Saturday 8 February 2014

Trouble Shooting Guide

User Temporary Profile issue
Your user profile was not loaded currently you have been logged on with a temporary profile, changes you make to this profile will be lost when you log off please see the event log for details or contact your administrator
Please refer this Microsoft article KB947242.
This something that normally happens in vista based system. When this happen you will see this following appear in your event logs.
Log name: application
Source: Microsoft windows user profile service
Event Id: 1511
Level: warning
Take this below option to solve this problem
Start
Run
Regedit
Hkey-Local-Machine + Software+ Microsoft+ Windows NT+ CurrentVersions+ ProfileList
Locate any subkeys named SID.BAK and delete them
Close regedit and reboot system.
User profiles troubleshoot?
If you are trying to determine why your user profile did not download properly, then you should activate USERENV.DLL’S logging feature and examine the log that it creates in
\windows\debug\usermode\userenv.log.
To enable USERENV.DLL logging, go to the sub key HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CurrentVersion\Winlogon and add a new entry called UserenvDebugLevel of type REG-DWORD. Set its Value to 3002 hex and reboot the system.
To diagnose the log please follow the below steps.
You will get log like below, chose the failed log to diagnose the issues.
USERENV(964.8d4) 13:14:39:557 ImpersonateUser: Failed to impersonate user with 5.
USERENV(964.8d4) 13:51:42:327 GetUserNameAndDomain Failed to impersonate user
Open Calc and change the View to Scientific. Change the type to Hex then enter 964 and hit the Decimal radio button. Now you will have a number, this is the PID for the process. Open Task Manager, go to View – Select Columns and put a check mark in the box for PID and hit OK and check the process name.
This way we will come to know the actual process getting failed.
NTLDR is missing file?
Boot Server using BOOT CD
Chose Repair Option
From the command prompt
Type [MAP] command, it will map your CD Drive. Go to CD Drive I386 folder. Copy that file into your C Drive.
Example: assume your CD Drive is E:
E:\I386\>copy ntldr c:\
Note:
Attrib –a –h –r –s ntldr
If you want to create a windows 2000 boot disk it should be contains the below files:
Ntldr
Ntdetect.com
Boot.ini
Ntbootdd.sys
Trouble Shooting Server Commands:
The process is simple:
Get to the windows recovery console for your particular windows installation navigate to the root letter of your installation (C: in most cases) issue eight commands called “Bootcfg / Rebuild” which is a complete diagnostic of the operating system loaded into the recovery console; the purpose of the command is to remove/replace/repair any system files that were preventing the operating system from loading correctly. Amongst the files it fixes are.
Windows hardware abstraction layer (HAL)
Corrupt registry Hives (\\Windows\system32\config\xxx)
Invalid boot.ini files
A corrupt ntoskrnl.exe
A missing NT Loader (NTLDR)
C:\CD
C:\attrib –h c:\boot.ini
C:\attrib –s c:\boot.ini
C:\attrib –r c:\boot.ini
C:\del boot.ini
C:\bootcfg /rebuild
C:\chkdsk /r /f

C:\fixboot

System Admin Tools

Tools Name
Description
Expart Utility


Dell expart utility we can extend the server drives
(ex c )drive and application drives, without reboot.

ERD Commander
we can change the administrator password if we forget and etc
Acronics
we can extend the drives etc
File Filler
File Filler it's tool for creating dummy file with amount of big file size.

This tool we can use for network speed testing purpose. for transfering file between one location to another location and we can check the network speed overther.
Ultrasound

Ultrasound is a powerful tool that measures the functioning of FRS replica sets by providing health ratings and historical information of these sets. The Ultrasound tool is a sophisticated monitoring system that uses Windows Management Instrumentation (WMI) providers, a data collection service, a Microsoft SQL Server Desktop Engine (MSDE) database, and a powerful user interface. To download this program, visit the following Microsoft Web site:

Robocopy
Robocopy is designed for reliable copy or mirroring of entire folders of any size, and in the copying process, ensure that all NTFS ACLS, attributes, owner information, alternate data streams, auditing information, timestamps and properties are copied except security information unless explicitly requested with /COPYALL switch.
Robocopy Examples
To use Robocopy is simple, just like how you would use Copy and Xcopy commands. For example, to copy entire folder of C:\Users to C:\UserBackup, simply type:
Robocopy C:\Users C:\UserBackup

DumpACL
Please generate a report for the Active Directory security group NA\DPYUSWAUnigraphics.  Query all folders/directories on the server DPYUSWAFPC03N2 where the security group has been granted access.

Use DumpACL to get this report
DCGPOFIX
If you are implementing changer to your policy structure and would like to revert these polices to their original settings, you can use the DCGPOFIX utility to do so.

Windows Event IDs

Event ID
Descriptions
1076
Hot shutdown server event ID for windows server 2008.
6013
System up time information
1074
The process winlogon.exe has initiated the restart of computer
1280
Nic Agents
6008
Unexpected Reboot
11728
Microsoft Operations Manager 2005 Agent -- Configuration completed successfully.
644
Account locked out. Event id
675
Bad password information
1119
Global Catalog
Event Viewer may show event ID 1119 in the Directory Service log. The Description for this event ID states that the computer is now advertising itself as a global catalog server.
1419
Infrastructure Master Rule
Event Id 1419 will be logged in event viewer when the two rules exist in the same domain controller
560, 4663
One of the file has deleted in your file server, you need to check which user has been deleted that file and which system. How do you check the event viewer?
In windows 2003 Event id is = 560
In windows 2008 Event id is = 4663

DHCP

Describe the lease process of the DHCP server?
DHCP Server leases the IP addresses to the clients as follows:
DORA
D (Discover): DHCP Client sends broadcast packets to identify the DHCP server; this packet will contain the source MAC.
O (Offer): Once the packet is received by the DHCP server, the server will send the packet containing Source IP and Source MAC.
R (Request): Client will now contact the DHCP server directly and request for the IP address.
A (Acknowledge): DHCP server will send an acknowledge packet which contains the IP address.
What is the DHCP Relay agent?
If you have routers separating some of your DHCP clients from the DHCP server you may have problems if they are not RFC compliant. This can be solved by placing a
DHCP relay agent on the local network area which is not actually a DHCP server which communicates on behalf of the DHCP Server. (The Relay agent component is live on windows 2003 Routing and Remote Access tool)
Why we want to use the conflict detection attempt our network?
Configure the DHCP server conflict detection attempts to 1
Explanation: when conflict detection attempts are set, the DHCP server uses the Packet Internet Groper (PING) process to test available scope IP addresses before including these addresses in DHCP lease offers to clients. A successful ping means the IP address is in use on the network. This results in the DHCP server not offering
To lease the address to A client.
If the ping request fails and times out, it indicates that the IP address is not in use on the network. In this case, the DHCP server offers to lease the address to a client. Each additional conflict detection attempt delays the DHCP server response by a second while for the ping request to time our. This in turn increases the load on the server. A value of no greater than two (2) is recommended for ping attempts
What is difference between scope and server options?

DHCP will manage multiple scope, each scope have different set of IP address and subnet and DNS and Gateway. If we want to supply unique DNS or WINS in our Network we can use Server Option the settings will be deploy all scope. If the scope does not require these settings, scope can use their own settings.  If conflict occurs then scope settings will be take presidency. 

Backup

What is the Archive Bit?
The archive bit is a small flag at the beginning of a file which indicates
Whether the file has changed since it was created. It’s most often used for backup programs which run on an incremental basis if the archive bit is set; the file has changed and so will be backed up. Once the file's been backed up, the archive bit is reset until you next open and change the file (for example, adding something to a Word document).
If the Archive bit is set -> the file has changed and so will be backed up.
Once the file is backed up -> the Archive bit is reset until next open and change the file.
For example: My backup plan (Sunday Normal and Monday to Saturday Differential)
1)     Sunday I am running Normal back up in my network once the files are backed up the Archive Bit is cleared which state the file has been backed up.
2)     The next to 6 days I am running differential backup (Differential backup copies files created or changed since the last normal or incremental backup. It does not mark files as having been backed up (in other words, the archive attribute is not cleared).
3)     If I need to restore the Wednesday deleted files on Thursday I need last normal back tape and Monday to Wednesday Differential back tape.
How many types backup are there in windows?
The Backup utility supports five methods of backing up data on your computer or network.
Normal backup Copies all selected files and then resets the archive bit.
A normal backup copies all selected files and marks each file as having been backed up (in other words, the archive attribute is cleared). With normal backups, you need only the most recent copy of the backup file or tape to restore all of the files. You usually perform a normal backup the first time you create a backup set.
Backing up your data using a combination of normal backups and incremental backups requires the least amount of storage space and is the quickest backup method. However, recovering files can be time-consuming and difficult because the backup set can be stored on several disks or tapes.
Backing up your data using a combination of normal backups and differential backups is more time-consuming, especially if your data changes frequently, but it is easier to restore the data because the backup set is usually stored on only a few disks or tapes.
Incremental backup Copies all selected files with the archive bit set and resets bit.
An incremental backup backs up only those files created or changed since the last normal or incremental backup. It marks files as having been backed up (in other words, the archive attribute is cleared). If you use a combination of normal and incremental backups, you will need to have the last normal backup set as well as all incremental backup sets in order to restore your data.
Differential backup Copies all selected files with the archive bit set but does not reset the bit.
Differential backup copies files created or changed since the last normal or incremental backup. It does not mark files as having been backed up (in other words, the archive attribute is not cleared). If you are performing a combination of normal and differential backups, restoring files and folders requires that you have the last normal as well as the last differential backup.
Copy backup Copies all selected files but does not rest the archive bit.
A copy backup copies all selected files but does not mark each file as having been backed up (in other words, the archive attribute is not cleared). Copying is useful if you want to back up files between normal and incremental backups because copying does not affect these other backup operations.
Daily backup Copies all selected files that were edited the day the backup was performed.
A daily backup copies all selected files that have been modified on the day the daily backup is performed. The backed-up files are not marked as having been backed up (in other words, the archive attribute is not cleared).
How many backup features are there in windows 2008 server?
1) Windows GUI backup
2) Wbadmin command line backup
3) IFM backup using Ntdsutil
NTDSUTIL
Activate Instance NTDS
IFM

Create sysvol full F:\IFM (the vol will contains Active Directory, Registry, Sysvol) we can use him when we are promoting new DC.

Sysvol

What is the SYSVOL Folder?
FRS Service is responsible for SYSVOL and DFS Replication.
The SYSVOL folder stores the server’s copy of the domain public files. The folder contains such as group policy, users etc of the sysvol folder are replicated to all domain controller in the domain. The sysvol folder must be located on the NTFS Volume.
Junction point:
 Is a physical location on a hard disk that points to data that is located elsewhere on the hard disk or on another storage device? Junction points look like folders and behave like folders but they are not folders. A junction point contains a link to another folder. When a program opens it, the junction point automatically redirects the program to the folder to which the junction point is linked
Staging Folder:
Whenever you change the GPO settings the corresponding policy folder in SYSVOL get updated and this change needs to be replicated to other replication members (Domain controller) how it’s happens? Staging folder acts like a queue for changed files and folders to be replicated to downstream partners.
FRS creates a file in staging folder by using APIs (backup application programming interfaces) based on the change and replicates to the downstream partners, downstream partners use restore APIs to reconstruct the staging files in the preinstall folder, full file get copied from staging folder to preinstall folder.
Preinstall folder :
Preinstall folder is nothing but the DO_NOT_REMOVE_NtFrs_PreInstall_Directory. Folder located under the replica root (Domain folder). Files and folders are replicated from the upstream partner staging folder. After the file or folder is completely replicated, it is renamed to its target location in the replica tree. So that partially constructed files are not visible in the replica tree
Pre-existing folder:

The pre-existing folder, named NtFrs_PreExisting___See EventLog, is an optional folder that is located under the replica root (Domain folder). It may not be available by default like others folders, If pre-existing folder is present on a replica member then mostly one of the below reasons.
• Active Directory Restore:
• SYSVOL Non-authoritative restore (also called D2):
• Server was pre-staged before it was added to the replica set
Mostly FRS moves existing data in the replica tree to the pre-existing folder and then receives the updated replica tree from one of the upstream partners and deletes the files inside the pre-existing folder after the successful completion of replication.
Policies Folder:
Policy folder contains the list of folders for each policy, if you create a new Group Policy it will create a Group policy templates folder on SYSVOL share under policy, it will contain the group policy setting related to that policy, GPT folder name would be Globally Unique Identifier (GUID) of the GPO that you created.
Scripts Folder:
Script Folder contains all the logon/logoff scripts which is used by the various policies
Monitoring Tool:
Ultrasound

Ultrasound is a powerful tool that measures the functioning of FRS replica sets by providing health ratings and historical information of these sets. The Ultrasound tool is a sophisticated monitoring system that uses Windows Management Instrumentation (WMI) providers, a data collection service, a Microsoft SQL Server Desktop Engine (MSDE) database, and a powerful user interface.
Rebuild SYSVOL using D4 and D2
How to force an authoritative (D4) good DC and non-authoritative (D2) bad DC synchronization
How to rebuild/recreate Active Directory SYSVOL and NETLOGON share... After domain controller migration from old to new you may face this problem..
Before proceed with this guide first check the health of DC by running dcdiag /q and repadmin /replsummary. If errors are not reported then proceed.
Before you begin, keep a backup of SYSVOL & NETLOGON on working DC.
Log on to working Domain Controller and Stop the File Replication Service.
Then open Registry editor (Regedit) and go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup path and modify BurFlags attribute value to D4
And Start File Replication Service
Wait for File Replication event ID 13516
Event Descriptions
"The File Replication Service is no longer preventing the comptuer DCNAME from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL."
Now log in to problematic domain controller and stop the File Replication Service.
Go to "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup" path and modify BurFlags attribute and change the value to D2
Start File Replication Service
And wait for File Replication event ID 13516

How To Know The Primary Member of A SYSVOL Replica Set?
This article explains how to determine the Primary Member of a SYSVOL Replica Set in an Active Directory domain.
The Primary Member is used by all the domain controllers to sync the SYSVOL Replica Set. The first DC in a domain is always the FRS Primary Member. This is useful when you want to perform a D4 operation on SYSVOL Replica Set.
Steps:
§  Log on to a DC.
§  Use ADSIEdit.msc snap-in
§  Navigate to the following location:
Domain NC > CN=System > CN=File Replication Service > CN=Domain System Volume (SYSVOL share) Properties
§  Go to Attribute Editor and check the attribute by name: fRSPrimaryMember

The above attribute will have the DC name on which the FRS was initially started and created the SYSVOL folder. If you ever encounter any problem and want to initate a D4/D2 operation on SYSVOL Replica Set then always use this DC as the Primary DC for D4 and other Domain Controllers as the D2. When you restart FRS, the D2 DCs will sync from the D4 DC.

What is the schema version

ü  Windows Server 2012                        56
ü  Windows 2008 R2                  47
ü  Windows 2008                        44
ü  Windows 2003 R2                  31
ü  Windows 2003                        30

ü  Windows 2000                        13

DNS 2

DNS Round Robin
DNS Round Robin is used to provide more than one IP address to a single hostname.
Each IP address represents a different physical host, and requests will be sent to each of the host in a rotation order.
Reverse NAME Resolution
Sometimes a computer needs to convert an IP address to DNS name. This conversion process is known as reverse name resolution.
The developers of the DNS created a special domain called in-addr.arpa that is specially designed for reverse name resolution.
ZONE TYPES
In windows 2003 supports 3 zones
ü  Primary zone
ü  Secondary zone
ü  Stub zone
Primary Zone:
A primary zone contains the master copy of the zone database. The database is stored in the stored in the Active Directory database.
Secondary Zone:
A secondary zone a duplicate of a primary zone on another server contains a backup copy of the primary master zone database file stored as an identical text file on the local drive. You cannot modify the resource records in a secondary zone manually you can only update them by replicating the primary master zone database file using a process called a zone transfer. You should always create at least one secondary zone from each file based primary zone in your name space to provide fault tolerance and load balance the DNS traffic load.
Stub Zone:
A stub zone is a copy of a primary zone that contains SOA and NS resource records plus the HOST (A) resource records that identify the authoritative servers for the zone
Using Active Directory Integrated Zones?
When you are running the DNS server Service on a computer that is an Active Directory domain controller and you select the zone in active directory check box when creating a zone using the new zone wizard the server does not create a zone database file instead it stores the DNS resource records for the zone in the Active Directory database.
Aging and Scavenging:
The process that can be used by window server 2003 DNS to clean up the DNS to clean up the DNS database when resource records no longer required by default it is disabled.
How to verify SRV Records?
Verifying SRV records with NSLOOKUP.
CMD > NSLOOKUP
LS –T SRV domain
LS –T A Domain
WINS – Windows Internet Name Service?
It converts NETBIOS name to IP Addresses.
DNS server converts Host name to IP address.
NetBIOS name is 16 characters
15 character – system name
1 character – service name (DNS, DHCP, DC)
Command to check a system’s NetBIOS Name
Nbtstat – N
Ipconfig –all
WINS server uses LMHOST file which contains all systems NetBIOS name and its IP addresses.
Path – C:\windows\system32\drivers\etc\lmhost.sam
When a new system is added in the network, the LMHost file should be manually updated by the system administrator. It should be created in all systems.
But DNS server is using Dynamic DNS method, when a new system is added it will update host name and IP address automatically.
What is DDNS and why do I need it?
Dynamic DNS allows servers to dynamically update and create records in DNS.
NetBIOS name max length?
The NetBIOS naming convention allows for 16 characters in a NetBIOS name.
Microsoft however limits NetBIOS names to 15 characters and uses the 16 character as a NetBIOS suffix. The NetBIOS is used by Microsoft Networking software to identify functionality on the registered device.

Windows NT is using NetBIOS? True or false details?
Yes because Microsoft networking services running on Windows NT –based computer are identified by using NetBIOS names.
Windows 2000 supports NetBIOS or not?
Yes using WINS it allows a NetBIOS name to be converted to an IP address. Therefore computers using WINS must be using NBT (NetBIOS over TCP/IP). The purpose of WINS is to allow NetBIOS name to be converted to an IP address. Therefore using wins must be using NBT (NetBIOS over TCP/IP).
What is a Zone?
Zone is collection of records.
Types of zones
Forward lookup zone (Name to IP)
 (A to PTR)
Reverse lookup zone (IP to Name)
 (PTR to A)
Zone types
Active directory integrated
Primary zone
(Which store their zone information in a writable text file on the name Server?)
Secondary zone
(Which store their zone information in a read-only text file on the name server?)
Is there any option in windows 2000 stub zone?
NO, stub zone is introduced on windows 2003 server
Net BIOS Name:
The naming mechanism that was used to refer to a computer or domain in earlier versions of windows. It consists of a 15-character name and a sixteenth character that references a service. It usually matches the DNS name.
DNS Records short notes
Host A: A record resolves form a hostname to IP address.
Pointer (PTR): PTR records resolve from an IP address to a hostname.
Start of Authority (SOA): SOA resource record specifies the information required for replication.
Service Record (SRV): A SRV records resolves from a service name to a hostname and port.
Name Server (NS): NS record resolves from a domain name to hostname.
Mail Exchange (MX): it indicates the presence of a SMTP email server.
Your network contains of a single active directory domain named contoso.com. You have a server named server1 that runs custom network applications. Server1 has the following IP address:
192.168.15.10
192.168.15.11
You need to ensure that a client computer resolves server1.contoso.com to only the 192.168.15.11 IP address. What should you do from the computer?
Edit the hosts file.
Differences between the HOSTS and LMHOSTS files in Windows NT.
In Windows NT, the HOSTS file is for TCP/IP utilities and the LMHOSTS file is for LAN manager NET utilities. If you cannot ping another computer (using friendly name), check the hosts file. If you cannot NET VIEW a server using only the tcp/ip protocol, check the LMHOSTS file.
Hosts file
The hosts file is a common way to resolve a host name to an ip address through a locally stored text file that contains ip-address-to-host-name mappings. On most unix-based computers, this file is /etc/hosts. On windows based computers, this file is the host file in the systemroot\system32\drivers\etc folder.
The following describes the attributes of the host file for windows.
1)     A single entry consists of an IP (IPV4 or IPV6) address and one or more host names.
2)     The hosts file is dynamically loaded into the DNS client resolver cache, which windows sockets applications use to resolve a host name to an ip address on both local and remote subnets.
3)     When you create entries in the hosts file and save it, its contents are automatically loaded into the DNS client resolver cache.
4)     The hosts file can be edited with any text editor.
5)     Each host name is limited to 255 characters
6)     Entries in the hosts file for windows based computers are not case sensitive.
The advantage of using a hosts file is that users can customize it for themselves. Each user can create whatever entries they want, including easy-to-remember nicknames for frequently access resources. However the individual maintenance required for the hosts file does not scale well to storing large numbers of FQDN mappings or reflecting changes to ip address for servers and network resources. The solution for the large-scale storage and maintenance of FQDN mappings is DNS. The solution for the maintenance of FQDN mappings for changing IP address is DNS dynamic update.
Not LMHOSTS file.
The lmhosts file is a local text file that maps IP addresses to NetBios names of remote servers with which you want to communicate over the TCP/IP protocol. Windows recognizes names instead of IP addresses for network requests and name discovery process is used to correctly route network requests with tcp/ip. Because the name discovery process is generally not routed by an ip router, the lmhosts file allows windows machines to communicate using tcp/ip across a subnet.
1)     LMHOSTS contains IP addresses to “NetBIOS over TCP/IP” name translations.
2)     LMHOSTS is only used by the NBT (NetBIOS over TCP/IP) interface.
3)     LMHOSTS file contains some valuable additions to the LAN manager and windows for workgroups LMHOSTS file, such as the ability to support routed domain logon validation.
4)     LMHOSTS contains static information about TCP/IP addresses , but using logon scripts and or the replicator service, the “master” file can be distributed transparently across all stations.

5)     By default the lmhosts file should be located in the directory %systemroor%\system32\drivers\etc (using c:\winnt\system32\drivers\etc)…

DNS (Domain Name System)

Note
Integrating a DNS Server Running Berkeley Internet Name Domain (BIND)
If you want to use a BIND DNS server to support Active Directory. It must be running version 8.12 or latter of the BIND software. Previous versions of BIND do not support the requirement for active directory.
How many root DNS servers are available in the world?
13 Root Servers are there.
What is DNS?
DNS stands for Domain Name System; this service is responsible for providing the hostname to IP address and IP address to hostname. DNS also interact with the AD for locate the servers that are providing the particular service to the clients.
What is the difference between DNS/WINS?
WINS and DNS are both name resolution Services.
DNS maps Hostnames to IP Address
Wins maps NetBIOS names to IP Address.
Hostnames can upto 255 characters in length by definition, while a NetBIOS name
Is a 16 byte address, the first 15 characters of your hostname plus an additional Character to identify a service?
DNS is the primary name resolution method in an Active Directory domain (2000 and
2003). Clients are configured with the address of a DNS server in their TCP/IP properties (manually or through DHCP). The clients then register their host names and IP addresses with this server, and domain controllers also register a list of the
Services that they offer (service records).Clients can then query DNS for a list of available domain controllers, or they can query DNS for the name or IP address of a PC to facilitate making a connection to it. You cannot install Active Directory without having DNS. DNS is that important...
WINS was the primary name resolution method before the introduction of Active Directory and Windows 2000. So networks that include older clients, find that they may still need to setup a WINS server on their network.
Resolving Host Names:-
On a computer running windows 2000 the table is named hosts, and it is located in the %System Root%\system32\drivers\etc folder.
What is Start of Authority (SOA)?
The SOA resource record identifies which name server is the authoritative source of information for data within this domain.
Name Server (NS):
The NS resource record identifies the name server that is the authority for the particular zone or domain.
Host (A):
The A resource records is the fundamental data unit of the DNS. This resource record has a single address field that contains the IP address associated with the system identified in the Name Field. Host resource records provide the name to IP mappings that DNS name servers use to perform name resolution.
Alias (CNAME)
The canonical name (CNAME) resource record is used to specify an alias or alternative name for the system specified in the name field. The resource record contains a single CNAME field that holds another name in the standard DNS naming format. You create CNAME resource records to use more than one name to point to a single IP address. For example you can host a file Transfer Protocol (FTP) server such as ftp.test.com and a web server such as a www.test.com on the same computer by creating an A record in the test.com domain for the host name www and a CNAME record equating the host name FTP with the A record for www.
Host Information (HINFO)
The HINFO resource record contains two fields called CPU and OS which contains values identifying the processor type and operating system used by the listed host. You can use this record type as a low-cast resource tracking tool.
Mail Exchange (MX):
A secondary but crucial function of the DNS is the direction of e-mail message to the appropriate mail server. The resource records in general use for e-mail transmission in the MX record.
The resource records contains two fields
Called Preference
The Preference field contains an integer value that indicates the relative priority of the resource records compared to other of the same type and class in the same domain the lower value higher priority. 
Exchange
The Exchange field contains the name of a computer that is capable of acting as an
E-mail server for the domain specified in the name field.
MX Record is the Main Exchanger Record. This is a service record which specifies where the mails for a particular domain are to be delivered. There can be more than one MX record for a given Domain. This is to have one or more backup servers to which the mails can be delivered in the event the default server has failed for some reason. The MX records have a field for Priority number. This is mainly to specify which is the first server to which a Domains emails should be delivered and which falls next in the queue in the event the 1st server is down and thereon. The server which has the lowest priority number will be the default server to which the mail is delivered. The next lower priority server will be the 1st backup and the next the 2nd backup server and so on. CNAME Syntax: Itsyourip.com. IN MX 0 mail.pcsupport.x-host.uni.cc Where, IN indicates Internet MX indicates the Mail Exchanger Record The above indicates that mails for itsyourip.com are being delivered to the server mail.pcsupport.x-host.uni.cc. Wilcards can be used in the MX records to allow mails for all the hosts to be delivered to a particular host. For example, *. Itsyourip.com. IN MX 0 mail.pcsupport.x-host.uni.cc indicates that all emails for all the hosts (or sub domains) of itsyourip.com will be delivered to mail.pcsupport.x-host.uni.cc
Pointer (PTR)
The PTR resource record is the functional opposite of the A record providing an IP to Name mapping for the system identified in the name field using the in-addr-arpa domain name.
The PTR resource record contains a single PTR Name field which contains the FQDN of the system identified by the IP address in the name field.
When you create the appropriate reverse lookup zone on your DNS server you can create PTR resource records automatically with you’re A records.
Service (SRV)
The service resource (SRV) record enables clients to locate servers that are providing a particular service.
Name Caching
The other mechanism that speeds up the DNS name resolution process is name caching. Most DNS server implementation a cache of information they receive from other DNS servers.
Recursive vs. Iterative Queries
Contrasting Iterative and Recursive Queries:
         To help explain the difference between these methods, let’s take a slide trip to a real world case. Suppose you are trying to find phone number of your old friend carol, with whom you have not spoken in years, you call your friend Joe; he does not have carol’s number, but he gives you John’s number, suggesting you call him. So you dial up john; he does not have the information but he knows the number of carol’s best friend, Debbie, and gives that to you. You call Debbie and she gives you carol’s information. This is an example of an Iterative process. In contrast, suppose you called Joe and Joe said,” I’ don’t know, but I think I know how to find out”. He called John and Debbie and called you back with phone number. That would be like Recursive Resolution.
Key Concept:- 
   The two method of Name resolution in DNS are Iterative resolution and recursive resolution in Iterative resolution. If a client sends a request to a name server that does not have the information the client needs, the server returns a pointer to a different name server and the client sends a new request to that server.
    In recursive resolution, if a client sends as request to a server that does not have the requested information, that server takes on the responsibility for sending requests to other servers to find the necessary records the returns them to the client. A server doing this takes on the role client for its requests to other servers.

Recursive query
Ask server to get answer for you
E.g., request 1 and response 8
Iterative query
Ask server who to ask next

E.g., all other request-response pairs

Kerberos

Explain Kerberos V5 authentication process?
Kerberos V5 is the primary security protocol for authentication within a domain. The Kerberos V5 protocol verifies both the identity of the user and network services. This dual verification is known as mutual authentication.
Kerberos Authentication in an Active Directory Domain
In an Active Directory domain, a protocol called Kerberos is used to authenticate identities. When a user or computer logs on to the domain, Kerberos authenticates its credentials and issues a package of information called a Ticket Granting Ticket (TGT). Before the user connects to the server to request the document, a Kerberos request is sent to a domain controller along with the TGT that identifies the authenticated user. The domain controller issues the user another package of information called a Service Ticket that identifies the authenticated user to the server. The user presents the Service Ticket to the server accepts the service ticket as proof that the user has been authenticated.

These Kerberos transactions result in a single network logon. After the user or computer has initially logged on and has been granted a TGT, the user is authenticated within the entire domain and can be granted service tickets that identify the user to any service. All of this ticket activity is managed by the Kerberos clients   and services built into windows and are transparent to the user.

DFS

What is DFS?
DFS expansions is Distributed File System
We can access multiple share folders which located on different file servers into single name space.
And it is providing and load balancing and data availability
FRS service is responsible for DFS replication. 
What is DFS & its usage
DFS is a distributed file system used to provide common environment for users to access files and folders even when they are shared in different servers physically.
There are two types of DFS domain DFS and Stand alone DFS. We cannot provide redundancy for standalone DFS in case of failure. Domain DFS is used in a domain environment which can be accessed by /domain name/root1 (root 1 is DFS root name). Stand alone DFS can be used in workgroup environment which can be accessed through /server name/root1 (root 1 is DFS root name). Both the cases we need to create DFS root (Which appears like a shared folder for end users) and DFS links (A logical link which is pointing to the server where the folder is physically shared)
ü  The maximum number of Dfs roots per server is 1.
ü  The maximum numbers of Dfs root replicas are 31.
ü  The maximum number of Dfs roots per domain is unlimited.

ü  The maximum number of Dfs links or shared folders in a Dfs root is 1,000

Group Policy Object 2

If more than one GPO is linked to an active directory container, which policy will take precedence?
If more than one group policy object is linked to an active directory container object, GPOs are processed from the BOTTOM to TOP as they are listed on the GPO tab in the properties dialog box. Again where there is a conflicting in setting the last setting applied becomes the effective settings.
Organization Unit limitation?
Microsoft recommends as OU structure that is not more than 10 top levels deep increasing the number of nested relationships adds to the complexity of permission and group policy inheritance.
Domain controllers group policy refresh interval:
By default, domain controller group policies are update in the background every 5 minutes.
Loopback Policy
Windows Server: Understand “User Group Policy Loopback Processing Mode”
Refer the below Link.
Group Policy Object (GPO) is a set of rules for users and computers, thus the policies for computers will be applied to computers and the polices for users will be applied to users.
Let’s assume that you have two organizational units in your domain.
OU – TSSERVERS
OU – Support
In OU – TSSERVERS units, there are computer accounts and in the OU-Support units are user’s accounts.
In OU-TSSERVER, you created and configured a new GPO, so there are policies for
Computer Configuration
User Configuration
In OU-Support, you created and configured a new GPO. So, there are polices for :
Computer Configurations
User Configurations
When a user belonging to OU-Support logs on a server that belongs to the OU-TSSERVER, what happens?
Apples:
Computer Configuration -> the configuration created in the GPO linked to OU-TSSERVER.
User Configuration -> The configuration created in GPO linked to OU-Support.
This is the default settings:
Now we are finally going to learn about User Group Policy Loopback Processing Mode.
When configuring the Policy Loopback Processing Mode, you can choose two different options, Replace and Merge.
Replace Mode:
When you define the “User Group Loopback Processing Mode”, to “Replace” on the GPO linked to the OU-TSSERVER.
Applies:
Computer Configuration -> The Configuration created in GPO linked to OU-TSSERVER.
User Configuration -> The Configuration created in GPO linked to OU-TSSERVER (This is the difference in replace mode)
Merge Mode:
When you defined the “User Group Loopback Mode”, to “Merge” on the GPO linked to the OU-TSSERVER.
Applies:
Computer Configuration -> The configuration created in GPO linked to OU-TSSERVER.
User Configuration -> The configuration created in GPO linked to OU-TSSERVER.
And
User Configuration -> The Configuration created in GPO linked to OU-Support.
 (This is the difference in Merge Mode).
Note: In case of conflict, the user polices from OU-TSSERVERS have precedence, because the computer’s GPO is processed after the user’s GPOs, they have precedence if any of the settings conflict.
Why is this configuration important to me?
Use this configuration if you have users in your domain whose folders are redirected through policy, but you don’t want that redirect to occur when users log on through Terminal Services.
You need to enable this policy setting using the Replace mode on GPO linked to OU, where the Terminal Server's computer accounts are (without folder redirection enabled). When users log on to Terminal Servers, the policy folder redirection is not applied.
To enable “Loopback processing Mode”
Using Group Policy Management Console, edit the GPO you desire, expand Computer Configuration\Policies\Administrative Templates\System\Group Policy,
and then double-click User Group Policy Loopback Processing Mode.
Then select the appropriate option (Replace or Merge).

Group Policy checking in client systems using help and supports

ü  Help and Supports
ü  System Administration
ü  See Allso
ü  Tools
ü  Advanced System Information
ü  View Group policy settings applied
Group Policy Backup?
Step-1
ü  Tools
ü  Administration Tools
ü  Group Policy Management Console
Step -2
ü  View
ü  Options
ü  Columns
ü  Table Location
ü  Here you choose
ü  Group Policy Objects
ü  OK
Step -3
ü  Group Policy Management Console
ü  Forest: Domain
ü  Domain
ü  Domain.com
ü  Group Policy Objects (Locate)
ü  Right Click Group Policy Objects
Step -4
Backup – All (If you want to take backup)
Step -5

Manage Backup (Use this for restore GPO)