70-640 Resources

Claymoore

Resources and study guide for the 70-640 TS: Windows Server 2008 Active Directory, Configuring exam

Recommended Reading
Windows Server 2008 Active Directory Resource Kit
MCTS Self-Paced Training Kit (Exam 70-640)
Group Policy: Fundamentals, Security, and Troubleshooting
Creating the Secure Managed Desktop

Skills Measured

Configuring Domain Name System (DNS) for Active Directory (16 percent)
Configure zones
What's New in DNS in Windows Server 2008
DNS Server Overview
Understanding Active Directory Domain Services Integration
DNS Architecture
DNS Overview
Configuring Zone Properties
Adding Zones
Managing Resource Records

Configure DNS server settings
Understanding Forwarders
Using Forwarders
Checklist: Use Forwarders
Understanding Zone Delegation
Updating Root Hints
Use Aging and Scavenging

Configure zone transfers and replication
Understanding DNS Zone Replication in Active Directory Domain Services
Planning DNS Zones
Create a DNS Application Directory Partition
DNS Notify
Troubleshooting zone problems

Configuring the Active Directory infrastructure (25 percent)
Configure a forest or a domain
Requirements for Installing AD DS
Steps for Installing AD DS
Active Directory Domain Services (AD DS) Installation and Removal Step-by-Step Guide
Steps for Removing AD DS
Appendix of Unattended Installation Parameters
Download details: ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains
Scenarios for Installing AD DS
Appendix of Functional Level Features

Configure trusts
Managing Trusts
Managing Forest Trusts
Configuring SID Filter Quarantining: Domain and Forest Trusts; Active Directory

Configure sites
Overview of Active Directory Sites and Services
Checklist: Configure an Additional Site
Changing site link properties: Active Directory
Creating a Site Link Bridge Design

Configure Active Directory replication
Introduction to Administering Intersite Replication: Active Directory
Managing Intersite Replication: Active Directory
Introduction to Administering DFS-Replicated SYSVOL: Active Directory
SYSVOL Replication Migration Guide: FRS to DFS Replication
Forcing Replication

Configure the global catalog
Enabling Universal Group Membership Caching in a Site
Understanding the Global Catalog
Introduction to Administering the Global Catalog: Active Directory
Checklist: Add a Global Catalog Server
Configuring a Global Catalog Server: Active Directory

Configure operations masters
Introduction to Administering the Windows Time Service: Windows Time Service
Introduction to Administering Operations Master Roles: Active Directory
Transferring an operations master role: Active Directory
Seizing an operations master role: Active Directory
Designating a standby operations master: Active Directory
Active Directory Schema
Planning Operations Master Role Placement

Configuring additional Active Directory server roles (9 percent)
Configure Active Directory Lightweight Directory Service (AD LDS)
Running Domain Controllers in Hyper-V
Hyper-V
Server Core Installation Option Getting Started Guide
http://technet.microsoft.com/en-us/library/cc754361(WS.10).aspx
Active Directory Lightweight Directory Services Operations Guide

Configure Active Directory Rights Management Service (AD RMS).
Active Directory Rights Management Services Overview
Active Directory Rights Management Services Role
Active Directory Rights Management Services
Active Directory Rights Management Services

Configure the read-only domain controller (RODC).
AD DS: Read-Only Domain Controllers
Read-only Domain Controllers (RODC) Step-by-Step Guide
Read-Only Domain Controller (RODC) Planning and Deployment Guide
Read-Only Active Directory Database, SYSVOL, and Unidirectional Replication
RODC Filtered Attribute Set, Credential Caching, and the Authentication Process with an RODC
Administrator Role Separation
Administering the Password Replication Policy
RODC Frequently Asked Questions

Configure Active Directory Federation Services (AD FS).
Active Directory Federation Services Overview
Active Directory Federation Services Role
Active Directory Federation Services (AD FS) Step-by-Step Guide
Active Directory Federation Services
AD FS Design Guide
AD FS Deployment Guide
Deploying Federation Servers
Deploying Federation Server Proxies

Creating and maintaining Active Directory objects (24 percent)
Automate creation of Active Directory accounts
Csvde
Dsadd
Ldifde
Administering Distribution Lists for Message Queuing

Maintain Active Directory accounts
Dsmod group
AGDLP - Wikipedia, the free encyclopedia
User Account Control
Delegating Administration of Account OUs and Resource OUs

Create and apply Group Policy objects (GPOs).
Group Policy
Download details: Planning and Deploying Group Policy
Download details: Group Policy Preferences Overview
Deploying Basic Settings by Using Group Policy
Loopback processing of Group Policy

Configure GPO templates
Managing Group Policy ADMX Files Step-by-Step Guide
Download details: Starter Group Policy Objects (GPOs)
Overview of AGPM

Configure software deployment GPOs
How to use Group Policy to remotely install software in Windows Server 2003

Configure account policies
Active Directory Domain Services (AD DS) Fine-Grained Password and Account Lockout Policy Step-by-Step Guide
AD DS: Fine-Grained Password Policies

Configure audit policy by using GPOs.
Active Directory Domain Services (AD DS) Auditing Step-by-Step Guide
Download details: Group Policy Settings Reference for Windows Server 2008
How to use Group Policy to configure detailed security auditing settings for Windows Vista-based and Windows Server 2008-based computers in a Windows Server 2008 domain, in a Windows Server 2003 domain, or in a Windows 2000 domain.

Maintaining the Active Directory environment (13 percent)
Configure backup and recovery
Windows Server Backup Step-by-Step Guide for Windows Server 2008
Backing Up Your Server
Recovering Your Server
Active Directory Domain Services (AD DS) Backup and Recovery Step-by-Step Guide
Introduction to Administering Active Directory Backup and Recovery: Active Directory
Backing Up Active Directory Domain Services: Active Directory
set DSRM password
authoritative restore
Backing Up Group Policy Objects

Perform offline maintenance
Active Directory Database Mounting Tool Step-by-Step Guide
Restartable Active Directory Domain Services (AD DS) Step-by-Step Guide
Compact the directory database file (offline defragmentation): Active Directory

Monitor Active Directory
Performance and Reliability Monitoring Step-by-Step Guide for Windows Server 2008
Windows Reliability and Performance Monitor
Repadmin

Configuring Active Directory Certificate Services (13 percent)
Install Active Directory Certificate Services
Active Directory Certificate Services Overview
Active Directory Certificate Services Step-by-Step Guide
Designing a Public Key Infrastructure: Public Key

Configure CA server settings
AD CS: Enterprise PKI (PKIView)
Download details: Active Directory Certificate Services Longhorn Beta3 Key Archival and Recovery Whitepaper

Manage certificate templates
Certificate Templates Overview
Download details: Implementing and Administering Certificate Templates in Windows Server 2008

Manage enrollments
Certificate Autoenrollment in Windows Server 2003
AD CS: Network Device Enrollment Service
AD CS: Web Enrollment
AD CS: Restricted Enrollment Agent
Download details: Microsoft SCEP Implementation Whitepaper.

Manage certificate revocations
AD CS: Online Certificate Status Protocol Support
Online Responder Installation, Configuration, and Troubleshooting Guide

Claymoore

I will be adding the other sections soon - hopefully this afternoon

sagewalkinthere

Dude! Someone sticky this! And thanks a bunch for posting this, I'm going to take this exam June 20.

saad3000

Am going to take the exam tomorrow morning!! Wish me Luck!!!!

darkerosxx

That's incredible! Good job, Claymoore!

Claymoore

Thanks, guys.

In the interest of full disclosure, I took the 70-649 upgrade exam instead of the 640 exam. If you are going to take 649, I recommend you focus on the Configuring additional Active Directory server roles and Configuring Active Directory Certificate Services sections for the AD portion of the exam.

d00dle

good timing. start 70-640 2day. just wonder why Microsoft Self-Paced training kit for 70-640 aint on the Recommended Reading list.

Jordus

I dont know why the umbrella'd everything that isnt AD under the AD moniker and now test on it.

I hate certificates.

Oh well, taking this the 30th of May so i better get used to it pretty quick.

BradH

Very nice and a good sticky

Just as a reminder to people who cannot book the 70-640 Exam and must book the 083-640 there are VM Sessions in those exams, so it is not a read & regurgitate type of test.

Nice work!

Lee H

I will be 140 years old by the time I read all them resources claymore ?

Can you get this on audio book, I wanna try subliminal hearing

bertieb

Excellent stuff Claymoore! Posts like that are why this forum rocks

sagewalkinthere

Just wanted to say thanks again to Claymoore for putting up this post. Even though I had the 83-640, it was still extremely useful in studying. Passed 800/1000.

tht

I'm studying for this exam and got referred specifically to this post by someone on another board . This will be extremely useful for me, big thumbs up to the OP for the effort.

maluna

Good stuff Claymoore

Cheers mate !

earweed

I just started studying for this exam. Good to see the post.

Someone on the WGU community took the 70-640 and it had him log into a VM and do work on the server. The 70-620 exam I took had questions simulations.
Are the 70 and 83 versions of these tests actually different?

Claymoore

earweed wrote: »

Someone on the WGU community took the 70-640 and it had him log into a VM and do work on the server. The 70-620 exam I took had 14/50 questions simulations.
Are the 70 and 83 versions of these tests actually different?

Same material just different execution. The 70- series are the standard exams with multiple choice and fake simulations where only a few of the options work. The 83- series has a combination of multiple choice questions and live VMs that you configure. You can configure the VMs any way you like without the restriction (or crutch) of restricted control panel views and limited functionality.

You do not have a choice as to which exam you take. As soon as the 83 exam is available in your language in your area, that is what you are required to take.

-Foxer-

earweed wrote: »

Someone on the WGU community took the 70-640 and it had him log into a VM and do work on the server. The 70-620 exam I took had 14/50 questions simulations.
Are the 70 and 83 versions of these tests actually different?

Hey, that was me on the WGU forums. I actually found these forums from a thread over there. Anyway, the actual test number was 96-640. I guess that's the educational version of the 83-640.

earweed

My bad. I didn't know our 70-640 was numbered like that. Thank Libertas Veritas for guiding us both over here.

Found this book on Group Policy that may fit in good here.
Amazon.com: Windows® Group Policy Resource Kit: Windows Server® 2008 and Windows Vista®: Derek Melber: Books

The following is a list of corrections put out by the authors of the MS Press Training Kit
MCTS Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® comments and corrections

Claymoore

earweed wrote: »

Found this book on Group Policy that may fit in good here.
Amazon.com: Windows® Group Policy Resource Kit: Windows Server® 2008 and Windows Vista®: Derek Melber: Books

I read the Group Policy resource kit during my 2008 studies and found it to be almost worthless. How can you have an entire book on Group Policy and never mention loopback processing? The Advanced Group Policy Management chapter is good, but that's a product that is bundled with the Microsoft Desktop Optimization Pack and thus not part of this exam.

The two Moskowitz books I list in the recommended reading section are much better for learning group policy. They are not exam-focused, so they contain lots of information that is not on this exam, but the additional infromation is great. The Secure Managed Desktop book may be the best App-V (Softgrid) resource out there even though is is a couple of years old and a couple of decimal point revisions behind.

Nobylspoon

All of the recommended reads appear to be available at Safari Books Online, maybe I will get my moneys worth out of it after all

gAnDo

I came across this post on the Active Directory Services Team blog which has much reading. Seems like a very good addition to whats already been posted here (although I havent checked for dupes)

Post-Graduate AD Studies - Ask the Directory Services Team - Site Home - TechNet Blogs

earweed

Server 2008 R2 has been added to the exam now.
Windows Server 2008 exams updated with R2 content - IT Pro Training and Certification - Training and Certification - Born to Learn

I used the MS Press book and the labsim for the 83-640. I also labbed everything I could.
You should be safe to go ahead and start but use the skills measured. They only changed a few things that wont be in the book. Checkout that link I gave above, it has stuff highlighted that's been changed.

Hers the changes that have to do with R2 are in red

I have noted the changes below in bold underlined red text.

OVERVIEW TAB:
The Microsoft Certified Technology Specialist (MCTS) on Windows Server 2008 credentials are intended for information technology (IT) professionals who work in the complex computing environment of medium to large companies. The MCTS candidate should have at least one year of experience implementing and administering Windows Server 2008 R2 in an environment that has the following characteristics: …

SKILLS MEASURED TAB:
Skills Being Measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam.

1. Configuring Domain Name System (DNS) for Active Directory (17%)
• Configure zones.
o May include but is not limited to: Dynamic DNS (DDNS), Non-dynamic DNS (NDDNS), and Secure Dynamic DNS (SDDNS); Time to Live (TTL); GlobalNames; Primary, Secondary, Active Directory Integrated, Stub; SOA; zone scavenging; forward lookup; reverse lookup
• Configure DNS server settings.
o May include but is not limited to: forwarding; root hints; configure zone delegation; round robin; disable recursion; debug logging; server scavenging
• Configure zone transfers and replication.
o May include but is not limited to: configure replication scope (forestDNSzone; domainDNSzone); incremental zone transfers; DNS Notify; secure zone transfers; configure name servers; application directory partitions

Configuring the Active Directory infrastructure (17 percent)
• Configure a forest or a domain.
o May include but is not limited to: remove a domain; perform an unattended installation; Active Directory Migration Tool (ADMT) ; change forest and domain functional levels; interoperability with previous versions of Active Directory; multiple user principal name (UPN) suffixes; forestprep; domainprep
• Configure trusts.
o May include but is not limited to: forest trust; selective authentication vs. forest-wide authentication; transitive trust; external trust; shortcut trust; SID filtering
• Configure sites.
o May include but is not limited to: create Active Directory subnets; configure site links; configure site link costing; configure sites infrastructure
• Configure Active Directory replication.
o May include but is not limited to: DFSR; one-way replication; Bridgehead server; replication scheduling; configure replication protocols; force intersite replication
• Configure the global catalog.
o May include but is not limited to: Universal Group Membership Caching (UGMC); partial attribute set; promote to global catalog
• Configure operations masters.
o May include but is not limited to: seize and transfer; backup operations master; operations master placement; Schema Master; extending the schema; time service

Configuring Additional Active Directory Server Roles and Services (14 percent)
• Configure Active Directory Lightweight Directory Service (AD LDS).
o May include but is not limited to: migration to AD LDS; configure data within AD LDS; configure an authentication server; Server Core Installation
• Configure Active Directory Rights Management Service (AD RMS).
o May include but is not limited to: certificate request and installation; self-enrollments; delegation; create RMS templates; RMS administrative roles; RM Add-on for IE
• Configure the read-only domain controller (RODC).
o May include but is not limited to: replication; Administrator role separation; read-only DNS; BitLocker; credential caching; password replication; syskey; read-only SYSVOL; staged install
• Configure Active Directory Federation Services (AD FS v2).
o May include but is not limited to: install AD FS server role; exchange certificate with AD FS agents; configure trust policies; configure user and group claim mapping; import and export trust policies

Creating and maintaining Active Directory objects (18 percent)
• Automate creation of Active Directory accounts.
o May include but is not limited to: bulk import; configure the UPN; create computer, user, and group accounts (scripts, import, migration); template accounts; contacts; distribution lists; offline domain join
• Maintain Active Directory accounts.
o May include but is not limited to: manage computer accounts; configure group membership; account resets; delegation; AGDLP/AGGUDLP; deny domain local group; local vs. domain; Protected Admin; disabling accounts vs. deleting accounts; deprovisioning; contacts; creating organizational units (OUs); delegation of control; protecting AD objects from deletion; managed service accounts
• Create and apply Group Policy objects (GPOs).
o May include but is not limited to: enforce, OU hierarchy, block inheritance, and enabling user objects; group policy processing priority; WMI; group policy filtering; group policy loopback; Group Policy Preferences (GPP)
• Configure GPO templates.
o May include but is not limited to: user rights; ADMX Central Store; administrative templates; security templates; restricted groups; security options; starter GPOs; shell access policies
• Deploy and manage software by using GPOs.
o May include but is not limited to: publishing to users; assigning software to users; assigning to computers; software removal; software restriction policies; AppLocker
• Configure account policies.
o May include but is not limited to: domain password policy; account lockout policy; fine-grain password policies
• Configure audit policy by using GPOs.
o May include but is not limited to: audit logon events; audit account logon events; audit policy change; audit access privilege use; audit directory service access; audit object access; advanced audit policies; global object access auditing; “Reason for Access” reporting

Maintaining the Active Directory environment (18 percent)
• Configure backup and recovery.
o May include but is not limited to: using Windows Server Backup; back up files and system state data to media; backup and restore by using removable media; perform an authoritative or non-authoritative restores; linked value replication; Directory Services Recovery Mode (DSRM); backup and restore GPOs; configure AD recycle bin
• Perform offline maintenance.
o May include but is not limited to: offline defragmentation and compaction; Restartable Active Directory; Active Directory database mounting tool
• Monitor Active Directory.
o May include but is not limited to: event viewer subscriptions; data collector sets; real-time monitoring; analyzing logs; WMI queries; PowerShell

Configuring Active Directory Certificate Services (15 percent)
• Install Active Directory Certificate Services.
o May include but is not limited to: certificate authority (CA) types, including standalone, enterprise, root, and subordinate; role services; prepare for multiple-forest deployments
• Configure CA server settings.
o May include but is not limited to: key archival; certificate database backup and restore; assigning administration roles; high-volume CAs; auditing
• Manage certificate templates.
o May include but is not limited to: certificate template types; securing template permissions; managing different certificate template versions; key recovery agent
• Manage enrollments.
o May include but is not limited to: network device enrollment service (NDES); auto enrollment; Web enrollment; extranet enrollment; smart card enrollment; authentication mechanism assurance; creating enrollment agents; deploying multiple-forest certificates; x.509 certificate mapping
• Manage certificate revocations.
o May include but is not limited to: configure Online Responders; Certificate Revocation List (CRL); CRL Distribution Point (CDP); Authority Information Access (AIA)

Changes in Functionality from Windows Server 2008 to Windows Server 2008 R2 This link may help
Migrate Server Roles to Windows Server 2008 R2 This link may also be useful

http://www.amazon.com/Group-Policy-Fundamentals-Security-Managed/dp/0470581859/ref=sr_1_7?s=books&ie=UTF8&qid=1285124136&sr=1-7 Book on group policy which includes Server 2008 R2


Three general books on Server 2008 R2 which may be helpful
http://www.amazon.com/Mastering-Microsoft-Windows-Server-2008/dp/0470532866/ref=sr_1_1?s=books&ie=UTF8&qid=1285124525&sr=1-1#_
http://www.amazon.com/Windows-Server-2008-R2-Unleashed/dp/067233092X/ref=sr_1_2?s=books&ie=UTF8&qid=1285124525&sr=1-2
http://www.amazon.com/Microsoft-Windows-Administration-Instant-Reference/dp/0470525398/ref=sr_1_3?s=books&ie=UTF8&qid=1285124525&sr=1-3

rscheckler

earweed wrote: »

Server 2008 R2 has been added to the exam now.
Windows Server 2008 exams updated with R2 content - IT Pro Training and Certification - Training and Certification - Born to Learn

I'm looking at just starting my studies for the 70-640. Should I be waiting for new material to be published (if there is any) or do you think that I am still safe to start my studies?

Also, I'm sure this is asked quite a bit but what personally do you recommend as the method for study?

Dracula28

Thanks for the effort earweed, its really appreciated.

LCA

Here's some links to the new R2 content for the 640 exam.


Configuring the Active Directory Infrastructure
Configure Active Directory replication
DFS Replication: What’s new in Windows Server™ 2008 R2


Configuring Active Directory Roles and Services
Configure Active Directory Federation Services (AD FSv2)
Active Directory Federation Services v2


Creating and maintaining Active Directory objects
Automate creation of Active Directory acounts
Offline Domain Join: Step-by-Step Guide

Deploy and manage software by using GPO's
Applocker resources - Technet

Configure audit policy by using GPO's
What's new in Wndows Security Auditing
Advanced Security Auditing in Windows 7 and Server 2008 R2
Advanced Security Audit Policy Step-by-Step Guide
Advanced Security Auditing FAQ


Maintaining the Active Directory Environment
Configure backup and recovery
Active Directory Recycle Bin Step-by-Step Guide

Configuring Active Directory Certificate Services
Manage enrollment
Certificate Enrollment Web Services in Windows Server 2008 R2 - Word document
Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide
Cross-Forest Certificate Enrollment for Windows Server 2008 R2 - Word document

I'll add anything else that applies to R2 if I come across it (I'm going to be doing this exam in 4 weeks time).

ITVince

Has DSADMIN.EXE therefore been replaced by AD Recycle Bin?

ltgenspecific

70-640 is a WIP for me and I just wanted to say thanks for putting this thread together. Great stuff!

NINJA1200

The R2 version is already out in the O'Reilly website:
MCTS Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory®, Second Edition - O'Reilly Media

I can't find the pdf anywhere, so I guess it is out just a few days ago.

Does someone want to help me buy the ebook version??

Stuppored

Errata for MCTS Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory®

- MCTS Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® Confirmed Errata | O'Reilly Media

PA_Kid

Hello all,

Just decided to start down the path toward my MCITP-SA certification, and I plan on starting with the 70-640 material. I do see that most of the training material available for this exam is for Sever 2008, and not specifically designated for the R2 release. I do know the MCTS Self-Paced training kit has been updated to R2, but this is about the only one I've seen on the market that has specifically been updated to reflect R2.

I guess my question on this type of situation is.... is there that significant of a difference between Server 2008 vs. the R2 release that would render most of the other available training resources pointless to study from?

Nobylspoon

PA_Kid wrote: »

Hello all,

Just decided to start down the path toward my MCITP-SA certification, and I plan on starting with the 70-640 material. I do see that most of the training material available for this exam is for Sever 2008, and not specifically designated for the R2 release. I do know the MCTS Self-Paced training kit has been updated to R2, but this is about the only one I've seen on the market that has specifically been updated to reflect R2.

I guess my question on this type of situation is.... is there that significant of a difference between Server 2008 vs. the R2 release that would render most of the other available training resources pointless to study from?

From what I have been reading, the exams are focusing pretty heavily on the R2 material. The old resources will still help but you will have to supplement with a lot of Technet material to cover the new things.

There is a second edition of all the Self-Paced training kit books. It will have a big "2" in the upper right corner of the cover.

Amazon.com: MCTS Self-Paced Training Kit (Exam 70-640): Configuring Windows Server 2008 Active Directory (Self-Paced Training Kits) (9780735651937): Dan Holme, Nelson Ruest, Danielle Ruest, Jason Kellington: Books