Below I’ve pasted an edited and cleaned up copy of most of the Q&A from today’s webcast on Active Directory Fundamentals. 

HUGE thank you to Chris Henley, John Baker, John Weston for handling the Q&A on the back-end, and who’s work this really represents.

Also – here is the resource page I put together for this topic also.

-Kevin

—

Questions and Answers:

"Where can I find a step by step guide to setup this on my network?"

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/default.mspx
is the best place to start for step by step guides

"One thing I did not understand is which machine do you use to manage the active directory. Is it a seperate server which has access to all machines on network?"

You can manage AD from any DC or any workstation or server that has the Adminpak installed and has access to a DC. http://www.microsoft.com/downloads/details.aspx?familyid=c16ae515-c8f4-47ef-a1e4-a8dcbacff8e3&displaylang=en

"Doesn't the OU security customization defeat the overall purpose of AD? restriction vs. transitive trust?"

Good Question. The OU customization does not defeat the purpose because of the heirarchical structure of AD. Each Level of OU structure can provide the benefits of inheritance and granular control for security purposes while the trust relationships can provide access at the forest and domain levels above.

"What are the differences between OU's and Containers?"

An organizational unit is a heirarchical object component of Active Directory while a container is simply a holding area for objects until we decide which OU they should be a part of. 
Another benefit of OUs over Containers is that OUs can have policy (Group Policy) applied to them; containers can not.  And you can delegate administration to OUs, but not to containers.

"Where can I download the GPMC?"

http://www.microsoft.com/downloads/details.aspx?FamilyID=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887&DisplayLang=en

"So we might have objects that reside both in OU's and Containers or can they be present only in one of these at any point in time ?"

Object can only reside in ONE OU or container at any time. It can't exist in both places.

"Is the extention .com required or necessary in AD naming? Is .you or .org allowable? .com implies an HTTP protocol, doesn't it?"

There are several schools of thought on this.  The reality of it is that there is no restriction on what you use for your AD domain names.  Many companies use their DNS namespace as a part of their AD domain name root.  For example, Contoso might have Contoso.com as their external domain space for their WWW site and other applications, but internally they may have "corp.Contoso.com" as the root of their Active Directory namespace. 

"Is there a way to get a report on who is in which OU?"

I think you'd have to create a custom script. Check this link for scripts for managing OU's http://www.microsoft.com/technet/scriptcenter/scripts/ad/ous/default.mspx

"Back to group policy for a moment... I understand distributing software packages via the AD infrastructure is also supported. What are the possible deployment targets? Only OUs, or can these packages be targeted at single users or computers, or the entire domain?"

Group Policy can be applies at 3 levels. Sites, Domains, or OU's. When planning software deployments generally we deploy them to the OU level. It is possible to filter group policies so that only a single user or group of users receive the software you are deploying.

"I just missed the part of how to create the active directory, can you give the direction?"

Active directory can be installed by using the "dcpromo" command from a command line.

"AD replication site need ports ???"

Check this link and scroll down to Active Directory Communication http://www.microsoft.com/technet/prodtechnol/exchange/DE/Guides/E2k3FrontBack/f9733398-a21e-4b40-8601-cfb452da82ad.mspx?mfr=true

"There's a minimal number of DNS server that I must have in my infraestructure, or only one by domain is the recommended ?"

The minimum number of DNS servers necessary to allow active directory to function is 1. Depending on the structure and connectivity of your organization you might implement any number of strategies to supply DNS resolution for Active Directory. There is no specific rule on number of DNS servers per domain.

"What kind of objects can dynamically register in DNS?"

Forests, Domains, and computers from the active directory. Other services might also register such as the Kerberos Key distribution Center.

"What is a cost value?"

A site link is a connection object between two or more sites. A site link allows the administrator to assign cost, a replication schedule, and a transport for replication. Cost is an arbitrary value selected by the administrator to reflect the relative speed and reliability of the physical connection between the sites; the lower the cost, the more desirable is the connection. See link and scroll to "Site Links" http://www.microsoft.com/technet/archive/windows2000serv/technologies/activedirectory/deploy/adguide/adplan/adpch03.mspx?mfr=true

"Is there a way to assign static IPs to workstations through AD or GPOs?"

No, how would the machine be able to get GPO if is didnt already have an IP address?  You need to do this using DHCP.
Another option, though a bit odd (not sure why you would need to do this) would be to use a WMI script - maybe as part of the startup or login script.  You can use WMI commands to configure the NIC.  But.. again, the first time it's run you'd have to first have it dynamically get an address, then the script could launch to reset it to a static address. 

"Can you give a typical rule of thumb figure in bps of how much BW is used for intersite replication?"

It really depends on the number of changes that are made at each individual site and the replication interval between the sites. There is really no standard figure.

"Can users and computers be migrated from one domain to another?"

Yes. 

"Has anything changed around Active Directory in Vista? Is there anything to mention about any of the following scenarios? (1) Connecting Vista clients to Win2k3 DCs (2) Connecting XP/Win2k3 clients to Vista Server DCs (3) Connecting Vista clients to Vista Server DCs.”

Watch some of the great webcasts on Windows Vista that are currently available on the webcast archives, or in up-coming webcasts.

"Is the KCC automatically run or is there some manual process that needs to occur there?"

Automatic.

“Is there a ‘best practices’ guide on how to audit Active Directory?”

I would use the active directory deployment guides here http://www.microsoft.com/windowsserver2003/technologies/directory/activedirectory/default.mspx

"Thanks Kevin - Great talk! Although not necessarily within the scope of the talk, I do have some additional questions around how flexible the software deployment options are through Active Directory. Are there ways to deploy things other than single MSI packages? What are .ZAP files, and what does AD do with them?"

As promised, here are some software deployment resources for you:
Using Active Directory -
http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/instmain.mspx
Using Microsoft Systems Management Server 2003 (SMS 2003) -
http://www.microsoft.com/smserver/evaluation/capabilities/appdeploy.mspx

"I'm running classrooms and a lab in an elementary school, and wanadd a file server. Do I lose anything if I don't use Active Directory?"

I guess it depends on how you're handling authentication for the sake of securing the files or other resources. If you're okay with leaving things wide open, then you're fine. If you're only managing a few computers, then doing peer-to-peer authentication is okay. But any more resources than that become difficult to manage without some central directory. I highly recommend you look at Small Business Server 2003.

"What are the core differences between Win2k and Win2k3 AD features based on today's presentation?"

GREAT question.  Here's a really good "What's new" chat, with additional links to resources that should make it pretty clear: http://www.microsoft.com/technet/community/chats/trans/windowsnet/wnet0630.mspx

—

Kevin’s Webcast Resources:

Active Directory Fundamentals

Here are some resources relating to the webcast topic presented.  I hope you find them useful.

Kevin

Announced at WinHEC 2006…

Microsoft made some big announcements about our Virtualization product road map yesterday at WinHEC 2006.  (I’m sorry I wasn’t able to get the news out about it sooner, but was busy attending and presenting at a seminar in St. Louis.)  Two products and an acquisition were announced:

• Windows Server Virtualization
• Microsoft System Center Virtual Machine Manager (SCVMM)
• Acquisition of Softricity, Inc

Windows Server Virtualization is the “hypervisor” you may have heard something about.  It’s a thin layer of virtualization that will be optimized for 64 bit environments using the new virtualization support in the newer Intel and AMD processors. 

“Wait a second, Kevin.  I thought Virtual Server 2005 R2 SP1 was going to also take advantage of the ‘virtualization support’ in the new processors?”

True.  It will.  (Expect to see a free beta of Virtual Server 2005 R2 SP1 soon).  But as opposed to Virtual Server 2005 R2, which is software running on top of the host OS, Windows Server Virtualization is a thin layer that allows multiple OS’s to be managed and run more efficiently, running under a thin, optimized version of “Longhorn” Server.  It will support the same .VHD disk format (so you can move easily to it when it arrives, and will support 64bit guest OS’s as well.  We expect to release it around the time “Longhorn” Server is released.

The Virtual Machine Manager is “a centralized, enterprise management solution for the virtualized data center, to meet the growing customer need for improved physical hardware utilization.”  (When I can’t say it better, I quote the press release.)  The tool is to be a part of the System Center family of tools, and will integrate nicely into that suite for the sake of centrally managing your virtual machines running on both Virtual Server 2005 R2 and Windows Server Virtualization.  Expect to see a beta of this product in a couple months.

The intent to acquire Softricity, Inc. comes from a desire to support something called “virtualized applications”. 

“Huh?”

That’s what I said at first, too.  Think about it this way: In Virtual PC or Virtual Server you virtualize entire machine OS installations by putting a virtualization layer in place to make an OS installation think it’s installed and running on it’s own machine, right?  Now take that layer up one level and instead let’s just do that for the applications and services that run on an OS – let them think that they’re installed and running on your OS, when in reality they’re being hosted in a way that doesn't actually have them installed or potentially conflicting with other applications or services.   

“My head hurts.”

Yeah.. mine too.  And add to that the capability to serve up those applications now from a central server instead.  “On-Demand Application Streaming”.  I can’t wait to play with it.  It has some really cool potential.  Apparently it was demonstrated during Bob Muglia’s keynote at the Microsoft Management Summit, so I’m going to watch the recording of his keynote to check it out.

Today, if I weren’t going to be on a plane home, I’d be watching Bill Gate’s keynote being broadcast from WinHEC 2006.  (It’ll be recorded, so I’m sure I’ll see it later.)

Wondering about Windows Desktop Search?

Wonder no more!

My friend and “cow-orker”** Matt “Mongo” Hester has created a very detailed, beautifully done screencast all about how it works and what it does for you.

He’s also in the process of submitting an article to a magazine about this.  I’ll let you know when it’s available.

Do you use a desktop search engine?  Are you going to install it after you view his video? 

**Extra points if you can comment here on where the “cow-orker” reference comes from. 

Windows Media Player 11 Beta

Yes, you can download the beta of Windows Media Player 11.  This is the version that will ship in Windows Vista, as well as be available for other OS’s.

Along with this, you can try out a new music service called URGE from the MTV folks. 

I just learned about a feature that is coming in Microsoft Word 2007 (part of the 2007 Office System) that has me pretty excited. And I asked permission to post this to my blog today.  The feature will be seen for the first time (although incomplete) in the soon-to-be-released “beta 2” of 2007 Office.

Would you like to post to your blog right from Word?  Well… who wouldn’t?

That’s what you can do now. In fact, I’m recording a screencast even as I make this post, showing exactly how it’s done.

Check back here for a link to view the recording of my quick-and-dirty-demo.

—

UPDATE: Here is the video containing my quick-and-dirty demo.

After I do a live TechNet Event, Microsoft Campus Connection Event, or TechNet Webcast, and the content has contained something about the new products coming out, the one question I’m asked the most is, “How do I get the beta?”

“Okay.. so how do I get the beta?”

Well, the best way of course is a TechNet Plus subscription.  That will include having betas sent directly to you.  But another way to keep tabs on what is new and available is to subscribe to the TechNet Flash e-mail newsletter.  This page here gives you the details and steps to take for signing up, so you’ll get the word when a new beta or CTP (Community Technology Preview) is available for you.

And.. I don’t think I will get in trouble telling you this - but I’m running an “escrow build” – a build that is in it’s final stages of being tested for beta release – of Windows Vista Beta 2.  It’s “flippin’ sweeet!”

Live Event Resources

For the past year or so I’ve gotten into the habit of typing out my live event and webcast resources, and making them available to my event attendees.  The response has been overwhelmingly positive.  And this quarter is no exception.  This time around, though, the document is HUGE!

Still, I’m printing them out and will bring them to my Des Moines and St. Paul events next week.  And for those of you who do NOT want to type in URLs, you can do directly to the document here.

“What are you guys covering this time?”

I’m glad you asked!  Here is the description of our three sessions.  (More details, dates, times, and places can be found at http://www.technetevents.com.)

Take Charge of Your Security with TechNet Events

Your customers are being bombarded with attacks and your boss wants to know what you’re going to do about it. What now? Join the TechNet Events team as we show you how to securely deploy and assess a wireless network – despite the existing threats. You’ll leave these must-see sessions armed and ready to deal with the bad guys. TechNet Events are your free, local ticket to the best IT information available. We’re talking solid technical resources that you can put into practice today.

Session 1: Implementing Security for Wireless Networks
• How to securely configure a WLAN using password authentication
• The 802.xx standard and the differences between PEAP, WPA and WEP
• Existing threats to wireless security

Session 2: Responding to Computer Attacks
• How to manage the most common security incidents
• How to detect, trace and assess network intrusions
• How to create and implement an incident response team

Session 3: What’s Next for Microsoft® Security?
• Microsoft’s new security innovations, such as Windows Defender
• Upcoming security products, services and technologies
• Where we’re headed next in the battle against security breaches

Be empowered!  Be secure!

-Kevin

Below I’ve pasted an edited and cleaned up copy of most of the Q&A from today’s webcast on Tools and Techniques for Managing a Windows Vista Desktop Deployment (Level 200)

HUGE thank you to John Baker, Kai Axford, and John Weston for handling the Q&A on the back-end, and who’s work this really represents.

-Kevin

—

Questions and Answers:

“Can event-triggered tasks such as defrag be enforced to an enterprise via Group Policy?”

There are about another 1700 policies available for Vista, I'm not sure that that is one of the additional settings. Check this link for more info http://www.microsoft.com/technet/windowsvista/library/gpol/a8366c42-6373-48cd-9d11-2510580e4817.mspx?mfr=true

“What is the size of the Virtual Store? Does it change in size dynamically?”

It is dynamic.

“Had to answer my phone, can you recap the process if a document is left open, and the system tries to patch?”

The system will get patched and the application will be reopened to the document it was on when the patch was installed.

“Does the application save and restore work with vista aware applications or all apps?”

As long as the apps use a common an documented response to commands for closing and saving un-saved work, then the app will be supported by this.

“Does imaging similar to norton ghost? or is it different?”

It is file based rather than sector based.

“They said that the users credentials were not stored on the system but rather on the Active Drectory domain... which is great until a laptop user needs to travel with their system. At that point would the credentials need to be transfered to the laptop?”

My understanding is that they are stored in both locations, so that you can easily recover them...sorta like EFS keys

“If I delete an AD account accidently, what's the best way to recovery it in Vista or in W2K3?”

The easiest way would be to be darned sure you WANT to delete before you do...other than that you're looking at doing a authoritative restore, since the change will be replicated to all the DCs.

“Does this mean that you don't need a third party tool for file images?  Vista does it all?”

Ximage and the .wim file format should be all you need.  You’ll download, install, and use the WAIK (Windows Automated Installation Kit) tools, which includes ImageX and the Windows Image System Manager (replaces Setup Manager).  See http://www.microsoft.com/technet/windowsvista/expert/ximage.mspx

“Can the image based installation be used for all processes, including lite touch, no touch, etc.?”

Check http://www.microsoft.com/technet/windowsvista/expert/ximage.mspx  You have several options, e.g. the WIM image format also lets you store multiple images within one actual file.

“Will this system be able to be used with RIS or will RIS images? Or will I have to reimage my older machines with this new system?”

Windows Deployment Services (WDS). WDS is the next version of Microsoft Remote Installation Services (RIS). WDS provides for the storage, management, and deployment of images. It uses the PXE boot process to install the operating system, including bare-metal installations.

“Is it already clear if the tool will be called ImageX or XImage?”

I don't think that has been finialized yet. Notice Kevin's slides have been updated to imagex, but the build he is using 5326, still calls the command ximage.

(Note: I also actually just copied the ximage.exe file and renamed it imagex.exe, just to be in-line with what the more current builds and information about the name have said. 
–Kevin)

“May be a stupid question, but will Vista still run on NTFS?”

Yes it will.  More info here: http://www.microsoft.com/whdc/device/storage/LocFileSys.mspx great whitepaper

“Where/how can I get WDS?”

Check http://www.microsoft.com/technet/windowsvista/deploy/depenhnc.mspx

“Ok that link is info, which is good but is WDS currently avaiable or is it something that will be available in the future?”

I thought there was a link in there... this one has the info http://www.microsoft.com/technet/windowsvista/library/88f80cb7-d44f-47f7-a10d-e23dd53bc3fa.mspx#BKMK_3

“Will SMS OSD and Vista be able to use the same WIM files in the near future?”

SMS 4.0 (now named “System Center Configuration Manager”) OSD will be able to use the .wim format.

“Sorry, I must have missed something, but how was install.win created?”

You didn't miss anything, for speed of demo, we have used a pre-created install.wim  It was captured from a running copy of Vista with the ximage /capture command.

“Can you use the technology being discussed to deploy Windows XP SP2 or Server 2003?”

You certainly can capture and restore images, but I don’t know if you’ll be able to use System Image Manager to further tweak the installation using the unattend.xml file.  I haven’t heard anything about that yet.

“When will the Windows System Image Manager be ready for downloading. Will it ready for download when Visat Beta is ready.”

I don't know if it will be out at the same time as the next Beta.  I certainly hope so.

“Do I need to pay anything to become a beta tester of vista?”

Current TechNet Plus or MSDN subscribers get the current beta, but you can sign up for future beta's here: http://www.microsoft.com/technet/prodtechnol/beta/preregister.mspx

“Will the SID change automatically or does it need to be scripted to change in a deployment?”

You'll still need to do SysPrep to remove SIDs prior to taking an image.

“Is there a document yet that lists all the steps for deployment in some detail that were covered in this webcast? I'm looking for a sort of roadmap to plan create and deploy a Vista image from scratch and then transfer users settings?”

Best place I know to send you is: http://www.microsoft.com/technet/windowsvista/deploy/default.mspx

“If files with different names but the same hash value exist, will it conserve space and not copy duplicates of those as well? Instead rename them appropriately when deploying?”

No.. I don't think it is THAT smart. I'm not 100% sure, but I think it's based on the name AND a hash. I'll double-check though.

“Ok a simple question regarding deployment. Is WDS downloadable? What do I need to do to get a copy of the software to use?”

I don't know when it's going to be available.  I know you'll be able to run it from Windows Server 2003 as well as Longhorn Server, but when it will be available I just don't know. You can, however, count on it being a free tool.

“The last couple of CTP releases have required a 14G boot disk. The is over 7 time the requirement of Windows XP. Is there a repartitioning tool provided for deployment to repartition a disk to be large enough to upgrade from xp to Vista?”

Not that I'm aware of, no.

“Is it possible to encrypt the local admin password in the unattend.xml”

No, it's not. You're best bet is to use Group Policy to apply a new password for that account so that it will be applied after it's first come up. That password is protected.

—

Here is my blog resource page for this session again:
http://blogs.technet.com/kevinremde/archive/2006/05/03/426928.aspx

Kevin’s Webcast Resources:

Tools and Techniques for Managing a Windows Vista Desktop Deployment (Level 200)

Here are some resources relating to the webcast topic presented.  I hope you find them useful.

Kevin