Configuring advanced Windows Server 2012 services exam 70-412

544 Pages·62.054 MB·English

by  Patrick Regan

This page is intentionally left blank
Microsoft® Offi cial Academic Course
Confi guring Advanced
Windows Server® 2012
Services
Exam 70-412

Patrick Regan
With Ed Baker, Tim Lorge, Garrett Stevens,
and Richard Watson
VP & PUBLISHER Don Fowley
EXECUTIVE EDITOR John Kane
DIRECTOR OF SALES Mitchell Beaton
EXECUTIVE MARKETING MANAGER Chris Ruel
MICROSOFT P RODUCT MANAGER Gene R. Longo of Microsoft Learning
EDITORIAL PROGRAM ASSISTANT Allison Winkle
TECHNICAL EDITOR Brian Svidergol
ASSISTANT MARKETING MANAGER Debbie Martin
SENIOR PRODUCTION & MANUFACTURING MANAGER Janis Soo
ASSOCIATE P RODUCTION MANAGER Joel Balbin
CREATIVE DIRECTOR Harry Nolan
COVER DESIGNER Georgina Smith
SENIOR PRODUCT DESIGNER Thomas Kulesa
CONTENT EDITOR Wendy Ashenberg
This book was set in Garamond by Aptara, Inc. and printed and bound by Bind-Rite Robbinsville. The covers were
printed by Bind-Rite Robbinsville.
Copyright © 2014 by John Wiley & Sons, Inc. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any
means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections
107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher,
or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc. 222
Rosewood Drive, Danvers, MA 01923, [phone], fax [phone]. Requests to the Publisher for
permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street ,
Hoboken , NJ 07030-5774 , [phone], fax [phone]. To order books or for customer service, please
call 1-800-CALL WILEY (225-5945).
Microsoft, Active Directory, AppLocker, Bing, BitLocker, DreamSpark, Hyper-V, Internet Explorer, SQL Server,
Visual Studio, Win32, Windows Azure, Windows, Windows PowerShell, Windows Server, and Windows Vista are
either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
Other product and company names mentioned herein may be the trademarks of their respective owners.
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events
depicted herein are fi ctitious. No association with any real company, organization, product, domain name, e-mail
address, logo, person, place, or event is intended or should be inferred.
The book expresses the author’s views and opinions. The information contained in this book is provided without
any express, statutory, or implied warranties. Neither the authors, John Wiley & Sons, Inc., Microsoft Corporation,
nor their resellers or distributors will be held liable for any damages caused or alleged to be caused either directly
or indirectly by this book.
ISBN 978-1-118-51159-6
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1 + [phone] ( U.S. & Canada only)
Foreword from the Publisher
Wiley’s publishing vision for the Microsoft Official Academic Course series is to provide
students and instructors with the skills and knowledge they need to use Microsoft technol-
ogy effectively in all aspects of their personal and professional lives. Quality instruction is
required to help both educators and students get the most from Microsoft’s software tools and
to become more productive. Thus, our mission is to make our instructional programs trusted
educational companions for life.
T o accomplish this mission, Wiley and Microsoft have partnered to develop the highest-quality
educational programs for information workers, IT professionals, and developers. Materials
created by this partnership carry the brand name “Microsoft Official Academic Course,”
assuring instructors and students alike that the content of these textbooks is fully endorsed by
Microsoft, and that they provide the highest-quality information and instruction on Microsoft
products. The Microsoft Official Academic Course textbooks are “Official” in still one more
way—they are the officially sanctioned courseware for Microsoft IT Academy members.
The Microsoft Official Academic Course series focuses on workforce development . These
programs are aimed at those students seeking to enter the workforce, change jobs, or embark
on new careers as information workers, IT professionals, and developers. Microsoft Official
Academic Course programs address their needs by emphasizing authentic workplace scenarios
with an abundance of projects, exercises, cases, and assessments.
The Microsoft Official Academic Courses are mapped to Microsoft’s extensive research
and job-task analysis, the same research and analysis used to create the Microsoft Certified
Solutions Associate (MCSA) exam. The textbooks focus on real skills for real jobs. As students
work through the projects and exercises in the textbooks and labs, they enhance their level
of knowledge and their ability to apply the latest Microsoft technology to everyday tasks.
These students also gain resume-building credentials that can assist them in finding a job,
keeping their current job, or in furthering their education.
The concept of life-long learning is today an utmost necessity. Job roles, and even whole job
categories, are changing so quickly that none of us can stay competitive and productive
without continuously updating our skills and capabilities. The Microsoft Official Academic
Course offerings, and their focus on Microsoft certification exam preparation, provide a
means for people to acquire and effectively update their skills and knowledge. Wiley supports
students in this endeavor through the development and distribution of these courses as
Microsoft’s official academic publisher.
Today educational publishing requires attention to providing quality print and robust
electronic content. By integrating Microsoft Official Academic Course products, MOAC Labs
Online, and Microsoft certifications, we are better able to deliver efficient learning solutions
for students and teachers alike.
Joseph Heider
General Manager and Senior Vice President
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+[phone] (U.S. & Canada only) | iii
Preface
Welcome to the Microsoft Official Academic Course (MOAC) program for becoming a
Microsoft Certified Solutions Associate for Windows Server 2012. MOAC represents the
collaboration between Microsoft Learning and John Wiley & Sons, Inc. Microsoft and Wiley
teamed up to produce a series of textbooks that deliver compelling and innovative teaching
solutions to instructors and superior learning experiences for students. Infused and informed
by in-depth knowledge from the creators of Windows Server 2012, and crafted by a publisher
known worldwide for the pedagogical quality of its products, these textbooks maximize skills
transfer in minimum time. Students are challenged to reach their potential by using their new
technical skills as highly productive members of the workforce.
Because this knowledgebase comes directly from Microsoft, architect of Windows Server
2012 and creator of the Microsoft Certified Solutions Associate exams, you are sure to receive
the topical coverage that is most relevant to students’ personal and professional success.
Microsoft’s direct participation not only assures you that MOAC textbook content is accurate
and current; it also means that students will receive the best instruction possible to enable
their success on certification exams and in the workplace.

■ The Microsoft Offi cial Academic Course Program
The Microsoft Official Academic Course series is a complete program for instructors and
institutions to prepare and deliver great courses on Microsoft software technologies. With
MOAC, we recognize that because of the rapid pace of change in the technology and curriculum
developed by Microsoft, there is an ongoing set of needs beyond classroom instruction tools for
an instructor to be ready to teach the course. The MOAC program endeavors to provide
solutions for all these needs in a systematic manner in order to ensure a successful and rewarding
course experience for both instructor and student—including technical and curriculum training
for instructor readiness with new software releases; the software itself for student use at home for
building hands-on skills, assessment, and validation of skill development; and a great set of tools
for delivering instruction in the classroom and lab. All are important to the smooth delivery of an
interesting course on Microsoft software, and all are provided with the MOAC program. We
think about the model below as a gauge for ensuring that we completely support you in your goal
of teaching a great course. As you evaluate your instructional materials options, you may wish to
use the model for comparison purposes with available products.
www.wiley.com/college/microsoft or
iv | call the MOAC Toll-Free Number: 1 + [phone] ( U.S. & Canada only)
Illustrated Book Tour

■ Textbook Organization
This textbook is organized in twenty-one lessons, with each lesson corresponding to a particular
exam objective for the 70-412 Configuring Advanced Windows Server 2012 Services exam.
This MOAC textbook covers all the learning objectives for the 70-412 certification exam, which
is the third of three exams needed in order to obtain a Microsoft Certified Solutions Associate
(MCSA) certification. The exam objectives are highlighted throughout the textbook.

■ Pedagogical Features
Many pedagogical features have been developed specifically for Microsoft Official Academic
Course programs.
Presenting the extensive procedural information and technical concepts woven throughout the
textbook raises challenges for the student and instructor alike. The Illustrated Book Tour that
follows provides a guide to the rich features contributing to Microsoft Official Academic
Course program’s pedagogical plan. Following is a list of key features in each lesson designed
to prepare students for success on the certification exams and in the workplace:
• Each lesson begins with an overview of the skills covered in the lesson. More than
a standard list of learning objectives, the overview correlates skills to the certification
exam objective.
• Illustrations: Screen images provide visual feedback as students work through the
exercises. The images reinforce key concepts, provide visual clues about the steps, and
allow students to check their progress.
• Key Terms: Important technical vocabulary is listed at the beginning of the lesson. When
these terms are used later in the lesson, they appear in bold italic type and are defined.
• Engaging point-of-use reader aids, located throughout the lessons, tell students why this
topic is relevant (T he Bottom Line ), provide students with helpful hints (T ake Note ), or
show cross-references to where content is covered in greater detail (X Ref ) . Reader aids
also provide additional relevant or background information that adds value to the lesson.
• Certification Ready features throughout the text signal students where a specific
certification objective is covered. They provide students with a chance to check their
understanding of that particular exam objective and, if necessary, review the section
of the lesson where it is covered.
• Using Windows PowerShell: Windows PowerShell is a Windows command-line shell
that can be utilized with many Windows Server 2012 functions. The Using Windows
PowerShell sidebar provides Windows PowerShell-based alternatives to graphical user
interface (GUI) functions or procedures. These sidebars begin with a brief description
of what the Windows PowerShell commands can do, and they contain any parameters
needed to perform the task at hand. When needed, explanations are provided for the
functions of individual parameters.
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+[phone] (U.S. & Canada only) | v
vi | Illustrated Book Tour
• Knowledge Assessments provide lesson-ending activities that test students’
comprehension and retention of the material taught, presented using some of the
question types that they’ll see on the certification exam.
• An important supplement to this textbook is the accompanying lab work. Labs are
available via a Lab Manual, and also by MOAC Labs Online. MOAC Labs Online
provides students with the ability to work on the actual software simply by connecting
through their Internet Explorer web browser. Either way, the labs use real-world
scenarios to help students learn workplace skills associated with administering a
Windows Server 2012 infrastructure in an enterprise environment.
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+[phone] (U.S. & Canada only)
Illustrated Book Tour | vii
■ Lesson Features
Deploying and 1
LESSON
Managing Server
Images
Exam Objective
70-411 EXAM OBJECTIVE
Objective 1.1 – Deploy and manage server images. This objective may include but is not limited to: install the Windows
Deployment Services (WDS) role; configure and manage boot, install, and discover images; update images with patches,
hotfixes, and drivers; install features for offline images.
LESSONHEADING EXAM OBJECTIVE
Using Windows Deployment Services
Installing the Windows Deployment Services Role Install the Windows Deployment Services (WDS) role Configuring VPN and Routing | 333
Configuring the WDS Server
Configuring and Managing Boot, Install, Configure and manage boot, install, and discover images • Verify that the user is not affected by logon hour restrictions.
and Discover Images • Verify that the correct VPN protocol and authentication are selected.
Updating Images with Patches, Hotfixes, and Drivers Update images with patches, hotfixes, and drivers • If used, verify that you have the correct and valid digital certificate. The certificate must
Installing Features for Offline Images Install features for offline images ba ev aislsidu eddi gwitiatlh c ae rvtaifliicda tdea.te, is trusted, and is not revoked. The certificate must also have
Deploying Driver Packages with an Image • Some certificates need to be checked to see whether they have been revoked or not.
Therefore, make sure that the Certificate Revocation List (CRL) list is available over the
Internet.
• Verify that the Routing and Remote Access service runs on the VPN server.
• Verify that the VPN server is enabled for remote access from the VPN Server Properties
Key Terms dialog box’s General tab.
KEY TERMS • Verify the appropriate ports (PPTP, L2TP, SSTP, and IKEv2) are enabled and available
on the VPN server.
answer files image group Windows Deployment • Verify that the user in Active Directory Users and Computers is allowed to connect. If
boot image install image Services Capture Utility the connection is based on network policies, verify that the user is allowed to connect.
D DddfeyieesaMnppctaolluaoomvnryyeeaimmscrg eeidemnnmrittave gISenmeert ra p(vgDreoeirsv Smise.ireovxniecini)ngg and mpSSTWryyrauiessnnltbttdeesoiomcpmoawo t sPrI stmter i eAxnSapesgegascreeruva steMtsiriomoannne aenUgntt veialirinrt oy(dS n (ISmMye)snptre (pP.XexEe)) W W W iiiSF E(nnnWonedddrrviooomnviwwwridocaosssetn w sPDIm(m Wr(seeWe apIPniMgnDlEtois)S)nyt)gamlleanttio n ••• IAApWVMfie glsyairnaonikoigf ndeuyr o,e as thmwnnuhadresaeve ttmecw t t tlrhNiboheaaerenAktr ct c T a etposh ruonfiaintplnrtie. pcebRwicoeetRarstitl woAlsa n reSiI’esesP nsncspt eooaatcvthtr i eaNecbrm elcpAodleaiTct eckien knritents r L tagah ve fnaaeisldvsrntoes eyat nr hplsns ee( we 1rNVcm2ielAP lsi aTssNbnsa-ilrdT ooys nce) 1pk.r 3tv aNhI.ecCrrkA,o eMTuytosg P iuhso prdnn apieecsetrckwoduet ostotssroce kt odch lp osalo,ant tlsfaieuicrrgcie ueih nsur .e astesh dIi sKbEy .
image file Deployment Kit (ADK) lesson.
If you receive an error message, the error message might give you some indication of where to
look for the cause of the error. Common errors are listed in Table 10-1.
Table 10-1
Common VPN Errors
ERROR DESCRIPTION
Error 800: VPN Server is unreachable F or whatever reason the PPTP, L2TP, SSTP, or IKEv2 packets cannot get
to the VPN server. Verify that the appropriate ports are open on all
relevant firewalls, including host firewalls (on the client and server).
Error 721: Remote Computer is Not Responding F or whatever reason, GRE traffic (part of PPTP) is not getting to the
VPN. Therefore, check the standard ports are open on all relevant
firewalls, including host firewalls (on the client and server) for PPTP.
Error 741 or 742: Encryption Mismatch Error T hese errors occur if the VPN client requests an invalid encryption level
or the VPN server does not support an encryption type that the client
requests. On the client, check the VPN connection properties (Security
Bottom Line tNaPbS) , tcoh veecrki ftyh teh aent cthryep tpioronp leerv eenl cinry tphteio nne itsw soerlke cpteodli.c yIf iyno tuh ea rNe PuSsing
console or check the policies on other RADIUS servers. Finally, check
Reader Aid the server to verify that the correct encryption level is enabled.
0x80092013: The revocation function was unable Client is failing the certificate revocation check. Ensure the CRL check
to check revocation because the revocation server servers on the server side are exposed on the Internet.
was offline
Monitoring Servers| 93
■Using Event Viewer Easy-to-Read
One of the most useful troubleshooting tools is the Event Viewer, which is essentially a Tables
TTHHEE BBOOTTTTOOMM LLIINNEE leorrgo vrsie owre wr. aWrnhinengse vtehra ty omui ghhatv ere pvreoabl lwemhast, tyhoeu p srhoobuleldm l oiso.k in the Event Viewer to see any
CMOEboRjneTicttIoiFvrI eCe v1Ae.T3nItOs.N READY Tianlohcnelu eEd cveoednn istno V ltehi.e eYw Coeuor mcisa pnaun at leMsro MM exaCenc asungteaemp t-heienn tet havnaetdn e tinsv aiwbnrlce.lsum ydsoecdu citonom Abmrdomawnisnde.i satnrdat imvea nTaogoel se avse nat s ltoagnsd. -It is
Event Viewer enables you to perform the following tasks:
•View events from multiple event logs (see Figure 3-7).
•Save useful event filters as custom views that can be reused.
•Schedule a task to run in response to an event.
•Create and manage event subscriptions.
Figure 3-7
Event Viewer
Certification
Ready Alert
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+[phone] (U.S. & Canada only)
viii | Illustrated Book Tour
c06ConfiguringFileServicesAndDiskEncryption.indd Page 212 1/22/13 8:30 PM f-481 /208/WB00898/XXXXXXXXXXXX/ch02/text_s
212 | Lesson 6
Managing BitLocker Certificates
CERTIFICATION READY Similar to EFS, you should back up the necessary digital certificates and keys. You can
Manage EFS and use the Certificate Management console to back up any digital certificates, such as DRA
BirneicstLltuoodrceikn.egr cbearctkifuicpa taensd cuepr ttihfiec arteecso. vIetr hy aks eayl.so been mentioned earlier that you can use the Control Panel to back
Objective 2.3 You can configure BitLocker Drive Encryption to back up recovery information for
BitLocker-protected drives and the TPM to AD DS. Recovery information includes the
recovery password for each BitLocker-protected drive, the TPM owner password, and the
information required to identify which computers and drives the recovery information applies
to. To store information in Active Directory, you can enable the Store BitLocker Recovery
Information in AD DS (see Figure 6-28).
Figure 6-28
Enabling Store BitLocker
Recovery Information in AD DS
Take Note Reader Aid
c06ConfiguringFileServicesAndDiskEncryption.indd Page 202 1/22/13 8:29 PM f-481 /208/WB00898/XXXXXXXXXXXX/ch02/text_s
202 | Lesson 6
encrypted, and the system partition remains unencrypted so that your computer can
start. If your computer doesn’t have two partitions, BitLocker creates them for you. Both
partitions must be formatted with the NTFS file system.
• Your computer must have a BIOS that is compatible with TPM and supports USB
devices during computer startup. If this is not the case, you need to update the BIOS
More before using BitLocker.
✚MBc7r0yeO -ad4tRe1infE2ag u IcltNoth,u FeWr OsBieRni.tdLMoowcAkTse IrSO eDrNRvAer t2e0m1p2la dteo,e vsi sniot tM hiacrvoes othfte’s B TietLcohcNkeetr BDlRoAgs .t eMmapnlaatgei.n Tgh tehreef oCrAe , isif dyiosucu nseseedd iinn ftohrem MatiOoAn Co n IRnefaodrmera Atiiodn TAKE NOTE* Bamsdesrir oitBvvLseeitotr sLoc rfkrorageoccarkmk nei sit rz bh naheatoiatin tosc gncab osnse tme uobnslme eei nmaop.cnhpclyerysos isuvceesadedl d ost enoocl nuyw r sboietryryk v a feo orhnrsa , snfbeadruivlftoue vmrl seo ar(f ys cu plbuceehsoct peoalrmse v)le oot colmuk pmoedrreee svs ceeaornnvmtde rt mh SreAoo noNc omismn. aIptnnhudsett/ eeforaur dta u,n rde
Configuring the Network Unlock Feature IDnesstekatdop, Bciotmlocpkuetre riss. mHoorwe ecvoemr, mit otnaklye su ase ddo wmiathin m inofbrailset rcuocmtuprue twerist ha nWd itnod ao wless sseerr veexrtse ntot,
CCoEnRfTigIuFIrCe AthTeI ONNet wREoArkD Y AU nnleowck f epartouvried eins aWn ianudtoowmsa 8ti ca nudn lWocikn dofo wops eSreartvinegr 2sy0s1t2em is vNoleutwmoersk a Ut snylsotcekm. Nreebtowoot rwk hen get the most benefits from BitLocker and the management of systems running BitLocker.
UOnbljoecctki vfee a2t.u3re. connected to a trusted wired corporate network. BIDitEL,o caknedr SsuCpSpIo drrtsiv NesT. IFt Sd, oFeAs Tn1o6t ,s uFpApTo3r2t CanDd FEixleF ASyTs toenm U, iSSBC,S FI,i rFewibierre ,C ShAaTnAn,e lS, AeSSA, TATAA, ,
and Bluetooth. BitLocker also does not support dynamic volumes; it supports only basic
volumes.
BitLocker has five operational modes for OS drives, which define the steps involved in the system
boot process. These modes, in a descending order from the most to least secure, are as follows:
• TPM + startup PIN + startup key: The system stores the BitLocker volume encryption
key on the TPM chip, but an administrator must supply a personal identification num-
ber (PIN) and insert a USB flash drive containing a startup key before the system can
unlock the BitLocker volume and complete the system boot sequence.
• TPM + startup key: The system stores the BitLocker volume encryption key on the
TPM chip, but an administrator must insert a USB flash drive containing a startup key
before the system can unlock the BitLocker volume and complete the system boot
sequence.
• TPM + startup PIN: The system stores the BitLocker volume encryption key on the
TPM chip, but an administrator must supply a PIN before the system can unlock the
BitLocker volume and complete the system boot sequence.
• Startup key only: The BitLocker configuration process stores a startup key on a USB
flash drive, which the administrator must insert each time the system boots. This mode
does not require the server to have a TPM chip, but it must have a system BIOS that
supports access to the USB flash drive before the operating system loads.
• TPM only: The system stores the BitLocker volume encryption key on the TPM chip,
and accesses it automatically when the chip has determined that the boot environment
is unmodified. This unlocks the protected volume and the computer continues to
Warning Reader Aid boot. No administrative interaction is required during the system boot sequence.
When you use BitLocker on fixed and removable data drives that are not the OS volume, you
can use one of the following:
• Password
• Smart card
• Automatic Unlock
When you enable BitLocker using the BitLocker Drive Encryption control panel, you can
c04ConfiguringDistributedFileSystem(DFS).indd Page 146 1/22/13 7:20 PM f-481 /208/WB00898/XXXXXXXXXXXX/ch02/text_s select the TPM + startup key, TPM + startup PIN, or TPM only option. To use the
146 | Lesson 4
ibctbcsahoae rnar cgrdknoueeugtptW lp eeatsesdtA e.erd, rRe dI vofNpo,e r alnI rcaN,c h cfotiGiatehlr enmrewu g gDeiopelenlFttd thetSms, ed f oRoord oresret tnpal e rlliiotgckeneaedettl,y i o n TuhWcuceestahnnieAvledttieN zrr beaaimn edlll s ui scctnteol hotkrmminevsp e.ejpll urteeOu hna ostosncriettdt e resis s oesust ,roolnc ovi l htrucew e ratbacistitse oeoha cdnivt one b tamf rahtot hc feertrke shotc u hememop vircsso ep oa nrito rseodip r nt aidoposgtiar resfsasofi et aotvcetenfi ur fidudo licept fsde fi ta t.Duco oRWer Fpi.uen SAepsgr eNlRf itobceh raabpemtcal ikiwoc cubknaeapu teociskpok.ce ncusDnou pdbFlrsuses,S. t t wp wiYRoahoenereuetp.nni lcFt ihuttcohhealranete rei o sWxboinataveAm cec kNrsape ntulr he lvpai,een l irtsskfhso ls yo et bowoa eru eea r
servers. Therefore, you still need INSTALLING DFS REPLICATION
tporo utseec tbioanc kaunpds rteoc opvroervyi.de data DSeFrvSe rR Mepalincaagtieorn t ois iannstoatlhl eDr FseSr vNera mroelsep, ascime.ilar to DFS Namespace. Therefore, you would use
INSTALL DFS REPLICATION
GET READY. To install DFS Replication, perform the following steps:
1. Open Server Manager.
2. At the top of Server Manager, select Manage and click Add Roles and Features. The
Add Roles and Feature Wizard opens.
3. On the Before you begin page, click Next.
4. Select Role-based or feature-based installation and then click Next.
5. Click Select a server from the server pool, click the name of the server to install DFS
to, and then click Next.
6. Scroll down and expand File and Storage Services and expand fi le and iSCSI Services.
Select DFS Replication, as shown in Figure 4-17. If File Server is not already installed,
select it.
Figure 4-17
Selecting DFS Replication
Screen Images
www.wiley.com/college/microsoft or
call the MOAC Toll-Free Number: 1+[phone] (U.S. & Canada only)