Jason Yoder, MCT

This question came about because when we set of DFS replication, it asked for permissions to be set. These permissions are share permissions, not NTFS permission. By changing the permission (NTFS or Share) on the folders in the DFSROOT folder, you can change both the NTFS and the Share permission after the DFS share has been created.

That one caught me off guard. I never thought of anybody putting a mac in an NAP setup. Thanks to Dan from Network Services Group ( http://networkservicesgroup.com/default.aspx)for walking into our classroom at the right time. Dan happened to be at the same training site as I am this week. He recommended going to http://unet.co.kr/nap/ to download an NAP client for Macintosh. Sure enough, someone thought about putting a Mac in an NAP.

In the DFS Manager, when you attempt to change the topology to facilitate more than 2 servers, you are required to delete the current topology and recreate it. From our in class testing, the data located on the Primary server (before first replication) over wrote the data on the destination server. At this point, expect to have a full replication done from your hub site for this migration. If anyone else has had a different experiance, please share it with us.

There are two approaches to implementing 802.1X NAP in your organization. You can utilize VLANs or Port ACLs. So the answer is maybe. If you go with the VLAN, you will have to bring in whom ever programs your switches to create you Unrestricted, Restricted, and guest VLANS. At that point, you can configure NPS to redirect client to where they need to go. You can also program Port ACLs on the switch. Have on policy tell the port that it is compliant, and another one for non-compliant. Your policies will tell the switch with ACL to use. Below is a blog from technet that describes this in more detail. http://blogs.technet.com/wincat/archive/2008/08/19/network-access-protection-using-802-1x-vlan-s-or-port-acls-which-is-right-fir-you.aspx

In Windows Server 2003, on the Dial-in tab of a users properties, the default setting is Control access through Remote Access Policy. In 2008, it is Control access through Network Policy Server. Since NPS actually allows for the configuration of multiple RRAS servers and their policies, this setting on a 2003 domain controller should still allows a users dial-in properties to be set according to NPS if a Widows Server 2008 is on the domain and NPS is configured. NPS is compatible with RRAS in Server 2000, 2003, and 2008 Reference: http://tehnet.micorosoft.com/en-us/library/cc771347.aspx

This was a hard one to do research on. We all know about the great capabilities of Active Directory and its ability to be expanded. The problem in researching this one is that Microsoft has many documents advertising what you can do with EAP authentication and active directory, but I had a difficult time finding a definitive yes or no as to where that data is store. Is it in Active Directory or a third party program that integrates with Active Directory? I did find one article that says Active Directory can store Biometric data alongside your other user profile information. Reference: http://searchfinancialsecurity.techtarget.com/tip/0,289483,sid185_gci1322177,00.html For authentication purposes, a certificate is use when you are using an EAP method, such as smart cards. Reference: http://technet.microsoft.com/en-us/library/cc732849.aspx Windows 7 has biometric management built in. Reference: http://technet.microsoft.com/en-us/library/dd367857.aspx

You can configure your local routers to forward your DHCP packets to the correct subnet. I do recommend having a DHCP server available on the local subnet. This is a good way to repurpose an older server or workstation with Windows 2008 Server Core.

You can add files the CMAK (Connection Manager Administration Kit) to allow you to run programs, or scripts, when a connection is established. This is a very powerful tool that goes beyond mapping drives and printers for you mobile workforce. During the creation of the CMAK profile, you are prompted if you like to include any files. This is where you would browse to include the programs, data, or scripts that will be required by your mobile users. You can also add them when you specify additional actions to take by checking the Include custom action program with this service profile. The files will be copied to the service profile location: c:\Program Files\CMAK\OS version\profile name.

No they do not. The idea behind the GlobalNames zone in Windows Server 2008 is that no client configuration is needed. Just remember that you need to meet these requirements. · DNS Servers must be Windows Server 2008. · Global Names Zone must be enabled (DNSCMD /config /enableglobalnamessupport 1) on each DNS server. · A forward lookup zone named GlobalNames must be set up on each DNS server that · · · Is active directory integrated · · · Does not support dynamic updates (recommended) · You must provide a CNAME record mapping the client name to its FQDN. When a client makes a single name request to a DNS server, DNS will check all its zones to try and match it to a FQDN. This will not work. After DNS has exhausted all its zones, it will look in the Globalnames zone. There, should it be present, it will locate a CNAME record for that single name. It will point to the FQDN record in the forward lookup zone. DNS will now return the IP address to t...

AD FS (Active Directory Federated Services) allow you to provide single sign on (SSO) capability to your business partners. You, as the resource organization, control the access. Your partner organization (or account organization) controls the accounts. That way the user management is not with you, but security is. The users of the partner organization can get access to your resources without creating new user accounts and passwords. The question of licensing comes into play. Microsoft that a licensing option called External Connector or EC license. This option allows you to provide access to your Windows Server 2000/2003/2008 environments to users who are part of a partner organization and access your resources remotely. You can also utilize a standards Server 2008 CAL for this. I still recommend talking with a Microsoft Licensing Specialist to best determine the licensing model for your organization. External Connector license overview. http://www.microsoft.com/windowsserver20...

The answer is continuously. When a health changing event occurs, the client notifies its enforcement point. Below is a link to a blog from Joe Davis, Senior Program Manager for NAP at Microsoft. http://blogs.technet.com/nap/archive/2008/09/05/what-is-the-nap-client-doing.aspx

By default, once you specify a backup location in the WINS MMC, Windows will backup the WINS database every 24 hours. Here is how you can back it up on a schedule. First you need to configure WINS to do a backup when it shuts down. • Open the WINS MMC . • Right mouse click the server and select Properties . • On the General tab, check Backup database during server shutdown . • Also, specify a default backup path. A simple batch file will do the trick. Net Stop WINS Net Start WINS Exit Use the Task Scheduler to run this at the required interval. Don’t forget to give the task the credentials to perform this task. To maintain availability, make sure that you have 2 WINS servers and your clients knows about both servers. Configure them as Push/Pull partners. The backup only needs to be done on one server. Class: 6421A Configuring and Troubleshooting a Windows Server 2008 Network Infrastructure

When a file in a DFS folder is changed in two or more locations between replication, a conflict occurs. The last one saved is going to be the one that is replicated. To ensure no critical data is lost, look for a folder on the local path of the replicated folder called DfsrPrivate/ConflictandDelete. You should find what you are looking for there. Reference: http://technet.microsoft.com/en-us/library/cc773238.aspx#BKMK_049

Simply put, anything lower is not supported. Microsoft did not include NAP compatibility in the older Service Packs. XP is compatible with NAP as long as it is up to date with SP3. Windows XP Home and Vista Home editions are also not compatible because they lack the ability to join a domain with is an NAP requirement. Reference: http://technet.microsoft.com/en-us/library/dd125301.aspx

I’m sorry to say that no, it does not. Take a look at the second Note at the bottom of this article: http://support.microsoft.com/kb/926185 It would be nice for those using Server 2008 as a workstation OS, but it looks like we will have to rely on Volume Shadow Copy Service and good old backups. Update to this article - May 8, 2009 For those of you running your environments in Hyper-V and want some sort of system restore, take a look at Hyper-V snapshots. Just remember to keep your data elsewhere and to thoroughly test using snapshots before using them in a production environment.

Microsoft tries to work with vendors to make their products compatible with the Windows Security Center. The product must be registered with Windows Security Center for its status to be reported to NAP for a validation check. As for how far out of date a definition file can be, NAP does not provide for this. APIs are available to developers so they can develop SHA’s (System Health Agents) to work with NAP to says the software is up to date or not. For a listing of Network Access Protection Partners: http://www.microsoft.com/windowsserver2008/en/us/nap-partners.aspx Reference: http://technet.microsoft.com/en-us/library/cc753550.aspx Class: 6421A Configuring and Troubleshooting a Windows Server 2008 Network Infrastructure

Yes you can, but not like you can for other services like DHCP or WINS. There are also different procedures for active directory integrated zones and non-integrated zones. Below is a link to an article in MCPMAG.COM that explains the steps in detail. http://mcpmag.com/columns/article.asp?editorialsid=1024 Class: 6421A Configuring and Troubleshooting a Windows Server 2008 Network Infrastructure

The Application Server Role is designed for applications that take advantage of one or more of the following: Internet Information Services (IIS) (the Hypertext Transfer Protocol (HTTP) server that is built into Windows Server) Microsoft® .NET Framework versions 3.0 and 2.0. (If you have applications that are built with the .NET Framework 3.5, you can download and install the .NET Framework 3.5 onto the operating system.) ASP.NET COM+ Message Queuing Web services that are built with Windows Communication Foundation (WCF) As always, check the documentation of your application or the developer’s web site for specific instructions on how to deploy to a Windows 2008 Server environment. Reference: http://technet.microsoft.com/en-us/library/cc754024.aspx Class: 6421A Configuring and Troubleshooting a Windows Server 2008 Network Infrastructure

The short answer is yes. DNSLINT works on Windows 2000 and later Operating Systems. DNSLINT helps you troubleshoot Active Directory . The link below will provide more of a description of DNSLINT and the download site from Microsoft. http://support.microsoft.com/kb/321045 Class: 6421A Configuring and Troubleshooting a Windows Server 2008 Network Infrastructure

You need to run the ADPREP command to populate your current Windows Server 2003 Active Directory environment with the schema and permissions to support the new features of Server 2008. You can get the ADPREP software on the Server 2008 source DVD at \sources\adprep folder. You have several options at this point: /ForestPrep – Use this on the server holding the Schema Operations Manager Role. This preps the entire forest. /DomainPrep – Run this after /ForestPrep in the domain that you want to add a Windows Server 2008 Domain Controller. This must be on the machine with the Infrastructure Operations Master Role for the domain. Reference: http://technet.microsoft.com/en-us/library/cc731728.aspx Class: 6421A Configuring and Troubleshooting a Windows Server 2008 Network Infrastructure