Microsoft 70-640 Braindumps 2021

NEW QUESTION 1
Your company has an Active Directory forest that contains Windows Server 2008 R2 domain controllers and DNS servers. All client computers run Windows XP SP3.
You need to use your client computers to edit domain-based GPOs by using the ADMX files that are stored in the ADMX central store.
What should you do?

• A. Add your account to the Domain Admins grou
• B. Upgrade your client computers to Windows 7.
• C. Install .NET Framework 3.0 on your client computer
• D. Create a folder on PDC emulator for the domain in the PolicyDefinitions pat
• E. Copy the ADMX files to the PolicyDefinitions folde

Answer: B

Explanation:
http://technet.microsoft.com/en-us/library/cc709647%28v=ws.10%29.aspx Managing Group Policy ADMX Files Step-by-Step Guide
Microsoft Windows Vista. and Windows Server 2008 introduce a new format for displaying registry-based policy settings. Registry-based policy settings (located under the Administrative Templates category in the Group Policy Object Editor) are defined using a standards-based, XML file format known as ADMX files. These new files replace ADM files, which used their own markup language. The Group Policy tools —Group Policy Object Editor and Group Policy Management Console—remain largely unchanged. In the majority of situations, you will not notice the presence of ADMX files during your day-to-day Group Policy administration tasks. http://blogs.technet.com/b/grouppolicy/archive/2008/12/17/questions-on-admx-in-windows-xp-and-windows2003-environments.aspx Questions on ADMX in Windows XP and Windows 2003 environments We had a question a couple of days ago about the usage of ADMX template formats in Windows XP/Server 2003 environments. Essentially the question was: “…What’s the supported or recommended way of getting W2k8 ADMX templates applying in a W2k3 domain with or with no W2k8 DCs. What I’ve done in test is, created a central store in the /Sysvol/domain/policies folder on the 2k3 DC (PDC) and created and edited a GPO using GPMC from the W2k8 member server applying to a W2k8 machine and it seems to work just fine. Is this the right way to do it?…” The answer is Yes. Again this is one of those things that confuse people. The template format has nothing to do with the policy file that’s created. Its just used to create the policy by the administrative tool itself. In the case of GPMC on Windows XP and Windows Server 2003 and previous – this tool used the ADM file format. These ADM files were copied into every policy object on the SYSVOL, which represents about 4MB of duplicated bloat per policy. This was one of the areas that caused major problems with an issue called SYSVOL bloat. In Vista and Server 2008 this template format changed to ADMX. This was a complete change towards a new XML based format that aimed to eliminate SYSVOL bloat. It doesn’t copy itself into every policy object but relies on a central or local store of these templates (Note that even in the newer tools you can still import custom ADM files for stuff like Office etc). In the question above, the person wanted to know if copying the local store, located under c:/windows/ policydefinitions, could be copied into a Windows Server 2003 domain environment as the central store and Explanationd by the newer admin tools. Again the domain functional mode has little to do with Group Policy. I talked about that one before. The things that we care about are the administrative tools and the client support for the policy functions. So of course it can. Here’s the confusion-reducing scoop – Group Policy as a platform only relies on two main factors. Active Directory to store metadata about the policy objects and to allow client discoverability for the location of the policy files. The other is the SYSVOL to store the policy files. So at its core that’s LDAP and SMB file shares. Specific extensions on top of the policy platform may require certain domain functionality but that’s very specific to that extension. Examples are the new Wireless policy and BitLocker extensions in Vista SP1. They require schema updates – not GP itself. So if you don't currently use them then you don't have to update schema. So provided you’re using Windows Vista SP1 with RSAT or Windows Server 2008 to administer the policies you get all the benefits to manage downlevel clients. That means eliminating SYSVOL bloat. That means all the joys of Group Policy PExplanations. Honestly – it amazes us the amount of IT Pros that still haven’t discovered GPP…especially with the power it has to practically eliminate logon scripts! As a last point – IT Pros also ask us when we will be producing an updated GPMC version for Windows XP to support all the new stuff. The answer is that we are not producing any updated GPMC versions for Windows XP and Server 2003. All the new administrative work is being done on the newer platforms. So get moving ahead! There are some really good benefits in the newer tools and very low impact to your current environment. You only need a single Windows Vista SP1 machine to start!

NEW QUESTION 2
Your network contains an Active Directory forest named contoso.com. The forest contains a single domain and 10 domain controllers. All of the domain controllers run Windows Server 2008 R2 Service Pack 1 (SP1).
The forest contains an application directory partition named dc=app1/dc=contoso,dc=com. A domain controller named DC1 has a copy of the application directory partition.
You need to configure a domain controller named DC2 to receive a copy of dc=app1,dc=contoso,dc=com.
Which tool should you use?

• A. Dsdbutil
• B. smgmt
• C. Dsamain
• D. Dsmod

Answer: B

NEW QUESTION 3
Your network contains a single Active Directory domain. All servers run Windows Server 2008 R2.
You deploy a new server that runs Windows Server 2008 R2. The server is not connected to the internal network.
You need to ensure that the new server is already joined to the domain when it first connects to the internal network.
What should you do?

• A. From a domain controller, run sysprep.exe and specify the /oobe paramete
• B. From the new server, run sysprep.exe and specify the /generalize paramete
• C. From a domain controller, run sysprep.exe and specify the /generalize paramete
• D. From the new server, run sysprep.exe and specify the /oobe paramete
• E. From a domain-joined computer, run djoin.exe and specify the /provision paramete
• F. From the new server, run djoin.exe and specify the /requestodj paramete
• G. From a domain-joined computer, run djoin.exe and specify the /requestodj paramete
• H. From the new server, run djoin.exe and specify the /provision paramete

Answer: C

Explanation:
Explanation 1: MS Press - Self-Paced Training Kit (Exam 70-640) (2nd Edition, July 2012) pages 217, 218 Offline Domain Join Offline domain join is also useful when a computer is deployed in a lab or other disconnected environment. When the computer is connected to the domain network and started for the first time, it will already be a member of the domain. This also helps to ensure that Group Policy settings are applied at the first startup. Four major steps are required to join a computer to the domain by using offline domain join:
1. Log on to a computer in the domain that is running Windows Server 2008 R2 or Windows 7 with an account that has permissions to join computers to the domain.
2. Use the DJoin command to provision a computer for offline domain join. This step prepopulates Active
Directory with the information that Active Directory needs to join the computer to the domain, and exports the information called a blob to a text file.
3. At the offline computer that you want to join the domain use DJoin to import the blob into
the Windows directory.
4. When you start or restart the computer, it will be a member of the domain.
Explanation 2:
http://technet.microsoft.com/nl-nl/library/offline-domain-join-djoin-step-by-step.aspx
Steps for performing an offline domain join
The offline domain join process includes the following steps:
1. Run the djoin.exe /provision command to create computer account metadata for the
destination computer (the computer that you want to join to the domain). As part of this
command, you must specify the name of the domain that you want the computer to join.
2. Run the djoin.exe /requestODJ command to insert the computer account metadata into
the Windows directory of the destination computer.
3. When you start the destination computer, either as a virtual machine or after a complete
operating system installation, the computer will be joined to the domain that you specify.

NEW QUESTION 4
Your network contains an Active Directory domain named contoso.com. Contoso.com contains a writable domain controller named DC1 and a read-only domain controller (RODC) named DC2. All domain controllers run Windows Server 2008 R2.
You need to install a new writable domain controller named DC3 in a remote site. The solution must minimize the amount of replication traffic that occurs during the installation of Active Directory Domain Services (AD DS) on DC3.
What should you do first?

• A. Run dcpromo.exe /createdcaccount on DC3.
• B. Run ntdsutil.exe on DC2.
• C. Run dcpromo.exe /adv on DC3.
• D. Run ntdsutil.exe on DC1.

Answer: D

Explanation:
We can run dcpromo.exe /adv on DC3 to install a new writable domain controller using the
Install From Media (IFM) option. That way there is less replication traffic. But before we can
do that we have to create the installation media first. I suspect that's what they mean when
they say "What should you do first?" So first we create the installation media, then we use
the installation media to install DC3.
Technet gives us instructions on how to create the installation media. It says:
"You can use the Ntdsutil.exe tool to create installation media for additional domain
controllers that you are creating in a domain. By using the Install from Media (IFM) option,
you can minimize the replication of directory data over the network. This helps you install
additional domain controllers in remote sites more efficiently."
"You must use writeable domain controller installation media to install a writeable domain
controller. You can create writeable domain controller installation media only on a writeable
domain controller."
Since DC2 in answer B is a read-only domain controller, that leaves us with answer D
("Run ntdsutil.exe on DC1").
Explanation 1:
http://technet.microsoft.com/en-us/library/cc770654.aspx
[Used for the information above]
[Some extra info on using IFM to install the DC:]
Explanation 2:
http://http://technet.microsoft.com/en-us/library/cc732887.aspx
dcpromo /adv
Performs an install from media (IFM) operation.
Explanation 3:
http://http://technet.microsoft.com/en-us/library/cc816722.aspx
Installing an Additional Domain Controller by Using IFM When you install Active Directory Domain Services (AD DS) by using the install from media (IFM) method, you can reduce the replication traffic that is initiated during the installation of an additional domain controller in an Active Directory domain. Reducing the replication traffic reduces the time that is necessary to install the additional domain controller.

NEW QUESTION 5
You need to ensure that users who enter three successive invalid passwords within 5 minutes are locked out for 5 minutes.
Which three actions should you perform? (Each correct answer presents part of the solution.
Choose three.)

• A. Set the Minimum password age setting to one da
• B. Set the Maximum password age setting to one da
• C. Set the Account lockout duration setting to 5 minute
• D. Set the Reset account lockout counter after setting to 5 minute
• E. Set the Account lockout threshold setting to 3 invalid logon attempt
• F. Set the Enforce password history setting to 3 passswords remembere

Answer: CDE

Explanation:

C:Documents and Settingsusernwz1Desktop1.PNG

NEW QUESTION 6
Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. The Audit account management policy setting and Audit directory services access setting are enabled for the entire domain.
You need to ensure that changes made to Active Directory objects can be logged. The logged changes must include the old and new values of any attributes.
What should you do?

• A. Run auditpol.exe and then configure the Security settings of the Domain Controllers O
• B. From the Default Domain Controllers policy, enable the Audit directory service access setting and enable directory service change
• C. Enable the Audit account management policy in the Default Domain Controller Polic
• D. Run auditpol.exe and then enable the Audit directory service access setting in the Default Domain polic

Answer: A

Explanation:
http://technet.microsoft.com/en-us/library/cc731607%28v=ws.10%29.aspx AD DS Auditing Step-by-Step Guide In Windows Server 2008 you can now set up AD DS auditing with a new audit subcategory to log old and new values when changes are made to objects and their attributes.
The ability to audit changes to objects in AD DS is enabled with the new audit policy subcategory Directory Service Changes. This guide provides instructions for implementing this audit policy subcategory. The types of changes that you can audit include a user (or any security principal) creating, modifying, moving, or undeleting an object. The new audit policy subcategory adds the following capabilities to auditing in AD DS: When a successful modify operation is performed on an attribute, AD DS logs the previous and current values of the attribute. If the attribute has more than one value, only the values that change as a result of the modify operation are logged. If a new object is created, values of the attributes that are populated at the time of creation are logged. If the user adds attributes during the create operation, those new attribute values are logged. In most cases, AD DS assigns default values to attributes (such as samAccountName). The values of such system attributes are not logged. If an object is moved, the previous and new location (distinguished name) is logged for moves within the domain. When an object is moved to a different domain, a create event is generated on the domain controller in the target domain. If an object is undeleted, the location where the object is moved to is logged. In addition, if the user adds, modifies, or deletes attributes while performing an undelete operation, the values of those attributes are logged.
In Windows Server 2008, you implement the new auditing feature by using the following controls: Global audit policy System access control list (SACL) Schema Global audit policy Enabling the global audit policy, Audit directory service access, enables all directory service policy subcategories. You can set this global audit policy in the Default Domain Controllers Group Policy (under Security SettingsLocal PoliciesAudit Policy). In Windows Server 2008, this global audit policy is not enabled by default. Although the subcategory Directory Service Access is enabled for success events by default, the other subcategories are not enabled by default. You can use the command-line tool Auditpol.exe to view or set audit policy subcategories. There is no
Windows interface tool available in Windows Server 2008 to view or set audit policy
subcategories.
Further information:
http://technet.microsoft.com/en-us/library/cc731451%28v=ws.10%29.aspx
Auditpol
Displays information about and performs functions to manipulate audit policies.
http://servergeeks.wordpress.com/2012/12/31/auditing-directory-services/
AD Scenario – Auditing Directory Services
Auditing of Directory Services depends on several controls, these are:
1. Global Audit Policy (at category level using gpmc.msc tool)
2. Individual Audit Policy (at subcategory level using auditpol.exe tool)
3. System ACLs – to specify which operations are to be audited for a security principal.
4. Schema (optional) – this is an additional control in the schema that you can use to create
exceptions to what is audited.
In Windows Server 2008, you can now set up AD DS (Active Directory Domain Services)
auditing with a new audit policy subcategory (Directory Service Changes) to log old and
new values when changes are made to AD DS objects and their attributes. This can be
done using auditpol.exe tool.
Command to check which audit policies are active on your machine: auditpol /get
/category:*

C:Documents and Settingsusernwz1Desktop1.PNG Command to view the audit policy categories and Subcategories:

C:Documents and Settingsusernwz1Desktop1.PNG
How to enable the global audit policy using the Windows interface i.e. gpmc tool Click Start, point to Administrative Tools, and then Group Policy Management or run gpmc.msc command.
In the console tree, double-click the name of the forest, double-click Domains, double-click the name of your domain, double-click Domain Controllers, right-click Default Domain Controllers Policy, and then click Edit.

C:Documents and Settingsusernwz1Desktop1.PNG
Under Computer Configuration, double-click Policies, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then click Audit Policy.

C:Documents and Settingsusernwz1Desktop1.PNG
In the details pane, right-click Audit directory service access, and then click Properties.
Select the Define these policy settings check box.
Under Audit these attempts, select the Success, check box, and then click OK.

C:Documents and Settingsusernwz1Desktop1.PNG
How to enable the change auditing policy using a command line
Click Start, right-click Command Prompt, and then click Run as administrator.
Type the following command, and then press ENTER:
auditpol /set /subcategory:”directory service changes” /success:enable
To verify if the auditing is enabled or not for “Directory Service Changes”, you can run
below command:
auditpol /get /category:”DS Access”

C:Documents and Settingsusernwz1Desktop1.PNG
How to set up auditing in object SACLs Click Start, point to Administrative Tools, and then click Active Directory Users and Computers. Right-click the organizational unit (OU) (or any object) for which you want to enable
auditing, and then click Properties.
Click the Security tab, click Advanced, and then click the Auditing tab.

C:Documents and Settingsusernwz1Desktop1.PNG
Click Add, and under Enter the object name to select, type Authenticated Users (or any other security principal) and then click OK.

C:Documents and Settingsusernwz1Desktop1.PNG
In Apply onto, click Descendant User objects (or any other objects). Under Access, select the Successful check box for Write all properties. Click OK

C:Documents and Settingsusernwz1Desktop1.PNG
Click OK until you exit the property sheet for the OU or other object.
To Test whether auditing is working or not, try creating or modifying objects in Finance OU
and check the Security event logs.
I just created a new user account in Finance OU named f4.

C:Documents and Settingsusernwz1Desktop1.PNG
If you check the security event logs you will find eventid 5137 (Create)
Note:
Once the auditing is enabled these eventids will appear in security event logs: 5136
(Modify), 5137 (Create), 5138 (Undelete), 5139 (Move).

C:Documents and Settingsusernwz1Desktop1.PNG

NEW QUESTION 7
Your network contains an Active Directory forest. The forest contains one domain named contoso.com.
You attempt to create a new child domain and you receive the following error message: "An LDAP read of operational attributes failed."
You need to ensure that you can add a new child domain to the forest.
What should you do?

• A. Move the PDC emulator rol
• B. Move the RID master rol
• C. Move the infrastructure master rol
• D. Move the schema master rol
• E. Move the domain naming master rol
• F. Move the global catalog serve
• G. Move the bridgehead serve
• H. Install a read-only domain controller (RODC).
• I. Deploy an additional global catalog serve
• J. Restart the Active Directory Domain Services (AD DS) servic

Answer: E

Explanation:
http://technet.microsoft.com/en-us/library/bb727058.aspx
Troubleshooting Active Directory Installation Wizard Problems
Symptom or Error
An LDAP read of operational attributes failed.
Root Cause
The domain naming master for the forest is offline or cannot be contacted.
Solution Make the current domain naming master accessible. If necessary, see "Seizing
Operations Master Roles" in this guide.

NEW QUESTION 8
You install an Active Directory domain in a test environment.
You need to reset the passwords of all the user accounts in the domain from a domain controller.
Which two Windows PowerShell commands should you run? (Each correct answer presents part of the solution, choose two.)

• A. $ newPassword = *
• B. Import-Module ActiveDirectory
• C. Import-Module WebAdministration
• D. Get- AdUser -filter * | Set- ADAccountPossword - NewPassword $ newPassword -Reset
• E. Set- ADAccountPossword - NewPassword - Reset
• F. $ newPassword = (Read-Host - Prompt "New Password" - AsSecureString )
• G. Import-Module ServerManager

Answer: DF

Explanation:
First we create a variable, $newPassword, and prompt the user for the password to assign
it to the variable.
Next we use Get-ADUser -filter * to collect all user accounts and pipe it through to
SetADAccountPassword to assign the $newPassword variable to every account's new
password.
Note that Set- ADAccountPossword must be a typo.
Explanation 1:
http://technet.microsoft.com/en-us/library/ee176935.aspx
Prompting a User to Enter Information
The Read-Host cmdlet enables you to interactively prompt a user for information. For
example, this command prompts the user to enter his or her name, then stores that name
in the variable $Name (to answer the prompt, type a name and then press ENTER):
$Name = Read-Host "Please enter your name"
Explanation 2:
http://technet.microsoft.com/en-us/library/ee617241.aspx
Get-ADUser Gets one or more Active Directory users.
Explanation 3:
http://technet.microsoft.com/en-us/library/ee617261.aspx
Set-ADAccountPassword Modifies the password of an Active Directory account.
Parameters
NewPassword
Specifies a new password value.
Reset
Specifies to reset the password on an account. When you use this parameter, you must set
the NewPassword parameter. You do not need to specify the OldPassword parameter.

NEW QUESTION 9
You have a domain controller that runs Windows Server 2008 R2 and is configured as a DNS server.
You need to record all inbound DNS queries to the server.
What should you configure in the DNS Manager console?

• A. Enable debug loggin
• B. Enable automatic testing for simple querie
• C. Configure event logging to log errors and warning
• D. Enable automatic testing for recursive querie

Answer: A

Explanation:
http://technet.microsoft.com/en-us/library/cc753579.aspx DNS Tools Event-monitoring utilities The Windows Server 2008 family includes two options for monitoring DNS servers: Default logging of DNS server event messages to the DNS server log. DNS server event messages are separated and kept in their own system event log, the DNS server log, which you can view using DNS Manager or Event Viewer. The DNS server log contains events that are logged by the DNS Server service. For example, when the DNS server starts or stops, a corresponding event message is written to this log. Most additional critical DNS Server service events are also logged here, for example, when the server starts but cannot locate initializing data and zones or boot information stored in the registry or (in some cases) Active Directory Domain Services (AD DS).
You can use Event Viewer to view and monitor client-related DNS events. These events appear in the System log, and they are written by the DNS Client service at any computers running Windows (all versions). Optional debug options for trace logging to a text file on the DNS server computer. You can also use DNS Manager to selectively enable additional debug logging options for temporary trace logging to a text-based file of DNS server activity. The file that is created and used for this feature, Dns.log, is stored in the %systemroot%System32Dns folder.
http://technet.microsoft.com/en-us/library/cc776361%28v=ws.10%29.aspx Using server debug logging options The following DNS debug logging options are available: Direction of packets Send Packets sent by the DNS server are logged in the DNS server log file. Receive Packets received by the DNS server are logged in the log file. Further information:
http://technet.microsoft.com/en-us/library/cc759581%28v=ws.10%29.aspx Select and enable debug logging options on the DNS server

NEW QUESTION 10
Your network contains an Active Directory forest. The forest contains one domain and three sites. Each site contains two domain controllers. All domain controllers are DNS servers.
You create a new Active Directory-integrated zone.
You need to ensure that the new zone is replicated to the domain controllers in only one of
the sites.
What should you do first?

• A. Modify the NTDS Site Settings object for the sit
• B. Modify the replication settings of the default site lin
• C. Create an Active Directory connection objec
• D. Create an Active Directory application directory partitio

Answer: D

Explanation:
Practically the same question as A/Q50 and K/Q17, different set of answers. To control which servers get a copy of the zone we have to store the zone in an application directory partition. That application directory partition must be created before we create the zone, otherwise it won't work. So that's what we have to do first. Directory partitions are also called naming contexts and we can create one using ntdsutil. Here I tried to create a zone with dnscmd /zoneadd. It failed because the directory partition I wanted to use did not exist yet. To fix that I used ntdsutil to create the directory partition dc=venomous,dc=contoso,dc=com. Note that after creating it a new naming context had been added. Then, after a minute or two, I tried to create the new zone again, and this time it worked.

C:Documents and Settingsusernwz1Desktop1.PNG
Explanation 1:
http://technet.microsoft.com/en-us/library/cc725739.aspx
Store Data in an AD DS Application Partition
You can store Domain Name System (DNS) zones in the domain or application directory
partitions of Active
Directory Domain Services (AD DS). An application directory partition is a data structure in
AD DS that distinguishes data for different replication purposes. When you store a DNS
zone in an application directory partition, you can control the zone replication scope by
controlling the replication scope of the application directory partition.
Explanation 2:
http://technet.microsoft.com/en-us/library/cc730970.aspx
Partition management
Manages directory partitions for Active Directory Domain Services (AD DS) or Active
Directory Lightweight
Directory Services (AD LDS).
This is a subcommand of Ntdsutil and Dsmgmt.
Examples
To create an application directory partition named AppPartition in the contoso.com domain,
complete the following steps:
1. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, rightclick Command Prompt, and then click Run as administrator.
2. Type: ntdsutil
3. Type: Ac in ntds
4. Type: partition management
5. Type: connections
6. Type: Connect to server DC_Name
7. Type: quit
8. Type: list
The following partitions will be listed: 0 CN=Configuration, DC=Contoso, DC=com 1 DC=Contoso, DC=com 2 CN=Schema, CN=Configuration, DC=Contoso, DC=com 3 DC=DomainDnsZones, DC=Contoso, DC=com 4 DC=ForestDnsZones, DC=Contoso, DC=com
9. At the partition management prompt, type: create nc dc=AppPartition, DC=contoso,dc=com
ConDc1.contoso.com
10. Run the list command again to refresh the list of partitions.

NEW QUESTION 11
Your company has one main office and four branch offices.
The main office contains a standard primary DNS zone named adatum.com. Each branch
office contains a copy of the adatum.com zone.
When records are added to the adatum.com zone, you discover that it takes up to one hour before the changes replicate to each zone in the branch offices.
You need to minimize the amount of time it takes for the records to be updated in the branch offices.
What should you do?

• A. On the DNS server in the main office, configure the Notify setting
• B. On the DNS servers in the branch offices, configure the Notify setting
• C. On the DNS servers in the branch offices, configure the Zone Aging/Scavenging Propertie
• D. On the DNS server in the main office, configure the Zone Aging/Scavenging Propertie

Answer: A

NEW QUESTION 12
Your network contains two Active Directory forests named contoso.com and adatum.com.
The functional level of both forests is Windows Server 2008 R2. Each forest contains one
domain. Active Directory Certificate Services (AD CS) is configured in the contoso.com forest to allow users from both forests to automatically enroll user certificates.
You need to ensure that all users in the adatum.com forest have a user certificate from the contoso.com certification authority (CA).
What should you configure in the adatum.com domain?

• A. From the Default Domain Controllers Policy, modify the Enterprise Trust setting
• B. From the Default Domain Controllers Policy, modify the Trusted Publishers setting
• C. From the Default Domain Policy, modify the Certificate Enrollment polic
• D. From the Default Domain Policy, modify the Trusted Root Certification Authority setting

Answer: C

Explanation:
http://technet.microsoft.com/en-us/library/dd851772.aspx Manage Certificate Enrollment Policy by Using Group Policy Configuring certificate enrollment policy settings by using Group Policy

NEW QUESTION 13
Your network contains an Active Directory forest named contoso.com. The domain contains two domain controllers named DC1 and DC2 that run Windows Server 2008 R2. DC2 holds the PDC emulator role.
The power supply on DC2 fails.
You seize the PDC emulator role to DC1.
You replace the power supply on DC2.
You need to bring DC2 back online as the PDC emulator as soon as possible. The solution must minimize the disruption of services for users.
What should you do?

• A. Connect DC2 to the networ
• B. Turn on DC2, and then transfer the PDC emulator rol
• C. Reinstall Windows Server 2008 on DC2 and promote DC2 to a domain controlle
• D. Transfer the PDC emulator rol
• E. Reinstall Windows Server 2008 on DC2 and promote DC2 to a domain controlle
• F. Seize the PDC emulator rol
• G. Disconnect DC2 from the networ
• H. Turn on DC2, and then seize the PDC emulator rol
• I. Connect DC2 to the networ

Answer: A

NEW QUESTION 14
Your network contains an Active Directory forest named contoso.com. The functional level of the forest is Windows Server 2008 R2. The forest contains a single domain.
You need to ensure that objects can be restored from the Active Directory Recycle Bin.
Which tool should you use?

• A. Ntdsutil
• B. Set-ADDomain
• C. Dsamain
• D. Enable-ADOptionalFeature

Answer: D

Explanation:
Similar question to question E/Q28 Explanation:
http://technet.microsoft.com/en-us/library/dd379481.aspx
Enabling Active Directory Recycle Bin
After the forest functional level of your environment is set to Windows Server 2008 R2, you can enable Active Directory Recycle Bin by using the following methods:
Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.)
Ldp.exe

NEW QUESTION 15
A corporate network includes a single Active Directory Domain Services (AD DS} domain.
The HR department has a dedicated organization unit (OU) named HR. The HR OU has two sub-OUs: HR Users and HR Computers. User accounts for the HR department reside in the HR Users OU. Computer accounts for the HR department reside in the HR Computers OU. All HR department employees belong to a security group named HR Employees. All HR department computers belong to a security group named HR PCs.
Company policy requires that passwords are a minimum of six characters.
You need to ensure that, the next time HR department employees change their passwords, the passwords are required to have at least eight characters. The password length requirement should not change for employees of any other department.
What should you do?

• A. Modify the local security policy on each computer in the HR PCs grou
• B. Create a fine-grained password policy and apply it to the HR Employees grou
• C. Create a new GPO, with the necessary password policy, and link it to the HR Computers O
• D. Create a fine-grained password policy and apply it to the HR Computers O

Answer: C

NEW QUESTION 16
Your network contains an Active Directory domain named contoso.com.
You have an organizational unit (OU) named Sales and an OU named Engineering.
You have a Group Policy object (GPO) linked to the domain. The GPO is used to deploy a number of software packages.
You need to ensure that the GPO is applied only to client computers that have sufficient free disk space.
What should you do?

• A. Modify the Group Policy permission
• B. Enable block inheritanc
• C. Configure the link orde
• D. Enable loopback processing in merge mod
• E. Enable loopback processing in replace mod
• F. Configure WMI filterin
• G. Configure Restricted Group
• H. Configure Group Policy PExplanation
• I. Link the GPO to the Sales O
• J. Link the GPO to the Engineering O

Answer: F

NEW QUESTION 17
Your network contains an Active Directory domain. The domain contains eight domain controllers.
You need to verify that all the domain controllers can connect to the time server.
Which command should you run?

• A. netdom.exe query fsmo
• B. dcdiag.exe /e /test:Topology
• C. repadmin.exe /showrepl *
• D. dcdiag.exe /a

Answer: D

NEW QUESTION 18
Your network contains an Active Directory domain. The domain contains four domain
controllers.
You modify the Active Directory schema.
You need to verify that all the domain controllers received the schema modification.
Which command should you run?

• A. dcdiag.exe /a
• B. netdom.exe query fsmo
• C. repadmin.exe /showrepl *
• D. sc.exe query ntds

Answer: C

Explanation:
http://blogs.technet.com/b/askds/archive/2009/07/01/getting-over-replmon.aspx Getting Over Replmon
Status Checking Replmon had the option to generate a status report text file. It could tell
you which servers were configured to replicate with each other, if they had any errors, and
so on. It was pretty useful actually, and one of the main reasons people liked the tool.
Repadmin.exe offers similar functionality within a few of its command line options. For
example, we can get a summary report:
Repadmin /replsummary *

C:Documents and Settingsusernwz1Desktop1.PNG
Several DCs have been taken offline. Repadmin shows the correct error of 58 – that the
other DCs are not available and cannot tell you their status.
You can also use more verbose commands with Repadmin to see details about which DCs
are or are not replicating:
Repadmin /showrepl *

C:Documents and Settingsusernwz1Desktop1.PNG

NEW QUESTION 19
Your company has two domain controllers that are configured as internal DNS servers. All zones on the DNS servers are Active Directory-integrated zones. The zones allow all dynamic updates.
You discover that the contoso.com zone has multiple entries for the host names of computers that do not exist.
You need to configure the contoso.com zone to automatically remove expired records.
What should you do?

• A. Enable only secure updates on the contoso.com zone,
• B. Enable scavenging and configure the refresh interval on the contoso.com zon
• C. From the Start of Authority tab, decrease the default refresh interval on the contoso.com zon
• D. From the Start of Authority tab, increase the default expiration interval on the contoso.com zone

Answer: B

Explanation:
http://www.it-support.com.au/configure-aging-and-scavenging-of-a-dns-server/2012/12/ Configure aging and scavenging of a DNS Server Resource records that are either outdated or decayed from DNS zone data are removed through the use of the Server aging and scavenging feature in Windows Server 2008. Issues develop if decayed resource records are not dealt with, such as: Zone transfers take longer as the DNS server disk space contains a large number of stale records The accumulation of stale records degrades the DNS server performance and response time Potential conflicts can occur, if an IP address in a dynamic DNS environment is assigned to a different host. By default, the aging and scavenging feature is disabled. In order to use this particular feature, the user is required to enable the operations on the zone and at the DNS server. In addition, a user is able to manually enable individual resource records to be aged and scavenged. This process involves permitting the records to use the current (non-zero) timestamp value. The aging and scavenging operation figures out when the records should be cleared by reviewing their timestamps. The DNS Server uses a simple equation when setting a time value on a record: current server time + refresh interval. Procedure: Navigate to Start - Administrative Tools – DNS Manager. Right click the relevant DNS server and select Set Aging/Scavenging for All Zones from the drop down list.

C:Documents and Settingsusernwz1Desktop1.PNG
The Server Aging/Scavenging Properties dialog box opens. Tick the option Scavenge stale
resource records.
Under the No-refresh interval heading, specify the duration for which the server must not
refresh its records.
Configuring this setting reduces replication traffic as unnecessary updates to existing
records are prevented.
Under the Refresh interval heading, specify the duration for which the server must refresh
its records. The fresh interval is the time required between when a no-refresh interval
expires and when a record is considered stale.
When you have configured these settings, click OK to continue.

C:Documents and Settingsusernwz1Desktop1.PNG
A confirmation box appears showing a summary of your settings. Tick the Apply these settings to the existing Active Directory-integrated zones option and click OK.

C:Documents and Settingsusernwz1Desktop1.PNG
The Aging and Scavenging intervals have now been configured for all zones managed by the DNS server. http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-bepatient.aspx Don't be afraid of DNS Scavenging. Just be patient. http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/bb556cfb-3217-4dcf-af4f-460366faa1b8Answered Best Practices configuration for DNS server on Windows 2008 R2 Server (aging/scavenging, etc.)

NEW QUESTION 20
Your network contains an Active Directory domain. The domain contains a domain
controller named DC1 that runs Windows Server 208 R2 Service Pack 1 (SP1).
You need to implement a central store for domain policy templates.
What should you do?
To answer, select the source content that should be copied to the destination folder in the
answer area.

Answer:

Explanation: