* What is virtualization (in general)?
* What are the 4 major virtualization areas?
* Describe the major benefits of Server Virtualization.
* What is the difference between hosted virtualization and hypervisor-based virtualization?
* What's the idea behind Type 1 and Type 2 methods of virtualization?
* Talk briefly about the history of Microsoft-based virtualization products.
* What is Hyper-V?
* Name a few competitive products that can be compared (even roughly) with Hyper-V.
* What are the major differences between Hyper-V RTM and Hyper-V R2? Name some of the major differences.
* What are the hardware requirements for Hyper-V?
* How many logical CPUs does Hyper-V R2 support?
* How much RAM can be assigned to VMs in Hyper-V R2?
* What's Microsoft Hyper-V Server?
* Describe the process of installing Hyper-V from scratch on a brand new Dell R710 machine.
* ...
* What types of network connections does Hyper-V allow?
* When building a new Hyper-V host, what would your networking considerations be?
* Why is it important to leave one physical NIC for the host OS?
* Talk about MAC address ranges and potential issues with Hyper-V RTM. How was this solved in R2?
* ...
* What are the different virtual disk options in Hyper-V?
* When considering performance, what type 0f virtual disk would you use?
* What are pass-through disks?
* Talk about hot adding and hot removing disks in Hyper-V R2.
* What are VM snapshots?
* Talk about performance considerations and other "issues" with VM snapshots.
* What's the difference between applying, deleting and reverting to snapshots?
* ...
* Describe the process of creating a new VM from scratch.
* Where does Hyper-V place the files and settings for VMs, by default? How do you change that?
* What are synthetic drivers?
* What are emulated drivers?
* When creating a new VM that'll run Windows Server 2008, what type of NIC would you create?
* Following the previous question, what type of NIC would you create for a WIN PE-based VM? Why?
* Migrating a Windows Server 2003 VM from Virtual Server 2005, what type of NIC would you need to use?
* Creating a new VM, what type of disk controller would you need to use for the VM's system disk?
* ...
* What are Integration Components?
* Talk about certain issues with hosting DCs virtually.
* What are "Enlightened Partitions"?
* What OSs are supported on Hyper-V?
* What types of backups can you use for VMs?
* Talk about performing backups of VMs and VSS.
* How do you export a VM? Mention a couple of methods.
* ...
* Talk about domain membership considerations for Hyper-V hosts.
* Where can you manage Hyper-V hosts from?
* What is RSAT?
* How would you manage Hyper-V from a Windows 7-based machine?
* Talk about permission issues in regards of managing Hyper-V hosts.
* What is AZMAN?
* ...
* Talk about the licensing benefits of Hyper-V under the various editions of Windows Server 2008.
* Wanting to create a failover cluster on 2 Hyper-V nodes in Windows Server 2008 R2, what edition of Windows would you prefer? Why?
* ...
* Talk about Hyper-V-based high availability.
* What's Quick Migration?
* What's Live Migration?
* Talk about downtime issues with Quick Migration vs. Live Migration.
* Talk about the steps needed to be taken in order to setup a Live Migration setup.
* What is CSV?
* Can you create a Live Migration setup without CSV? Explain.
* Mention a few methods for initiating a Live Migration movement of VMs between one host and another.
* ...
* How do you monitor the performance of your VMs?
* How do you know how much memory a specific VM uses?
* How do you know what's the I/O used on a Hyper-V host?
* How do you monitor the bandwidth used by a specific VM?
* Talk about SCVMM, SCOM, SCCM and Hyper-V.
* Talk about WMI and Hyper-V.

* What is Active Directory?
* What is LDAP?
* Where is the AD database held? What other folders are related to AD?
* Talk about all the AD-related roles in Windows Server 2008/R2.
* What are the new Domain and Forest Functional Levels in Windows Server 2008/R2?
* What is the SYSVOL folder?
* What are the AD naming contexts (partitions)s and replication issues for each NC?
* What are application partitions?
* What applications or services use AD application partitions? Name a couple.
* How do you create a new application partition?
* What are the requirements for installing AD on a new server?
* What can you do to promote a server to DC if you're in a remote location with slow WAN link?
* ...
* How do you view replication properties for AD partitions and DCs?
* What is the Global Catalog?
* How do you view all the GCs in the forest?
* Why not make all DCs in a large forest as GCs?
* Talk about GCs and Universal Groups.
* Describe the time synchronization mechanism in AD.
* What is ADSIEDIT? What is NETDOM? What is REPADMIN?
* What is DCDIAG? When would you use it?
* ...
* What are sites? What are they used for?
* What's the difference between a site link's schedule and interval?
* What is the KCC?
* What is the ISTG? Who has that role by default?
* Talk about sites and GCs.
* Talk about sites and Exchange Server 2007/2010.
* ...
* What is GPO?
* Describe the way GPO is applied throughout the domain.
* What can you do to prevent inheritance from above?
* How can you override blocking of inheritance?
* Name some of the major changes in GPO in Windows Server 2008.
* What are ADM files? What replaced them in Windows Server 2008?
* What's the GPO repository? How do you use it?
* What are GPO Preferences?
* Which client OSs can use GPO Preferences?
* What are GPO Templates?
* What are WMI Filters?
* What is the concept behind GPO Filtering?
* How can you determine what GPO was and was not applied for a user? Name a few ways to do that.
* A user claims he did not receive a GPO, yet his user and computer accounts are in the right OU, and everyone else there gets the GPO. What will you look for?
* You want to standardize the desktop environments (wallpaper, My Documents, Start menu, printers etc.) on the computers in one department. How would you do that?
* ...
* What are the major changes in AD in Windows Server 2008?
* What are the major changes in AD in Windows Server 2008 R2?
* What is the AD Recycle Bin? How do you use it?
* What is tombstone lifetime attribute?
* What are AD Snapshots? How do you use them?
* What is Offline Domain Join? How do you use it?
* What are Fine-Grained Passwords? How do you use them?
* Talk about Restartable Active Directory Domain Services in Windows Server 2008/R2. What is this feature good for?
* What are the changes in auditing in Windows Server 2008/R2?
* ...
* How can you forcibly remove AD from a server, and what do you do later?
* Can I get user passwords from the AD database?
* What tool would I use to try to grab security related packets from the wire?
* Talk about PowerShell and AD.
* ...
* How do you backup AD?
* How do you restore AD?
* Talk about Windows Backup and AD backups.
* How do you change the DS Restore admin password?
* Why can't you restore a DC that was backed up 7 months ago?
* What's NTDSUTIL? When do you use it?
* ...
* What are RODCs?
* What are the major benefits of using RODCs?
* How do you install an RODC?
* Talk about RODCs and passwords.
* What is Read Only DNS?
* What happens when a remote site with an RODC loses connectivity to the main site?
* ...
* Talk about Server Core and AD.
* How do you promote a Server Core to DC?
* ...
* What are the FSMO roles? Who has them by default? What happens when each one fails?
* How can you tell who holds each FSMO role? Name a 2-3 of methods.
* What FSMO placement considerations do you know of?
* You want to look at the RID allocation table for a DC. What do you need to do?
* What's the difference between transferring a FSMO role and seizing one? Which one should you NOT seize? Why?

* What is FSB?
* What are Vcore and Vi/o?
* On what type of socket can you install a Pentium 4 CPU?
* What is SMP?
* Which Intel and AMD processors support SMP?
* How do LGA sockets differ from PGA and SEC?
* What is the difference between Pentium 4 and Pentium Core 2 Duo? Explain the new technology.
* How does IRQ priority works?
* What technology enables you to upgrade your computer's BIOS by simply using a software?
* What happens if you dissemble the battery located on the Mother-Board?
* How do L1, L2, and L3 work?
* How should we install RAM on a Dual-Channel Motherboard?
* What is the advantage of serial over parallel bus?
* Is USB using serial or parallel bus? What about Firewire?
* How much power is supplied to each USB port?
* When should you change your bus-powered USB hub to a self-powered USB hub?
* What is a UPS?
* What is the difference between standby and online UPS?
* What is LBA (in Hard-Disks)?
* How many Hard Disks can you install on an E-IDE controller?
* Can you configure two hard disks to use the Master setting on the same PC?
* What is the difference between Narrow-SCSI and Wide-SCSI?
* What is SAS?
* What are the three main reasons for using RAID?
* Is RAID 0 considered to be a redundant Solution? Why?
* How many disks can be used for RAID 1?
* How RAID 5 works?
* What is the smallest number of disks required for RAID5?
* What other types of RAID do you know?
* What are the six steps for laser printing?
* What is the difference between PCI-EX x1 and PCI-EX x16?

Microsoft-based Operating Systems

* What is the difference between a workgroup and a domain?
* What are the major advantages of working in a domain model?
* What types of operating system installation methods do you know?
* What is an answer file?
* How would you create an answer file for Windows XP? How would you create one for Windows Vista?
* How do you perform an unattended installation on Windows XP?
* What is Sysprep?
* How do you use Sysprep?
* What is the major difference between Newsid and Sysprep?
* What is the function of the pagefile.sys file?
* What is the function of the hiberfil.sys file?
* What is the Registry?
* How can you edit the Registry? Name at least 3 ways of doing that.
* What should you do if you receive a message stating: "The following file is missing or corrupt: 'WINDOWS'SYSTEM32'CONFIG'SYSTEM"?
* How would you repair an unsuccessful driver update?
* When should you use each of the fallowing tools: System Restore, LKGC and Recovery Console?
* How do you set different print priority for different users?
* How can you reset user's passwords if you don't know his current password?
* What's the difference between changing a user's password and resetting it?
* You want to grant a user the right to perform backups – should you add him to the administrators group?
* What is MMC?
* What is gpedit.msc?
* How would you use the MMC to manage other servers on your network?
* You set a local policy for your Stand-alone XP Professional – would the local policy effects the administrators group?
* What new in the Windows Vista Local Policy?
* What is the difference between User Privileges and User Permissions?
* What is Safe Mode?
* Which logs can be found in Event Viewer?
* What is msconfig? On which OS can it be found?
* Can you upgrade XP Home Edition to Server 2003?
* Which permission will you grant a user for a folder he need to be able to create and delete files in, if you do not want him to be able to change permissions for the folder?
* What is the difference between clearing the "allow" permission and checking the "deny"?

Networking

* What is a NIC?
* What is a MAC Address?
* When would you use a crosslink cable?
* What are the main advantages and disadvantages of Fiber-Optic-based networks?
* What is the difference between a Hub and a Switch?
* On which OSI layer can a router be found?
* What is CSMA/CD?
* What is multicast?
* What is Broadcast?
* What is the difference between TCP and UDP?
* Describe some of the settings that are added by TCP and by UDP to the packet's header.
* What are TCP Ports? Name a few.
* What is a TCP Session?
* What three elements make up a socket?
* What will happen if you leave the default gateway information empty while manually configuring TCP/IP?
* What will happen if you execute the following command: "arp –d *"?
* What is ICMP?
* When would you use the ping command with the "-t" switch?
* What command-line tool would help you discover for which port numbers your computer is listening?
* What is APIPA? How would you recognize it?
* What is a Cyclic Redundancy Check?
* What would you type in at a command prompt to view the IP settings for the computer that you are sitting at?
* What command would you type in at a command prompt to view the IP address of the remote computer?
* What is the W Value for class B?
* What is the Net ID of an IP Address of 18.9.25.3 with Subnet Mask of 255.0.0.0?
* What is CIDR?
* What is 255.255.255.255 used for?
* What is the maximum number of hosts for a Class B Network?
* What is the (default) class type of 195.152.12.1?
* What is the subnet mask for 10.0.10.1/17?
* What is the result when changing from a subnet mask of 255.255.224.0 to a subnet mask of 255.255.240.0?
* How can you access a shared folder from a remote computer? Name at least 3 methods.

* Tell me a bit about the capabilities of Exchange Server.
* What are the different Exchange 2003 versions?
* Name some of the main differences between Exchange 5.5 and Exchange 2000/2003?
* What are the major network infrastructure requirements for installing Exchange 2003?
* What is the latest Exchange 2003 Service Pack? Name a few changes in functionality in that SP.
* What are the disk considerations when installing Exchange (RAID types, locations and so on).
* You got a new HP DL380 (2U) server, dual Xeon, 4GB of RAM, 7 SAS disks, 64-bit. What do you do next to install Exchange 2003? (considering you already have AD in place)
* Why shouldn't you install Exchange on the same machine as a DC?
* Why shouldn't you install Outlook on the same machine as an Exchange server?
* Are there any other installation considerations?
* How would you prepare the AD Schema in advance before installing Exchange?
* What type or permissions do you need in order to install the first Exchange server in a forest? In a domain?
* How would you verify that the schema was in fact updated?
* What type of memory optimization changes could you do for Exchange 2003?
* How would you check your Exchange configuration settings to see if they're right?
* What are the Exchange management tools? How and where can you install them?
* What types of permissions are configurable for Exchange?
* How can you grant access for an administrator to access all mailboxes on a specific server?
* What is the Send As permission?
* What other management tools are used to manage and control Exchange 2003? Name the tools you'd use.
* What are Exchange Recipient types? Name 5.
* You created a mailbox for a user, yet the mailbox does not appear in ESM. Why?
* You wanted to change mailbox access permissions for a mailbox, yet you see the SELF permission alone on the permissions list. Why?
* What are Query Based Distribution groups?
* What type of groups would you use when configuring distribution groups in a multiple domain forest?
* Name a few configuration options for Exchange recipients.
* What's the difference between Exchange 2003 Std. and Ent. editions when related to storage options and size?
* Name a few configuration options related to mailbox stores.
* What are System Public Folders? Where would you find them?
* How would you plan and configure Public Folder redundancy?
* How can you immediately stop PF replication?
* How can you prevent PF referral across slow WAN links?
* What types of PF management tools might you use?
* What are the differences between administrative permissions and client permissions in PF?
* How can you configure PF replication from the command prompt in Exchange 2003?
* What are the message hygiene options you can use natively in Exchange 2003?
* What are the configuration options in IMF?
* What are virtual servers? When would you use more than one?
* Name some of the SMTP Virtual Server configuration options.
* What is a Mail Relay? Name a few known mail relay software or hardware options.
* What is a Smart Host? Where would you configure it?
* What are Routing Groups? When would you use them?
* What are the types of Connectors you can use in Exchange?
* What is the cost option in Exchange connectors?
* What is the Link State Table? How would you view it?
* How would you configure mail transfer security between 2 routing groups?
* What is the Routing Group Master? Who holds that role?
* Explain the configuration steps required to allow Exchange 2003 to send and receive email from the Internet (consider a one-site multiple server scenario).
* What is DS2MB?
* What is Forms Based Authentication?
* How would you configure OWA's settings on an Exchange server?
* What is DSACCESS?
* What are Recipient Policies?
* How would you work with multiple recipient policies?
* What is the "issue" with trying to remove email addresses added by recipient policies? How would you fix that?
* What is the RUS?
* When would you need to manually create additional RUS?
* What are Address Lists?
* How would you modify the filter properties of one of the default address lists?
* How can you create multiple GALs and allow the users to only see the one related to them?
* What is a Front End server? In what scenarios would you use one?
* What type of authentication is used on the front end servers?
* When would you use NLB?
* How would you achieve incoming mail redundancy?
* What are the 4 types of Exchange backups?
* What is the Dial-Tone server scenario?
* When would you use offline backup?
* How do you re-install Exchange on a server that has crashed but with AD intact?
* What is the dumpster?
* What are the e00xxxxx.log files?
* What is the e00.chk file?
* What is circular logging? When would you use it?
* What's the difference between online and offline defrag?
* How would you know if it is time to perform an offline defrag of your Exchange stores?
* How would you plan for, and perform the offline defrag?
* What is the eseutil command?
* What is the isinteg command?
* How would you monitor Exchange's services and performance? Name 2 or 3 options.
* Name all the client connection options in Exchange 2003.
* What is Direct Push? What are the requirements to run it?
* How would you remote wipe a PPC?
* What are the issues with connecting Outlook from a remote computer to your mailbox?
* How would you solve those issues? Name 2 or 3 methods
* What is RPC over HTTP? What are the requirements to run it?
* What is Cached Mode in OL2003/2007?
* What are the benefits and "issues" when using cached mode? How would you tackle those issues?
* What is S/MIME? What are the usage scenarios for S/MIME?
* What are the IPSec usage scenarios for Exchange 2003?
* How do you enable SSL on OWA?
* What are the considerations for obtaining a digital certificate for SSL on Exchange?
* Name a few 3rd-party CAs.
* What do you need to consider when using a client-type AV software on an Exchange server?
* What are the different clustering options in Exchange 2003? Which one would you choose and why.

* What is Active Directory?
* What is LDAP?
* Can you connect Active Directory to other 3rd-party Directory Services? Name a few options.
* Where is the AD database held? What other folders are related to AD?
* What is the SYSVOL folder?
* Name the AD NCs and replication issues for each NC
* What are application partitions? When do I use them
* How do you create a new application partition
* How do you view replication properties for AD partitions and DCs?
* What is the Global Catalog?
* How do you view all the GCs in the forest?
* Why not make all DCs in a large forest as GCs?
* Trying to look at the Schema, how can I do that?
* What are the Support Tools? Why do I need them?
* What is LDP? What is REPLMON? What is ADSIEDIT? What is NETDOM? What is REPADMIN?
* What are sites? What are they used for?
* What's the difference between a site link's schedule and interval?
* What is the KCC?
* What is the ISTG? Who has that role by default?
* What are the requirements for installing AD on a new server?
* What can you do to promote a server to DC if you're in a remote location with slow WAN link?
* How can you forcibly remove AD from a server, and what do you do later? • Can I get user passwords from the AD database?
* What tool would I use to try to grab security related packets from the wire?
* Name some OU design considerations.
* What is tombstone lifetime attribute?
* What do you do to install a new Windows 2003 DC in a Windows 2000 AD?
* What do you do to install a new Windows 2003 R2 DC in a Windows 2003 AD?
* How would you find all users that have not logged on since last month?
* What are the DS* commands?
* What's the difference between LDIFDE and CSVDE? Usage considerations?
* What are the FSMO roles? Who has them by default? What happens when each one fails?
* What FSMO placement considerations do you know of?
* I want to look at the RID allocation table for a DC. What do I do?
* What's the difference between transferring a FSMO role and seizing one? Which one should you NOT seize? Why?
* How do you configure a "stand-by operation master" for any of the roles?
* How do you backup AD?
* How do you restore AD?
* How do you change the DS Restore admin password?
* Why can't you restore a DC that was backed up 4 months ago?
* What are GPOs?
* What is the order in which GPOs are applied?
* Name a few benefits of using GPMC.
* What are the GPC and the GPT? Where can I find them?
* What are GPO links? What special things can I do to them?
* What can I do to prevent inheritance from above?
* How can I override blocking of inheritance?
* How can you determine what GPO was and was not applied for a user? Name a few ways to do that.
* A user claims he did not receive a GPO, yet his user and computer accounts are in the right OU, and everyone else there gets the GPO. What will you look for?
* Name a few differences in Vista GPOs
* Name some GPO settings in the computer and user parts.
* What are administrative templates?
* What's the difference between software publishing and assigning?
* Can I deploy non-MSI software with GPO?
* You want to standardize the desktop environments (wallpaper, My Documents, Start menu, printers etc.) on the computers in one department. How would you do that?

Technical Interview Questions – Networking

* What is an IP address?
* What is a subnet mask?
* What is ARP?
* What is ARP Cache Poisoning?
* What is the ANDing process?
* What is a default gateway? What happens if I don't have one?
* Can a workstation computer be configured to browse the Internet and yet NOT have a default gateway?
* What is a subnet?
* What is APIPA?
* What is an RFC? Name a few if possible (not necessarily the numbers, just the ideas behind them)
* What is RFC 1918?
* What is CIDR?
* You have the following Network ID: 192.115.103.64/27. What is the IP range for your network?
* You have the following Network ID: 131.112.0.0. You need at least 500 hosts per network. How many networks can you create? What subnet mask will you use?
* You need to view at network traffic. What will you use? Name a few tools
* How do I know the path that a packet takes to the destination?
* What does the ping 192.168.0.1 -l 1000 -n 100 command do?
* What is DHCP? What are the benefits and drawbacks of using it?
* Describe the steps taken by the client and DHCP server in order to obtain an IP address.
* What is the DHCPNACK and when do I get one? Name 2 scenarios.
* What ports are used by DHCP and the DHCP clients?
* Describe the process of installing a DHCP server in an AD infrastructure.
* What is DHCPINFORM?
* Describe the integration between DHCP and DNS.
* What options in DHCP do you regularly use for an MS network?
* What are User Classes and Vendor Classes in DHCP?
* How do I configure a client machine to use a specific User Class?
* What is the BOOTP protocol used for, where might you find it in Windows network infrastructure?
* DNS zones – describe the differences between the 4 types.
* DNS record types – describe the most important ones.
* Describe the process of working with an external domain name
* Describe the importance of DNS to AD.
* Describe a few methods of finding an MX record for a remote domain on the Internet.
* What does "Disable Recursion" in DNS mean?
* What could cause the Forwarders and Root Hints to be grayed out?
* What is a "Single Label domain name" and what sort of issues can it cause?
* What is the "in-addr.arpa" zone used for?
* What are the requirements from DNS to support AD?
* How do you manually create SRV records in DNS?
* Name 3 benefits of using AD-integrated zones.
* What are the benefits of using Windows 2003 DNS when using AD-integrated zones?
* You installed a new AD domain and the new (and first) DC has not registered its SRV records in DNS. Name a few possible causes.
* What are the benefits and scenarios of using Stub zones?
* What are the benefits and scenarios of using Conditional Forwarding?
* What are the differences between Windows Clustering, Network Load Balancing and Round Robin, and scenarios for each use?
* How do I work with the Host name cache on a client computer?
* How do I clear the DNS cache on the DNS server?
* What is the 224.0.1.24 address used for?
* What is WINS and when do we use it?
* Can you have a Microsoft-based network without any WINS server on it? What are the "considerations" regarding not using WINS?
* Describe the differences between WINS push and pull replications.
* What is the difference between tombstoning a WINS record and simply deleting it?
* Name the NetBIOS names you might expect from a Windows 2003 DC that is registered in WINS.
* Describe the role of the routing table on a host and on a router.
* What are routing protocols? Why do we need them? Name a few.
* What are router interfaces? What types can they be?
* In Windows 2003 routing, what are the interface filters?
* What is NAT?
* What is the real difference between NAT and PAT?
* How do you configure NAT on Windows 2003?
* How do you allow inbound traffic for specific hosts on Windows 2003 NAT?
* What is VPN? What types of VPN does Windows 2000 and beyond work with natively?
* What is IAS? In what scenarios do we use it?
* What's the difference between Mixed mode and Native mode in AD when dealing with RRAS?
* What is the "RAS and IAS" group in AD?
* What are Conditions and Profile in RRAS Policies?
* What types or authentication can a Windows 2003 based RRAS work with?
* How does SSL work?
* How does IPSec work?
* How do I deploy IPSec for a large number of computers?
* What types of authentication can IPSec use?
* What is PFS (Perfect Forward Secrecy) in IPSec?
* How do I monitor IPSec?
* Looking at IPSec-encrypted traffic with a sniffer. What packet types do I see?
* What can you do with NETSH?
* How do I look at the open ports on my machine?

# How do you double-boot a Win 2003 server box? The Boot.ini file is set as read-only, system, and hidden to prevent unwanted editing. To change the Boot.ini timeout and default settings, use the System option in Control Panel from the Advanced tab and select Startup.

# What do you do if earlier application doesn’t run on Windows Server 2003? When an application that ran on an earlier legacy version of Windows cannot be loaded during the setup function or if it later malfunctions, you must run the compatibility mode function. This is accomplished by right-clicking the application or setup program and selecting Properties –> Compatibility –> selecting the previously supported operating system.

# If you uninstall Windows Server 2003, which operating systems can you revert to? Win ME, Win 98, 2000, XP. Note, however, that you cannot upgrade from ME and 98 to Windows Server 2003.

# How do you get to Internet Firewall settings? Start –> Control Panel –> Network and Internet Connections –> Network Connections.

# What are the Windows Server 2003 keyboard shortcuts? Winkey opens or closes the Start menu. Winkey + BREAK displays the System Properties dialog box. Winkey + TAB moves the focus to the next application in the taskbar. Winkey + SHIFT + TAB moves the focus to the previous application in the taskbar. Winkey + B moves the focus to the notification area. Winkey + D shows the desktop. Winkey + E opens Windows Explorer showing My Computer. Winkey + F opens the Search panel. Winkey + CTRL + F opens the Search panel with Search for Computers module selected. Winkey + F1 opens Help. Winkey + M minimizes all. Winkey + SHIFT+ M undoes minimization. Winkey + R opens Run dialog. Winkey + U opens the Utility Manager. Winkey + L locks the computer.

# What is Active Directory? Active Directory is a network-based object store and service that locates and manages resources, and makes these resources available to authorized users and groups. An underlying principle of the Active Directory is that everything is considered an object—people, servers, workstations, printers, documents, and devices. Each object has certain attributes and its own security access control list (ACL).

# Where are the Windows NT Primary Domain Controller (PDC) and its Backup Domain Controller (BDC) in Server 2003? The Active Directory replaces them. Now all domain controllers share a multimaster peer-to-peer read and write relationship that hosts copies of the Active Directory.

# How long does it take for security changes to be replicated among the domain controllers? Security-related modifications are replicated within a site immediately. These changes include account and individual user lockout policies, changes to password policies, changes to computer account passwords, and modifications to the Local Security Authority (LSA).

# What’s new in Windows Server 2003 regarding the DNS management? When DC promotion occurs with an existing forest, the Active Directory Installation Wizard contacts an existing DC to update the directory and replicate from the DC the required portions of the directory. If the wizard fails to locate a DC, it performs debugging and reports what caused the failure and how to fix the problem. In order to be located on a network, every DC must register in DNS DC locator DNS records. The Active Directory Installation Wizard verifies a proper configuration of the DNS infrastructure. All DNS configuration debugging and reporting activity is done with the Active Directory Installation Wizard.

# When should you create a forest? Organizations that operate on radically different bases may require separate trees with distinct namespaces. Unique trade or brand names often give rise to separate DNS identities. Organizations merge or are acquired and naming continuity is desired. Organizations form partnerships and joint ventures. While access to common resources is desired, a separately defined tree can enforce more direct administrative and security restrictions.
# How can you authenticate between forests? Four types of authentication are used across forests: (1) Kerberos and NTLM network logon for remote access to a server in another forest; (2) Kerberos and NTLM interactive logon for physical logon outside the user’s home forest; (3) Kerberos delegation to N-tier application in another forest; and (4) user principal name (UPN) credentials.

# What snap-in administrative tools are available for Active Directory? Active Directory Domains and Trusts Manager, Active Directory Sites and Services Manager, Active Directory Users and Group Manager, Active Directory Replication (optional, available from the Resource Kit), Active Directory Schema Manager (optional, available from adminpak)

# What types of classes exist in Windows Server 2003 Active Directory?

* Structural class. The structural class is important to the system administrator in that it is the only type from which new Active Directory objects are created. Structural classes are developed from either the modification of an existing structural type or the use of one or more abstract classes.
* Abstract class. Abstract classes are so named because they take the form of templates that actually create other templates (abstracts) and structural and auxiliary classes. Think of abstract classes as frameworks for the defining objects.
* Auxiliary class. The auxiliary class is a list of attributes. Rather than apply numerous attributes when creating a structural class, it provides a streamlined alternative by applying a combination of attributes with a single include action.
* 88 class. The 88 class includes object classes defined prior to 1993, when the 1988 X.500 specification was adopted. This type does not use the structural, abstract, and auxiliary definitions, nor is it in common use for the development of objects in Windows Server 2003 environments.

# How do you delete a lingering object? Windows Server 2003 provides a command called Repadmin that provides the ability to delete lingering objects in the Active Directory.

# What is Global Catalog? The Global Catalog authenticates network user logons and fields inquiries about objects across a forest or tree. Every domain has at least one GC that is hosted on a domain controller. In Windows 2000, there was typically one GC on every site in order to prevent user logon failures across the network.

# How is user account security established in Windows Server 2003? When an account is created, it is given a unique access number known as a security identifier (SID). Every group to which the user belongs has an associated SID. The user and related group SIDs together form the user account’s security token, which determines access levels to objects throughout the system and network. SIDs from the security token are mapped to the access control list (ACL) of any object the user attempts to access.

# If I delete a user and then create a new account with the same username and password, would the SID and permissions stay the same? No. If you delete a user account and attempt to recreate it with the same user name and password, the SID will be different.

# What do you do with secure sign-ons in an organization with many roaming users? Credential Management feature of Windows Server 2003 provides a consistent single sign-on experience for users. This can be useful for roaming users who move between computer systems. The Credential Management feature provides a secure store of user credentials that includes passwords and X.509 certificates.

# Anything special you should do when adding a user that has a Mac? "Save password as encrypted clear text" must be selected on User Properties Account Tab Options, since the Macs only store their passwords that way.

# What remote access options does Windows Server 2003 support? Dial-in, VPN, dial-in with callback.

# Where are the documents and settings for the roaming profile stored? All the documents and environmental settings for the roaming user are stored locally on the system, and, when the user logs off, all changes to the locally stored profile are copied to the shared server folder. Therefore, the first time a roaming user logs on to a new system the logon process may take some time, depending on how large his profile folder is.

# Where are the settings for all the users stored on a given machine? \Document and Settings\All Users

# What languages can you use for log-on scripts? JavaScipt, VBScript, DOS batch files (.com, .bat, or even .exe)

1. What is Active Directory schema?
2. What are the domain functional level in Windows Server 2003?
3. What are the forest functional level in Windows Server 2003?
4. What is global catalog server?
5. How we can raise domain functional & forest functional level in Windows Server 2003?

6. Which is the deafult protocol used in directory services?
7. What is IPv6?
8. What is the default domain functional level in Windows Server 2003?
9. What are the physical & logical components of ADS
10. In which domain functional level, we can rename domain name?
11. What is multimaster replication?
12. What is a site?
13. Which is the command used to remove active directory from a domain controler?
14. How we can create console, which contain schema?
15. What is trust?
16. What is the file that’s responsible for keep all Active Directory database?

• What is Active Directory?
• What is LDAP?
• Can you connect Active Directory to other 3rd-party Directory Services? Name a few options.
• Where is the AD database held? What other folders are related to AD?
• What is the SYSVOL folder?
• Name the AD NCs and replication issues for each NC
• What are application partitions? When do I use them
• How do you create a new application partition
• How do you view replication properties for AD partitions and DCs?
• What is the Global Catalog?
• How do you view all the GCs in the forest?
• Why not make all DCs in a large forest as GCs?
• Trying to look at the Schema, how can I do that?
• What are the Support Tools? Why do I need them?
• What is LDP? What is REPLMON? What is ADSIEDIT? What is NETDOM? What is REPADMIN?
• What are sites? What are they used for?
• What’s the difference between a site link’s schedule and interval?
• What is the KCC?
• What is the ISTG? Who has that role by default?
• What are the requirements for installing AD on a new server?
• What can you do to promote a server to DC if you’re in a remote location with slow WAN link?
• How can you forcibly remove AD from a server, and what do you do later? • Can I get user passwords from the AD database?
• What tool would I use to try to grab security related packets from the wire?
• Name some OU design considerations.
• What is tombstone lifetime attribute?
• What do you do to install a new Windows 2003 DC in a Windows 2000 AD?
• What do you do to install a new Windows 2003 R2 DC in a Windows 2003 AD?
• How would you find all users that have not logged on since last month?
• What are the DS* commands?
• What’s the difference between LDIFDE and CSVDE? Usage considerations?
• What are the FSMO roles? Who has them by default? What happens when each one fails?
• What FSMO placement considerations do you know of?
• I want to look at the RID allocation table for a DC. What do I do?
• What’s the difference between transferring a FSMO role and seizing one? Which one should you NOT seize? Why?
• How do you configure a “stand-by operation master” for any of the roles?
• How do you backup AD?
• How do you restore AD?
• How do you change the DS Restore admin password?
• Why can’t you restore a DC that was backed up 4 months ago?
• What are GPOs?
• What is the order in which GPOs are applied?
• Name a few benefits of using GPMC.
• What are the GPC and the GPT? Where can I find them?
• What are GPO links? What special things can I do to them?
• What can I do to prevent inheritance from above?
• How can I override blocking of inheritance?
• How can you determine what GPO was and was not applied for a user? Name a few ways to do that.
• A user claims he did not receive a GPO, yet his user and computer accounts are in the right OU, and everyone else there gets the GPO. What will you look for?
• Name a few differences in Vista GPOs
• Name some GPO settings in the computer and user parts.
• What are administrative templates?
• What’s the difference between software publishing and assigning?
• Can I deploy non-MSI software with GPO?
• You want to standardize the desktop environments (wallpaper, My Documents, Start menu, printers etc.) on the computers in one department. How would you do that?

Windows Server 2003 Active Directory and Security questions


1. What’s the difference between local, global and universal groups? Domain local groups assign access permissions to global domain groups for local domain resources. Global groups provide access to resources in other trusted domains. Universal groups grant access to resources in all trusted domains.

2. I am trying to create a new universal user group. Why can’t I? Universal groups are allowed only in native-mode Windows Server 2003 environments. Native mode requires that all domain controllers be promoted to Windows Server 2003 Active Directory.
3. What is LSDOU? It’s group policy inheritance model, where the policies are applied to Local machines, Sites, Domains and Organizational Units.
4. Why doesn’t LSDOU work under Windows NT? If the NTConfig.pol file exist, it has the highest priority among the numerous policies.
5. Where are group policies stored? %SystemRoot%System32\GroupPolicy
6. What is GPT and GPC? Group policy template and group policy container.
7. Where is GPT stored? %SystemRoot%\SYSVOL\sysvol\domainname\Policies\GUID
8. You change the group policies, and now the computer and user settings are in conflict. Which one has the highest priority? The computer settings take priority.
9. You want to set up remote installation procedure, but do not want the user to gain access over it. What do you do? gponame–> User Configuration–> Windows Settings–> Remote Installation Services–> Choice Options is your friend.
10. What’s contained in administrative template conf.adm? Microsoft NetMeeting policies
11. How can you restrict running certain applications on a machine? Via group policy, security settings for the group, then Software Restriction Policies.
12. You need to automatically install an app, but MSI file is not available. What do you do? A .zap text file can be used to add applications using the Software Installer, rather than the Windows Installer.
13. What’s the difference between Software Installer and Windows Installer? The former has fewer privileges and will probably require user intervention. Plus, it uses .zap files.
14. What can be restricted on Windows Server 2003 that wasn’t there in previous products? Group Policy in Windows Server 2003 determines a users right to modify network and dial-up TCP/IP properties. Users may be selectively restricted from modifying their IP address and other network configuration parameters.
15. How frequently is the client policy refreshed? 90 minutes give or take.
16. Where is secedit? It’s now gpupdate.
17. You want to create a new group policy but do not wish to inherit. Make sure you check Block inheritance among the options when creating the policy.
18. What is "tattooing" the Registry? The user can view and modify user preferences that are not stored in maintained portions of the Registry. If the group policy is removed or changed, the user preference will persist in the Registry.
19. How do you fight tattooing in NT/2000 installations? You can’t.
20. How do you fight tattooing in 2003 installations? User Configuration - Administrative Templates - System - Group Policy - enable - Enforce Show Policies Only.
21. What does IntelliMirror do? It helps to reconcile desktop settings, applications, and stored files for users, particularly those who move between workstations or those who must periodically work offline.
22. What’s the major difference between FAT and NTFS on a local machine? FAT and FAT32 provide no security over locally logged-on users. Only native NTFS provides extensive permission control on both remote and local files.
23. How do FAT and NTFS differ in approach to user shares? They don’t, both have support for sharing.
24. Explan the List Folder Contents permission on the folder in NTFS. Same as Read & Execute, but not inherited by files within a folder. However, newly created subfolders will inherit this permission.
25. I have a file to which the user has access, but he has no folder permission to read it. Can he access it? It is possible for a user to navigate to a file for which he does not have folder permission. This involves simply knowing the path of the file object. Even if the user can’t drill down the file/folder tree using My Computer, he can still gain access to the file using the Universal Naming Convention (UNC). The best way to start would be to type the full path of a file into Run… window.
26. For a user in several groups, are Allow permissions restrictive or permissive? Permissive, if at least one group has Allow permission for the file/folder, user will have the same permission.
27. For a user in several groups, are Deny permissions restrictive or permissive? Restrictive, if at least one group has Deny permission for the file/folder, user will be denied access, regardless of other group permissions.
28. What hidden shares exist on Windows Server 2003 installation? Admin$, Drive$, IPC$, NETLOGON, print$ and SYSVOL.
29. What’s the difference between standalone and fault-tolerant DFS (Distributed File System) installations? The standalone server stores the Dfs directory tree structure or topology locally. Thus, if a shared folder is inaccessible or if the Dfs root server is down, users are left with no link to the shared resources. A fault-tolerant root node stores the Dfs topology in the Active Directory, which is replicated to other domain controllers. Thus, redundant root nodes may include multiple connections to the same data residing in different shared folders.
30. We’re using the DFS fault-tolerant installation, but cannot access it from a Win98 box. Use the UNC path, not client, only 2000 and 2003 clients can access Server 2003 fault-tolerant shares.
31. Where exactly do fault-tolerant DFS shares store information in Active Directory? In Partition Knowledge Table, which is then replicated to other domain controllers.
32. Can you use Start->Search with DFS shares? Yes.
33. What problems can you have with DFS installed? Two users opening the redundant copies of the file at the same time, with no file-locking involved in DFS, changing the contents and then saving. Only one file will be propagated through DFS.
34. I run Microsoft Cluster Server and cannot install fault-tolerant DFS. Yeah, you can’t. Install a standalone one.
35. Is Kerberos encryption symmetric or asymmetric? Symmetric.
36. How does Windows 2003 Server try to prevent a middle-man attack on encrypted line? Time stamp is attached to the initial client request, encrypted with the shared key.
37. What hashing algorithms are used in Windows 2003 Server? RSA Data Security’s Message Digest 5 (MD5), produces a 128-bit hash, and the Secure Hash Algorithm 1 (SHA-1), produces a 160-bit hash.
38. What third-party certificate exchange protocols are used by Windows 2003 Server? Windows Server 2003 uses the industry standard PKCS-10 certificate request and PKCS-7 certificate response to exchange CA certificates with third-party certificate authorities.
39. What’s the number of permitted unsuccessful logons on Administrator account? Unlimited. Remember, though, that it’s the Administrator account, not any account that’s part of the Administrators group.
40. If hashing is one-way function and Windows Server uses hashing for storing passwords, how is it possible to attack the password lists, specifically the ones using NTLMv1? A cracker would launch a dictionary attack by hashing every imaginable term used for password and then compare the hashes.
41. What’s the difference between guest accounts in Server 2003 and other editions? More restrictive in Windows Server 2003.
42. How many passwords by default are remembered when you check "Enforce Password History Remembered"? User’s last 6 passwords.

VPN Setup
Summary
Basic VPN Requirement
Can I setup my VPN client as a router to direct all local computers traffic to the VPN.
Can't ping computer name when using VPN
Configure RRAS tracing
How many inbound dial-in connections are supported
How to add DNS and WINS into your Cisco VPN server
How to assign a static IP to VPN client
How to connect to a Windows domain using Windows VPN at startup
How to configure VPN Packet Filters
How do I set up a modem to dial into a remote compute
How to configure W2K server as VPN server
How to configure Win 2000/XP Pro as VPN host
How to configure a W2K/XP as VPN client
How to configuring a multihomed VPN server
How to configure VPN Packet Filters
How to create an incoming networking connection
How to establish VPN connection automatically
How to manage IP assignment on RRAS
How to schedule to connect and disconnect a VPN
How to setup VPN server on 2003 server
How to setup Windows 2003 as VPN server with one NIC
How to setup VPN on w2k server with one NIC
How to use PPTP through a Cisco PIX
Incoming Connection or RRAS
Logon script with VPN
Manage VPN connections
Security on Windows VPN Server
VPN to SBS and then dial-up to another network
Which ports need to be opened for running VPN
What statements are required to allow a VPN inbound past my Cisco PIX?
Why doesn't my w2k/xp have "log on using dial-up connection" option on the logon screen
Summary
Virtual Private Networks (VPN) allow users working at home, on the road or at a branch office to connect in a secure manner to a remote corporate server using the public Internet. VPN server or host is a computer that accepts VPN connections from VPN clients. A VPN server or host can be a NT/W2K server or W2K/XP Pro. VPN client is a computer that initiates a VPN connection to a VPN server or host. A VPN client can be an individual computer running MS Windows NT version 4.0, Windows 2000, 9x. VPN clients can also be any non-Microsoft Point-to-Point Tunneling Protocol (PPTP) client or Layer Two Tunneling Protocol (L2TP) client using IPSec.

Basic VPN Requirement

*

User Permission. Enable a user to access the VPN. To do this, go to AD Users and Computers, select the user who need to access the VPN, click Dial-in. Check Allow access on the Remote Access Permission (Dial-in or VPN).
*

IP Configuration. The VPN server should have a static IP address and assign the arrange IP addresses to VPN clients. The VPN server must also be configured with DNS and WINS server addresses to assign to the VPN client during the connection.
*

Data Encryption. Data carried on the public network should be rendered unreadable to unauthorized clients on the network.
*

Protocol Support. The TCP/IP is common protocols used in the public network. The VPN also include IP, Internetwork Packet Exchange (IPX), NetBEUI and so on.
*

Firewall Ports. When you place a VPN server behind your firewall, be sure to enable IP protocol 47 (GRE) and TCP port 1723.
*

Interface(s) for VPN server. If your network doesn't have a router or the VPN is also a gateway, your computer must have at least two interfaces, one connecting to the Internet and another connecting to the LAN. If it is behind a router, you just need one NIC.
*

One interface for VPN client. The interface can be a dial-in modem, or a dedicated connection to the Internet.

Still need help, contact consultant

Q: Can I setup my VPN client as a router to direct all local computers traffic to the VPN.

A: No, you need to setup site to site VPN.

Can't ping computer name when using VPN

If you have name resolution issue when using VPN, check the PPTP filtering on the server. If you disable UDP ports 137 and 138 or TCP port 139, NetBIOS packets can't pass through the network. You also need to enable these ports on all firewalls and routers that are between the client and the server for unicast (point-to-point) traffic.

Configure RRAS tracing

When you need to monitor the activities of RRA and Dial-Up Networking components, use the tracing functionality to configure RRA and Dial-Up Networking components to log tracing information to a file. You can make RRA and Dial-Up Networking tracing available by either configuring the registry or using the netsh command.

How to add DNS and WINS into your Cisco VPN server

If your VPN client cannot find servers or cannot ping computernmae, you may need to add DNS and WINS into your VPN server. For example, to add DNS and WINS on a Cisco Firewall PIX, add vpdn group 1 client configuation dns dnsservername and vpdn group 1 client configuration wins winsservername..

How to assign a static IP to VPN client

If you have Windows 2003 server as VPN server, you can assign a static IP under user's properties. If you use other Windows OS as VPN server, you may do create a DHCP reservation.

How to connect to a Windows domain using Windows VPN at startup

If you are running w2k/xp pro setup for a domain controller, you will have a option to "log on using dial-up connection" on logon screen after creating a VPN/dial-up connection. In the Log On to Windows dialog box, the user can select the Log on using dial-up connection check box. After clicking OK, the user is prompted to choose a network connection.

How to configure VPN Packet Filters

When you setup the RRAS, a set of default Input and Output Filters on the external adapter on the VPN server will be created. If you aren't running your server in a highly secure environment, you can comfortably place the server outside the firewall and restrict incoming VPN traffic to PPTP packets only. To display and mortify these filters, go to Routing and Remote Access>IP Routing>General, and then you can add or edit the packet filters of the dedicated Local Area Connection. Or to enable PPTP filtering from Control Panel, select the Network applet, Protocols, TCP/IP Protocols, the WAN adapter, Advanced. Then, select the Enable PPTP Filtering check box, as Screen 1 shows. When you enable PPTP filtering, the server will refuse all non-PPTP requests.

How do I set up a modem to dial into a remote compute

You need to install your modem from the control panel if you haven't already, and you need to set up the dialup networking server on your remote computer. (This is included with Win98, NT4 and w2k/xp. On Win95 it is in the Plus! pack, but you need to get an update to version 1.3 or later from Microsoft's site. At the time of writing it can be found here.) You can enable the dialup server from the 'Connections' menu of the dial-up networking window. If it isn't there, or if you've updated the dialup networking as mentioned above, you need to install it using the Windows Setup section of 'Add/Remove Programs' in the control panel.

How many inbound dial-in connections are supported

W2K server supports 256 inbound dial-in connections while w2k pro supports 1.

How to create an incoming networking connection

You can configure an incoming connection to accept the following connection types: (modem, ISDN, X.25), VPN (PPTP, L2TP), or direct (serial, infrared, DirectParallel). On a computer running Windows 2000, 2003 or XP Pro, an incoming connection can accept up to three incoming calls, up to one of each of these types. Note: on a computer running Windows 2000/2003 Server, the number of inbound calls is only limited by the computer and its hardware configuration.

To create VPN connection, open Networking Connections>New Connection Wizard>Set up an advanced connection>Accept incoming connections, then follow the instruction.
How to establish VPN connection automatically

1. You can run rasdial.exe as a service by using instsrv.exe
2. Add rasdial.exe into startup.
3. Create IPSec VPN if you have static IP.

How to manage IP assignment on RRAS

Open RRAS, right-click on the RRAS server>Properties>IP. You will have two options, DHCP and Static address pool.

How to schedule to connect and disconnect a VPN

You can use rasdial command plus scheduler.

How to setup VPN server on 2003 server

You may have two options to setup VPN server on Windows 2003. 1) Create an incoming networking connection if you have small network or you want to setup one PC to PC VPN; 2) If you have large numbers of incoming connections on a server that operates as part of a distributed network or as a domain controller, you should use RRA to create a VPN server.

How to setup VPN on w2k server with one NIC

Symptoms: When attempting to create VPN on w2k server with one NIC, you may receive "You have chosen the last available connection as the Internet connection. A VPN server required that one connection be used as the private network connection" if you select the NIC.

1. You should highlight No internet connection instead of the NIC or LAN connection.
2. You may try "Manually configured server option".

How to use PPTP through a Cisco PIX

In order to use PPTP through a PIX, you must have a one-to-one mapping from the external IP to an internal IP for type 47 GRE packets and port 1723.

How to configure W2K server as VPN server

To setup a Windows 2000 server for VPN, open Routing and Remote Access console in the Administrative Tools folder, right-click the server and then click Configure and Enable Routing and Remote Access>Virtual private network [VPN] server. Click Next if TCP/IP is only protocol you will use. Select a connection you will connect to on the Internet Connection. You will have two options to assign IP to VPN clients. The default is Automatically. It is recommended to configure the server to assign client addresses from a static address pool, rather than assigning addresses from a DHCP server. If you configure RAS to assign client addresses from a static address pool, clients inherit the DNS and WINS settings from the RAS server. If your RAS server can browse the network, clients should also be able to browse the network with the same settings. If you prefer DHCP, verify that DHCP scope option 44 (WINS/NetBIOS name server) points to the WINS server and scope option 6 shows the address of your DNS server. When you don't define these options, you almost guarantee problems with client browsing. Finally, you can select using RADIUS or not.

NOTE: If VPN traffic is traveling through a router or firewall, configure the router or firewall to pass PPTP (TCP Port 1723 and IP Protocol ID 47 [GRE - Generic Routing Encapsulation]) or L2TP over IPSec (UDP Port 500 and IP Protocol ID 50 [Encapsulating Security Payload]) traffic to and from the VPN server.
How to configure Win 2000/XP Pro as VPN host

Prior to Windows 2000/XP Pro, you must add PPTP on NT 4.0 Server to establish VPN connections. With the release of Windows 2000/XP Pro, you have the ability to run a Windows 2000/XP Pro as a VPN host. However, Windows 2000/XP Pro enables only one VPN connection at a time and requires Internet Protocol (IP).

Before you start the VPN configuration, you should have a equipment (modem, T1, Frame Relay, ADSL, or cable modem) connecting to the Internet. Also make sure you have correct TCP/IP settings on the W2K/XP.

To setup Win XP (in our case) Pro as VPN host, go to the Properties of My Network Places>Create a New Connections>Set up a Advanced Connection>Accept Incoming Connections. On the Devices for Incoming Connections dialog box, do not select any device, only click Next and check Allow Private Connections, and then click Next. On the Allowed Users dialog box, select or add all users for whom you want to enable access. The accounts have to exist on both computers that are involved in establishing the VPN connection. On the New Connection Wizard, File and Printer Sharing for Microsoft Networks, Internet Protocol (TCP/IP) and Client for Microsoft Networks should be listed as networking components. By default, Allow callers to access my local area network and Assign TCP/IP address automatically using DHCP are checked. If you would like to keep the default settings, click Next to continue. Now, the Incoming Connection icon should show on Incoming section under the Properties of My Network Places and is ready to use.
How to configure a W2K/XP as VPN client

To connect to a VPN server, you should have a dail-in modem or a dedicated connection to the Internet. To setup a XP client to access the VPN host, go to the Properties of My Network Places>Create a New Connections>Connect to the network at my workplace>Virtual Private Network connection. Type Computer that will be showed as connection name in VPN section, select Do not dial the initial connection and then type the VPN host IP. You have two options to create this connection for anyone or for yourself.
How to configuring a multihomed VPN server
If the VPN server has two network cards, one for the LAN and one for the WAN, leave the gateway on the LAN adapter blank. In the gateway field of the WAN network interface, enter the TCP/IP address that your ISP defines; the gateway address usually points to a router at your ISP. It is recommend you manually enter the TCP/IP address, DNS and WINS for the LAN NIC instead of using DHCP.

Incoming Connection or RRAS

You can create an incoming connection on a computer acting as a remote access server if it is running Windows 2000, XP Pro. or if it is a stand-alone computer running Windows 2000/2003 Server. For large numbers of incoming connections on a computer running Windows 2000/2003 Server as a router or as a domain controller, or a member of a domain, you should use Routing and Remote Access to create a remote access server.

Logon script with VPN

To run logon script while establishing a VPN, you may have two options. 1) create a batch including rasdial.exe plus mapping. 2) Use Microsoft CMAK

Manage VPN connections

To manage VPN logon time, permissions, disconnect if idle for certain minutes, maximum session other constraints, use Remote Access Policies under RRAS.
Security on Windows VPN Server

A Windows 2000 VPN server is installed with a default set of Input and Output filters on the external adapter. These filters support PPTP, L2TP, and IPSec connectivity only and block other traffic.. However, the filters can be modified. To modify the filters, go to RRAS>IP Routing>General, right-click the external adapter and select Properties.

Which ports need to be opened for running VPN

A: PPTP VPN uses TCP Port 1723, IP Protocol 47 (GRE); L2TP: UDP Port 1701; IPSec: UDP Port 500, Pass IP protocol 50 and 51. Note: 47 is a protocol number and not TCP port. The protocol name is GRE. It'll make a big difference when configuring your firewall or router.

What statements are required to allow a VPN inbound past my Cisco PIX?

The following example is a simple PPTP access list:

access-list 110 permit tcp any host x.x.x.x eq 1723
access-list 110 permit gre any host x.x.x.x

Note: 1. x.x.x.x is outside ip. 2. If you use 6.3.1, you will need to enable fixup protocol pptp 1723.

Why doesn't my w2k/xp have "log on using dial-up connection" option on the logon screen

1. You must create a VPN or dial-up connection.
2. Your administrator may disable this option.
3. If the computer is not a member of a domain, the Log on using dial-up connection check box does not appear.

To deploy a VPN solution for Electronic, Inc., the network administrator performs an analysis and makes design decisions regarding:

The network configuration
The remote access policy configuration
The domain configuration
The security configuration
The network configuration
The key elements of the network configuration are:

The Electronic, Inc. corporate intranet uses the private networks of 172.16.0.0 with a subnet mask of 255.240.0.0 and 192.168.0.0 with a subnet mask of 255.255.0.0. The corporate campus network segments use subnets of 172.16.0.0 and the branch offices use subnets of 192.168.0.0.
The VPN server computer is directly attached to the Internet by using a T3 (also known as a DS-3) dedicated WAN link.
The IP address of the WAN adapter on the Internet is 207.209.68.1 as allocated by the Internet service provider (ISP) for Electronic, Inc. The IP address of the WAN adapter is referred to on the Internet by the domain name vpn.electronic.microsoft.com.
The VPN server computer is directly attached to an intranet network segment that contains a RADIUS server, a file and Web server for business partner access, and a router that connects to the rest of the Electronic, Inc. corporate campus intranet. The intranet network segment has the IP network ID of 172.31.0.0 with the subnet mask of 255.255.0.0.
The VPN server computer is configured with a static pool of IP addresses to allocate to remote access clients and calling routers. The static pool of IP addresses is a subset of the intranet network segment (an on-subnet address pool).
The following illustration shows the network configuration of the Electronic, Inc. VPN server.


Enlarge figure

Note

While the illustration shows the RADIUS server and file and Web server, the RADIUS server is not discussed until Dial-up and VPNs with RADIUS, and the file and Web servers are not discussed until Extranet for business partners.
Based on the network configuration of the Electronic, Inc. corporate campus intranet, the VPN server computer is configured as follows.

1. Install hardware in the VPN server
The network adapter that is used to connect to the intranet segment and the WAN adapter that is used to connect to the Internet are installed according to the adapter manufacturer's instructions. Once drivers are installed and functioning, both adapters appear as local area connections in the Network Connections folder.

2. Configure TCP/IP on the LAN and WAN adapter
For the LAN adapter, an IP address of 172.31.0.1 with a subnet mask 255.255.0.0 is configured. For the WAN adapter, an IP address of 207.209.68.1 with a subnet mask 255.255.255.255 is configured. A default gateway is not configured for either adapter. DNS and WINS server addresses are also configured.

3. Install the Routing and Remote Access service
The Routing and Remote Access Server Setup Wizard is run. Within the wizard, the Remote Access (dial-up or VPN) option is selected. For more information, see To enable the Routing and Remote Access service.

While running the wizard, a static IP address pool with a starting IP address of 172.31.255.1 and an ending IP address of 172.31.255.254 is configured. This creates a static address pool for up to 253 VPN clients.

For more information, see To create a static IP address pool.

The default method of authenticating remote access and demand-dial connections is to use Windows authentication, which is appropriate in this configuration containing only one VPN server. For information on the use of RADIUS authentication for Electronic, Inc., see Dial-up and VPNs with RADIUS. For more information on the use of Windows and RADIUS authentication, see Authentication vs. authorization.

4. Enable the EAP authentication method
To enable the use of smart card-based remote access VPN clients and certificate-based calling routers, the network administrator enables Extensible Authentication Protocol (EAP) on the VPN server.

For more information, see To enable EAP.

5. Configure static routes on the VPN server to reach intranet and Internet locations
To reach intranet locations, a static route is configured with the following settings:

Interface: The LAN adapter attached to the intranet
Destination: 172.16.0.0
Network mask: 255.240.0.0
Gateway: 172.31.0.2
Metric: 1
This static route simplifies routing by summarizing all destinations on the Electronic, Inc. intranet. This static route is used so that the VPN server does not need to be configured with a routing protocol.

To reach Internet locations, a static route is configured with the following settings:

Interface: The WAN adapter attached to the Internet
Destination: 0.0.0.0
Network mask: 0.0.0.0
Gateway: 0.0.0.0
Metric: 1
This static route summarizes all destinations on the Internet. This route allows the VPN server to respond to a remote access client or demand-dial router VPN connection from anywhere on the Internet.

Note

Because the WAN adapter creates a point-to-point connection to the ISP, any address can be entered for the gateway. The gateway address of 0.0.0.0 is an example. 0.0.0.0 is the unspecified IP address.
Setting the phone number for the PPTP and L2TP devices
To aid in the configuration of remote access policies to confine VPN connections from Internet users, the port properties for the WAN Miniport (PPTP) and WAN Miniport (L2TP) devices are modified with the IP address of the VPN server's Internet interface in the Phone number for this device field. For more information, see Setting a phone number on a device.

Configure a static route on the intranet router to reach all branch offices
To reach branch office locations from the intranet router, a static route is configured with the following settings:

Interface: The LAN adapter attached to the intranet
Destination: 192.168.0.0
Network mask: 255.255.0.0
Gateway: 172.31.0.1
Metric: 1
This static route simplifies routing by summarizing all destinations at branch offices of Electronic, Inc.

The remote access policy configuration
Electronic, Inc. has migrated to a Windows 2000 native domain and the network administrator for Electronic, Inc. decides on an access-by-policy administrative model. The remote access permission on all user accounts is set to Control access through Remote Access Policy. The granting of remote access permission to connection attempts is controlled by the remote access permission setting on the first matching remote access policy. Remote access policies are used to apply different VPN connection settings based on group membership, and the default remote access policies are deleted.

For more information, see Introduction to remote access policies.

The domain configuration
To take advantage of the ability to apply different connection settings to different types of VPN connections, the following Active Directory groups are created:

VPN_Users
Used for remote access VPN connections

VPN_Routers
Used for router-to-router VPN connections from Electronic, Inc. branch offices

VPN_Partners
Used for router-to-router VPN connections from Electronic, Inc. business partners

Note

All users and groups in this implementation example are created in the electronic.microsoft.com Active Directory domain.
The security configuration
To enable L2TP/IPSec connections, the use of smart cards by remote access clients, and the use of EAP-TLS by routers, the Electronic, Inc. domain is configured to auto-enroll computer certificates to all domain members.

For more information, see Deploying certificate-based authentication for VPN connections.

Notes

On Windows Server 2003, Web Edition, and Windows Server 2003, Standard Edition, you can create up to 1,000 Point-to-Point Tunneling Protocol (PPTP) ports, and you can create up to 1,000 Layer Two Tunneling Protocol (L2TP) ports. However, Windows Server 2003, Web Edition, can accept only one virtual private network (VPN) connection at a time. For more information about feature availability on Windows Server 2003, Web Edition, see Overview of Windows Server 2003, Web Edition. Windows Server 2003, Standard Edition, can accept up to 1,000 concurrent VPN connections. If 1,000 VPN clients are connected, further connection attempts are denied until the number of connections falls below 1,000.
The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred.

This step-by-step article describes how to move Microsoft Windows 2000 and Microsoft Windows Server 2003 Event Viewer log files to another location on the hard disk.

Windows 2000 and Windows Server 2003 record events in the following logs:

* Application log

The application log contains events that are logged by programs. Events that are written to the application log are determined by the developers of the software program.
* Security log

The security log contains events such as valid and invalid logon attempts. It also contains events that are related to resource use, for example, when you create, open, or delete files. You must be logged on as an administrator or as a member of the Administrators group to turn on, to use, and to specify which events are recorded in the security log.
* System log

The system log contains events that are logged by Windows system components. These events are predetermined by Windows.
* Directory Service log

The Directory Service log contains Active Directory-related events. This log is available only on domain controllers.
* DNS Server log

The DNS Server log contains events that are related to the resolution of DNS names to or from Internet protocol (IP) addresses. This log is available only on DNS servers.
* File Replication Service log

The File Replication Service log contains events that are logged during the replication process between domain controllers. This log is available only on domain controllers.

By default, Event Viewer log files use the .evt extension and are located in the following folder:
%SystemRoot%\System32\Config
Log file name and location information is stored in the registry. You can edit this information to change the default location of the log files. You may want to move log files to another location if you require more disk space in which to log data.

Back to the top
How to Move Event Viewer Log Files to Another Location
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

To move Event Viewer log files to another location on the hard disk, follow these steps:

1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. Locate and click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
4. Click the subkey that represents the event log that you want to move, for example, click Application.
5. In the right pane, double-click File.
6. Type the complete path to the new location (including the log file name) in the Value data box, and then click OK.

For example, if you want to move the application log (Appevent.evt) to the Eventlogs folder on the E drive, type e:\eventlogs\appevent.evt.
7. Repeat steps 4 through 6 for each log file that you want to move.
8. Click Exit on the Registry menu.
9. Restart the computer.

Back to the top
How to View the Name and the Location of Event Viewer Log Files
To view the name and the location of Event Viewer log files, follow these steps:

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click Administrative Tools, and then double-click Event Viewer.

Alternatively, open the snap-in that contains Event Viewer.
3. Click to expand Event Viewer (if it is not already expanded).
4. Right-click the log that you want to view, and then click Properties.
5. Click the General tab.

The name and the location of the log file is displayed under Log name.

NTFS Partition

1. Click the Start button, point to Settings, click Control Panel, and then double-click Services.
2. Select the EventLog service and click Startup. Change the Startup Type to Disabled, and then click OK. If you are unable to log on to the computer but can access the registry remotely, you can change the Startup value in the following registry key to 0x4:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
3. Restart Windows.

NOTE: When the system starts up, several services may fail; a message informing the user to use Event Viewer to review errors may appear.
4. Rename or move the corrupt *.evt file from the following location:
%SystemRoot%\System32\Config
5. In Control Panel Services tool, re-enable the EventLog service by setting it back to the default of Automatic startup, or change the registry Startup value back to 0x2.