Windows Server 2012 Active Directory Interview Questions

More and more companies are realizing the power of cloud services and networks. With the release of Office 365, Cloud services, and employees working away from the office, collaboration is crucial. Ensuring the networks that connect employees and allow access to the documents and projects within an organization is therefore critical to allow organizations to function efficiently. This means that the demand for good network administrators and system administrators who understand Active Directory is increasing.

1. What is Active Directory?
Active Directory (AD) is a directory service developed by Microsoft and used to store objects like User, Computer, printer, Network information, It facilitate to manage your network effectively with multiple Domain Controllers in different location with AD database, able to manage/change AD from any Domain Controllers and this will be replicated to all other DC’s, centralized Administration with multiple geographical location and authenticates users and computers in a Windows domain.

2. Define Active Directory?
Active Directory is a database that stores data pertaining to the users within a network as well as the objects within the network. Active Directory allows the compilation of networks that connect with AD, as well as the management and administration thereof.

3. What is Domain?
Active Directory Domain Services is Microsoft’s Directory Server. It provides authentication and authorization mechanisms as well as a framework within which other related services can be deployed.

4. What is Active Directory Domain Controller (DC)?
Domain Controller is the server which holds the AD database, All AD changes get replicated to other DC and vise vase.

5. What is a domain within Active Directory?
A domain represents the group of network resources that includes computers, printers, applications and other resources. Domains share a directory database. The domain is represented by address of the resources within the database. A domain address generally looks like 125.170.456. A user can log into a domain to gain access to the resources that are listed as part that domain.

6. What is the domain controller?
The server that responds to user requests for access to the domain is called the Domain Controller or DC. The Domain Controller allows a user to gain access to the resources within the domain through the use of a single username and password.

7. What is Tree?
Tree is a hierarchical arrangement of windows Domain that share a contiguous name space.

8. What is Forest?
Forest consists of multiple Domains trees. The Domain trees in a forest do not form a contiguous name space however share a common schema and global catalog (GC).

9. Explain what domain trees and forests are?
Domains that share common schemas and configurations can be linked to form a contiguous namespace. Domains within the trees are linked together by creating special relationships between the domains based on trust.
Forests consist of a number of domain trees that are linked together within AD, based on various implicit trust relationships. Forests are generally created where a server setup includes a number of root DNS addresses. Trees within the forest do not share a contiguous namespace.

10. What is Schema?
Active directory schema is the set of definitions that define the kinds of object and the type of information about those objects that can be stored in Active Directory
Active directory schema is Collection of object class and there attributes
Object Class = User
Attributes = first name, last name, email, and others

11. What is FSMO?
FSMO (flexible single master operations) is a specialized domain controller (DC) set of tasks, used where standard data transfer and update methods are inadequate. AD normally relies on multiple peer DCs, each with a copy of the AD database, being synchronized by multi-master replication.
12. Tel me about the FSMO roles?
Schema Master
Domain Naming Master
Infrastructure Master
RID Master
PDC

Schema Master
The schema is shared between every Tree and Domain in a forest and must be consistent between all objects. The schema master controls all updates and modifications to the schema.

Domain Naming Master
Domain Naming Master FSMO Role. The Domain Naming Master FSMOrole owner is the DC responsible for making changes to the forest-wide domain name space of the directory in the Partitions container.

Infrastructure Master
The Infrastructure FSMO role is one of the three "per domain" Operations Masters. The infrastructure FSMO keeps its domain's references to objects in other domains up-to-date by comparing its data with information in the Global Catalog (GC).

RID Master
This SID consists of a domain SID (the same for all SIDs created in a domain) and a relative ID (RID) that is unique for each security principal SID created in a domain. RIDs are allocated from a RID pool that is controlled by the RID Master FSMO.

Relative ID (RID) Master
Allocates RIDs to DCs within a Domain. When an object such as a user, group or computer is created in AD it is given a SID. The SID consists of a Domain SID (which is the same for all SIDs created in the domain) and a RID which is unique to the Domain.
When moving objects between domains you must start the move on the DC which is the RID master of the domain that currently holds the object.

PDC
Microsoft recommends the careful division of FSMO roles, with standby DCs ready to take over each role. The PDC emulator and the RID master should be on the same DC, if possible. The Schema Master and Domain Naming Master should also be on the same DC.

PDC Emulator
The PDC emulator acts as a Windows NT PDC for backwards compatibility, it can process updates to a BDC.It is also responsible for time synchronizing within a domain. It is also the password master (for want of a better term) for a domain. Any password change is replicated to the PDC emulator as soon as is practical. If a logon request fails due to a bad password the logon request is passed to the PDC emulator to check the password before rejecting the login request.

13. How to check which server holds which role?
Netdom query FSMO.

14. What is LDAP?
LDAP is an acronym for Lightweight Directory Access Protocol and it refers to the protocol used to access, query and modify the data stored within the AD directories. LDAP is an internet standard protocol that runs over TCP/IP.

15. Explain what intrasite and intersite replication is and how KCC facilitates replication?
The replication of DC’s inside a single site is called intrasite replication whilst the replication of DC’s on different sites is called Intersite replication. Intrasite replication occurs frequently while Intersite replication occurs mainly to ensure network bandwidth.
KCC is an acronym for the Knowledge Consistency Checker. The KCC is a process that runs on all of the Domain Controllers. The KCC allows for the replication topology of site replication within sites and between sites. Between sites, replication is done through SMTP or RPC whilst Intersite replication is done using procedure calls over IP.

16. Name a few of the tools available in Active Directory and which tool would you use to troubleshoot any replication issues?
Active Directory tools include:
• Dfsutil.exe
• Netdiag.exe
• Repadmin.exe
• Adsiedit.msc
• Netdom.exe
• Replmon.exe
Replmon.exe is a graphical tool designed to visually represent the AD replication. Due to its graphical nature, replmon.exe allows you to easily spot and deal with replication issues.

17. What tool would you use to edit AD?
Adsiedit.msc is a low level editing tool for Active Directory. Adsiedit.msc is a Microsoft Management Console snap-in with a graphical user interface that allows administrators to accomplish simple tasks like adding, editing and deleting objects with a directory service. The Adsiedit.msc uses Application Programming Interfaces to access the Active Directory. Since Adsiedit.msc is a Microsoft Management Console snap-in, it requires access MMC and a connection to an Active Directory environment to function correctly.

18. How would you manage trust relationships from the command prompt?
Netdom.exe is another program within Active Directory that allows administrators to manage the Active Directory. Netdom.exe is a command line application that allows administrators to manage trust relationship within Active Directory from the command prompt. Netdom.exe allows for batch management of trusts. It allows administrators to join computers to domains. The application also allows administrators to verify trusts and secure Active Directory channels.

19. Where is the AD database held and how would you create a backup of the database?
The database is stored within the windows NTDS directory. You could create a backup of the database by creating a backup of the System State data using the default NTBACKUP tool provided by windows or by Symantec’s Netbackup. The System State Backup will create a backup of the local registry, the Boot files, the COM+, the NTDS.DIT file as well as the SYSVOL folder.

20. What is SYSVOL, and why is it important?
SYSVOL is a folder that exists on all domain controllers. It is the repository for all of the active directory files. It stores all the important elements of the Active Directory group policy. The File Replication Service or FRS allows the replication of the SYSVOL folder among domain controllers. Logon scripts and policies are delivered to each domain user via SYSVOL.
SYSVOL stores all of the security related information of the AD.

21. Briefly explain how Active Directory authentication works?
When a user logs into the network, the user provides a username and password. The computer sends this username and password to the KDC which contains the master list of unique long term keys for each user. The KDC creates a session key and a ticket granting ticket. This data is sent to the user’s computer. The user’s computer runs the data through a one-way hashing function that converts the data into the user’s master key, which in turn enables the computer to communicate with the KDC, to access the resources of the domain.

Courtesy:  saLman 

Do you need malware protection on a VDI thin client?

There are plenty of options for VDI thin client devices out there, and most are safe to use without antimalware software. Learn which thin client needs extra protection and why.

Most thin client devices don't require malware protection, but PCs repurposed as thin clients do.

There is a huge variety of VDI thin client hardware on the market, and these devices have widely varying capabilities, but as a general rule thin clients are not extremely susceptible to malware. It's usually not worth an administrator's effort to add malware protection to these machines.

However, some organizations repurpose old desktop PCs for use as thin clients, and admins should add malware protection on those. Repurposed PCs often run a desktop operating system with a hardened security configuration and connect directly to a virtual desktop session. These devices are configured not to run software locally, but it is still technically possible for malware to infect a repurposed desktop. Malware on these types of thin client devices can also attack hardware redirection or hardware drivers, which might, for example, inject a key logger onto the device.

Of course, many organizations use traditional thin client hardware from vendors such as Dell Wyse and HP Inc., which typically consist of little more than a small plastic case with ports for the keyboard, mouse, monitor, network and power supply. These types of devices do technically contain an operating system, but the OS is designed to have an extremely minimal footprint and is not easily exposed to or exploited by malware. Most organizations do little, if anything, to protect the OS on traditional VDI thin client devices.

If they really need to, administrators can gain root level access to a thin client's OS and install antimalware software if the device has sufficient capacity. In most cases, repurposed PCs with a thick operating system are the only type of thin client that admins can add antimalware protection to.

By and large, thin clients don't really need malware protection because the odds of malware being able to reach and infect them are very low.

 Courtesy: Brien Posey

Nano Server benefits means big changes for Windows Server

Windows Nano Server offers many benefits over traditional Windows Server deployments, including the ability to run multiple instances on a single host.

With the buzz surrounding the Windows 10 release to manufacturing and general availability, you may have missed an important out–of-band Windows Server announcement. It was totally reworked to be smaller, faster, more nimble and more secure. This version is Windows Nano Server, and it's an important development.

We first heard about Windows Nano Server in early 2015 when Microsoft distinguished engineer and lead architect Jeffrey Snover discussed it in a blog post. Windows Nano Server is a lighter version of Windows Server designed to run exclusively in cloud and container scenarios.

It strips out the graphical user interface stack, desktop and interactive application compatibility, as well as the entire 32-bit compatibility layer -- it will only run 64-bit applications. Nano Server doesn't support installing applications through Microsoft Installer technology, which further erodes traditional application support.

The benefits of this lobotomy of the traditional Windows Server product are legion:

·         The installed size of an entire Windows Nano Server instance can be up to 93% smaller than traditional Windows Server setups.

·         Reboots because of security patches and other sorts of configuration administration tasks are cut down by 80%.

·         In an analysis of security patches, Microsoft was able to demonstrate that 92% fewer critical patches would apply to a production Nano Server deployment than a traditional Windows Server instance.

·         The time required for a preboot execution environment to boot and install Nano Server over the network reduces from 19 minutes to three minutes.

Nano Server supports runtimes for C#, Java, Node.js, Python and more, so it makes for a compact, lightweight and robust Web server and Web application role. It also supports Hyper-V and scale out file server clusters, meaning you could have lots of these small Nano Server instances provide file server support on a fault tolerant basis; it would also be at a significantly lower cost than you can do so today because of the traditional Windows Server resource requirements in that role. You can program against it directly using Visual Studio, which is great for your development team to roll out a new application complete with a preinstalled operating system, such asDocker or other container options. You can also manage Nano Server instances with System Center, PowerShell remoting and the old-fashionedWindows Management Instrumentation. Most of your existing remote management tools will still work, but interactive ones and those requiring an agent to be installed on the system won't function with Nano Server.

Why is Windows Nano Server important?

I think Windows Nano Server is the biggest thing to happen to Windows Server, or maybe even the entire Windows platform itself, since Active Directory. Active Directory's introduction in Windows 2000 cemented a move away from the 16-bit kernels of Windows 3.1, Windows 95 and Windows 98 while ushering in the NT codebase as the one from which Windows would be built -- we still use that today. It improved the Windows platform's usability and stability, so much so that I don't think computing would be where it is today if Microsoft hadn't made that move.

Nano Server signals a similar sea change for Windows. It's a break with the past -- the complete elimination of interactive applications and 32-bit application compatibility -- and solves problems that can make Windows insecure and unreliable. A clean departure from the albatross of robust backward compatibility allows Nano Server to really get compact and rugged. It makes Nano Server instances extremely portable, executable anywhere -- from a local Hyper-V host to a server closet -- and makes having an "OS appliance" a reality.

Think about the pure scalability of this option. Microsoft has frequently put up to 1,000 Windows Nano Server instances on a single host. For Web hosts and others who always look to compartmentalize and consolidate, stacking hundreds of virtual machines on one host is a dream come true. Your scale out file server clusters can happen with a few thousand dollars' worth of hardware and your existing storage area network, not with thousands of dollars of machines equipped to run the full Windows Server version. Your developers can package up their own applications complete with a well-tuned, customized, fully set up Web environment and make it part of their installable package, fully realizing the promise of the DevOps movementwhile eliminating a lot of back and forth between the developers and the IT team to get configurations tweaked and "just so."

Windows Nano Server is a hugely important development. Watch for its general availability alongside Windows Server 2016 early next year. While it might not be totally practical for you right now, it will be soon.

Courtesy: Jonathan Hassell

Hypervisor Types

A Type 2 hypervisor, also called a hosted hypervisor, is a virtual machine manager that is installed as a software application on an existing operating system (OS).Top of Form

Bottom of Form

There are two types of hypervisors: Type 1 and Type 2. Type 2 hypervisors support guest virtual machines by coordinating calls for CPU, memory, disk, network and other resources through the physical host's operating system. This makes it easy for an end user to run a virtual machine on a personal computing device. Examples of this type of hypervisor include VMware, Oracle Virtual Box, Oracle VM for x86, Solaris Zones, Parallels and VMware Workstation.

In contrast, a Type 1 hypervisor (also called a bare metal hypervisor) is installed directly on physical host server hardware just like an operating system. Type 1 hypervisors run on dedicated hardware. They require a management console and are used in data centers. Examples of this type of hypervisor include Oracle OVM for SPARC, ESXi, Hyper-Vand KVM.  

Regardless of the implementation, virtual machines (VMs) and their guest operating systems are typically unaware of which type of hypervisor is implemented, as they interact only with the hypervisor itself.

Courtesy:Margaret Rouse

Common network errors and their causes

Network not behaving? Learn how to identify the most common network errors -- like discards and collisions -- and how to implement solutions to get your network humming again.

Troubleshooting network errors is a fact of life. Learning about the most common network errors and their potential causes will help you both identify and resolve problems more quickly, improving your ability to meet service-level agreements (SLAs) for your network.

Switches and routers register network errors, as do servers and PCs connected to the network. Although you can log into a device and check its network logs, more often you will use a network management tool of some sort that will use simple network management protocol (SNMP) or other protocols to collect logs from network devices to find problems. Sometimes, especially if you are working with unmanaged switches, you will use a network sniffer orprotocol analyzer to dig into a problem in greater detail. Here are some of the most common network errors:

File check sequence (FCS) errors.Nodes that transmit Ethernetframes append an FCS number, which lets the receiving device determine if the packet is complete and correct upon arrival. The sending node calculates the FCS number using an algorithm called cyclic redundancy checking (CRC). The receiving node uses CRC to calculate its own FCS field value; if that number matches the one received, the frame is good. Where the values do not match, there is an FCS error.  

FCS errors are most commonly caused by noise on the data network. Network noise can be created by cabling located too close to noise sources such as lights, elevator motors or other heavy machinery. Cabling that has not been pulled and terminated in line with the appropriate specifications can also generate noise. Too much wire left untwisted at termination -- or runs that are too long or bends that are too tight -- can introduce noise from external sources or from crosstalk among pairs. Poorly manufactured components can compound such problems.

Alignment errors. Ethernet frames should be comprised of complete bytes -- octets of bits. In other words, the length of a frame in bits should always be evenly divisible by eight. When a frame doesn't meet that criterion, it has an alignment error. Alignment errors should always generate FCS errors. As with other FCS errors, alignment errors most often result from noise on the cabling, although hardware problems in network interface cards or other network hardware can also cause them.

Collisions and late collisions. These common network errors are separate anomalies with similar resolutions. Collisions occur when more than one device tries to use the network at the same time. This is increasingly rare. Today, nearly all networks are switched networks, which means each cable run connects one device to another device, with each device equipped with separate pairs to transmit and receive data (also called full-duplex mode). Since information is transmitted on separate pairs, data from one device cannot collide with data from the other. However, sometimes network portsare misconfigured as half-duplex. When this occurs, the ports will try to use the same pairs to transmit and receive data. This results in collisions, which can quickly become excessive in high-throughput environments. Switching the connection to full duplex solves the problem. (Duplex mismatch is a related issue: One end of a connection thinks it is on full-duplex; the other is set up as half-duplex, and as a result errors mount rapidly.)

Discards. All network devices can discard packets, and are expected to. For example, a switch can discard packets that arrive tagged for a specific virtual LAN (VLAN) on a port not configured for that VLAN. Most devices will discard packets when they run low on buffer memory. For example, if a high-definition video conference session consumes all the high-priority delivery bandwidth on a port, a router might discard lower-priority packets (e.g., those associated with an SMTP mail transfer session). Discards force TCPapplications to resend packets, which increases application latency. Discards cause performance problems for UDP applications as well, typically in the form of audio or video artifacts. Some discarding is inevitable, but excessive discards can indicate that the switch is misconfigured (e.g., it should have a VLAN on it that it does not) or that the device sending to it is misconfigured (trying to send on the wrong VLAN). Excessive drops can also indicate that a port has insufficient bandwidth for its current usage profile. In that case, to solve this common network error the port needs to be upgraded or its traffic split across multiple links.

Unknown protocol errors. A switch or router can receive a packet whose meaning isn't understood. Usually, this is due to a receiving device having a particular protocol disabled when it is in fact needed, or the sending device does not disable the protocol when it ought to be. Such network errors are most common when a new device configuration is pushed out to one or both devices, or when new equipment is swapped in.

Size errors. Frames that are too short (under 64 bytes, called runts), or too long (more than 1,518 bytes without a signal that a long frame is coming) or giant (more than 6,000 bytes in any circumstance) generate errors. These are almost always the result of hardware problems in network interfaces or software problems in the network stack; these common network errors are fixed by updating software or replacing hardware.

Courtesy: John Burke

Why do I even need software-defined technologies?

Once you've figured out what software-defined technologies are, it's time to discover what they do and what benefits they can offer.

No matter what part of the data center you're talking about, the term software-defined continues to pop up. At this point, most admins and IT staff know what software-defined is and what it does. The next hurdle to overcome is figuring out if you even need to venture down that path. When it comes to software-defined technology, there are plenty of benefits that accompany it.

Why do we even need "software-defined" technology, and what are its benefits?

Today's data centers are often plagued by static hardware configurations that are usually managed by disconnected silos of IT specialists. This complicates and slows new provisioning, sometimes introducing errors or unforeseen consequences that might need remediation before the new workload can enter production. This is an unacceptable mix of circumstances for any business seeking rapid, flexible provisioning with a high degree of automation. Many IT professionals see software-defined technologies as a means of overcoming these problems and achieving the speed and flexibility that new users (and workloads) require from IT in the role of a service provider.

Software-defined technologies promise numerous benefits. The most obvious and often-repeated benefits include provisioning speed and flexibility -- IT silos disappear and resources can be provided, changed and recovered for reuse in a matter of just a few mouse clicks. The close corollary here is the promise of automation, allowing end users to request and provision their own resources without direct IT involvement. This frees IT time for work on more strategic endeavors which can yield more benefit to the business than addressing user provisioning request.

The myth &reality around software-defined everything

There is a strong potential for lower hardware costs. For example, a technology like software-defined networking provides a common traffic control schema for more efficient network traffic handling, yet results in simpler -- and potentially less expensive -- physical switches since all that remains is the actual data plane. For network functions virtualization, the use of virtual appliances provides software-only network devices like firewalls, WAN accelerators and so on; which can be considerably cheaper and easier to deploy than physical appliances to do the same jobs.

Integrated management can be more streamlined, with better insights into total resource availability and usage across the data center. This can help with capacity planning and ensure ample resources to meet expected demands. Since resources are abstracted from underlying hardware, there is less chance of inadvertent changes to individual device configurations which might be hard to spot or difficult to troubleshoot.

And software-defined initiatives will build momentum for more common APIs or protocols like OpenFlow. This translates to better software design and superior interoperability between different vendors' products.

Courtesy: Stephen J. Bigelow

What works for daily event log monitoring?

I have 80 Windows servers in the data center. What can I use for daily event log monitoring?

Windows event log files contain a treasure trove of information on server performance and operations. But they're tedious to trawl through on a regular basis, especially when you have more than a few servers to maintain in the data center.

Windows Server sorts event logsinto Application, Security and System sections and saves the event log files locally on each server by default.

There is a plethora of event log monitoring tools available, both free and paid. You'll need to decide which one best fits your needs. Whatever tool you pick, expect to do a lot of work at the beginning to clean up and remediate or ignore a lot of errors that it picks up from the log files. Once you remove the noise, what's left is a very valuable tool for maintenance and troubleshooting on Windows servers.

Here are a few options for log file monitoring, but due to the scale of offerings out there, please take this as a sampling only.

Free vs. paid log monitoring tools

At the free low-end scale, try Microsoft Windows Event Viewer's subscriptions option. You can create a central point to collect and read the event log files from multiple machines and apply filters, such as "Errors & Warnings." You can review the files on a daily basis, with errors remediated. This is as simple as you can get in log monitoring, so you will miss out real-time error alerting, or easy results management from hiding or ignoring certain errors.

Also free, but more feature-rich and complex are syslog -- a standard for message logging, with many variants, builds and add-ons -- and the ELK stack, which includes Elasticsearch, Logstash and Kibana. These will collect and collate logs from Windows Event Viewer tool as well as other sources. You can start by monitoring event logs, then collect application-specific logs from IIS, SQL or other applications from outside of Windows Event Viewer.

At the paid end, two popular examples are SolarWinds Log & Event Manager and Splunk on-premises or as a service. These products are for the higher end of the market, and are not just plug and play.

Paid or enterprise versions of event log monitoring tools provide great amounts of information and alerting around all manner of logs, including Event Viewer logs. However, they may be too complex for a small IT team to maintain.

Look for vendors like Splunk and SolarWinds that offer demos, which will give you a feel for how the tool can help in your server environment.

Courtesy: AdamFowler