Windows Server 2003 Active Directory and Security Questions: February 3, 2010
Windows Server 2003 Active Directory and Security Questions: February 3, 2010
What does IntelliMirror do? It helps to reconcile desktop settings, applications, and stored
files for users, particularly those who move between workstations or those who must periodically
work offline.
What’s the major difference between FAT and NTFS on a local machine? FAT and
FAT32 provide no security over locally logged-on users. Only native NTFS provides extensive
permission control on both remote and local files.
How do FAT and NTFS differ in approach to user shares? They don’t, both have support
for sharing.
Explan the List Folder Contents permission on the folder in NTFS. Same as Read &
Execute, but not inherited by files within a folder. However, newly created subfolders will
inherit this permission.
I have a file to which the user has access, but he has no folder permission to read it. Can
he access it? It is possible for a user to navigate to a file for which he does not have folder
permission. This involves simply knowing the path of the file object. Even if the user can’t drill
down the file/folder tree using My Computer, he can still gain access to the file using the
Universal Naming Convention (UNC). The best way to start would be to type the full path of a
file into Run… window.
For a user in several groups, are Allow permissions restrictive or permissive?
Permissive, if at least one group has Allow permission for the file/folder, user will have the same
permission.
For a user in several groups, are Deny permissions restrictive or permissive? Restrictive,
if at least one group has Deny permission for the file/folder, user will be denied access,
regardless of other group permissions.
What hidden shares exist on Windows Server 2003 installation? Admin$, Drive$, IPC$,
NETLOGON, print$ and SYSVOL.
What’s the difference between standalone and fault-tolerant DFS (Distributed File
System) installations? The standalone server stores the Dfs directory tree structure or topology
locally. Thus, if a shared folder is inaccessible or if the Dfs root server is down, users are left
with no link to the shared resources. A fault-tolerant root node stores the Dfs topology in the
Active Directory, which is replicated to other domain controllers. Thus, redundant root nodes
may include multiple connections to the same data residing in different shared folders.
We’re using the DFS fault-tolerant installation, but cannot access it from a Win98 box.
Use the UNC path, not client, only 2000 and 2003 clients can access Server 2003 fault-tolerant
shares.
Where exactly do fault-tolerant DFS shares store information in Active Directory? In
Partition Knowledge Table, which is then replicated to other domain controllers.
Can you use Start->Search with DFS shares? Yes.
What problems can you have with DFS installed? Two users opening the redundant copies
of the file at the same time, with no file-locking involved in DFS, changing the contents and then
saving. Only one file will be propagated through DFS.
I run Microsoft Cluster Server and cannot install fault-tolerant DFS. Yeah, you can’t.
Install a standalone one.
Is Kerberos encryption symmetric or asymmetric? Symmetric.
How does Windows 2003 Server try to prevent a middle-man attack on encrypted line?
Time stamp is attached to the initial client request, encrypted with the shared key.
What hashing algorithms are used in Windows 2003 Server? RSA Data Security’s
Message Digest 5 (MD5), produces a 128-bit hash, and the Secure Hash Algorithm 1 (SHA-1),
produces a 160-bit hash.
What third-party certificate exchange protocols are used by Windows 2003 Server?
Windows Server 2003 uses the industry standard PKCS-10 certificate request and PKCS-7
certificate response to exchange CA certificates with third-party certificate authorities.
What’s the number of permitted unsuccessful logons on Administrator account?
Unlimited. Remember, though, that it’s the Administrator account, not any account that’s part of
the Administrators group.
If hashing is one-way function and Windows Server uses hashing for storing passwords,
how is it possible to attack the password lists, specifically the ones using NTLMv1? A
cracker would launch a dictionary attack by hashing every imaginable term used for password
and then compare the hashes.
What’s the difference between guest accounts in Server 2003 and other editions? More
restrictive in Windows Server 2003.
How many passwords by default are remembered when you check "Enforce Password
History Remembered"? User’s last 6 passwords.
What secure authentication and encryption mechanisms are supported by IIS 6.0?
Basic authentication, Digest authentication, Advanced digest authentication, Certificate-based
Web transactions that use PKCS #7/PKCS #10, Fortezza, SSL, Server-Gated Cryptography,
Transport Layer Security
What’s the relation between SSL and TLS? Transport Layer Security (TLS) extends SSL
by providing cryptographic authentication.
What’s the role of http.sys in IIS? It is the point of contact for all incoming HTTP requests.
It listens for requests and queues them until they are all processed, no more queues are available,
or the Web server is shut down.
Where’s ASP cache located on IIS 6.0? On disk, as opposed to memory, as it used to be in
IIS 5.
What is socket pooling? Non-blocking socket usage, introduced in IIS 6.0. More than one
application can use a given socket.
Describe the process of clustering with Windows 2003 Server when a new node is
added. As a node goes online, it searches for other nodes to join by polling the designated
internal network. In this way, all nodes are notified of the new node’s existence. If other nodes
cannot be found on a preexisting cluster, the new node takes control of the quorum resources
residing on the shared disk that contains state and configuration data.
What applications are not capable of performing in Windows 2003 Server clusters? The
ones written exclusively for NetBEUI and IPX.
What’s a heartbeat? Communication processes between the nodes designed to ensure
node’s health.
What’s a threshold in clustered environment? The number of times a restart is attempted,
when the node fails.
You need to change and admin password on a clustered Windows box, but that requires
rebooting the cluster, doesn’t it? No, it doesn’t. In 2003 environment you can do that via
cluster.exe utility which does not require rebooting the entire cluster.
For the document of size 1 MB, what size would you expect the index to be with
Indexing Service? 150-300 KB, 15-30% is a reasonable expectation.
Doesn’t the Indexing Service introduce a security flaw when allowing access to the
index? No, because users can only view the indices of documents and folders that they have
permissions for.
What’s the typical size of the index? Less then 100K documents - up to 128 MB. More
than that - 256+ MB.
Which characters should be enclosed in quotes when searching the index? &, @, $, #, ^,
( ), and |.
How would you search for C++? Just enter C++, since + is not a special character (and
neither is C).
What about Barnes&Noble? Should be searched for as Barnes’&’Noble.
Are the searches case-sensitive? No.
What’s the order of precedence of Boolean operators in Microsoft Windows 2003
Server Indexing Service? NOT, AND, NEAR, OR.
What’s a vector space query? A multiple-word query where the weight can be assigned to
each of the search words. For example, if you want to fight information on ‘black hole’, but
would prefer to give more weight to the word hole, you can enter black[1] hole[20] into the
search window.
What’s a response queue? It’s the message queue that holds response messages sent from
the receiving application to the sender.
What’s MQPing used for? Testing Microsoft Message Queue services between the nodes
on a network.
Which add-on package for Windows 2003 Server would you use to monitor the installed
software and license compliance? SMS (System Management Server).
Which service do you use to set up various alerts? MOM (Microsoft Operations Manager).
What languages does Windows Scripting Host support? VB, VBScript, JScript.
7 :: Where are the Windows NT Primary Domain Controller (PDC) and its
Backup Domain Controller (BDC) in Server 2003?
The Active Directory replaces them. Now all domain controllers share a multimaster
peer-to-peer read and write relationship that hosts copies of theActive Directory.
8 :: How long does it take for security changes to be replicated among the
domain controllers?
Security-related modifications are replicated within a site immediately. These
changes include account and individual user lockout policies, changes to password
policies, changes to computer account passwords, and modifications to the Local
Security Authority (LSA).
(1) Kerberos and NTLM network logon for remote access to a server in another
forest;
(2) Kerberos and NTLM interactive logon for physical logon outside the user’s home
forest;
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 6
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
Abstract class:
Abstract classes are so named because they take the form of templates that
actually create other templates (abstracts) and structural and auxiliary classes.
Think of abstract classes as frameworks for the defining objects.
Auxiliary class:
The auxiliary class is a list of attributes. Rather than apply numerous attributes
when creating a structural class, it provides a streamlined alternative by applying a
combination of attributes with a single include action.
88 class:
The 88 class includes object classes defined prior to 1993, when the 1988 X.500
specification was adopted. This type does not use the structural, abstract, and
auxiliary definitions, nor is it in common use for the development of objects
inWindows Server 2003 environments.
user and related group SIDs together form the user account’s security token, which
determines access levels to objects throughout the system and network.
SIDs from the security token are mapped to the access control list (ACL) of any
object the user attempts to access.
17 :: If I delete a user and then create a new account with the same
username and password, would the SID and permissions stay the same?
No.
If you delete a user account and attempt to recreate it with the same user name
and password, the SID will be different.
19 :: Anything special you should do when adding a user that has a Mac?
"Save password as encrypted clear text" must be selected on User Properties
Account Tab Options, since the Macs only store their passwords that way.
21 :: Where are the documents and settings for the roaming profile
stored?
All the documents and environmental settings for the roaming user are stored
locally on the system, and, when the user logs off, all changes to the locally stored
profile are copied to the shared server folder. Therefore, the first time a roaming
user logs on to a new system the logon process may take some time, depending on
how large his profile folder is.
22 :: Where are the settings for all the users stored on a given machine?
\Document and Settings\All Users
To position windows server 2003 more competitively against other web servers,
Microsoft has released a
stripped-down-yet-impressive edition of windows server 2003 designed specially for
web services. the feature set and licensing allows customers easy deployment of
web pages, web sites, web applications and web services.
Web Edition supports 2GB of RAM and a two-way symmetric multiprocessor(SMP). It
provides unlimited anonymous web connections but only 10 inbound server
message block(SMB) connections, which should be more than enough for content
publishing. The server cannot be an internet gateway, DHCP or fax server. Although
you can remotely administer the server with Remote Desktop, the server can not be
a terminal
server in the traditional sense. The server can belong to a domain, but cannot be a
domain controller. The included version of the microsoft SQL server database
Engine can support as many as 25 concurrent connections.
logical structure:
Schema partition, configuration partition, domain
partition and application partition
5 :: If 512mb Ram is there what will be the minimum and maximum Virtual
memory for the system?
To workout the total virtual memory (page file) required for windows XP you should
take the amount of ram in the system and + 25% (512MB + 25% (128MB) = 640MB
total virtual memory. by setting both the min and max to 640MB you can increase
the performances of the operating system.
go to cd prompt d:
d:>cd i386
d:\i386>copy ntldr c: enter
restart u r computer
problem fix
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 10
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
7 :: What is LDAP?
LDAP, Lightweight Directory Access Protocol, is an Internet protocol that email and
other programs use to look up information from a server.
The application directory partition can contain any type of data except security
principles (users, computers, groups).
The KCC analyzes the replication topology within a site every 15 minute to ensure
that it still works. If you add or remove a domain controller from the network or a
site, the KCC reconfigures the topology to relect the change.
You frequently backup the system state data on domain controllers so that you can
restore the most current data. By establishing a regular backup schedule, you have
a better chance of recovering data when necessary.
To ensure a good backup includes at least the system state data and contents of
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 11
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
the system disk, you must be aware of the tombstone lifetime. By default, the
tombstone is 60 days. Any backup older than 60 days is not a good backup. Plan to
backup at least two domain controllers in each domain, one of at least one backup
to enable an authoritative restore of the data when necessary.
The computer will boot into a special safe mode and won’t start the DS. Be aware
that during this time the machine won’t act as a DC and won’t perform functions
such as authentication.
1. Start NT Backup.
2. Select the Restore tab.
3. Select the backup media, and select System State.
4. Click Start Restore.
5. Click OK in the confirmation dialog box.
After you restore the backup, reboot the computer and start in normal mode to use
the restored information. The computer might hang after the restore completes; I’ve
experienced a 30-minute wait on some machines.
1:- Local Group Policy object-each computer has exactly one Group Policy object
that is stored locally. This processes for both computer and user Group Policy
processing.
2:- Site-Any GPOs that have been linked to the site that the computer belongs to are
processed next. Processing is in the order that is specified by the administrator, on
the Linked Group Policy Objects tab for the site in Group Policy Management
Console (GPMC). The GPO with the lowest link order is processed last, and therefore
has the highest precedence.
4:- Organizational units-GPOs that are linked to the organizational unit that is
highest in the Active Directory hierarchy are processed first, then GPOs that are
linked to its child organizational unit, and so on. Finally, the GPOs that are linked to
the organizational unit that contains the user or computer are processed.
► Easy administration of all GPOs across the entire Active Directory Forest
► View of all GPOs in one single list
► Reporting of GPO settings, security, filters, delegation, etc.
► Control of GPO inheritance with Block Inheritance, Enforce, and Security Filtering
► Delegation model
► Backup and restore of GPOs
► Migration of GPOs across different domains and forests
With all of these benefits, there are still negatives in using the GPMC alone.
Granted, the GPMC is needed and should be used by everyone for what it is ideal
for. However, it does fall a bit short when you want to protect the GPOs from the
following:
17 :: What are the GPC and the GPT? Where can I find them?
GPOs store group policy settings in two locations: a Group Policy container (GPC)
(preferred) and a Group Policy template (GPT). The GPC is an Active Directory object
that stores version information, status information, and other policy information (for
example, application objects).
The GPT is used for file-based data and stores software policy, script, and
deployment information. The GPT is located on the system volume folder of the
domain controller. A GPO can be associated with one or more Active Directory
containers, such as a site, domain, or organizational unit. Multiple containers can be
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 13
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
associated with the same GPO, and a single container can have more than one
associated GPO.
By using the Administrative Template sections of the GPO you can deploy
modifications to machine (called HKEY_LOCAL_MACHINE in the registry) and user
(called HKEY_CURRENT_USER in the registry) portions of the Registry of computers
that are influenced by the GPO.
21 :: What is MUTEX?
A mutual exclusion object, or MUTEX, is an object created for use in computer
programs. The essential function of MUTEX is to make it possible for a multiple
program thread to make use of a single resource. Generally, the functionality of
mutual exclusion objects is to allow this use of a single resource by creating an
environment where the access to the resource is continually passed back and forth
between the various aspects of the program.
process:
In computing, a process is an instance of a computer program that is being
sequentially executed[1] by a computer system that has the ability to run several
computer programs concurrently.
Thread:
A single process may contain several executable programs (threads) that work
together as a coherent whole. One thread might, for example, handle error signals,
another might send a message about the error to the user, while a third thread is
executing the actual task of the...
23 :: What is INODE?
INODE is a pointer to a block on the disk and it is unique.
Inode is an unique number. Inode holds metadata of files.
26 :: What is Semaphore?
A hardware or software flag.
In multitasking systems, a semaphore is a variable with a value that indicates the
status of a common resource.
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 15
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
Multi tasking:
Multitasking is the logical extension of multiprogramming .The concept of
multitasking is quite similar to multiprogramming but difference is that the
switching
between jobs occurs so frequently that the users can interact with each program
while it is running. This concept is also known as time-sharing systems. A time-
shared operating system uses CPU scheduling and multiprogramming to provide
each user with a small portion of time-shared system.
Multi threading:
An application typically is implemented as a separate process with several threads
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 16
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
When Pi terminates, Pi+1 can obtain its needed resources, and so on.
->Deadlock Avoidance ?ensure that a system will never enter an unsafe state.
Mutual exclusion:
only one process at a time can use a resource.
No preemption:
a resource can be released only voluntarily by the process holding it, after that
process has completed its task.
Circular wait:
there exists a set {P0, P1, ?, P0} of waiting processes such that P0 is waiting for a
resource that is held by P1, P1 is waiting for a resource that is held by P
2, Pn1 is waiting for a resource that is held by
Pn, and P0 is waiting for a resource that is held by P0.
when its credits reaches zero, it is suspended and another process is chosen. If no
runnable processes have any credits, then Linux performs a recrediting operation,
adding credits to every process in the system (rather than just to the runnable
ones), according to the following rule:
Credits = credits/2 + priority
The above scheduling class is used for time-shared process and the in Linux for the
real-time scheduling is simpler it uses scheduling classes: first come, first served
(FCFS), and round-robin (RR) .In both cases, each process has a priority in addition
to its scheduling class. In time-sharing scheduling, however, processes of different
priorities can still compete with one another to some extent; in real-time
scheduling, the scheduler always runs the process with the highest priority. Among
processes of
equal priority, it runs the process that has been waiting longest. The only difference
between FCFS and RR scheduling is that FCFS processes continue to run until they
either exit or block, whereas a round-robin process will be preempted after a while
and will be moved to the end of the scheduling queue.
other vehicles give path to the vehicles that are in need. The example for
preemptive scheduling is
people standing in queue for tickets.
Aging:
Aging is a technique to avoid starvation in a scheduling system. It works by adding
an aging factor to the priority of each request. The aging factor must increase the
request?s priority as time passes and must ensure that a request will eventually be
the highest priority request (after it has waited long enough)
Assembler:
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 20
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
Compiler:
A compiler is a special program that processes statements written in a particular
programming language and turns them into machine language or "code" that a
computer'sprocessor uses. Typically, a programmer writes language statements in a
language such as Pascal or C one line at a time using an editor. The file that is
created contains what are called the source statements. The programmer then runs
the appropriate language compiler, specifying the name of the file that contains the
source statements.
Loader:
In a computer operating system, a loader is a component that locates a given
program (which can be an application or, in some cases, part of the operating
system itself) in offline storage (such as a hard disk), loads it into main storage (in a
personal computer, it's called random access memory), and gives that program
control of the compute
Linker:
Linker performs the linking of libraries with the object code to make the object code
into an executable machine code.
With 2000 server you have all the server capabilities plus on default u might have
Mohammed Rafique | Windows Server 2003 IIS and Scripting interview 21
questions
February 3, 2010 [WINDOWS SERVER INTERVIEW FAQ’S]
NTFS system rather than FAT or FAT32. pluse with server u have capabilities of
hosting services like DHCP, DNS, TERMINAL SERVICES etc..
There would be a lot if i start explaining in detail but for a creamy part...this is more
than enough
Kernel uses device drivers to control microcontroller card of peripheral device and
inturn work is being accomplished.
application program -> [shells ->kernel ->device driver -> controller card ->
physical hardware]
55 :: What is Dispatcher?
Dispatcher module gives control of the CPU to the process selected by the short-
term scheduler; this involves:
Switching context
Switching to user mode
Jumping to the proper location in the user program to restart that program
Dispatch latency ? time it takes for the dispatcher to stop one process and start
another running.
In Unix, a shared object (.so) file contains code to be used by the program, and also
the names of functions and data that it expects to find in the program. When the file
is joined to the program, all references to those functions and data in the file's code
are changed to point to the actual locations in the program where the functions and
data are placed in memory. This is basically a link operation.
In Unix, there is only one type of library file (.a) which contains code from several
object files (.o). During the link step to create a shared object file (.so), the linker
may find that it doesn't know where an identifier is defined. The linker will look for it
in the object files in the libraries; if it finds it, it will include all the code from that
object file.
61 :: Distributed Systems?
Distribute the computation among several physical processors.
Loosely coupled system each processor has its own local memory; processors
communicate with one another through various communications lines, such as high-
speed
buses or telephone lines
Advantages of distributed systems:
► Resources Sharing
► Computation speed up load sharing
► Reliability
► Communications
PROCESS :
one or more PROCESS will be required to complete a task.
FCFS:
FCSFS stands for First Come First Served. In FCFS the job that has been waiting the
longest is served next.
Priority Scheduling:
Priority scheduling is a scheduling method where at all times the highest priority
process is assigned the resource.
Secondary storage:
extension of main memory that provides large nonvolatile storage capacity.
Monolithic:
A monolithic operating system is one where all operating system code is in a single
executable image and all operating system code runs in system mode.
70 :: I have deleted a file from recycle bin but i want to use that file how
can i restore that file? I have already used system restore for the same
but the file could not be restore?
THere is two solutions:
Hard real-time:
Secondary storage limited or absent, data stored in short term memory, or read-
only memory (ROM) Conflicts with time-sharing systems, not supported by general-
purpose operating systems.
Soft real-time:
► Limited utility in industrial control of robotics