Andrew Warren Exam Ref 70 -742

381 Pages·2017·13.32 MB·English

Exam Ref 70-742
Identity
7E
Prepare for Microsoft Exam 70-742—and help demonstrate Identity with 0x
-a
your real-world mastery of Windows Server 2016 identity
Windows Server 2016 7m
features and functionality. Designed for experienced 4
IT professionals ready to advance their status, this Exam Ref 2 R
focuses on the critical-thinking and decision-making acumen About the Exam e with Windows
needed for success at the MCSA level. f
Exam 70-742 focuses on the skills and
knowledge necessary to implement
Focus on the expertise measured by and configure identity features and Id
functionality in Windows Server 2016. e
these objectives:
n
t
• Install and configure Active Directory Domain Services i Server 2016
About Microsoft Certification t
• Manage and maintain AD DS y
• Create and manage Group Policy Passing this exam earns you credit toward w
a Microsoft Certified Solutions Associate
• Implement Active Directory Certificate Services it
(MCSA) certification that demonstrates h
• Implement identity federation and access solutions your mastery of core Windows Server
W
2016 skills for reducing IT costs and
This Microsoft Exam Ref: delivering more business value. in ptg19289508
Exam 70-740 (Installation, Storage, and d
• Organizes its coverage by exam objectives Compute with Windows Server 2016) and o
Exam 70-741 (Networking with Windows w
• Features strategic, what-if scenarios to challenge you
Server 2016) are also required for MCSA: s
• Assumes you have experience working with Windows Server, Windows Server 2016 certification. S
Windows clients, and virtualization; are familiar with core e
networking technologies, and are aware of basic security See full details at: rv
microsoft.com/learning e
best practices
r
-
2 Exam Ref 70 742
About the Author 0
1
Andrew James Warren has served as 6
subject matter expert for Windows Server
2016 courses, technical lead for Windows
10 courses, and co-developer of TechNet W
sessions covering Microsoft Exchange a
r
r
Server. He has 30+ years of IT experience. e
n
MicrosoftPressStore.com
ISBN-13: 978-0-7356-9881-9 U.S.A. $39.99
ISBN-10: 0-7356-9881-3
5 3 9 9 9 Canada $49.99
[Recommended] Andrew Warren
9 780735 698819 Certification/WindowsServer
9780735698819_ExamRef_70-742_Identity_WinServer2016.indd 1 2/21/17 11:56 AM
Exam Ref 70-742
Identity with Windows
Server 2016
ptg19289508
Andrew Warren
Exam Ref 70-742 Identity with Windows Server 2016
Published with the authorization of Microsoft Corporation by:
Pearson Education, Inc.
Copyright © 2017 by Pearson Education Inc.
All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission must
be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form
or by any means, electronic, mechanical, photocopying, recording, or likewise. For information regarding permissions, request
forms, and the appropriate contacts within the Pearson Education Global Rights & Permissions Department, please visit
www.pearsoned.com/permissions/. No patent liability is assumed with respect to the use of the information contained herein.
Although every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for
errors or omissions. Nor is any liability assumed for damages resulting from the use of the information contained herein.
ISBN-13: 978-0-7356-9881-9
ISBN-10: 0-7356-9881-3
Library of Congress Control Number: 2016962648
First Printing March 2017
Trademarks
Microsoft and the trademarks listed at http://www.microsoft.com on the “Trademarks” webpage are trademarks of the
Microsoft group of companies. All other marks are property of their respective owners.
Warning and Disclaimer
Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is
implied. The information provided is on an “as is” basis. The authors, the publisher, and Microsoft Corporation shall have
neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information ptg19289508
contained in this book or programs accompanying it.
Special Sales
For information about buying this title in bulk quantities, or for special sales opportunities (which may include electronic
versions; custom cover designs; and content particular to your business, training goals, marketing focus, or branding
interests), please contact our corporate sales department at [email protected] or [phone].
For government sales inquiries, please contact [email protected].
For questions about sales outside the U.S., please contact [email protected].
Editor-in-Chief Greg Wiegand
Acquisitions Editor Trina MacDonald
Development Editor Rick Kughen
Managing Editor Sandra Schroeder
Senior Project Editor Tracey Croom
Editorial Production Ellie Vee Design
Copy Editor Christina Rudloff
Indexer Julie Grady
Proofreader Christina Rudloff
Technical Editor Tim Warner
Cover Designer Twist Creative, Seattle
Contents at a glance
Introduction xi
Preparing for the exam xv
CHAPTER 1 Install and configure Active Directory Domain Services 1
CHAPTER 2 Manage and maintain AD DS 77
CHAPTER 3 Create and manage Group Policy 149
CHAPTER 4 Implement Active Directory Certificate Services 241
CHAPTER 5 Implement identity federation and access solutions 295
Index 347
ptg19289508
This page intentionally left blank
ptg19289508
Contents
Introduction xi
Organization of this book ..........................................xi
Microsoft certifications ...........................................xii
Acknowledgments ...............................................xii
Free ebooks from Microsoft Press ..................................xii
Microsoft Virtual Academy ........................................xii
Quick access to online references ..................................xiii
Errata, updates, & book support ...................................xiii
We want to hear from you ........................................xiii
Stay in touch ....................................................xiv
ptg19289508
Preparing for the exam xv
Chapter 1 Install and configure Active Directory Domain Services 1
Skill 1.1: Install and configure domain controllers .....................1
AD DS fundamentals 2
Install a new forest 4
Add or remove a domain controller 9
Install AD DS on a Server Core installation 17
Install a domain controller using Install from Media 18
Install and configure a read-only domain controller 20
Configure a global catalog server 24
Configure domain controller cloning 28
Upgrade domain controllers 33
Transfer and seize operations master roles 36
Resolve DNS SRV record registration issues 41
What do you think of this book? We want to hear from you!
Microsoft is interested in hearing your feedback so we can continually improve our
books and learning resources for you. To participate in a brief online survey, please visit:
https://aka.ms/tellpress
v
Skill 1.2: Create and manage Active Directory users and computers ....44
Create, copy, configure, and delete users and computers 44
Implement offline domain join 57
Configure user rights 58
Perform bulk Active Directory operations 60
Skill 1.3: Create and manage Active Directory groups and
organizational units. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
Create and manage groups 63
Create and manage OUs 69
Delegate management of Active Directory with
groups and OUs 71
Chapter summary ................................................75
Thought experiment ..............................................76
Thought experiment answer .......................................76
Chapter 2 Manage and maintain AD DS 77
ptg19289508
Skill 2.1: Configure service authentication and account policies ........77
Create and configure MSAs and gMSAs 78
Manage SPNs 80
Configure Kerberos Constrained Delegation 82
Configure virtual accounts 82
Configure account policies 83
Configure and apply Password Settings Objects 89
Delegate password settings management 95
Skill 2.2: Maintain Active Directory .................................96
Manage Active Directory offline 96
Active Directory backup and recovery 102
Manage Read Only Domain Controllers 110
Managing AD DS replication 113
Skill 2.3: Configure Active Directory in a complex enterprise
environment .................................................120
Configure a multi-domain and multi-forest AD DS
infrastructure 120
Deploy Windows Server 2016 domain controllers
within a preexisting AD DS environment 121
vi Contents
Upgrade existing domains and forests 122
Configure domain and forest functional levels 122
Configure multiple user principal name suffixes 123
Configure trusts 126
Configure AD DS sites and subnets 136
Chapter summary ...............................................145
Thought experiment .............................................146
Thought experiment answers .....................................147
Chapter 3 Create and manage Group Policy 149
Skill 3.1: Create and manage Group Policy Objects ..................149
Configure multiple local Group Policies 150
Overview of domain-based GPOs 156
Manage starter GPOs 162
Configure GPO links 164
Back up, restore, import, and copy GPOs 166 ptg19289508
Create and configure a migration table 170
Reset default GPOs 174
Delegate Group Policy management 174
Detect health issues using the Group Policy
Infrastructure Status dashboard 178
Skill 3.2: Configure Group Policy processing ........................179
Configure processing order and precedence 181
Configuring inheritance 182
Configure security filtering and WMI filtering 187
Configure loopback processing 195
Configure and manage slow-link processing and
Group Policy caching 197
Configure client-side extension behavior 199
Force a Group Policy update 201
Skill 3.3: Configure Group Policy settings ...........................202
Configure software installation 202
Configure scripts 209
Import security templates 211
Contents vii
Configure folder redirection 214
Configure administrative templates 221
Skill 3.4: Configure Group Policy preferences .......................225
Configuring Group Policy preferences 226
Configure item-level targeting 236
Chapter summary ...............................................238
Thought experiment .............................................239
Thought experiment answers .....................................240
Chapter 4 Implement Active Directory Certificate Services 241
Skill 4.1: Install and configure AD CS ...............................241
Choosing between a standalone and an enterprise CA 243
Install standalone CAs 246
Install an AD DS integrated enterprise CA 252
Install offline root and subordinate CAs 253
ptg19289508
Install and configure an Online Responder 266
Implement administrative role separation 269
Configure CA backup and recovery 272
Skill 4.2: Manage certificates ......................................275
Manage certificate templates 275
Implement and manage certificate deployment,
validation, and revocation 283
Configure and manage key archival and recovery 288
Chapter summary ...............................................293
Thought experiment .............................................293
Thought experiment answers .....................................294
Chapter 5 Implement identity federation and access solutions 295
Skill 5.1: Install and configure AD FS ...............................295
Examine AD FS requirements 296
Install the AD FS server role 300
Configure the AD FS server role 300
viii Contents
Implement claims-based authentication, including
relying party trusts 303
Configure authentication policies 310
Implement and configure device registration 313
Configure for use with Microsoft Azure and
Microsoft Office 365 316
Configure AD FS to enable authentication of users
stored in LDAP directories 317
Upgrade and migrate previous AD FS workloads to
Windows Server 2016 318
Skill 5.2: Implement Web Application Proxy ........................319
Install and configure Web Application Proxy 319
Integrate Web Application Proxy with AD FS 322
Implement Web Application Proxy in pass-through mode 326
Publish Remote Desktop Gateway applications 327
Skill 5.3: Install and configure AD RMS .............................330
An AD RMS overview 330 ptg19289508
Deploying an AD RMS server 331
Manage rights policy templates 339
Configure exclusion policies 343
Backup and restore AD RMS 344
Chapter summary ...............................................344
Thought experiment .............................................345
Thought experiment answers .....................................345
Index 347
What do you think of this book? We want to hear from you!
Microsoft is interested in hearing your feedback so we can continually improve our
books and learning resources for you. To participate in a brief online survey, please visit:
https://aka.ms/tellpress
Contents ix