Windows Server 2008 Training

Transcription

1 Windows Server 2008 Training Day -4 Vijay Bhalerao BCS, MCM, CISA, DCL,MCTS, ISO LA 1

2 Day-4 Troubleshooting AD & issues- Solutions Server Security Measures - Installation & configuration Demonstration - Installing & Configuring DNS, DHCP - Offline & Online AD Maintenance - Performance Monitoring - Windows System Resource Manager

3 Windows Server 2008 Troubleshooting AD & Issues

4 Introduction to AD DS Troubleshooting Active Directory troubleshooting begins when: Users can not login Active Directory related events appear in the Event Viewer Domain controller performance is degraded An alert is generated by a performance monitoring No / partial replication between domain controllers 4

5 Troubleshooting User Access Errors User access errors may be the result of: Network access errors Authentication errors Authorization errors To address user access errors, verify: Network connectivity Time synchronization Domain controller availability User account and user lockout settings Group memberships Authorization 5

6 Overview of DNS and AD DS Troubleshoot the integration Troubleshooting of DNS and Active Directory when: Users cannot log on to Active Directory Active Directory replication is failing Active Directory installation fails To troubleshoot DNS and Active Directory integration, verify: DNS client and server configurations DNS name registration DNS zone replication 6

7 Troubleshooting DNS Name Resolution DNS name resolution may fail due to: Network connectivity issues Client configuration errors DNS server availability Name registration or DNS replication issues To troubleshoot DNS name resolution: Test network connectivity to DNS server by IP address Use IPConfig to examine the client configuration Use Ping to verify server availability Flush the DNS cache Use NSLookup to verify SRV record 7

8 Troubleshoot DNS Name Registration DNS name registration may fail due to: Client configuration errors DNS server availability DNS zone configuration To troubleshoot DNS name registration: Verify that the client is configured to register in DNS Test DNS server availability Verify that the DNS zone is configured for dynamic updates Register the SRV records by restarting the Netlogon service 8

9 Troubleshooting DNS Zone Replication Investigate DNS zone replication issues when: DNS-related issues are specific to certain DNS server clients Zone information is not consistent on different DNS servers DNS server availability Name registration or DNS replication issues Troubleshoot Active Directory replication for Active Directory integrated zones To troubleshoot standard zone transfer issues: Verify network connectivity Verify primary server and secondary server configuration Verify Start of Authority record Verify zone transfer configuration 9

10 Common Replication Issues Symptom Replication does not finish or occur Replication is slow Client computers receive a slow response Possible causes Sites not connected by site links No bridgehead server in the site group Inefficient site topology and schedule No domain controller online in client site Not enough domain controllers Replication greatly increases network traffic Insufficient bandwidth Incorrect site topology

11 Troubleshooting Domain Controller Performance Issues Most common performance issues include: High CPU utilization High network utilization To resolve performance issues: Identify the processes with high CPU utilization Monitor application specific network traffic Move applications or services to another server Distribute Active Directory and DNS roles across multiple servers Review and modify the replication topology Deploy domain controllers with 64 bit hardware

12 Server Security Measures Installation & Configurations

13 INSTALLATION Installation Another Option Security Only Required Features/Services should be installed Core OS installation Guest Account should be Disabled Protect Object should be enabled Ports not required should be closed Zones should be active directory integrated Secure updates should be only allowed Sites should be secured if created Access should be given on Need To Know Basis Protecting DC Physical Security Virtual DC - Security

14 Features DNS Trust RODC WSUS Description DDNS, RWDNS, RDNS Trust relationship between Multiple Forest Password Caching Approved updates should be installed

15 Admin & Diagnostics Auditpol Dcdiag Wbadmin WSRM Account Logon events Diagnostic & Health Checking Tool Backup & Restore Tool Windows System Resource Manager Tool

16 What Are the Account Policies? Account policies mitigates the threat of brute force guessing of account passwords Account policies consist of : Policies Description Password Enforce password history : 24 passwords Max password age : 42 days Min password age : 1 day Min password length : 7 characters Complex password : enabled Store password using reversible encryption : disabled Account lockout Lockout duration : not defined Lockout threshold : 0 invalid logon attempts Reset account lockout after : not defined Kerberos Can only be applied at the domain level

17 What Are Fine-Grained Password Policies? Fine grained password allow multiple password policies to exist in the same domain Password changes: 7 days Administrator group Password changes: 14 days Manager group End user group Password changes: 30 days

18 Questions? 18

19 Test 1) Select all correct types of DNS Zones? A) Primary B) Secondary C) Stub D) Private 2) Benefit of Active directory integrated Zone is. A) Availability B) Enhance Security C) Ease of Operation D) Durability 3) RODC cannot be configured as Operations Master? A) True B) False 4) Which of the following is not domain functional level? A) Windows 2000 Native B) Windows Server 2003 C) Windows 98 D) Windows Server ) What are various Operation s Master Role? (Select All Applicable) A) Infrastructure B) PDC Emulator C)Hyper-V D) RID 19

20 Forest Wood.com W1 Teak.com W2 W3 T 1 W Server T 2 T 3 20

21 Forest Wood.com W4 W1 W5 W2 W3 Application server W Server 21