Windows 2000 Server

Windows Installer introduces a new installer package which replaces the setup.exe file with a file called .msi.

Using the locally-stored version of the user profile will save time when logging on by dial-up, because their workstation at home will not have to download their profiles from the server. Solutions that involve downloading information from the server add logon time while information is downloading. PPTP (Point-to-Point Tunneling Protocol) is used to "piggy-back" data packets of non-native format across networks (e.g., sending NetWare packets across a network that uses TCP/IP exclusively). It is mainly used in secure connections to send encrypted data that is "wrapped' like a Point-to-Point Protocol (PPP) packet. This process is referred to as encapsulation. You do not need to set up a database of information about each user’s connection. The connection information is determined by the server when a client computer attempts to connect to the server.

The secret to effective monitoring is to use the correct counters. All data is interesting but not pertinent to your needs. The System Cache Resident Bytes counter for Memory will support your decision to adjust the memory usage for Server Optimization by going to the Local Area Connection, Properties, File and Printer Sharing for Microsoft Networks. The pagefile size determines virtual memory while file system cache is an area of physical memory.

The .udf file is used when multiple computers are installed with variations in setup answers. The .txt file is the answer file for unattended installations. The .bat file facilitates an installation using winnt32 with switches. A .sif file is used for the bootable CD-ROM installation.

Your first option for recovery is the Last Known Good Configuration because you know that the registry was just altered. Safe Mode is appropriate if you know a device driver or software was just added and now the system won't start up. It allows you to remove the problem driver, server, or software so the system will start. The Recovery Console is a necessary task if you do not have a Last Known Good Configuration that works. You are required in this case to restore a good copy of core system files. The Windows 2000 Setup floppy disks can get the system started so you can use the Recovery Console. The ERD can help repair system files but it does not replace damaged files and it is computer-specific.

You must use the answer file to indicate there is a non-signed driver so the setup will continue without interaction from a keyboard. The [OEMBootFiles] section is the wrong place to make the setting in the answer file. Manual settings, other than within the answer file, are incorrect.

You can simplify the installation of Service Packs by upgrading the files in each of your shares. Each computer receives only the latest files during installation. The individual files cannot be manually copied to the distribution shares; they are placed there during the update. The sysdiff utility installs Windows by using difference files; it does not install Service Packs.

Microsoft advises that you should not place a page file on a stripe set with parity. Therefore, you have only two disks on which you could possibly place the page file. You should place a paging file on the disk with the lowest amount of disk activity. The disk with the Windows 2000 system files (the boot partition) is used almost constantly in the operation of the system. In this question, the Windows NT system files are on drive C:. Thus, the best place for the paging file in this instance is on drive D. NOTE: This can be confusing! The SYSTEM PARTITION contains the BOOT FILES that the computer boots from (in the root directory of the drive). The BOOT FILES (NTLDR, NTDETECT.COM, BOOT.INI, and BOOTSECT.DOS) must always be on the Active partition (called the SYSTEM PARTITION). The BOOT PARTITION is where the WINNT folder (the folder containing the Windows 2000 PROGRAM FILES) is located. It contains the SYSTEM FILES (%systemroot%), and can be on a primary partition or a logical drive in an extended partition on a basic disk.

Only the upgraded server needs the Basic template applied to make it equivalent to the clean-installed servers. Then you can make the modifications to the security settings your network requires on a new template and apply it, knowing that all servers started out with the same settings.

In this scenario, the most likely reason that the new disk drive cannot be located is that the SCSI ID of the drive conflicts with the ID of another SCSI device. Many SCSI devices must have the SCSI ID set manually. Since the replacement drive is the same make and model as the failed drive, it is not likely that the SCSI cable length differs. Since the other drives can be located, the SCSI bus is terminated properly. Whether or not the disk drive is a Plug and Play device, the SCSI ID generally must be set manually.

When a client computer attempts to connect to a printer using a web browser, it will try to use Remote Procedure Calls (RPC) first. If this is successful, the computer will communicate with the print server using RPC. RPC is faster and more efficient than other protocols. If the client computer cannot use RPC to communicate with the print server, it will use the Internet Printing Protocol (IPP) encapsulated in the Hypertext Transport Protocol (HTTP). The Server Message Block (SMB) protocol is used if a user creates a local port on the client computer and then redirects output to that port to a printer on a print server using the UNC path of the shared printer.

You should add NWLink only to the Local Area Connection of the Terminal Services server, since Terminal Services clients must use TCP/IP to communicate with the Terminal Services server. It is a good practice to limit the number of protocols installed on each computer, so you should not add NWLink to the Local Area Connection of the Terminal Services clients. NWLink is Microsoft's implementation of the protocol IPX/SPX. For NetWare version 3.11 and earlier, the frame type used is 802.3. For NetWare versions 3.12 and above, the frame type used is 802.2. Thus, you should configure NWlink with frame type 802.2. Frame type 802.2 is the default frame type configured if Windows 2000 detects multiple frame types on a network.

You should use the Password Policies category in the Account Policies node to enable passwords to be stored using reverse encryption. You also use the Account Policies node to configure lockout policies and Kerberos policies. You use the Lockout Policy node to define the number of failed attempts that can be made to log on before an account is disabled and the time period after which the account will be enabled again. You use the User Rights Assignment node to configure which rights are enabled on a system and who is entitled to exercise these rights. You use the Security Options node to configure advanced rights and advanced auditing such as "Automatically log off users when logon time expires" and "Prevent users from installing printer drivers".

When a Hypertext Transfer Protocol (HTTP) request is received from a browser for a site that is stopped, the Default Web site home page will be returned to the requester. Thus, the content of this home page should be appropriate for all web sites hosted on the IIS server. The user cannot be redirected to an alternate default page for the site’s home directory if the site is stopped. If a user requests a web page that does not exist for a web site that is running, the user will receive a 404 – File Not Found error message. You can customize the default error messages for IIS from the Custom Errors tab of the Properties dialog box of each web site or the Master Properties dialog box for the IIS server. A user will receive a 403.2 – Read Access Forbidden error message if the user tries to access a page for which the user does not have permission. This typically is a web page with NTFS permissions set that do not give permissions to this user or any group to which the user belongs.

The Indexing Service in Windows 2000 replaces Index Server 2.0, which was available with IIS 4.0. The Indexing Service is installed with Windows 2000 Server but it is disabled by default. It must be enabled to index the contents of the online help for IIS so you can use the search feature. To enable the Indexing Service, open Computer Management, expand Services and Applications, and then start the Indexing Service from the context menu of the Indexing Service node. You do not need to publish the folder that contains the IIS 5 online help files in Active Directory. You do not need to store the catalog on a volume or partition formatted with NTFS.

You should configure the limited access virtual directories to use Basic Authentication, since it is the only authentication method supported by all web browsers. You need to have Internet Explorer 5.0 or newer when using Digest Authentication. Internet Explorer 2.0 or newer supports Integrated Windows Authentication. You can use Anonymous Authentication for the Default Web Site, but you should not use it for the limited access virtual directories.

You should copy the profile for your account to the Default User profile. When a user first logs on interactively at a computer, the user receives a copy of the profile defined for the Default User. This is copied to the folder %systemdrive%\Documents and Settings\, where is the user’s account name. A local profile is created for each user who logs on interactively to a computer, not for the group to which the user belongs. Profiles are not created for groups, so you cannot establish a profile for the Administrators group. Defining a path to your profile in the properties of each user account requires more administrative effort than copying the profile to the Default User profile. Also, changes made to the profile by any administrator will update your profile, so each user will not have a customized desktop. Copying your profile to the default location for each user’s profile requires more administrative effort than copying the profile to the Default User profile. The procedure defined in this scenario will not work if a user account is configured to use roaming profiles. If roaming profiles are in use, the Default profile is not used.

The best performance will be achieved by creating a striped volume using the three remaining disk drives. This is not a fault-tolerant solution, but it does provide the best performance because data is written evenly across all the disks in the volume set. You do not increase performance when using a spanned volume, since Windows 2000 uses up the space available on one disk in a spanned volume before using space on another disk drive. Creating a RAID-5 volume gives you a fault-tolerant solution, but the overhead of calculating parity during write operations detracts from performance.

The most likely reason that none of the network services started is that the network adapter card settings conflict with the settings for another device on the system. Since network protocols and services are dependent on the network adapter card driver, the protocols and services will not initialize if the driver for the card is not loaded and initialized. The drivers for the network adapter card and the network protocols and services will load and initialize if the network cable is unplugged. If a computer cannot contact a DHCP server, the computer will use the Automatic Private IP Addressing (APIPA) feature of Windows 2000 and assign itself an address in the range of 169.254.0.0 to 169.254.255.255. By default, network services are configured to start automatically. Since Windows 2000 Server was recently installed, these values are most likely set to start automatically. If they were configured as disabled or for a manual start, you would not receive an error message when they fail to start.

The WINS server sends a name query request to the computer that currently has the name registered. If this client responds, the WINS server sends a negative name registration response to the new client. If the existing client does not respond, the WINS server updates its registration information and sends a positive response to the new client. The WINS server does not contact replication partners to verify the existing client and it does not direct the client to register with another WINS server.

File and Printer Sharing for Microsoft Networks is the equivalent of the Windows NT 4.0 server service. This service is responsible for responding to requests from network clients to access shared resources on a computer. The properties of this service allow you to determine how memory should be allocated for this service. When a computer is running applications that manage their own memory caching, you should select the setting "Maximize data throughput for network applications". Exchange Server and SQL Server are examples of this type of application. You should select the setting "Minimize memory used" if the computer serves a small number of clients, typically 10 or less. You should select the setting "Balance" if the computer is used both by an interactive user and by network clients for access to shared resources. You should select the setting "Maximize throughput for file sharing" if the computer is primarily a file and print server. This is the default setting for computers running Windows 2000 Server.

The tape from the copy backup should be used. Although a copy backup does not clear the archive marker, it does back up all selected files and folders. You could restore the tape from the normal backup and then the tape from the differential backup that was done on Wednesday. However, this would take longer than restoring the tape from the copy backup. Restoring the tape from the normal backup and then the tape from the copy backup would take too long. Also, if files had been deleted between the normal backup and the copy backup, they would be restored with this process. Restoring just the tape from Wednesday's differential backup would restore only those files that had changed since Sunday, not all of the files.

You use Local Users and Computers in Computer Management to create users and groups in the Security Accounts Management (SAM) database of a standalone server. Users and Passwords in Control Panel is not available on a computer running Windows 2000 Server. It is available on a computer running Windows 2000 Professional. You do not define accounts using the Internet Information Services Snap-In. You can use it to define which accounts or groups have Operator privileges on a web site. Local Security Policy in Administrative Tools is used to manage policies for accounts, auditing, user rights, public keys, and IP Security.

You cannot use Security Templates to configure Public Key Policies and IP Security Policies. You can use Security Templates to configure Account Policies, Local Policies, Event Log settings, Restricted Groups, and settings for System Services, the Registry, and the File System.

The Bandwidth Throttling feature of IIS 5.0 allows an administrator to throttle the amount of available bandwidth used for web services for individual network adapter cards. Use of this feature can help insure that network bandwidth is available for other services. The Process Throttling feature of IIS 5.0 allows an administrator to limit the amount of processor time used by web services. The Socket Pooling feature of IIS 5.0 allows web sites on a computer that are bound to different IP addresses but the same port number to share sockets. This helps to minimize the use of non-paged memory for web services. The Out-of-process Pooling feature of IIS 5.0 allows web applications to run in a process that is separate from the Inetinfo process. The Inetinfo process is the IIS server process. Using the Out-of-process Pooling feature helps to insure the reliability of the web services, and uses less memory than having each web application run in its own process.

UNIX clients use the Line Printer Remote (LPR) utility to communicate with a print server running the Line Printer Daemon (LPD) service. You install Print Services for Unix (using Add/Remove Programs) to configure a print server to respond to LPR requests. You then configure an LPR port for these clients. The standard TCP/IP port is used to manage network interface print devices that are configured to use TCP/IP. Although you can configure this port type to use LPR, this configuration allows the print server to communicate with the print device using the LPR protocol instead of the Raw protocol. This does not enable the print server to respond to LPR requests from clients. A Local port can be used to manage a device that is connected to a parallel or serial port on the print server. It can also be used to redirect printing to a shared printer on another print server but not to a network interface print device that is not currently managed by a print server. A Lanman print services port is used to support clients running LAN Manager.

When Terminal Services is installed on a computer in Remote Administration mode, no Terminal Services client access licenses are required. However, at most two Remote Administration connections can be active concurrently. Terminal Services client access licenses are needed when Terminal Services is running in Application Server mode. There must be one client access license for each concurrent connection. A Terminal services client access license is not required for users who connect to the Terminal Services computer from a computer running Windows 2000 Professional. There are two other options available when using Terminal Services in Application Server mode. An enterprise can purchase a Terminal Services Internet Connector License. This license allows up to 200 concurrent anonymous connections to a Terminal Services server. An enterprise can also purchase Work at Home Windows 2000 Terminal Services client access licenses for use on computers installed at the homes of employees.

You use the Advanced Settings option in the Advanced menu of Network Connections to modify the binding order for protocols and services. You cannot modify the binding order from the properties of the Local Area Connection, the Workstation service, or the network adapter card.

When you select the option to obtain an IP address automatically in the Local Area Network connection’s TCP/IP properties, you should also disable the option Use the following DNS server addresses. Disabling this option enables the option Obtain DNS server address automatically, and allows the computer to obtain the DNS server address from a DHCP server. The option Use the following DNS server addresses is selected by default, but no DNS server addresses are added to the dialog box during installation. You do not need to convert the zone to an Active Directory-Integrated zone, even though the DNS service is installed on a domain controller. You do not need to configure a computer at the branch office as a DHCP relay agent because the DHCP server is at the branch office. You do not need to disable APIPA on that computer.

If the Full Control permission for a shared folder is denied to a user or to a group to which the user belongs, the user will not be able to access the shared folder. Selecting deny for the Full Control permission also enables deny for the Read and Change permissions. Without the Read permission, a user cannot view the contents of a shared folder. If a user or a group to which a user belongs has not been denied access, the user’s effective permission is the combination of the permissions assigned to the user and to all the groups to which the user belongs. Thus, the least restrictive of the permissions applies. NTFS permissions are more granular than share permissions. With NTFS, you could deny a specific permission to a user while granting another permission. For example, you could deny the Read permission while allowing the Write permission.

You must start the computer from the Windows 2000 Server CD-ROM and choose the repair option. Then, you press C to start the Recovery Console and use the fixmbr command to repair the master boot record. When the master boot record is corrupt, the startup menu cannot be displayed. The master boot record cannot be repaired from either Safe Mode or by using the Last Known Good Configuration.

You should disable the mirror. You can reestablish the mirror after you complete the installation. You should also disconnect the UPS device because the Windows 2000 setup process attempts to detect devices connected to serial ports and may not detect the UPS device properly. You can reconfigure the UPS to work with Windows 2000 after completing the installation. The RAM does not need to be increased to 256 MB. The minimum amount of RAM required is 64 MB for up to 5 clients. The recommended minimum amount for a file and print server is 128 MB. You should use System Monitor to determine if this is adequate to support the system load. The boot partition does not have to be converted to NTFS nor does it need to be extended. A partition cannot be extended unless it is formatted with NTFS. If the computer will be a domain controller, you must have a partition that is formatted as NTFS to support the shared system volume (sysvol). This is usually stored on the boot partition, but can be stored in a separate partition.

When the status of a disk drive is Missing, the system cannot access the drive. You must use the Remove Mirror option to break the mirror, replace the failed disk drive, convert the new drive to a dynamic disk, and then use the Add Mirror option to recreate the mirror. The Repair Volume option is not used when the status of a disk drive is Missing. You do not need to start the system in Safe Mode to replace the failed member of a mirrored volume. You cannot use the Break Mirror option if one of the drives in the mirrored volume is not functional.

You can configure this option by using the setting "Maximum tolerance for computer clock synchronization" in the Account Policies\Kerberos Policy node. You use the Password Policy node to define settings such as the minimum password length, password expiration time, and password history. You use the Account Lockout Policy to define settings such as the number of failed logon attempts that will trigger a lockout and the time after which a lockout will expire. You use Security Options to manage advanced auditing and user rights.

Jack’s effective permissions are Read & Execute and Read. As a member of the group Accounting, he has Full Control. However, since he is denied the Write permission, and a Deny overrides an Allow, he cannot modify the file. He can still read or execute the file. Unlike NTFS permissions in Windows NT 4.0, you can deny a specific permission for a group or user, but allow other permissions. In Windows NT 4.0, designating No Access to a file for a user takes precedence over any other permissions assigned to groups to which the user belongs. In Windows 2000, denying a specific permission does not affect other permissions that are allowed. The effective NTFS permissions for a user are the combination of permissions assigned to the user and to all groups to which the user belongs. File permissions take precedence over permissions assigned to the parent folder of the file. If a specific permission is denied for the user or any groups to which the user belongs, the user will be blocked from using that permission.

Only the computers on which the DNS service is installed can respond to DNS queries. In this scenario, both DCA and MS can respond to requests. A member server can be a secondary DNS server even with Active Directory-Integrated zones configured. DCA can be configured as a master server for MS. When a DNS zone is converted to an Active Directory-Integrated zone, the zone data is stored in Active Directory and is replicated to all domain controllers in the domain. A domain controller that is also a DNS server reads the zone data from Active Directory and can use a standard zone transfer to transfer it to a secondary DNS server. Domain controllers on which the DNS service is not installed do not respond to DNS queries.

You can add the Outlook 2000 template file to System Policy Editor, then open the existing system policy, configure the settings, and save the file. You cannot import an existing policy into a new policy You cannot add a template or import a template with System Policy Editor after you open a policy file.

Both the Sysvol Directory and the Active Directory can only be restored while in Directory Service Restore Mode. Registry files, system boot files, and the Certificate Services database can be restored by using the restore operation of the Backup utility whether or not the system is in Directory Service Restore Mode.