host a root zone (usually identified by a zone named only with a period, or dot ("."). You must delete this zone to enable the DNS server to forward DNS requests. In a configuration in which the DNS server does not rely on an ISP DNS server or a corporate DNS server, you can use a root zone entry.
Type the appropriate IP addresses for the DNS servers that will accept forwarded requests from this DNS server. The list reads from the top down in order; if there is a preferred DNS server, place it at the top of the list.
Click OK to accept the changes.

73)DC's FQDN Does Not Match Domain Name?
Ans: Symptoms: After you promote or install a domain controller, the DNS suffix of your computer name may not match the domain name. Or the FQDN does not match the domain name because a NT 4.0 upgrade automatically clears the Change primary DNS suffix when domain membership changes check box. It is not possible to rename the computer on the Network Identification tab. Also, you may receive NETLOGON events in the System Log with ID:5781 or other error messages that indicate a failure to dynamically register DNS records.
Resolutions: 1. After you upgrade to Microsoft Windows 2000, but before you run dcpromo and obtain the Active Directory Installation Wizard, add the following values to the following registry key:
Value name: SyncDomainWithMembership
Value type: REG_DWORD
Value: 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

2. If you have already promoted to a domain controller, use the Active Directory Installation Wizard to demote to a member server. Click to select the Change primary DNS suffix when domain membership changes check box, and then run dcpromo to promote back to a domain controller.
3. Modify HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ and changed domain=mydomain.com, NV Domain=mydomain.com, SyncDomainWithMembership= 1 (here mydomain.com is yhe donaim name).


74)Primary or Active Directory Integrated DNS
Ans:With Active Directory Integrated DNS, this permits all servers to accept updates. Instead of adding standard secondary DNS servers, you can convert the server from a primary DNS server to an Active Directory Integrated Primary server and configure another domain controller to be a DNS server. With Active Directory Integrated DNS servers, all the servers are primary servers, so when a zone change is made at one server, it is replicated to the others, eliminating the need for a zone transfer.

75)2nd DNS Issues
1. When setup 2nd DNS, make sure you type correct Master DNS Server IP address.
2. Make sure primary DNS and 2nd DNS servers can ping each other and not firewall block them.
3. Make sure primary DNS and 2nd DNS servers point to each other as primary and themselves as secondary.

76)Some A Records don't appear in DNS
Cause: 1. incorrect TCP/IP settings.
2. Register this connection's address in DNS is unchecked.

77)The DSA operation is unable to proceed because of a DNS lookup failure.
Symptoms: 1. When trying to DCPROMO, ,you receive: "The operation failed because: The directory service failed to replicate off changes made locally. The DSA operation is unable to proceed because of a DNS lookup failure."
2. The Event Viewer may list Event ID: 1265 - The DSA operation is unable to proceed because of a DNS lookup failure.
3. DCDiag test display this message: "The DSA operation is unable to proceed because of a DNS lookup failure".
Causes: 1. Incorrect TCP/IP configuration.
2. Incorrect DNS configuration
3. Bad information in DNS Manager.

78)“The procedure entry point DsIsManagedDnW could be located in the dynamic link library NTDSAPI.dll”
Ans: Symptom: when trying to run DCDiag and getting the following error, "the procedure entry point DsIsManagedDnW could be located in the dynamic link library NTDSAPI.dll".
Resolutions: 1. Remove the dcdiag.exe from Controller Panel and install it from w2k/xp DC.
2. The "entry point not found" is typical of a service pack mismatch and the dcdiag.exe is out of sync with the service pack level of your system. To fix, go to the service pack x folder, and find "adminpack.msi" Right click it and select install.

79)Troubleshooting the Domain Locator Process
1) Check Event Viewer on both the client and the DNS server for any errors.
Verify that the IP configuration is correct for your network by using ipconfig /all.
Ping both the DNS IP address and the DNS server name to verify network connectivity and name resolution. .
Use nslookup servername.domain.com command to verify that DNS entries are correctly registered in DNS.
If nslookup command does not succeed, use one of the following methods to reregister records with DNS: a) force host record registration by using ipconfig /register dns; b) force domain controller service registration by stopping/restarting the Netlogon service.
If you still have the same issue, use Network Monitor to monitor network traffic between the client and the domain controller.

80)Which DNS does a VPN client use
1. Assuming both LAN connection and VPN connection have the different DNS because they are assigned by different DHCPs, the active DNS goes with the default gateway.
2. You can pick up which DNS you want to use manually.

81)Which ports are used for DNS
Ans:UDP and TCP port 53. However, the internal DNS clients may not hear answers even though the query has been sent out on 53,until you open the UDP port above 1023.

82)Why I can't perform external name resolution to the root hint servers on the Internet?
A: make sure "." zone does not exist under forward lookup zones in DNS. If you do not delete this setting, you may not be able to perform external name resolution to the root hint servers on the Internet.


83) Why do I have to point my domain controller to itself for DNS?
A: The Netlogon service on the domain controller registers a number of records in DNS that enable other domain controllers and computers to find Active Directory-related information. If the domain controller is pointing to the ISP's DNS server, Netlogon does not register the correct records for Active Directory, and errors are generated in Event Viewer. The preferred DNS setting for the domain controller is itself; no other DNS servers should be listed. The only exception to this rule is with additional domain controllers. Additional domain controllers in the domain must point to the first domain controller (which runs DNS) that was installed in the domain and then to themselves as secondary.

84): Everyone can access our web site on the Internet. But no one can
access the web site internally. Instead, we are point to our Intranet.
A: If you network domain name is the same of your web site name, you should point the web to the web public IP. To do this, open DNS manager and create a host. for example www.chicagotech.net=public ip.

85) *** Can't find server name for address w.x.y.z: Timed out
Cause: the DNS server cannot be reached or the service is not running on that computer.
2. *** Can't find server name for address 127.0.0.1: Timed out
Cause: no servers have been defined in the DNS Service Search Order list
3. *** Can't find server name for address w.x.y.z: Non-existent domain
Cause: there is no PTR record for the name server's IP address.
4.*** ns.domain.com can't find child.domain.com.: Non-existent domain
5. *** Can't list domain child.domain.com.: Non-existent domain
Cause: No separate db file for the domain, thus querying that domain or running a zone transfer on it will produce the above errors.

86)What does netdiag /fix do
A:Netdiag /fix switch is very useful tool to correct issues with DNS and domain controller tests. 1. DNS Test: If the computer is a domain controller, Netdiag verifies all the DNS entries in the Netlogon.dns file to determine if they are correct and updates the appropriate entries if there is a problem. 2. Domain Controller Test: If the domain GUID cached in a local computer on your primary domain is different than the domain GUID saved in a domain controller, Netdiag tries to update the domain GUID on the local computer.

ACTIVE DIRECTORY

1

1) What is Active directory?
ans:active directory is a centralized hierarchical directory database and it’s a directory servive which contains information of all user accounts and shared resources on a network.

2) What is a tree?
Ans: a tree is a collection of domains that share a single dns name space and are connected by transitive trust relationship.

3) What is forest?
Ans:A forest is collection of one or more domains that share a common schema and global catalog.

4) What is organizational unit? And it’s purpose?
Ans:OU are additional container objects that can store users, computers,groups&other OU’s.
Purpose:
1)To delegate administration
2)To manage the application of group policy.

5)what are sites?
Ans: a site is a physical component of active directory that is used to define and represent the topology of a network.
A site is collection of one or more well connected IP subnets.
Uses:
1)To control replication traffic
2)To make authentication faster and more efficient.
3)To locate the nearest server providing directory enabled services.

6)what is domain controllers?
Ans: domain controllers are the physical storage location for the active directory database.

7)what are physical components of a active directory?
Ans:Domain controllers, sites.

8)what are logical components of active directory?
Ans: Forests,trees,domains,OU’s

9)what is the command to make a server into domain controller in win 2000&2003?
Ans: DCPROMO.
10) What is the command to remove the domain controller functionality?
Ans: DCPROMO /FORCEREMOVAL.

11) what is the location & file system type where the active directory
Information is installed?
Ans: On NTFS partition, c:\windows\ntds.dit&c:\windows\sysvolv.

12)for the replication between dc&adc some file are used, what is the location of that directory?
Ans:c:\windows\sysvolv.

13)which version of active directory in win2000&win2003?
Ans: Win2000 : 1.0
Win2003 : 1.1.

14)what is the command used to install active directory on remote servers?
Ans: dcpromo /answer: answerfile
(answer file is a text file created from the /support/tool folder by using deploy.cab file)

15)what is the type of backup is used to take the active directory?
Ans: system state data backup.

16)which protocol plays the security role for the authentication in 2000&2003?
Ans: KEREBROS

17)What is version of kerebros in 2003 o/s?
Ans: KEREBROS v 5.5

18)what is the protocol used by the active directory to perform it’s function?
Ans:LDAP : Light weight directory access protocol base on tcp/ip.

19)How many services are installed ,when you install active directory and what are they?
Ans: Total five services
1)Active directory domains &t rusts
2)Active directory sites and services
3)Active directory users and groups
4)Domain controller security policy.
5)Domain security policy.
20)what is the command which display the dc. Adc, member server?
Ans: Net accounts.

21)what is command to know the SID,RID,DID of a user?
Ans: who am I /user(SID: security identifier

21)can you create a new domain tree in existing forest in win2000?
Ans:No, in win 2003 only we can create.

22)In what replication process goes in win2000 and win2003?
Ans: two way replication process.(ADC::read &write copy)

22) How can you authenticate between forests?
A: Windows 2000 always uses NTLM for authentication between forests; 2003 will use kerebros if and only if dns is used while setting up the domains. If the netbios name is uses; NTLM is used for 2003.

23) What types of classes exist in Windows Server 2003 Active Directory?
A: Structural class. The structural class is important to the system administrator in that it is the only type from which new Active Directory objects are created. Structural classes are developed from either the modification of an existing structural type or the use of one or more abstract classes.
Abstract class. Abstract classes are so named because they take the form of templates that actually create other templates (abstracts) and structural and auxiliary classes. Think of abstract classes as frameworks for the defining objects.
Auxiliary class. The auxiliary class is a list of attributes. Rather than apply numerous attributes when creating a structural class, it provides a streamlined alternative by applying a combination of attributes with a single include action.
88 class. The 88 class includes object classes defined prior to 1993, when the 1988 X.500 specification was adopted. This type does not use the structural, abstract, and auxiliary definitions, nor is it in common use for the development of objects in Windows Server 2003 environments

25) When should you create a forest?
A: Organizations that operate on radically different bases may require separate trees with distinct namespaces. Unique trade or brand names often give rise to separate DNS identities. Organizations merge or are acquired and naming continuity is desired. Organizations form partnerships and joint ventures. While access to common resources is desired, a separately defined tree can enforce more direct administrative and security restrictions.


26) what type domain names are used in win 2003& win2000?
Ans:Fully qualified domain names(Any name with extension)

27)what are the six underplaying major roles in active directory to be transferred to ADC from DC to make additional domain controller to act as a domain controller?
Ans:1)Domain naming master 6)Global catalog server.
2)Schema master
3)PDC Emulator
4) RID master
5)Infrastructure master

28)what are FSOM rules?
Ans: FSOM stands for flexible Single operation Master
:1)Domain naming master
2)Schema master
3)PDC Emulator
4) RID master
5)Infrastructure master

29) Define the six responsibilities of an active directory?
Ans:
Domain naming master: ensures the domain names to be unique.
Schema master: classes and attributes and architecture is maintained by the schema.
RID Master: ensures user accounts to be unique
PDC Emulator: Act as a emulator for user login, replication between DC and BDC’s.
Infrastructure Master: responsible for changes or modifications in group membership.
Allows to user to move from one group to other.

30) What snap-in administrative tools are available for Active Directory?
A: Active Directory Domains and Trusts Manager, Active Directory Sites and Services Manager, Active Directory Users and Group Manager, Active Directory Replication (optional, available from the Resource Kit), Active Directory Schema Manager (optional, available from admin pack)

31) How do you delete a lingering object?
A: Windows Server 2003 provides a command called Repadmin that provides the ability to delete lingering objects in the Active Directory.


32)what is Global catalog Server?
Ans: A Global catalog server is a searchable index which stores all the information about all objects in an active directory.
The main role of global catalog server is to help quickly find objects across domains ,supply information about universal group membership and authenticate user principal names(UPN) are supplied.

33)which type of zone is created when you install active directory?
Ans:active directory integrated zone with six service records are created with domain name when you install A.D on application directory partition.

34)where global catalog servers are configured?
Ans:Domain controller individually.

35)where universal group membership cache is configured?
Ans:At the site ,it applies to all domain controllers with in a specific site.

36)what command line utility is used on windows 2000 servers domain controllers before they upgrade to plan win2003 domain controllers?
Ans:
1) adprep /forestprep.
(This command must be issued on win 2000server holding schema master role in forest root domain to prepare existing schema to support win2003AD.)
2)adprep /domainprep
(infrastructure master to be deployed on win 2003 server
Note: adprep tool on win 2003 CD ROM i386 directory

37) what are the types of partitions a win2000 domain controller holds in a active directory?
Ans: Domain Partition: It contains all objects,objects associated with particular domain.
Schema master: It contains a copy of active directory schema for a given forest. this partition was replicated to all DC.
Configuration Master: which contains information about active directory sites& services.
Global catalog partition: :which contains a subset of the attributes of all objects in active directory forest.

38)what are the types of partitions that is supported by win 2003 server?
Ans: win 2003 server supports all four partitions, i.e supports win 2000 server.it also supports new partition.
Application directory partition: the main purpose of this partition is to store data (objects and attributes) related to active directory integrated application and services.
Note: it’s a partition that is replicated only to specific domain controller. it is used to store data relating to services such as DNS
Some benefits of using this partition
1)provides redundancy,availability,fault tolerance.
2) reduce replication traffic
3)allows applications or services thst use LDAP to store& access their data In A.D.
4)it holds any type of object except security principal such as users&computer&security groups.


39)How to check DC replication status,
Ans: Go to event logs for NTFRS (File Replication Service) It will tell you when the last synch was.

40)How to Enable or Disable a Global Catalog (GC)
Ans:Open to Administrative Tools>Active Directory Sites and Services>Sites, and then double-click the domain controller you want to work with in the Server folder for your desired site: Right-click NTDS Settings>Properties. Make a change accordingly.

WARNING: Do not turn on this option unless you are certain it will provide value in your deployment. For this option to be useful, your deployment must have multiple domains, and even then, only one global catalog is (typically) useful in each site.

41)How to install/remove AD/DC
Ans:To install/remove AD/DC, use Promote and Demote command.

42)How to repopulate AD DNS entries
Ans:Manually repopulate the Active Directory DNS entries. You can use the Windows 2000 Netdiag tool to repopulate the Active Directory DNS entries. Netdiag is included with the Windows 2000 Support tools. At a command prompt, type netdiag /fix.

This domain controller holds the last replica of the following application directory partitions

Symptoms: When you demote a DC by using the Active Dcpromo, you may receive the following error message: This domain controller holds the last replica of the following application directory partitions:
DC=MSTAPI,DC=yourdomain,DC=com

Resolutions: Try NTDSUTIL, Tapicfg.exe and dcpromo /forceremoval. Refer to case 082604JH.

43)What will happen when demoting a DC
Ans:When a domain controller is demoted, if it is not the last domain controller in the domain, it performs a final replication and then transfers the roles to another domain controller. If the domain controller is a global catalog, that role is not transferred to another domain controller. In this case, you must manually select the check box in Active Directory Sites and Services Manager for another domain controller to take over the role.