uCertify Articles » 70-648 http://www.ucertify.com/article Just another WordPress weblog Wed, 04 Nov 2009 00:00:00 +0000 http://wordpress.org/?v=2.8.4 en hourly 1 What is forwarder? http://www.ucertify.com/article/what-is-forwarder-2.html http://www.ucertify.com/article/what-is-forwarder-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401335

A forwarder is a DNS server that receives queries from other DNS servers on the network. To configure a forwarder in a network, DNS servers on the network are configured to send DNS queries to a particular DNS server. The DNS server acting as a forwarder need not require any special configuration. A forwarder has no secondary zones.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-forwarder-2.html/feed 0 What is ad hoc network? http://www.ucertify.com/article/what-is-ad-hoc-network-2.html http://www.ucertify.com/article/what-is-ad-hoc-network-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401340

Ad hoc is a basic topology of a wireless network. An ad hoc network consists of two or more wireless devices that communicate directly with each other. The wireless local area network (WLAN) network interface adapters in the wireless devices generate omni directional signals within a limited range called basic service area (BSA). When two wireless devices come within the range of each other, they immediately form a two-node network and are able to communicate with each other.

An ad hoc network is non-transitive.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-ad-hoc-network-2.html/feed 0 What is non-authoritative restore method? http://www.ucertify.com/article/what-is-non-authoritative-restore-method-2.html http://www.ucertify.com/article/what-is-non-authoritative-restore-method-2.html#comments Tue, 25 Aug 2009 00:00:00 +0000 uCertify 1401282

A non-authoritative restore method is a type of backup restoration of the System State data. It is also called a normal restore method. This restoration method is used whenever more than one domain controller is configured on the network and the rollback of changes in the Active Directory database is not required. An object restored through this method is updated through the replication partners of the domain controller.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-non-authoritative-restore-method-2.html/feed 0 Group Policy and Group Policy Object (GPO) http://www.ucertify.com/article/group-policy-and-group-policy-object-gpo-2.html http://www.ucertify.com/article/group-policy-and-group-policy-object-gpo-2.html#comments Mon, 24 Aug 2009 00:00:00 +0000 uCertify 1401259

What are group policies?

Group policies specify how programs, network resources, and the operating system work for users and computers in an organization. They are collections of user and computer configuration settings that are applied on users and computers (not on groups). For better administration of group policies in the Windows environment, the group policy objects (GPOs) are used.

What is GPO?

Group policy object (GPO) is a collection of group policy settings. It can be created using a Windows utility known as the Group Policy snap-in. GPO affects the user and computer accounts located in sites, domains, and organizational units (OUs). Windows operating systems support two types of GPOs, local and non-local (Active Directory-based) GPOs.

Local GPOs

Local GPOs are used to control policies on a local server running Windows Server 2003/2008. On each Windows server, a local GPO is stored. The local GPO affects only the computer on which it is stored. By default, only Security Settings nodes are configured. The rest of the settings are either disabled or not enabled. The local GPO is stored in the %systemroot%SYSTEM32GROUPPOLICY folder.

Non-local GPOs

Non-local GPOs are used to control policies on an Active Directory-based network. A Windows server needs to be configured as a domain controller on the network to use a non-local GPO. Non-local GPOs must be linked to a site, domain, or organizational unit (OU) to apply group policies to the user or computer objects. Non-local GPOs are stored in %systemroot%SYSVOL<domain name>POLICIES<GPO GUID>ADM, where <GPO GUID> is the GPO’s globally unique identifier. Two non-local GPOs are created by default when the Active Directory is installed:

  1. Default Domain Policy: This GPO is linked to the domain and affects all users and computers in the domain.

  2. Default Domain Controllers Policy: This GPO is linked to the Domain Controllers OU and affects all domain controllers placed in this OU.

Multiple GPOs

When multiple group policy objects are assigned, the group policies are applied in the following order:

  • The local group policy object is applied first.

  • Then, the group policy objects linked to sites are applied.
    If multiple GPOs exist for a site, they are applied in the order specified by an administrator.

  • GPOs linked to the domains are applied in the specified order.

  • Finally, GPOs linked to OUs are applied.
    The OU group policy objects are set from the largest to the smallest organizational unit, i.e., first the parent OU and then the child OU.
    By default, a policy applied later overwrites a policy that was applied earlier. Hence, the settings in a child OU can override the settings in the parent OU.

Group policy settings are cumulative if they are compatible with each other. In case they conflict with each other, the GPO processed later takes precedence.

The following are the exceptions with regard to the above-mentioned settings:

  1. No Override: Any GPO can be set to No Override. If the No Override configuration is set to a GPO, no policy configured in the GPO can be overridden. If more than one GPO has been set to No Override, then the one that is the highest in the Active Directory hierarchy takes precedence.

  2. Block Policy Inheritance: The Block Policy Inheritance option can be applied to the site, domain, or OU. It deflects all group policy settings that reach the site, domain, or OU from the object higher in the hierarchy. However, the GPOs configured with the No Override option are always applied.

  3. Loopback setting: By default, users settings override computer settings in case of any conflict in policy settings. By configuring the loopback setting, an administrator can reverse the process of the application of policies. When the Loopback option is configured, the computer settings take precedence on the users settings. The Looback option can be set as Not Configured, Enabled, or Disabled. The enabled Loopback option can be set in the following two modes:
    • Replace mode: In this mode, the computer policy settings override the user policy settings.

    • Merge mode: In this mode, the computer policy settings are appended to the user policy settings.

Note: The computers that are members of a workgroup are not affected by the non-local GPOs policy settings. They process only the local GPOs.

Group Policy Inheritance

The group policies are inherited from a parent to a child within a domain. They are not inherited from the parent domain to a child domain. The ollowing are the rules regarding group policy inheritance:

  • A policy setting is configured (Enabled or Disabled) for a parent OU, and the same policy setting is not configured for its child OUs. The child OUs inherit the parent’s policy.

  • A policy setting is configured (Enabled or Disabled) for a parent OU, and the same policy setting is configured for its child OUs. The child OUs settings override the settings inherited from the parent’s OU.

  • If any policy is not configured, no inheritance takes place.

  • Compatible policy settings configured at the parent and child OUs are accumulated.

  • Incompatible policy settings from the parent OU are not inherited.

Filtering Scope of GPOs

Although GPOs are linked to the site, domain, or OUs, and they cannot be linked to the security groups directly, applying permissions to the GPO can filter its scope. The policies in a non-local GPO apply only to users who have the Read and Apply Group Policy permissions set to Allow. By specifying appropriate permissions to the security groups, the administrators can filter a GPO’s scope for the computers and users.

Note: The Apply Group Policy permission is not available with the local GPO.

Share/Bookmark]]> http://www.ucertify.com/article/group-policy-and-group-policy-object-gpo-2.html/feed 0 How to assign IPv6 address manually on a computer running Windows Server 2008? http://www.ucertify.com/article/how-to-assign-ipv6-address-manually-on-a-computer-running-windows-server-2008.html http://www.ucertify.com/article/how-to-assign-ipv6-address-manually-on-a-computer-running-windows-server-2008.html#comments Sun, 09 Aug 2009 00:00:00 +0000 uCertify 5609789

Take the following steps to assign IPv6 address manually on a computer running Windows Server 2008:

  1. Run the Control Panel through Start > Control Panel.

  2. On the Control Panel, double-click Network and Sharing Center. This will open the Network and Sharing Center window.

  3. On the window, click the View Status option. This will open the Local Area Connection Status window.

  4. On the window, click the Properties button. This will open the Local Area Connection Properties page.

  5. On the page, select the Internet Protocol Version 6(TCP/IPv6) option. Click the Properties button. This will open the Internet Protocol Version 6(TCP/IPv6) Properties page.

  6. On the page, choose the Use the following IPv6 address radio button. Provide required settings. Click the OK button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-assign-ipv6-address-manually-on-a-computer-running-windows-server-2008.html/feed 0 How to assign IPv4 address manually on a computer running Windows Server 2008? http://www.ucertify.com/article/how-to-assign-ipv4-address-manually-on-a-computer-running-windows-server-2008.html http://www.ucertify.com/article/how-to-assign-ipv4-address-manually-on-a-computer-running-windows-server-2008.html#comments Sun, 09 Aug 2009 00:00:00 +0000 uCertify 5609791

Take the following steps to assign IPv4 address manually on a computer running Windows Server 2008:

  1. Run the Control Panel through Start > Control Panel.

  2. On the Control Panel, double-click Network and Sharing Center. This will open the Network and Sharing Center window.

  3. On the window, click the View Status option. This will open the Local Area Connection Status window.

  4. On the window, click the Properties button. This will open the Local Area Connection Properties page.

  5. On the page, select the Internet Protocol Version 4(TCP/IPv4) option. Click the Properties button. This will open the Internet Protocol Version 4(TCP/IPv4) Properties page.

  6. On the page, select the Use the following IP address radio button. Configure the required settings. Click the OK button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-assign-ipv4-address-manually-on-a-computer-running-windows-server-2008.html/feed 0 How to authorize a DHCP server in a domain? http://www.ucertify.com/article/how-to-authorize-a-dhcp-server-in-a-domain.html http://www.ucertify.com/article/how-to-authorize-a-dhcp-server-in-a-domain.html#comments Sun, 09 Aug 2009 00:00:00 +0000 uCertify 5609793

Take the following steps to authorize a DHCP server in a domain:

  1. Run DHCP through Start > Administrative Tools > DHCP.

  2. Select and right-click on the server node. This will display a pop-up menu.

  3. Click the Authorize option in the menu.

  4. The green arrow will appear beside the IPv4 and IPv6 options indicating that the server is authorized now.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-authorize-a-dhcp-server-in-a-domain.html/feed 0 How to setup a DHCPv6 scope? http://www.ucertify.com/article/how-to-setup-a-dhcpv6-scope.html http://www.ucertify.com/article/how-to-setup-a-dhcpv6-scope.html#comments Sat, 08 Aug 2009 00:00:00 +0000 uCertify 5609795

Take the following steps to setup a DHCPv6 scope:

  1. Run DHCP from Start > Administrative Tools > DHCP.

  2. Select and right-click the IPv6 node under the server option. This will open a pop-up menu.

  3. On the menu, click the New Scope option. This will open the New Scope Wizard.

  4. On the Welcome page, click the Next button.

  5. On the Scope Name page, provide name and description of the scope. Click the Next button.

  6. On the Scope Prefix page, provide prefix value and preference value (if required). Click the Next button.

  7. On the Add Exclusions page, add the address range that is required to be excluded. Click the Next button.

  8. On the Scope Lease page, click the Next button.

  9. On the Completing the New Scope Wizard page, select the Yes radio button in Activate Scope Now section. Click the Finish button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-setup-a-dhcpv6-scope.html/feed 0 How to setup a DHCPv4 scope? http://www.ucertify.com/article/how-to-setup-a-dhcpv4-scope.html http://www.ucertify.com/article/how-to-setup-a-dhcpv4-scope.html#comments Sat, 08 Aug 2009 00:00:00 +0000 uCertify 5609797

Take the following steps to setup a DHCPv4 scope:

  1. Run DHCP through Start > Administrative Tools > DHCP.

  2. Select and right-click the IPv4 option under the server node. This will open a pop-up menu.

  3. On the menu, select the New Scope option. This will open the New Scope Wizard page.

  4. On the Welcome page, click the Next button.

  5. On the Scope Name page, provide name and description of the scope. Click the Next button.

  6. On the IP Address Range page, provide the required information. Click the Next button.

  7. On the Add Exclusions page, add exclusion range. Click the Next button.

  8. On the Lease Duration page, click the Next button.

  9. On the Configure DHCP Options page, select the Yes, I want to configure these options now radio button. Click the Next button.

  10. On the Router page, provide address of the router installed on the network. Click the Next button.

  11. On the Domain Name and DNS Servers page, provide the information (if required). Click the Next button.

  12. On the WINS Servers page, click the Next button.

  13. On the Activate Scope page, select the Yes, I want to activate this scope now radio button. Click the Next button.

  14. On the Completing the New Scope Wizard page, click the Finish button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-setup-a-dhcpv4-scope.html/feed 0 WSUS Deployment Methods http://www.ucertify.com/article/wsus-deployment-methods.html http://www.ucertify.com/article/wsus-deployment-methods.html#comments Fri, 07 Aug 2009 00:00:00 +0000 uCertify 5609802

To keep a Windows network safe and effective, it is required that operating systems on all computers on the network are updated. Microsoft releases updates of operating systems from time to time. These updates (or patches) may be related to functionality, security, etc. Each computer can be configured to directly download upgrades from the Microsoft site. But, thousands of computers downloading updates individually will waste lots of bandwidth. To effectively manage these upgrades, Microsoft provides a tool named Windows Server Update Services (WSUS).

What is WSUS?

Windows Server Update Services (WSUS) is an add-on component of Windows Server 2008. It provides functionality to a server to run as a Windows Update server in a Windows network environment. Administrators can configure WSUS server as the only server to download updates from Windows site, and configure other computers on the network to use the server as the source of update files. This will save lots of bandwidth, as each computer will not download updates individually. WSUS 3.0 SP1 is the first version of WSUS to be installed on Windows Server 2008. Earlier versions cannot be installed on a server running Windows Server 2008.

What are the requirements for installing WSUS 3.0 SP1?

The installation of WSUS 3.0 SP1 requires the following Windows components to be enabled on a server running Windows Server 2008:

  • Windows Authentication

  • Static Contents

  • ASP.NET

  • IIS 6.0 Management Compatibility

  • IIS 6.0 Metabase Compatibility

Apart from these Windows components, Microsoft Report Viewer, version 2005 or later is also required to be installed. This software must be downloaded from Microsoft’s Web site.

Administration

When WSUS 3.0 SP1 is installed on a computer running Windows Server 2008, it adds the following two local groups for administrative purposes:

  • WSUS Administrators: WSUS Administrators is a local group that is used for WSUS administrative roles. The members of this group are able to administer the WSUS server. A member of this group can use the Update Services console to connect remotely to manage WSUS.

  • WSUS Reporters: WSUS Reporters is a local group that is used for administrative roles. The members of this group are able to create reports on the WSUS server. The group members can use the Update Services console to connect remotely to manage WSUS.

These administrative roles can be assigned to a user by making him a member of the appropriate group.

Deployment

There are four common deployment methods of WSUS used according to the requirements of an organization:

Single WSUS Server Deployment

In the single WSUS server deployment method, a WSUS server is deployed behind the firewall of an organization. It is configured to synchronize contents directly with Microsoft Update by downloading the updates from the site. These updates are then distributed to clients by the server. The single WSUS server deployment method is shown below:

This is the most common type of deployment and it can serve up to 25000 WSUS clients.

Deploying Multiple Independent WSUS Servers

Multiple independent WSUS servers are deployed in organizations having multiple branches. Each branch office is configured with a separate WSUS server that synchronizes contents directly with Microsoft Update by downloading the updates from the site. These updates are then distributed to their respective clients by the server. The deployment is shown below:

Each single WSUS server can serve up to 25000 WSUS clients.

Deploying Multiple Internally Synchronized WSUS Servers

Multiple internally synchronized WSUS servers are deployed in organizations having branch offices at different locations. One WSUS server, designated as upstream server, is configured to receive updates from Microsoft Update. Other servers, designated as downstream servers, retrieve updates from the upstream server. The deployment of multiple internally synchronized WSUS is shown below:

This method is uncommon these days, as a single WSUS 3.0 server can serve up to 25000 clients. Moreover, Background Intelligent Transfer service (BITS) peer-caching technology of Windows Server 2008 and Windows Vista further reduces the requirement of deploying multiple WSUS servers on a network. This method of deployment is used mostly for the purpose of redundancy.

Deploying Disconnected WSUS Servers

Disconnected WSUS servers are configured on a network to download updates from Microsoft Update. The updates are then copied to writable media (for example, writable DVD-ROM, USB hard disk drive) and manually (physically) transferred to other WSUS servers to deploy updates to the clients. The disconnected WSUS deployment is shown below:

This method of deployment is used in scenarios where administrators want to save bandwidth of slow WAN or Internet links in remote branch offices. Instead of using slow links to retrieve updates, updates are physically transported and added to WSUS servers at remote locations.

Share/Bookmark]]> http://www.ucertify.com/article/wsus-deployment-methods.html/feed 0