Exam 70-412: Configuring Advanced Windows Server 2012 Servic

Examine the dhcp server components, including the server service and dhcp client service with auto start, the dhcp database at system32/dhcp, the dhcp console for administration, and enterprise admin authorization.

Explore DHCP options and features in Windows Server 2012, including super scopes, multicast scopes, and IPv6 options, plus high availability, failover, split scopes, and name protection.

Explore how dhcpv6 regional registries allocate ipv6 addresses across regions, from Africa and Asia-Pacific to Aeron, Canada, Caribbean, Europe, and Latin America, for internet-facing use.

Explore DNS solutions that keep the DNS process running smoothly, including server-level records. Understand delegation, DNS logging, DNS security, recursion, cache locking, and the global names zone.

Delegate dns permissions to manage dns zones and dns backup tasks, and assign domain admins, enterprise admins, and the global dns admins group to balance administrative responsibility.

Explore signing a zone with three options—manually configure parameters, copy from an existing zone, or use the recommended settings—and learn to unassign zones via DNS management interface to remove signatures.

Configure aging and scavenging to remove stale DNS records left by crashes, with clients refreshing on boot or within 24 hours and default 7 days for refresh and non-refresh intervals.

Explore enterprise name resolution strategies by configuring forwarders, conditional forwards, and stub zones, optimize with netmask ordering and recursion to route queries to nearest authoritative DNS servers.

Add an alias (CNAME) to the global names zone by creating a new alias with a fully qualified domain name, selecting the file server, and refreshing the list.

Use a dedicated server with no ad ds, joined to the domain as a member. Logon with a domain account in the local security group and enable auditing and IPv6.

Migrate IPAM data to Windows Server 2012 with a seamless database migration during upgrade to R2, and rest assured the database transfers without issues when upgrading from the prior version.

Demonstrates installing IPAM by adding the feature, installing prerequisites, and provisioning and discovering servers with group policy and PowerShell to centralize IP address management.

Add an IP address block to IPAM by providing the network ID and a /24 prefix, set the RIR for public ranges, and optionally include a description and owner.

Add an IPAM subnet by specifying a friendly name, network ID, and prefix length; set optional site and IP pool details, or use PowerShell with -IPSubnet and -NetworkID.

Add an IP address range to IPAM, including prefix length, network ID, and IP pool name, and specify creation behavior when an address is missing.

Add an IP address to IPAM and associate it with a reservation or map it to a range, using managed by service, address state, assignment type, and custom fields.

Ensure all hosts in the network load balancing cluster share the same subnet, have latency under 250 ms, use static IPs, and disable the DACP client on interfaces before joining.

Network load balancing distributes load but offers limited fault tolerance; it detects server failures with a one-second heartbeat and removes nodes after five missed heartbeats, not detecting application failures.

Configure network load balancing with virtual machines across separate disks and redundant hosts. Enable unicast mode with multiple virtual network cards and MAC address spoofing to protect the cluster.

Upgrade nlb clusters by migrating to new nodes, decommissioning old ones, and choosing piecemeal or rolling upgrades, with support for mixed operating system environments, though not recommended long term.

Clustered shared volumes enable multiple nodes to share read/write access to the same disk, with quick failover and visibility, provisioned as NTFS and supporting SMB 3.0, BitLocker, and storage spaces.

Ensure all failover cluster nodes run the same edition of Windows Server 2012, with identical service packs and updates; standard can be full or server core, data center likewise.

Ensure Hyper-V cluster hosts meet the hardware requirements: a 64-bit processor, hardware-assisted virtualization, and hardware DEP, and are validated by Microsoft using the validator configuration wizard or PowerShell test-cluster.

Explore how the cluster network enables node communication with clients across public, private, and hybrid networks; resources on nodes surface to clients, can be started or moved, with shared storage.

Explore quorum modes for Windows Server 2012, including no majority and node majority with disk or file share witness, and why disk witness can create a single point of failure.

Identify the three failover cluster networks—private, public, and public-private—and explain their roles in internal communication, client access, and ip address resource records creation.

Demonstrates configuring fail over clustering on Windows Server 2012, setting up shared storage with iSCSI, validating servers and disks, and creating a cluster with the create a cluster wizard.

Clarify cluster and quorum terminology, configure applications and services by understanding cluster services as roles or applications, resources, failover, and managing shared disks, names, and ip addresses online or offline.

Install the cluster service roles using Server Manager or PowerShell, validate in Failover Cluster Manager, install on cluster nodes, create a clustered application, and configure it.

Deploy highly available file server by adding a clustered role, selecting general use or scale-out for application data, and configuring a cluster name for failover with SMB and NFL protocols.

Choose an authoritative restore to roll back a cluster to a point in time, or a non-authoritative restore for a damaged node, using system state recovery via Windows Server Backup.

Configure dhcp failover parameters, including the maximum client lead time and auto switch over interval, set 10 minute default, enable message authentication, and apply firewall rules via the failover wizard.

Ensure all Hyper-V cluster servers share identical 64-bit hardware with hardware-assisted virtualization and DEP, same software updates, service packs, and installation type, certified for Windows Server via validate configuration wizard.

Enable guest clustering for high availability by failover clustering virtual machines across hosts, requiring cluster-aware vms and shared storage via ice Kaze or virtual fiber channel interface on Server 2012.

Learn how Windows Server 2012 R2 enables shared virtual disks in the VHDX format, added as SCSI drives for guest clusters, serving as witness or data disks.

Explore the DMM components, led by the Vienna manager, that process commands and coordinate the VM database, library server, and hosts as a deployment hub, stored in a sequel database.

Meet prerequisites for VMM 2012: Windows Server 2008 R2 SP2, .NET Framework 3.5 SP1, Windows Administration Kit; enable WinRM, allocate 2 GHz CPU, 4–8 GB RAM, 40–150 GB disk.

Server 2012 supports odx with intelligent storage arrays that offload VM transfers, enabling rapid import and export via a data token copied between servers.

Migrate a powered virtual machine and its storage without shared storage using live storage migration in Hyper-V, copying data to a new virtual hard drive and synchronizing changes.

Configure Hyper-V replica components, including the replication engine, change tracking, and network module, and use the replica broker server role to redirect VM events during quick, live, or storage migrations.

Export virtual machines to a separate drive for backup, powering them off and creating folders for snapshots, virtual hard disks, and virtual machines; import provides register, restore, and copy options.

Standardize user logon across multiple Active Directory domains by configuring UPNs with a common suffix in a forest. Use UPN suffixes such as a forest DNS suffix to simplify sign-in.

Explore domain functional levels and UPN suffixes in active directory, including raising functional levels, managing operations masters, and adding a UPN suffix for forest-wide login.

Use the Active Directory migration tool to restructure domains and migrate user, group, computer, and server accounts, along with trust relationships and Exchange servers, with reporting and undo the migration.

Prepare the target domain for older cryptographic algorithms and align accounts; establish trust between old and new domains, enable sid history migration, and test migration with rollback and firewall settings.

Explain how sid history preserves a user’s identity across old and new domains during migrations, using a trust relationship and a separate sid history attribute to maintain access to resources.

Explore Active Directory partitions, including the configuration, domain, application, and schema, and how they shape replication, domain controllers, and the forest-wide global catalog.

Explore multi-master replication in active directory, with readable and writable domain controllers. Understand pull-based replication, read-only branch offices, store-and-forward topology, and data store partitioning across domain and forest.

Explore how active directory sites and replication manage traffic across physical locations and subnets, using connection objects, bridgeheads, and the kcc to shape topology and notifications.

Explore how the KCC automatically builds forest-wide replication topology across red and blue domains, linking domain controllers, config and schema partitions, and global catalog servers with DNS.

Create and bridge site links using either ip or smtp transport, ensuring domain names match the physical site structure, and manage default and custom site links for continuous replication.

Configure active directory domain services site replication using sites and services, adjusting the default IP site link properties, costs, and schedules, and bridge all site links for automatic connectivity.

Learn to manage replication with DC diag and repadmin, running tests from domain membership to DFS replication events and viewing status and connections with a fully qualified domain name.

Learn to run and interpret DC diag replication tools to diagnose domain controller health, test connectivity, DNS, replication of AD components like DFS, GPOs and schema, and identify replication issues.

Use repadmin to manage and verify replication between domain controllers, run KCC checks, view inbound neighbors, and inspect replication boundaries across sites and dns zones.

Describe how an SRV record encodes the service name, port, protocol (TCP or UDP), and the host performing the service, mapping to the domain controller in a host-record hierarchy.

Discover two methods to extend active directory to the cloud with server 2012: sync with on-premises AD and cloud-based AD, plus AD DS, AD FS, and AD RMS.

Implement Azure by guiding you through creating a cloud Active Directory, management portal, a trial, domain setup, user creation, and apps and DNS integration with your directory.

Verify and monitor DNS configuration; ensure clients query domain controllers and service records exist. Deploy AD integrated zones and a global names zone to replace WINS and support replication.

Explore Active Directory Federation Services to connect two organizations, enabling partner and customer collaborations; learn identity federation, claim rules, claim provider trusts, and other federation configurations for forest relationships.

Understand how a claims provider trust links a federated server and a claims provider, defining how claims are processed and credentials issued, and configure it with metadata or manual setup.

Identify prerequisites for adfs deployment: active directory services (ADAM/AD LDS), SQL Server 2005+ or attribute stores, domain-joined federation servers (not domain controllers), a perimeter proxy, DNS, and ports such as 389.

Explore how the AD FS components interact, including the attribute store, claim provider, home domain token, relaying party, and claims rules, for secure federation across organizations.

Explore the claim types available in AD FS on Windows Server 2012 R2, including operating system version, IP address, group, given name, email, and certificate issuer.

Configure client firewall rules via the default domain policy to enable branch cache, using predefined inbound rules for content retrieval and peer discovery, then apply policy domain-wide.

Create a group policy object and link it to an organizational unit with client computers to enable distributed cache mode or hosted cache mode, using computer configuration policies or PowerShell.

Utilize discretionary access control as a central policy to manage and audit access across file servers, enabling reporting and security, with access denied remediation and owner-directed fixes.

Create certificate-based claims by using Active Directory Certificate Services and the PowerShell module, storing claims in the AD configuration partition and mapping attributes from computer and user accounts.

Enable pre-defined resource properties such as department and confidentiality, or create your own with value types including date and time, text, number, multivalue, ordered list, single value, or yes/no.

Configure central access control rules by defining a name and description, evaluating conditional expressions for user and device claims, setting a scope with and/or logic, and enabling accidental deletion protection.

Demonstrates enabling a file share for BranchCache in Windows Explorer by creating a folder, using advanced sharing and caching settings, and adding sample documents.

Configure branch cache on branch office file servers by creating an OU, adjusting group policy to block inheritance, enabling branch cache via PowerShell, and verifying status.

Explore how file server resource manager enables dynamic file classification, dynamic access control, and file screening to protect confidential data, manage quotas, and generate reports for storage usage.

Configure file classification rules by setting scope, based on folder path or content, and using patterns or regex such as three-digit dash two-digit dash four-digit strings, with case sensitivity.

Demonstrate configuring resource property definitions within dynamic access control, enabling department and confidentiality, managing department suggested values, and verifying they appear in resource property lists.

Configure central access rules and policies with dynamic access control in the domain controller's Active Directory administration center, applying department-based conditions and permissions for confidential documents.

Publish a central access policy using group policy by creating and linking a GPO, then edit under computer configuration and Windows settings to enable central access policies for documents.

Enable iSCSI components to access storage over an ip network using standard ethernet, with optional switches and host bus adapters, and ensure firewalls accommodate tcp/ip port 30 to 60.

Explore disaster recovery requirements, roll back data to any server when needed, define critical resources, risks, and recovery time objectives to align with service level agreements and business needs.

Learn service-level recovery by reinstalling critical services while preserving data for Active Directory, DNS, DHCP, Exchange Server mailbox, and certificates, using backups, bare-metal images, and redundancy.

Align recovery point and recovery time objectives for full server recovery, determine critical servers, and back up the full server while duplicating essential services and data.

Compare full backups back up all files and folders, while incremental backups save changes since the last full backup; recovery is slower.

Plan backups by calculating space for full and image-based backups, forecasting growth and incremental changes, while setting retention, frequency, and recovery time objectives.

Backups contain all data, and the operator can back up even without full access. Secure backup media and off-site storage to prevent unauthorized restore anywhere, as encryption is not guaranteed.

Perform a bare metal system restore, ensuring the disk is the same size or larger. Restore to similar hardware or create a new virtual machine from a Windows Server backup.

Explore Windows Azure online backup, a Microsoft subscription service integrated with Windows Server 2012, featuring block-level incremental backups, data compression, encryption in transit, and post-backup data integrity checks.

Learn to configure Windows Azure Backup by creating a backup vault, uploading certificates, installing the backup agent, and registering the server to start backups in the backup portal.

Install DPM on a single-purpose server with no other roles. Prepare prerequisites including SQL Server, dotnet 3.5 SP1, PowerShell, Windows Installer 4.5+, single instance storage, and Microsoft application error reporting.

Single instance storage reduces volume space by storing one copy of each file and linking changes. Use backups with NTFS version 5 or later and single instance storage filter.

Explore business continuity and disaster recovery for Windows server, including backup and restore, volumes and volume shadow copy, safe mode boot, Windows Recovery Environment, fault tolerance levels, and recover sites.

Explain how active directory certificate services implement public key infrastructure to encrypt and digitally sign data, enroll devices, verify identities, and manage and revoke certificates via root and subordinate CAs.

Explain how SSL certificates secure data in transit, verify trusted authorities, and show how the client and server derive a shared key and encrypt with the public key.

Explore certificate authority hierarchies, including two-tier models with root and subordinate CAs, and cross-certification between independent hierarchies to establish mutual trust.

Deploy a standalone root certificate authority by installing certificate services, configuring a private key and key length, and setting the distinguished name and database locations.

Subordinate CAs deploy certificates for users and computers, depending on hierarchy; ensure domain membership and issue secure mime certificates while enabling Active Directory sites with load balancing for fault tolerance.

Explore computer template settings, including single and multipurpose certificates for web servers and ipsec; view certificates to validate sites and enable multipurpose certificates for fs, secure email, and domain controllers.

Configure certificate auto enrollment by defining permissions and template settings in group policy, enabling automatic certificate requests and renewals for all domain computers without user interaction.

Demonstrates configuring a restricted enrollment agent by adding an enrollment agent certificate template, setting security permissions in the template management console, and issuing the certificate via the MMC certificates snap-in.

Understand how revoked certificates get published and how Windows clients verify certificate status using CRL locations, AIA information, and the online certificate services provider. Track the revocation process through the CRL component, path validation, local cache, and online certificate services provider checks to determine if a certificate is revoked.

Update the web server certificate using a subordinate CA, install certificate services and IIS, create a domain certificate, and bind it to an HTTPS site.

Loss of recovery keys prevents data decryption, often after OS reinstall, bare-metal install, or corrupted user profiles. Back up cryptographic keys stored in the local file system and registry.

Explore key recovery agents (kra) and how they recover a private key during certificate requests, and review key archival with recovery certificates in version 2 systems.

Explore real-world RMS examples by safeguarding confidential payroll data with restricted access, copy, print, and forwarding controls, and applying confidential email practices in Outlook.

Discover the super users group in Windows Server 2012, disabled by default but granting full owner rights, and ensure it is an active directory group with an assigned email address.