Exam booked for tomorrow

mr2nut

Any advice for tomorrow? From what I can see, 90% of the exam is GPOs and OUs with a few AD questions about FSMO roles and replication.

aordal

Good luck! I'm booked tomorrow as well so maybe we'll be able to congrats each other =D

mr2nut

aordal wrote:

Good luck! I'm booked tomorrow as well so maybe we'll be able to congrats each other =D

Hopefully yea Good luck. What materials have you used to revise then? MS press seems to be ok (for once) for this exam. Rest is learnt off the net from petri and CBT Nuggets. Ive really focused on group policies though after reading peoples reviews on here.

aordal

I bought the sybex book and Transcender practice test. Also, MS has several virtual labs on technet I went through. Most of it is review but there's a couple little nuggets of info I took away from the labs. If you want I can find you a link, they're free. Take about an hour each.

Also im a sys admin at my job so I'm already doing 80% of what's on the test IRL.

bertieb

Good luck for tomorrow folks

bwcarty

Good luck...I plan on taking this one in the next couple weeks.

mr2nut

Failed with a 605. 1000 / 44 = 22.7(ish) so around 5 questions out from scraping a pass. Gutted! I went through at the end and I was sure I was going to at least get a pass. Didn't help that I overdosed some medication and was up all night before the exam, really knocked my concentration out.

Another MS exam that includes many questions that barely make sense and sometimes I wonder if they even know what they are asking for. Need to brush up on my OU placing though apparently. 2nd shot here we come

aordal

D'oh. You'll get it next time. I just got back to work. Passed with a 891 though. But you are right, it is trixy.

Graham_84

I passed this one quite easily with 920, i honestly think its luck of draw but have failed 3 times on the design one!! 70-297! Avoid if you are taking path to MCSE. Good luck next time. But dont beat yourself. You could have done an exam straight after and got 800+ all depends what topics your stronger at.

aordal

Graham_84 wrote:

I passed this one quite easily with 920, i honestly think its luck of draw but have failed 3 times on the design one!! 70-297! Avoid if you are taking path to MCSE. Good luck next time. But dont beat yourself. You could have done an exam straight after and got 800+ all depends what topics your stronger at.

Oh no. Im planning on taking that one next... hopefully I have better luck lol

mr2nut

Graham_84 wrote:

I passed this one quite easily with 920, i honestly think its luck of draw but have failed 3 times on the design one!! 70-297! Avoid if you are taking path to MCSE. Good luck next time. But dont beat yourself. You could have done an exam straight after and got 800+ all depends what topics your stronger at.

Your right, it's all luck. Am I right in thinking that the MS exams are adaptive? For example, if I know the answer for a question in a certain topic, and answer it incorrectly accidentally on purpose, will it give me another question from the topic that 'i'm not so good at ' ? I was thinking about this today, but only after the exam lol!

aordal

They are not =d Its a random set of questions which are chosen when the exam begins.

mr2nut

Gutted I didn't think this would be possible but we can hope

mr2nut

aordal wrote:

D'oh. You'll get it next time. I just got back to work. Passed with a 891 though. But you are right, it is trixy.

Since your so good at this exam i've got a few questions if you dont mind

If I have 1 root domain, 2 child domains, then 2 departments in each child domain, how would I set permissions to minimize administrative work?

Would I need to create a domain local group from the root domain, create global groups in each child domain, then nest these groups in the domain local group in the root?


These were the kind of questions that tripped me up. Also, when would you need to use a universal group? Do you ONLY use these groups when you have more than one domain? i.e. a 2way forest trust?

mr2nut

I now have 2 seperate domains (both on a 10.0.0.x range) with a trust going between the two domains. I have created a domain local group in testdomain1, and i'm trying to nest a global group from testdomain2 for users to access some resources. Both domain and forest functional levels have been raised to 2003 but for some reason, when I try query the other domain for the users and groups, it just searches and searches and brings up no objects. It's almost as if it's a permission problem but a two way trust is in place?

dynamik

mr2nut wrote:

I now have 2 seperate domains (both on a 10.0.0.x range) with a trust going between the two domains. I have created a domain local group in testdomain1, and i'm trying to nest a global group from testdomain2 for users to access some resources. Both domain and forest functional levels have been raised to 2003 but for some reason, when I try query the other domain for the users and groups, it just searches and searches and brings up no objects. It's almost as if it's a permission problem but a two way trust is in place?

Is DNS setup right? Can you ping the other machine by its FQDN?

This should help you with your group questions: http://technet.microsoft.com/en-us/library/cc755692.aspx

mr2nut

dynamik wrote:

mr2nut wrote:

I now have 2 seperate domains (both on a 10.0.0.x range) with a trust going between the two domains. I have created a domain local group in testdomain1, and i'm trying to nest a global group from testdomain2 for users to access some resources. Both domain and forest functional levels have been raised to 2003 but for some reason, when I try query the other domain for the users and groups, it just searches and searches and brings up no objects. It's almost as if it's a permission problem but a two way trust is in place?

Is DNS setup right? Can you ping the other machine by its FQDN?

This should help you with your group questions: http://technet.microsoft.com/en-us/library/cc755692.aspx

I get this message when trying to verify the trust...


The trust cannot be repaired because: there are currently no logon server available to service the logon request. But it let me create the trust fine I've tried rebooting both DCs and rejoining the trust, but still nothing. DNS is fine and can ping the FQDN no problems.

I did however have NLB setup on both of these machines and in the past when i've had this running with DCs, whenever i've deleted the cluster, i've had DNS issues so i'm guessing its some DNS records that have been left behind. What is the best way to clear these records? I've tried a flushdns command an each machine and reloaded the DNS zones.

mr2nut

Scrap that Dynamik, i've sorted it! Cheers anyway. I needed to remove the DG from each machine and also add the IP address of each alternate server into the secondary DNS settings for each NIC.

mr2nut

I've now tried universal groups with no luck

I can only seem to see the domain that i'm currently in when trying to add members to the universal group. I am in Windows 2003 domain level for the forest and native for the domains so it should work fine shouldn't it?

Nesting global groups into domain locals works a treat too.

UncleCid

I don't want to sound silly, but what does "DG" stand for? You think maybe it could be a Global Catalog issue?

mr2nut

UncleCid wrote:

I don't want to sound silly, but what does "DG" stand for? You think maybe it could be a Global Catalog issue?

Sorry, me shortening stuff down too much as i'm busy. Its default gateway.

I'm not too sure to be honest, it's a spanking new setup so I wouldn't have thought so, and all other aspects work fine. It just seems like i'm doing something wrong, but not sure how as global groups nest in local groups in each others forest fine.

UncleCid

You can check the Global catalog status by right clicking the ntds settings of your servers on the sites and services snap in. You go to the properties dialog box.

When you are looking for these users/groups are you changing the "location" to the domain where they are being replicated? Don't you need to do that when capturing "foriegn" Active Directory objects in another domain?

Is there anything else that they are unable to do?

mr2nut

UncleCid wrote:

You can check the Global catalog status by right clicking the ntds settings of your servers on the sites and services snap in. You go to the properties dialog box.

When you are looking for these users/groups are you changing the "location" to the domain where they are being replicated? Don't you need to do that when capturing "foriegn" Active Directory objects in another domain?

Is there anything else that they are unable to do?

Sorry for late reply. Been very busy at work. Yes, replication is fine and I can place global groups in domain locals in the opposite domain. I'm on a 2003 forest functional level as well as my domains so everythings native 2k3. It physically lets me create the universal group, but when searching for the other domain, it simply isn't there, just the domain that I am currently in. Where as when I make a global group, then search for members, it shows the other domain to query.

UncleCid

Have you tried validating your trusts? If your trusts are not validating then that could definitely be the problem.

mr2nut

UncleCid wrote:

Have you tried validating your trusts? If your trusts are not validating then that could definitely be the problem.

Yes the trusts validate fine

UncleCid

Did you create the right kinds of trusts? A two-way trust from both ends? You should be able to make them at your current functioning level.

edit: To be honest, Can you do searches in another forest? I don't think you can. If you are using windows search 4.0, you can specfic search locations. I can't seem to find any material on cross forest searching for 3.1.

UncleCid

So i was thinking, Do you have a global catalog server setup on your sites? You could try putting you users into different universal groups.. maybe like trying to put one universal group in the domain to that is attempting the search and one in the domain being searched. Try putting users from the searched domain in both universal groups. Try to make your searchs from the Global Catalog server, see if maybe that brings up anything. I was thinking that since your Global Catalog server facalitates your AD searches and holds all universal groups, it might be able to find your users.

If it does work you can use process of elimination to see where the problem was.

mr2nut

Both domains are litterally local virtual machines even on the same subnet. I've tried creating a universal group in both domains and adding users from the other domain, it doesnt work in either domain for some reason. Both Servers are global catalog servers too. I'm really confused now but thanks for the suggestions, but to be fair I think ive tried all that stuff

UncleCid

Maybe i will create a similar test enviroment and see if i can make it work.

aordal

Good new mr2nut, I have the same problem with one of my virtual environments and never noticed it until now. So I'll see if I can find the fix and help you out.

jetfan

good luck with this one, this is one of the exams in the pipeline for me....