Training Guide Administering Windows Server 2012 R2 (2014)

---

Lesson summary

A and AAAA records map FQDNs to IP addresses.

PTR records map IP addresses to FQDNs.

CNAME records enable you to create aliases for FQDNs.

MX records are used to provide information about the location of mail servers.

Scavenging and aging enable you to minimize the amount of stale resource records in a DNS zone.

Scavenging and aging can only scavenge dynamically generated resource records.

DNSSEC uses public key cryptography to sign DNS zones and resource records.

When a query occurs against a DNSSEC signed zone, both the requested record and a key to validate the records are provided.

Lesson review

Answer the following questions to test your knowledge of the information in this lesson. You can find the answers to these questions and explanations of why each answer choice is correct or incorrect in the “Answers” section at the end of this chapter.

1. What type of resource record do you create if you want to have a different name associated with an existing FQDN?

A. A record

B. MX record

C. PTR record

D. CNAME record

2. You have just deployed a server that will function as an SMTP gateway on your organization’s perimeter network. This server has been assigned an FQDN, and an entry exists pointing to the server in the reverse lookup zone associated with the server’s public IP address. Which type of resource record should you create if you want to ensure that the mail servers of external organizations can recognize this server as your organization’s external mail gateway?

A. CNAME record

B. PTR record

C. MX record

D. A record

3. Which of the following Windows PowerShell cmdlets should you use to create a host record that maps an FQDN with an IPv6 address?

A. Add-DnsServerResourceRecordCName

B. Add-DnsServerResourceRecordAAAA

C. Add-DnsServerResourceRecordMX

D. Add-DnsServerResourceRecordPtr

4. Which of the following can you enable to reduce the number of stale resource records in a zone?

A. Secure dynamic updates

B. Aging and scavenging

C. DNSSEC

D. Zone transfers

5. You want to ensure that clients can validate the authenticity of DNS records in several primary zones that are hosted on DNS servers in your organization. Which of the following should you enable to accomplish this goal? (Choose all that apply.)

A. DNSSEC

B. Zone transfers

C. Aging and scavenging

D. Secure dynamic updates

Practice exercises

The goal of this section is to provide you with hands-on practice with the following:

Managing DNS zones

Single-label name resolution

Configuring and managing DNSSEC

To perform the exercises in this section, you need access to an evaluation version of Windows Server 2012 R2. You should also have access to virtual machines SYD-DC, MEL-DC, CBR-DC, and ADL-DC, the setup instructions for which are described in the Introduction. You should ensure that you have a checkpoint of these virtual machines that you can revert to at the end of the practice exercises. You should revert the virtual machines to this initial state prior to beginning these exercises.

Exercise 1: Manage DNS zones

In this exercise, you create a new Active Directory integrated zone, configure this zone to replicate to all domain controllers in the forest, and configure the zone to accept only secure dynamic updates. To complete this exercise, perform the following steps:

1. Sign on to SYD-DC as Contoso\don_funk.

2. In Server Manager, click the Tools menu, and click DNS.

3. In the DNS Manager Console, expand SYD-DC, and click Forward Lookup Zones, as shown in Figure 3-27.

FIGURE 3-27 Forward Lookup Zones

4. In the Action menu, click New Zone.

5. On the first page of the New Zone Wizard, click Next.

6. On the Zone Type page, click Primary Zone and ensure that Store The Zone In Active Directory is selected, as shown in Figure 3-28, and click Next.

FIGURE 3-28 Active Directory integrated primary zone

7. In the Active Directory Zone Replication Scope page, click To All DNS Servers Running On Domain Controllers In This Forest: Contoso.com, as shown in Figure 3-29, and click Next.

FIGURE 3-29 Zone replication scope

8. On the Zone Name page, type fabrikam.com and click Next.

9. On the Dynamic Update page, click Allow Only Secure Dynamic Updates, as shown in Figure 3-30, and click Next.

FIGURE 3-30 Configuring secure dynamic updates

10. Click Finish to complete the New Zone Wizard.

Exercise 2: Configure partition-based replication

In this exercise, you create a new Active Directory DNS partition and then create a new Active Directory integrated zone that replicates to DNS servers enrolled in this partition. To complete this exercise, perform the following steps:

1. On SYD-DC, right-click the Windows PowerShell prompt, and click Run As Administrator.

2. Execute the following command to create a new Active Directory DNS partition named Tasmania:

Add-DNSServerDirectoryPartition –Name Tasmania

3. Close the Windows PowerShell window.

4. In the DNS Manager console, click Forward Lookup Zones.

5. In the Action menu, click New Zone.

6. On the Welcome page of the New Zone Wizard, click Next.

7. In the Zone Type page, click Primary Zone, verify that Store The Zone In Active Directory is selected, and click Next.

8. In the Active Directory Zone Replication Scope page, click To All Domain Controllers Specified In The Scope Of This Directory Partition and click Tasmania, as shown in Figure 3-31, and click Next.

FIGURE 3-31 Replicating to a specific directory partition

9. In the Zone Name Wizard page, type margiestravel.com, as shown in Figure 3-32, and click Next.

FIGURE 3-32 Providing a zone name

10. In the Dynamic Update page, click Do Not Allow Dynamic Updates, as shown in Figure 3-33, and click Next.

FIGURE 3-33 Do Not Allow Dynamic Updates

11. Click Finish to complete the New Zone Wizard.

Exercise 3: DNS delegation and secondary zones

In this exercise, you install the DNS role and perform a zone delegation. To complete this exercise, perform the following steps:

1. Start MEL-DC, and sign in using the Administrator account with the password Pa$$w0rd.

2. Open the Windows PowerShell prompt and type the following commands.

Add-Computer -DomainName contoso.com

3. In the Windows PowerShell Credentials dialog box type don_funk@contoso.com and Pa$$w0rd, and click OK.

4. Type the following command in the Windows PowerShell prompt to restart the computer.

Restart-Computer

5. Ensure that you are signed on to SYD-DC as Contoso\don_funk.

6. In Server Manager on SYD-DC, click All Servers.

7. In the Manage menu, click Add Servers.

8. In the Name box, type MEL-DC and click Find Now.

9. In the Add Servers dialog box, click MEL-DC, and click the arrow button, as shown in Figure 3-34, and click OK.

FIGURE 3-34 Adding servers to a group

10. In the All Servers area of Server Manager on SYD-DC, click MEL-DC. From the Manage menu, click Add Roles And Features.

11. In the Before You Begin page of the Add Roles And Features Wizard, click Next.

12. In the Installation Type page, click Role-Based Or Feature-Based Installation, and click Next.

13. In the Select Destination Server page, click MEL-DC.contoso.com, and click Next.

14. In the Select Server Roles page, click DNS Server. In the Add Roles And Features Wizard pop-up list, click Add Features.

15. Verify that the Add Roles And Features Wizard appears the same as shown in Figure 3-35 and click Next.

FIGURE 3-35 Installing DNS Server role

16. In the Select Features page, click Next.

17. In the DNS Server page, click Next.

18. In the Confirm Installation Selections page, click Install, and then click Close.

19. In DNS Manager console, click DNS. In the Action menu, click Connect To DNS Server.

20. In the Connect To DNS Server dialog box, click The Following Computer: and type MEL-DC.contoso.com, as shown in Figure 3-36. Click OK.

FIGURE 3-36 Connecting to a DNS server

21. In the DNS Manager Console, click Forward Lookup Zones under MEL-DC.contoso.com, as shown in Figure 3-37.

FIGURE 3-37 Connecting to two DNS servers

22. Click Action, and click New Zone.

23. In the Welcome page of the New Zone Wizard, click Next.

24. In the Zone Type page of the New Zone Wizard, click Primary Zone. Note (as shown in Figure 3-38) that the option to store the zone in Active Directory is not present because MEL-DC is not an Active Directory domain controller. Click Next.

FIGURE 3-38 Configuring a primary zone

25. In the Zone Name page, type australia.fabrikam.com, and click Next.

26. In the Zone File page, click Create A New File With This File Name, as shown in Figure 3-39, and click Next.

FIGURE 3-39 Creating a zone file

27. In the Dynamic Update page, click Do Not Allow Dynamic Updates, and click Next.

28. In the Completion page, click Finish.

29. In the DNS Manager Console, expand SYD-DC\Forward Lookup Zones and click Fabrikam.com.

30. In the Action menu, click New Delegation.

31. In the Welcome page of the New Delegation Wizard, click Next.

32. In the Delegated Domain Name page, type australia, as shown in Figure 3-40, and click Next.

FIGURE 3-40 Configuring a delegated domain

33. In the Name Servers page, click Add.

34. In the New Name Server Record dialog box, type MEL-DC.contoso.com and click Resolve. Click OK.

35. Verify that the Name Servers page of the New Delegation Wizard matches Figure 3-41 and then click Next.

FIGURE 3-41 Delegated name server

36. Click Finish to close the New Delegation Wizard.

Exercise 4: Configure a secondary zone

In this exercise, you configure a DNS server to host the secondary zone copy of a DNS zone. To complete this exercise, perform the following steps:

1. On SYD-DC, in DNS Manager, click Margiestravel.com.

2. In the Action menu, click Properties.

3. On the Zone Transfers tab, click Allow Zone Transfers, and click Only To The Following Servers.

4. Click Edit. In the Allow Zone Transfers dialog box, click the text <Click Here To Add An IP Address Or DNS Name>, type MEL-DC.contoso.com, and press Enter.

5. Click No Such Host Is Known, and click Delete. Even though an error symbol is present, click OK.

6. Verify that the Zone Transfers tab matches Figure 3-42, and click OK.

FIGURE 3-42 Configuring zone transfers

7. In the DNS Manager Console, click Forward Lookup Zones under MEL-DC.contoso.com, as shown in Figure 3-43.

FIGURE 3-43 Forward Lookup Zones

8. In the Action menu, click New Zone.

9. In the Welcome page of the New Zone Wizard, click Next.

10. In the Zone Type page, click Secondary Zone, as shown in Figure 3-44, and click Next.

FIGURE 3-44 Secondary zone

11. In the Zone Name page, type margiestravel.com and click Next.

12. In the Master DNS Servers page, type SYD-DC.contoso.com, press Enter, and click Next (as shown in Figure 3-45).

FIGURE 3-45 Master DNS Servers

13. Click Finish and verify that margiestravel.com is listed as a secondary zone on MEL-DC.contoso.com, as shown in Figure 3-46.

FIGURE 3-46 Secondary zone configured

Exercise 5: Single-label name resolution

In this exercise, you configure single-label name resolution. To complete this exercise, perform the following steps:

1. In the DNS Manager, click Forward Lookup Zones under SYD-DC.

2. Click the Action Menu, and click New Zone.

3. In the Welcome page of the New Zone Wizard, click Next.

4. In the Zone Type page, click Primary Zone, ensure that Store The Zone In Active Directory is selected, and click Next.

5. In the Active Directory Zone Replication Scope page, click To All DNS Servers Running On Domain Controllers In This Forest: Contoso.com and click Next.

6. In the Zone Name page, type GlobalNames, as shown in Figure 3-47, and click Next.

FIGURE 3-47 Secondary zone configured

7. In the Dynamic Update page, click Do Not Allow Dynamic Updates, and click Next.

8. In the Completing The New Zone Wizard page, click Finish.

9. Right-click the Windows PowerShell icon on the taskbar, and click Run As Administrator.

10. Issue the following command to enable the GlobalNames zone on SYD-DC.

Set-DnsServerGlobalNameZone –ComputerName SYD-DC –Enable $True

11. Switch to DNS Manager.

12. Click the GlobalNames zone. In the Action menu, click New Alias (CNAME).

13. In the New Resource Record dialog box, configure the following information, as shown in Figure 3-48, and click OK.

Alias Name (Uses Parent Domain If Left Blank): Wollongong

Fully Qualified Domain Name (FQDN) For Target Host: MEL-DC.contoso.com

FIGURE 3-48 Record in GlobalNames zone

14. In the Windows PowerShell prompt, type the following to verify single name resolution.

nslookup Wollongong

Exercise 6: Configure and manage DNSSEC

In this exercise, you configure and manage DNSSEC. To complete this exercise, perform the following steps:

1. In DNS Manager, click Forward Lookup Zones under SYD-DC.

2. In the Action menu, click New Zone.

3. In the Welcome page of the New Zone Wizard, click Next.

4. In the Zone Type page, click Primary Zone, enable the Store The Zone In Active Directory option, and click Next.

5. In the Active Directory Zone Replication Scope page, click To All DNS Servers Running On Domain Controllers In This Forest: Contoso.com.

6. In the Zone Name page, type the zone name as secure.contoso.com, as shown in Figure 3-49, and click Next.

FIGURE 3-49 Creating a new zone

7. In the Dynamic Update page, click Allow Only Secure Dynamic Updates, and click Next.

8. In the Completing The New Zone Wizard page, click Finish.

9. In the DNS Manager, click Secure.contoso.com under Forward Lookup Zones.

10. In the Action menu, click New Host (A Or AAAA).

11. In the New Host dialog box, configure the following details, as shown in Figure 3-50, and then click Add Host.

Name: Host-1

IP Address: 10.10.10.150

FIGURE 3-50 Creating a new host

12. In the New Host dialog box, configure the following details, click Add Host, and click Done:

Name: Host-2

IP Address: 10.10.10.151

13. Run the following Windows PowerShell command to verify that no RRSIG record is present.

Resolve-DNSname host-1.secure.contoso.com –server SYD-DC –dnssecok

14. In DNS Manager, click Secure.contoso.com.

15. From the Action menu, click DNSSEC and click Sign The Zone.

16. In the DNS Security Extensions (DNSSEC) page of the Zone Signing Wizard, click Next.

17. In the Signing Options page, click Use Default Settings To Sign The Zone, as shown in Figure 3-51, and click Next.

FIGURE 3-51 Sign DNS Zone

18. In the DNS Security Extensions page, click Next.

19. In the Signing The Zone page, click Finish.

20. Click Secure.contoso.com and from the Action menu, click Refresh.

21. View the contents of the Secure.contoso.com zone in DNS Manager to verify the presence of the new DNSKEY, RRSIG, and NSEC3 records.

22. Rerun the Windows PowerShell command from step 13 and note the presence of the RRSIG record.

Suggested practice exercises

The following additional practice exercises are designed to give you more opportunities to practice what you’ve learned and to help you successfully master the lessons presented in this chapter.

Exercise 1 Configure a primary zone on MEL-DC. Configure a secondary zone of the primary zone on SYD-DC. Create host records in the primary zone on MEL-DC and verify that they replicate to the secondary zone on SYD-DC.

Exercise 2 Install Peer Name Resolution Protocol on SYD-DC, MEL-DC, and ADL-DC. Use PNRP to resolve the IPv6 address of each server.

Exercise 3 Use Windows PowerShell to create A, CNAME, PTR, and MX records in the secure.contoso.com zone created in Exercise 3.

Answers

This section contains the answers to the lesson review questions in this chapter.

Lesson 1

1. Correct answers: A and C

A. Correct. Configuring the zone as Active Directory integrated primary enables you to configure the zone to accept only secure dynamic updates.

B. Incorrect. You cannot configure a standard primary zone so that it will accept only secure dynamic updates. A standard primary zone can be configured to accept both secure and insecure dynamic updates.

C. Correct. Configuring this setting ensures that only computers that are members of the domain can update the zone.

D. Incorrect. If you do not configure the zone to allow dynamic updates, you have to perform zone updates manually.

2. Correct answer: C

A. Incorrect. This network ID would be associated with the 168.192.in-addr.arpa zone.

B. Incorrect. This network ID would be associated with the 192.186.15.in-addr.arpa zone.

C. Correct. Zone names use octets in reverse. The zero is dropped from the zone name.

D. Incorrect. This network ID would be associated with the 15.168.192.0.in-addr.apra zone.

3. Correct answer: B

A. Incorrect. You should not create the target zone on the computer on which you are going to perform the delegation, unless that computer will host that zone. In this situation, the target zone will be hosted on the computer with IP address 10.100.10.10.

B. Correct. You must create the target zone on the server that will host that zone prior to performing the delegation.

C. Incorrect. You must create the target zone before you perform a delegation.

D. Incorrect. You must create the target zone before you perform a delegation.

4. Correct answer: D

A. Incorrect. Although configuring a secondary zone will provide a local copy of the partner organization’s zone, a better approach is to use a stub zone because the zone updates frequently. This way, clients on your organizational network can quickly locate the authoritative name servers in the partner zone and resolve addresses in that zone accurately.

B. Incorrect. Conditional forwarders use static entries for authoritative servers in the target zone. Because the authoritative servers in the target zone often change, a conditional forwarder is quickly out of date.

C. Incorrect. Forwarders are used to forward all queries, rather than queries to a specific zone.

D. Correct. The best approach is to use a stub zone. This way, clients on your organizational network can quickly locate the authoritative name servers in the partner zone and resolve addresses in that zone accurately.

5. Correct answers: B and C

A. Incorrect. A stub zone replicates authoritative name server information from a target zone. In this situation, you simply want to forward traffic for hosts in a specific zone to a specific DNS server.

B. Correct. You need to configure a forwarder that will forward traffic to your ISP’s DNS server.

C. Correct. A conditional forwarder will forward all traffic to the margiestravel.com DNS zone, to a DNS server at a specific address.

D. Incorrect. You want to forward client request traffic either to your ISP’s DNS server or to the margiestravel.com DNS server. Hosting a secondary zone of the margiestravel.com DNS zone does not accomplish this goal.

Lesson 2

1. Correct answer: B and D

A. Incorrect. DHCP provides network address information to clients, but can’t be used to provide IPv6 single-label name resolution.

B. Correct. GlobalNames zones can be used to provide single-label name resolution for IPv6.

C. Incorrect. WINS does not support IPv6.

D. Correct. PNRP provides single-label name resolution for IPv6.

2. Correct answer: B

A. Incorrect. DNS option 005 is used to provide clients with the address of DNS servers.

B. Correct. DNS option 044 is used to provide clients with the address of WINS servers.

C. Incorrect. Option 004 is used to provide clients with the address of time servers.

D. Incorrect. Option 015 is used to provide clients with their DNS domain name.

3. Correct answer: D

A. Incorrect. Reverse lookup zones are used to translate IP addresses into FQDNs. They can’t be used for single-label name resolution.

B. Incorrect. Stub zones are used to store the addresses of authoritative name servers. They can’t be used for single-label name resolution.

C. Incorrect. Secondary zones are read-only replicas of primary zones, although it is possible to create a secondary zone of a GlobalNames zone.

D. Correct. GlobalNames zones allow you to provide single-label name resolution without deploying WINS. You can manually update a GlobalNames zone.

4. Correct answer: C

A. Incorrect. DNS requires the deployment of a centralized server to respond to DNS lookup requests.

B. Incorrect. WINS requires the deployment of a centralized server to respond to WINS lookup requests.

C. Correct. PNRP provides IPv6 name resolution without requiring the deployment of a centralized server.

D. Incorrect. DHCP provides IP address information. It can’t be used to resolve name resolution queries.

5. Correct answer: C

A. Incorrect. Although Set-DnsServer can be used to configure the properties of a DNS server, it can’t be used to enable GlobalNames zone.

B. Incorrect. You use this cmdlet to configure DNS conditional forwarders.

C. Correct. You use the Set-DnsServerGlobalNameZone cmdlet to enable GlobalNames zones once they are created.

D. Incorrect. You use this cmdlet to configure a DNS server forwarder.

Lesson 3

1. Correct answer: D

A. Incorrect. A records are associated with IP addresses. In this case, you want to associate a new name with an existing FQDN.

B. Incorrect. MX records are used to provide MX information.

C. Incorrect. PTR records are used to associate IP addresses with FQDNs.

D. Correct. A CNAME record, also known as an alias record, allows you to provide an alternate name that points to an existing A record.

2. Correct answer: C

A. Incorrect. You don’t need to create an alias record; you need to create an MX record to allow the mail servers of external organizations to locate your organization’s mail gateway.

B. Incorrect. A PTR record already exists in this scenario.

C. Correct. MX records are used by mail gateways to determine the address of remote mail gateways during message delivery.

D. Incorrect. An A record already exists for this host.

3. Correct answer: B

A. Incorrect. You use the Add-DnsServerResourceRecordCName cmdlet to add an alias rather than an AAAA record.

B. Correct. You use the Add-DnsServerResourceRecordAAAA cmdlet to create an AAAA record. AAAA records map FQDNs to IPv6 addresses.

C. Incorrect. You use the Add-DnsServerResourceRecordMX cmdlet to add MX records to a DNS zone.

D. Incorrect. You use the Add-DNSSErverResourceRecordPtr cmdlet to add a pointer record. A pointer record has already been configured for this host.

4. Correct answer: B

A. Incorrect. Secure dynamic updates ensure that only authorized hosts can update records in a DNS zone. They do not reduce the number of stale resource records.

B. Correct. By time stamping records, aging and scavenging ensures that stale resource records are removed from a zone in a timely manner.

C. Incorrect. You use DNSSEC to validate the authenticity of DNS records.

D. Incorrect. You configure zone transfers to authorize which servers can perform zone transfers of a DNS zone.

5. Correct answer: A

A. Correct. You can use DNSSEC to validate the authenticity of DNS records.

B. Incorrect. You configure zone transfers to authorize which servers can perform zone transfers of a DNS zone.

C. Incorrect. Aging and scavenging ensures that stale resource records are removed from a zone in a timely manner. You can’t use aging and scavenging to validate the authenticity of records.

D. Incorrect. Secure dynamic updates ensure that only authorized hosts can update records in a DNS zone. This technology does not allow a client to determine the authenticity of the results of a DNS query.