291 Study Bullet Points
Okay I'm reading some material and will post some of their bullet points they list that to help me study and maybe help you in your studies as well.
* If you want a computer to talk to the subnet it is currently in but not talk to any other subnets, don't give it a default gateway
* If you are using RRAS, make sure that the NIC connected to the subnet that does not have the DHCP server is configured as the DHCP Relay Agent
* Don't forget you can use "pathping IP address or DNS address" to trace packets and get reports at each destination.
* MBSA is the Microsoft Baseline Security Analyzer and will scan your computer for security defects.
* Automatic Updates is not installed on a 2003 server by default. You must install the right service packs or the AU client.
* To uninstall a windows update, you need to run spuninst in the windows\$ntuninstall\spuninst
directory.
* You should normally try to use the RunAs command instead of logging into the machine as an administrator. 2 ways you can use runas, hold down shift and right click a program. RunAs should appear. Or you can open a command prompt and type "runas".
* Run the status of computer report in WSUS to see if computers in the domain have all approved updates
* Use the "Automatically download the updates, and install them on the schedule that I specify" option in automatic updates if you have laptop users who shut their laptops off during times.
* If you have a proxy server for internet access, make sure you configure the proxy settings on the WSUS admin page with the correct proxy.
* Run wuauclt /detectnow options to get new updates from a WSUS client
* Use IPSec Monitor to verify users are connecting to your servers with encryption
* Only use the specific languages that you need when synchronizing updates.
* You can't change a subnet mask on a DHCP scope without deleting it. It has to be re-created if you are trying to change the subnet mask.
* Routers have "dhcp helper addresses" which store the IP address or DNS name of your DHCP server and will allow DHCP resolution over broadcast domains. Remember, DHCP talks over broadcasts and a broadcast domain (usually a router) blocks broadcasts from talking between subnets.
* A DHCP reservation is when you want to map an IP address directly to a computer by matching the MAC address of the client computer to the setting you put in the DHCP server. An exclusion only disables the IP address(es) listed from being used by the DHCP server. This is usually used when you have a computer configured with a static IP in the middle of a DHCP range.
* You do not have to include the dashes in the MAC address when assigning a reservation. 0009d5a6b1b6
* To restore a DHCP server at its most simple description, restore the database to your server. Use the DHCP console to restore the backup from the folder which the database resides. Then at the command prompt type "net start dhcpserver" and then authorize the DHCP server. You can also stop your first DHCP server, copy the database over to your second DHCP server, then start the service, authorize and activate the DHCP scopes.
* FSMO - there needs to be only 1 PDC emulator per domain and it must be on a domain controller
* ICF - If you have an FTP server that needs to be protected from the internet, make sure you turn on ICF and select FTP Server check box on the services tab
* IIS - you can view log files to collect information about which users are accessing the web server via HTTPS and which users are experiencing failed HTTPS requests
* ISA - make sure that on the Public interface that you clear the "Register this connection's address in DNS"
* You can use network monitor to identify whether Server-A is receiving requests for resources through NETBIOS broadcast
* Network monitor does not capture packets for the whole network, it only captures packets for the server it is installed on.
* Use network monitor to figure out a DoS attack
* To ensure the impact of monitoring on a server is reduced and that all packets are captured, then use run Network Monitor in dedicated capture mode
* If a large number of packets are captured, make sure you increase the buffer and decrease the frame to reduce the size of captured data
* Configure a Trigger in Network Monitor to send notifications
* You can capture a users communication to a domain controller by monitoring all traffic between the DC and CP1 with a capture filter
* If you are running system monitor with Network Interface, bytes per second at a sample rate of 15 seconds and the log size is getting too large, then set the sample rate to 60 seconds
* If you are monitoring events that are associated with invalid logins, then use Errors Logon, Errors Access Permissions, Errors Granted Access
* Use system monitor to create a log of the DNS counter Dynamic updates/sec and Total queries/sec for DNS client traffic causing problems
* To monitor the successful incremental zone transfers, use XFR Success Received counter
* Remember creating an ADI zone and configuring the zone for Secure Dynamic Updates Only is ~Important~ and best practice!
* ADI DNS domain controllers can minimize WAN traffic
* Use the replmon tool to find out why DNS data is out of date
* One way to do a zone transfer is this:
1. New-DNS-Server setup a secondary zone for domain X
2. Add a NS records to New-DNS-Server for the X zone
3. on New-DNS-Server change the secondary zone to a primary zone for domain X
4. On Old-DNS-Server delete X zone
5. On Old-DNs-Server setup a secondary zone for domain X
*If you are configuring a complete DNS infrastructure which includes root zones, make sure to include all of the root DNS servers on each of your zoning DNS servers in your root hints configuration page.
*Round Robin enables DNS records that have multiple IP addresses mapped to one host to be able to evenly distribute the IP addresses in load balancing fashion.
* The following protocols encrypt data transmissions and authentication: EAP-TLS, MS-CHAPv2, MS-CHAP. Only encrypts authentication: CHAP.
* EAP-TLS = smart cards and certificates, MS-CHAPv2 = supports newer OS's and is mutual auth, MS-CHAPv1 = supports older OS's and is one way auth, CHAP = supports non-windows OS's, SPAP = shiva products, PAP = plaintext authentication
* You can use the MBSA to scan for WSUS/windows updates on a client machine
