Exam Profile: MCSE: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (70-294)

Date: Jan 26, 2011

Return to the article

The 70-294 exam is meant to be taken by those who have at least one year of administrator experience in a network that includes more than 350 users, at least three physical locations, and at least three domain controllers. Experience with Windows 2003 specifically is recommended but not absolutely necessary. After you pass the Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure exam, in addition to being on your way to the MSCE certification, you achieve Microsoft Certified Professional (MCP) status. You also earn credit toward the following certifications:

• Core credit toward Microsoft Certified Systems Administrator (MCSA) on Windows Server 2003 certification
• Core credit toward Microsoft Certified Systems Engineer (MCSE) on Windows Server 2003 certification
• Core credit toward Microsoft Certified Database Administrator (MCDBA) on Microsoft SQL Server 2000 certification

In order to get your Microsoft MCSE certification, you will be required to pass seven exams (in any order):

• Four exams on networking systems
• One exam on client operating systems
• One exam on design
• One elective exam

The 70-294 is a core exam that counts toward one of the four networking system exams that must be taken.

Exam Details

• Number of Questions: Approximately 45 questions with 3-5 simulations (Since Microsoft does not publish this information, the number of exam questions may change without notice.)
• Types of Questions: This test consists mainly of multiple choice questions, but can also contain drag and drop, build list and reorder questions. You will definitely see multiple simulation questions.
• Passing Score: 700 out of 1000
• Time Limit: 4 hours
• How to Register: Prometric.com or Certiport.com

Trouble Spots

As with any exam, it will vary from person to person as to what is deemed to be difficult. While one person may have trouble with groups, another will find RAID configurations to be hard to understand. There are no real issues with this exam that you need to watch for other than to know the objectives. Hands-on experience that deals with managing and maintaining a Windows network will be of immense value, especially when it comes to the simulations. Basically, the simulations present a mock-up of the computer screen that behaves similarly to an actual server. In a simulation, you may have to set permissions for a folder or add users to a group or some other task.

Preparation Hints

Review the Exam Objectives below and make sure that you are familiar with them. If you do have access to a Windows 2003 network, hands-on practice in that environment will help you to connect the theory with real life. Always check the Microsoft site for the specific exam you are going to take. In this instance, the site is http://www.microsoft.com/learning/en/us/exam.aspx?ID=70-294&locale=en-us.

There are many web sites and blogs that can help you to research topics, but be careful to fully research the information you read. It is not advisable to try to find sites that list questions and answers for several reasons. First, you don’t know if you will be asked a specific question and second, the answers given in a blog may be inaccurate and third, you need to understand the information to adequately prepare.

When taking the exam, read each question carefully, as Microsoft is notorious for adding a lot of unneeded information in their questions. Make sure that when you click on a choice, that it is really marked. Be careful clicking anywhere on the screen. I found that by inadvertently clicking near the scroll bar on the right of the screen, I actually changed an answer. You get a single piece of paper and a marker for writing. You can use a small amount of time before you even start the exam to make notes once you enter the test area. Sometimes there is even a questionnaire at the beginning of the test that does not count against your test time. You can use this time to write down notes, facts, tables or other information rather than taking up time between answers. Since this particular exam is four hours long, if you are prepared, you should have plenty of time.

Recommended Study Resources

Trancender

MCSA/MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition) by Will Willis and David Watts

MCSE 70-294 Exam Prep: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition) by Don Poulton

Exam Objectives

This exam is broken up into five different categories. We will look at what you have to know in each category to pass the exam.

Planning and Implementing an Active Directory Infrastructure

• Plan a strategy for placing global catalog servers.

A global catalog server is a domain controller that provides the ability to locate objects from any domain without having to know the domain name. Global catalog servers can use a lot of bandwidth because of replication.

• Evaluate network traffic considerations when placing global catalog servers.

You should not place a global catalog server where there is already network congestion. It will not be able to respond to queries in a timely fashion.

• Evaluate the need to enable universal group caching.

Universal group caching can be enabled in lieu of a global catalog server for smaller networks or if bandwidth is an issue.

• Plan flexible operations master role placement.
  • Plan for business continuity of operations master roles.

  The servers that function as the schema master, PDC emulator, domain naming master, infrastructure master and RID master require a single server approach.

  • Identify operations master role dependencies.
• Implement an Active Directory directory service forest and domain structure.
  • Set an Active Directory forest and domain functional level based on requirements.

  The highest-level container in Active Directory is the forest. A single forest is the simplest model. Because forests can contain millions of objects, there are few technical reasons why the majority of organizations cannot deploy a single forest to meet their needs.

  • Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and cross-forest trusts.
  • Create the forest root domain.

  The first domain created by default is the forest root domain. All objects in a single forest are listed in the global catalog.

  • Create a child domain.

  A child domain is a new domain under the parent. It will share a contiguous namespace with the parent domain. You create the child domain using the Active Directory Installation Wizard.

  • Create and configure Application Data Partitions.

  NtdsUtil is a command line utility that can be used to create application directory partitions.

  • Install and configure an Active Directory domain controller.

  Installing an AD domain controller is an important step that requires a lot of planning. Small organizations may only need one domain controller, but should have two for redundancy. To promote a member server to a domain controller, run the command line utility DCpromo.exe

• Implement an Active Directory site topology.
  • Configure site links.

  Site Links are created to link sites. Replication traffic will travel these links. Every site must be included in a site link in order for changes to be replicated between domain controllers.

  • Configure preferred bridgehead servers.

  Assigning a bridgehead server manually can create problems.

  The Knowledge Consistency Checker (KCC) automatically assigns one or more bridgehead servers to make sure that changes in Active Directory are replicated across a site link one at a time.

• Plan an administrative delegation strategy.

Administration of Active Directory components can be delegated allowing for decentralized management.

• Plan an organizational unit (OU) structure based on delegation requirements.

You can use OUs to delegate administration to a group or an individual allowing for management of local data and resources.

• Plan a security group hierarchy based on delegation requirements.

The three types of security groups are domain local, global and universal.

Managing and Maintaining an Active Directory Infrastructure

• Manage an Active Directory forest and domain structure.
  • Manage schema modifications.

  There can only be one schema per forest. The attributes that are defined in the forest affect all domains and OUs. There are default attributes that cannot be modified and there are others that can be added or deleted.

  • Add or remove a UPN suffix.

  A User Principal Name is added through the Active Directory Domains and Trusts.

• Manage an Active Directory site.

As mentioned before, the Knowledge Consistency Checker (KCC) is responsible by default for setting up replication inside and outside the site. Inside replication will be optimized for speed and outside replication will be optimized for bandwidth.

• Configure replication schedules.

Replication should be configured to occur during off hours, which is usually at night.

• Configure site link costs.

You may have several links that can be used for replication. Active Directory Sites and Services can be used for assigning costs to those links. The Knowledge Consistency Checker will use this information and will avoid links that have a high cost associated with it.

• Configure site boundaries.

You need to consider what will happen if connectivity between sites is disrupted. If your site does not have its own domain controller, data servers, DHCP servers, etc., it will not be able to function.

• Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools.
  • Monitor Active Directory replication.

  To monitor replication, you would use the Directory Service Event Log in Event Viewer, Repadmin.exe or Dcdiag.exe.

  • Monitor File Replication service (FRS) replication.

  To monitor FRS replication you can use Event Viewer events associated with the File Replication Service or use FRSDiag.exe, which is a command line utility.

• Restore Active Directory services.
  • Perform an authoritative restore operation.

  An authoritative restore is most commonly used in cases in which a change was made within the directory that must be reversed, such as deleting an OU by mistake.

  • Perform a nonauthoritative restore operation.

  A nonauthoritative restore is most commonly used in cases when a DC fails because of a hardware or software related reasons.

• Troubleshoot Active Directory.

Some of the new tools in Windows 2003 that can be used to troubleshoot AD are: Dsadd.exe, Dsget.exe, Dsmod.exe, Dsmove.exe, DSQuery.exe and DSrm.exe

• Diagnose and resolve issues related to Active Directory replication.

A system administrator needs to review the Directory Service Log frequently to stay on top of replication problems.

• Diagnose and resolve issues related to operations master role failure.

If a current operations master has become unavailable, you can use the Ntdsutil.exe utility to seize the operations master role.

• Diagnose and resolve issues related to the Active Directory database.

Once again, Event Viewer will help you to troubleshoot and diagnose problems relate to the Active Directory database.

Planning and Implementing User, Computer, and Group Strategies

• Plan a security group strategy.

Organizing users or computers into groups makes your life as an administrator much easier. Instead of assigning permissions to dozens of users individually, you can create a group containing those users and assign permissions to the group. The four types of groups are Local, Domain Local, Global and Universal.

• Plan a user authentication strategy.

There are many attributes that can be assigned to a user account: Account Expiration, Logon Hours, Enable/Disable, Locked Out, Must Change Password at next Logon, Cannot Change Password, Password Never Expires.

• Plan a smart card authentication strategy.

A smart card allows a user to login using their card and a PIN. Smart cards store certificates, public and private keys, and passwords.

• Create a password policy for domain users.

Passwords have become much more complex since users started logging in. You must determine how you will setup the password requirements in your organization. You can set your password length, require it to have upper and lower case, require it to have a number and require it to have special characters.

• Plan an OU structure.

An Organizational Unit is used to delegate and decentralize control in your organization.

• Analyze the administrative requirements for an OU.

An Organization Unit is the smallest unit to which a Group Policy can be applied. Group Policies can be set to control the behavior of security and desktop configurations. Group Policies are applied in the following order: Local, Site, Domain, Parent and Child.

• Analyze the Group Policy requirements for an OU structure.
• Implement an OU structure.
  • Create an OU.

  You create an OU using Active Directory Computers and Users. You simply right-click on the location where you want a new OU and then choose New, Organization Unit.

  • Delegate permissions for an OU to a user or to a security group.

  The Delegation of Control Wizard is used to delegate control of an OU to a specific user or group.

  • Move objects within an OU hierarchy.

  The easiest way to move an OU to a different location in Active Directory is to simply drag and drop. You can also right-click on the OU and choose move or use the Dsmove.exe command line utility.

Planning and Implementing Group Policy

• Plan Group Policy strategy.
  • Plan a Group Policy strategy by using Resultant Set of Policy (RSoP) Planning mode.

  Group Policies should not be taken lightly. Applying a poorly conceived GP can create many problems for you. Resultant Set of Policy (RSoP) is a tool that allows you to review and test new policies before implementation.

  • Plan a strategy for configuring the user environment by using Group Policy.

  These settings are used to configure policies which affect users. The computer which the user is logging on to does not influence whether these settings are applied. User configuration settings are applied when a user logs on to the computer.

  • Plan a strategy for configuring the computer environment by using Group Policy.
    • Computer startup and shutdown
    • User logon and logoff
    • Registry based policy settings
    • Security settings
    • Scripts
    • Folder Replication
    • Application deployment and management
• Configure the user environment by using Group Policy.
  • Distribute software by using Group Policy.

  One key design feature of Active Directory is to ease the process of deploying software within an organization. Microsoft included the ability to deploy and distribute software using Group Policy. You can assign an application, which causes it to be installed automatically or you can publish an application, which allows the user to decide if the application should be installed.

  • Automatically enroll user certificates by using Group Policy.

  You need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.

  • Redirect folders by using Group Policy.

  Folder Redirection Group Policy Object can be used to redirect folders. You would use this if you wanted all of your users’ folders to point to a server. This would prevent users from saving data locally where it would probably not get backed up regularly.

  • Configure user security settings by using Group Policy.

  Security policies can affect Password Policy, Account Lockout Policy, Group Membership, User Rights Assignment, Authentication, Available Resources and Security Options.

• Deploy a computer environment by using Group Policy.

Group Policies can dictate a users wallpaper, desktop, available applications, standardized messages, etc.

• Distribute software by using Group Policy.

As mentioned earlier, Group Policy can distribute mandatory software or make optional software available.

• Automatically enroll computer certificates by using Group Policy.

This is similar to automatically enrolling user certificates in that you need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.

• Configure computer security settings by using Group Policy.

This too is similar to configuring user security settings. The types of things you can control with Group Policy are Password Policy, Account Lockout Policy, Kerberos Policy, User Rights Assignment and Security Options.

Managing and Maintaining Group Policy

• Troubleshoot issues related to Group Policy application deployment. Tools might include RSoP and the gpresult command.
• Maintain installed software by using Group Policy.

Just as you can distribute software using Group Policy, you can use Group Policy to make changes to the original deployment. You can even remove software with Group Policy.

• Distribute updates to software distributed by Group Policy.
• Configure automatic updates for network clients by using Group Policy.

Where to Go from Here

After you pass the Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (70-294) Exam, you have three more core exams to pass on your way to becoming an MCSE.

They are:

• Managing and Maintaining a Windows Server 2003 Environment Exam 70-290
• Implementing, Managing, and Maintaining a Windows Server 2003 Network Infrastructure Exam 70-291
• Planning and Maintaining a Windows Server 2003 Network Infrastructure Exam 70-293

© 2024 Pearson Education, Pearson IT Certification. All rights reserved.

800 East 96th Street, Indianapolis, Indiana 46240