Training Guide Configuring Advanced Windows Server 2012 R2 Services(2014)

---

Lesson summary

Active Directory domain controllers perform multi-master replication.

Domain controllers pull updates from replication partners.

RODCs are unable to update Active Directory.

The Password Replication Policy is unique to each RODC and determines which account passwords are stored on the RODC.

When you remove an RODC from the domain, you can configure an automatic password reset for all account passwords stored on the RODC.

You can use repadmin to manage and monitor Active Directory replication.

You can use dfsrmig.exe to migrate a domain that uses FRS for SYSVOL replication so that it uses DFSR.

Lesson review

Answer the following questions to test your knowledge of the information in this lesson. You can find the answers to these questions and explanations of each answer choice in the “Answers” section at the end of this chapter.

1. As a part of a security audit, you are attempting to verify which user accounts have replicated to the RODC named ADL-RO DC. This RODC is running on the server core version of Windows Server 2012 R2. Which of the following commands could you use to accomplish this goal?

A. Repadmin /prp view ADL-RODC Reveal

B. Repadmin /replsummary ADL-RODC

C. Repadmin /kcc ADL-RODC

D. Repadmin /showrepl ADL-RODC

E. Repadmin /syncall ADL-RODC

2. You have just substantially changed the structure of your organization’s WAN links. You want to trigger an update on SYD-DC of the inbound replication topology. Which of the following commands could you use to accomplish this goal?

A. Repadmin /prp view SYD-DC Reveal

B. Repadmin /syncall SYD-DC

C. Repadmin /showrepl SYD-DC

D. Repadmin /kcc SYD-DC

E. Repadmin /replsummary SYD-DC

3. You are in the process of diagnosing replication problems to a DC named CBR-DC, which is located in your organization’s Canberra branch office. You want to view information about the failure and success percentages of both inbound and outbound replication operations. Which of the following commands could you use to accomplish this goal?

A. Repadmin /showrepl CBR-DC

B. Repadmin /syncall CBR-DC

C. Repadmin /kcc CBR-DC

D. Repadmin /prp view CBR-DC Reveal

E. Repadmin /replsummary CBR-DC

4. You want to force the domain controller MEL-DC to immediately perform synchronization with all its replication partners. Which of the following commands would you use to accomplish this goal?

A. Repadmin /showrepl MEL-DC

B. Repadmin /syncall MEL-DC

C. Repadmin /kcc MEL-DC

D. Repadmin /replsummary MEL-DC

E. Repadmin /prp view MEL-DC Reveal

5. You are attempting to diagnose some replication problems with the domain controller BNE-DC. You want to show status information on this domain controller’s most recent attempts to perform inbound replication. Which of the following commands would you use to accomplish this goal?

A. Repadmin /syncall MEL-DC

B. Repadmin /kcc MEL-DC

C. Repadmin /showrepl MEL-DC

D. Repadmin /replsummary MEL-DC

E. Repadmin /prp view MEL-DC Reveal

6. Up until last night, the Perth site has had an RODC that was kept in a locked cupboard. This RODC was used to authenticate computer and user accounts in the Perth site. In the early hours of the morning, the Perth site was robbed and the RODC was stolen. As a part of your response to this incident, you are in the process of deleting the computer account of the Perth site RODC. Which of the following steps might you need to take after removing this account? (Choose all that apply.)

A. Assign users new passwords.

B. Enable user accounts.

C. Rejoin computers to the domain.

D. Enable computer accounts.

7. What is the minimum domain functional level required before you can update SYSVOL replication to use DFS instead of FRS?

A. Windows Server 2003

B. Windows Server 2008

C. Windows Server 2008 R2

D. Windows Server 2012

8. You have recently transitioned from a Windows Server 2003 domain functional level to a Windows Server 2012 R2 domain functional level. Which of the following utilities would you use to determine whether FRS or DFS is being used to support SYSVOL replication?

A. dfsrmig.exe

B. repadmin.exe

C. dcdiag.exe

D. dnscmd.exe

The goal of this section is to provide you with hands-on practice with the following:

Creating Active Directory sites

Creating Active Directory subnets

Creating site links

Modifying site link cost and replication schedule

Deploying an RODC

Configuring an RODC replication

Monitoring replication

Removing an RODC and resetting accounts

To perform the exercises in this section, you need access to an evaluation version of Windows Server 2012 R2. You should also have access to virtual machines SYD-DC, MEL-DC, CBR-DC, and ADL-DC, the setup instructions for which are as described in the Appendix. You should ensure that you have a checkpoint of these virtual machines that you can revert to at the end of the practice exercises. You should revert the virtual machines to this initial state prior to beginning these exercises.

Exercise 1: Create Active Directory sites

In this exercise, you create Active Directory sites in the Contoso.com domain named ADL-SITE, CBR-SITE, and MEL-SITE. You also rename the default first site to SYD-SITE. To complete this exercise, perform the following steps:

1. Power on SYD-DC and sign on as contoso\don_funk with the password Pa$$w0rd.

2. In the Server Manager console, click the Tools menu and then click Active Directory Sites And Services.

3. In the Active Directory Sites And Services console, right-click Default-First-Site-Name and click Rename.

4. Rename the Default-First-Site-Name site SYD-SITE as shown in Figure 2-27.

FIGURE 2-27 Rename the default site

5. Right-click the Sites node and click New Site.

6. In the New Object – Site dialog box, type ADL-SITE, click the DEFAULTIPSITELINK item as shown in Figure 2-28, and then click OK. In the Active Directory Domain Services dialog box, click OK.

FIGURE 2-28 Create the ADL-SITE

7. Right-click the Sites node and click New Site.

8. In the New Object – Site dialog box, type MEL-SITE, click the DEFAULTIPSITELINK item, and click OK.

9. In the Active Directory Domain Services dialog box, click OK.

10. Right-click the Sites node and click New Site.

11. In the New Object – Site dialog box, type CBR-SITE, click the DEFAULTIPSITELINK item, and click OK.

12. Verify that the list of sites in the Active Directory Sites And Services console matches Figure 2-29.

FIGURE 2-29 The Active Directory Sites And Services configuration

Exercise 2: Create Active Directory subnets

In this exercise, you create IPv4 subnets and associate them with different Active Directory sites. To complete this exercise, perform the following steps:

1. In the Active Directory Sites And Services console on SYD-DC, right-click the Subnets node and click New Subnet.

2. In the Prefix text box of the New Object – Subnet dialog box, type 10.10.10.0/28 and click SYD-SITE as shown in Figure 2-30. Click OK.

FIGURE 2-30 Create an Active Directory subnet

3. In the Active Directory Sites And Services console, right-click the Subnets node and click New Subnet.

4. In the Prefix text box of the New Object – Subnet dialog box, type 10.10.10.16/28, click ADL-SITE, and click OK.

5. In the Active Directory Sites And Services console, right-click the Subnets node and click New Subnet.

6. In the Prefix text box of the New Object – Subnet dialog box, type 10.10.10.32/28, click MEL-SITE as shown in Figure 2-31, and click OK.

FIGURE 2-31 Create another subnet

7. In the Active Directory Sites And Services console, right-click the Subnets node and click New Subnet.

8. In the Prefix text box of the New Object – Subnet dialog box, type 10.10.10.48/28, click CBR-SITE, and click OK.

9. Select the Subnets node and verify that the Active Directory Sites And Services console matches Figure 2-32.

FIGURE 2-32 Verify the subnet configuration

Exercise 3: Create site links

In this exercise, you create two new IP Site Links. To complete this exercise, perform the following steps:

1. On SYD-DC in the Active Directory Sites And Services console, expand the Sites\Inter-Site Transports node.

2. Right-click the IP node and click New Site Link.

3. On the New Object – Site Link dialog box, type MEL-ADL in the Name text box. Hold the Ctrl key, click ADL-SITE and MEL-SITE, and click Add as shown in Figure 2-33. Click OK.

FIGURE 2-33 Create a site link

4. Right-click the IP node and click New Site Link.

5. On the New Object – Site Link dialog box, type MEL-CBR in the Name text box. Hold the Ctrl key, click MEL-SITE and CBR-SITE, click Add, and then click OK.

6. Select the IP node of the Active Directory Sites and Services console and verify that the site links listed match those in Figure 2-34.

FIGURE 2-34 Verify the site link configuration

Exercise 4: Modify site link cost and replication schedule

In this exercise, you modify the site link cost and replication schedule of the MEL-CBR site link. To complete this exercise, perform the following steps:

1. In the Active Directory Sites And Services console on SYD-DC, expand Sites\Inter-Site Transports and click on the IP node.

2. In the list of site links, right-click MEL-CBR and click Properties.

3. On the MEL-CBR Properties dialog box, set the Cost to 150 and set the Replicate Every option to 240 as shown in Figure 2-35.

FIGURE 2-35 View the site link properties

4. On the General tab, click the Change Schedule button.

5. On the Schedule for MEL-CBR, select all of the hours on Sunday and click Replication Not Available as shown in Figure 2-36. Click OK twice.

FIGURE 2-36 The site link replication schedule

Exercise 5: Configure MEL-DC as an additional domain controller

In this exercise, you configure MEL-DC as an additional domain controller in the contoso.com domain. To complete this exercise, perform the following steps:

1. Sign on to MEL-DC as Administrator with the password Pa$$w0rd.

2. In the Server Manager console, click Local Server and verify that the IP address listed for Ethernet is set to 10.10.10.40 as shown in Figure 2-37.

FIGURE 2-37 Verify the IP address configuration

3. On the Manage menu, click Add Roles And Features.

4. On the Before You Begin page of the Add Roles And Features Wizard, click Next three times.

5. On the Select Server Roles page, click Active Directory Domain Services as shown in Figure 2-38.

FIGURE 2-38 Add the Active Directory Domain Services role

6. On the Add Roles And Features Wizard pop up, click Add Features.

7. Click Next three times and click Install.

8. Click Close to close the Add Roles And Features Wizard.

9. Click the alert item next to the notification flag and click Promote This Server To A Domain Controller.

10. On the Deployment Configuration page of the Active Directory Domain Services Configuration Wizard, click Add A Domain Controller To An Existing Domain and click Select.

11. In the Credentials for Deployment Operation, type contoso\don_funk in the User Name text box, Pa$$w0rd in the Password text box, and click OK.

12. In the Select A Domain From The Forest dialog box, click Contoso.com and click OK.

13. Verify that the Deployment Configuration page matches Figure 2-39 and click Next.

FIGURE 2-39 The Active Directory Domain Services deployment configuration

14. On the Domain Controller Options page, type the DSRM password Pa$$w0rd in both the Password and Confirm Password text boxes. Verify that the site name is set to MEL-SITE as shown in Figure 2-40 and then click Next twice.

FIGURE 2-40 Configure the domain controller options

15. On the Additional Options page, set the Replicate From drop-down menu to SYD-DC.contoso.com as shown in Figure 2-41 and then click Next three times.

FIGURE 2-41 Configure the domain controller to replicate from

16. On the Prerequisites Check page, click Install.

17. After MEL-DC restarts, sign on as contoso\don_funk with the password Pa$$w0rd.

Exercise 6: Verify site placement and trigger replication

In this exercise, you verify that MEL-DC is located in the MEL-SITE Active Directory site. To complete this exercise, perform the following steps:

1. When signed on to MEL-DC as contoso\don_funk, click Active Directory Sites And Services in the Tools menu of the Server Manger console.

2. Expand the MEL-SITE node, expand Servers and click MEL-DC as shown in Figure 2-42.

FIGURE 2-42 View the domain controller in the Active Directory Sites And Services console

3. Click NTDS Settings under MEL-DC.

4. In the Actions pane, click <Automatically Generated> and then click Replicate Now on the Action menu.

5. In the Replicate Now dialog box, shown in Figure 2-43, click OK.

FIGURE 2-43 The Replicate Now dialog box

6. In the Active Directory Sites And Services console, click the Sites\SYD-SITE\Servers\SYD-DC\NTDS Settings node.

7. In the Actions pane, click <Automatically Generated> and then click Replicate Now on the Action menu.

8. In the Replicate Now dialog box, click OK.

Exercise 7: Configure ADL-DC as an RODC

In this exercise, you configure ADL-DC as an RODC in the ADL-SITE Active Directory site. To complete this exercise, perform the following steps:

1. Sign on to ADL-DC as Administrator with the password Pa$$w0rd.

2. In the Local Server node of the Server Manager console, verify that the Ethernet address is set to 10.10.10.20 as shown in Figure 2-44.

FIGURE 2-44 Verify the ADL-DC IP address

3. On the Manage menu, click Add Roles And Features.

4. On the Before You Begin page of the Add Roles And Features Wizard, click Next three times.

5. On the Select Server Roles page, enable the Active Directory Domain Services check box.

6. On the Add Roles And Features Wizard pop-up, click Add Features.

7. On the Select Server Roles page, click Next three times and click Install. Click Close to close the Add Roles And Features Wizard.

8. Click the Notification icon next to the Manage menu on the Server Manager console and click Promote This Server To A Domain Controller as shown in Figure 2-45.

FIGURE 2-45 Promote this server to a domain controller

9. On the Deployment Configuration page of the Active Directory Domain Services Configuration Wizard, click Select.

10. On the Credentials For Deployment Operation dialog box, type contoso\don_funk and Pa$$w0rd as shown in Figure 2-46 and then click OK.

FIGURE 2-46 Provide deployment credentials

11. On the Select A Domain from the Forest dialog box, click Contoso.com and then click OK.

12. On the Deployment Configuration page, click Next.

13. On the Domain Controller Options page, click the Read Only Domain Controller (RODC) check box, type the DSRM password as Pa$$w0rd, and ensure that the site name is set to ADL-SITE as shown in Figure 2-47. Click Next.

FIGURE 2-47 Verify the RODC deployment options

14. On the RODC Options page, shown in Figure 2-48, review the list of accounts that are blocked from password replication and click Next.

FIGURE 2-48 The RODC password replication options

15. On the Additional Options page, use the Replicate From drop-down menu to specify that replication should occur from SYD-DC.contoso.com, click Next three times, and click Install.

16. After ADL-DC restarts, sign on as Contoso\don_funk with the password Pa$$w0rd.

Exercise 8: Configure RODC replication

In this exercise, you configure replication for ADL-DC, which you configured as an RODC in the previous exercise. To complete this exercise, perform the following steps:

1. Sign on to SYD-DC as Contoso\don_funk with the password Pa$$w0rd.

2. On the Tools menu, click Active Directory Administrative Center.

3. In the Active Directory Administrative Center, click Contoso (Local).

4. In the details pane of the Active Directory Administrative Center, double-click the Users container.

5. Under the Users section in the Tasks pane, click New and then click Group.

6. In the Create Group dialog box, type the group name as ADL-Replicated-Accounts as shown in Figure 2-49 and click OK.

FIGURE 2-49 Create a security group

7. Double-click the Contoso (Local) node and then double-click the Domain Controllers node.

8. In the Details pane, click ADL-DC and click Properties.

9. In the ADL-DC dialog box, click Extensions, click the Password Replication Policy tab, and click Add.

10. In the Add Groups, Users And Computers dialog box, select the Allow Passwords For The Account To Replicate To This RODC option as shown in Figure 2-50 and click OK.

FIGURE 2-50 Specify the password replication options

11. On the Select Users, Computers, Service Accounts, Or Groups dialog box, type ADL-Replicated-Accounts, click Check Names, and click OK.

12. Verify that the ADL-DC dialog box matches Figure 2-51 and click OK.

FIGURE 2-51 Verify the password replication options

Exercise 9: View account passwords replicated to ADL-DC

In this exercise, you create a user account and add it to the group that has its password replicated to ADL-DC. You also add the account of a user who should not have his or her password replicated to the RODC to this group. You then trigger replication and verify which accounts have had password information replicated. To complete this exercise, perform the following steps:

1. While signed on to SYD-DC as Contoso\don_funk, click Active Directory Users And Computers in the Tools menu of the Server Manager console.

2. In the Active Directory Users And Computers console, expand Contoso.com and click the Users container.

3. On the Action menu, click New and click User.

4. On the New Object – User dialog box, type kim_akers in the Full Name and User Logon Name text boxes as shown in Figure 2-52 and click Next.

FIGURE 2-52 Create a new user account

5. On the New Object – User dialog box, type Pa$$w0rd in the Password and Confirm Password dialog boxes, click Next, and click Finish.

6. In the Active Directory Users And Computers console, click Don Funk. Hold down the Ctrl key and click kim_akers.

7. On the Action menu, click Add To A Group.

8. On the Select Groups dialog box, type ADL-Replicated-Accounts as shown in Figure 2-53, click Check Names, and click OK. Click OK to dismiss the Active Directory Domain Services dialog box.

FIGURE 2-53 Add a user to a group

9. In the Active Directory Users And Computers console, click the Domain Controllers node.

10. Right-click ADL-DC and click Properties.

11. On the Password Replication Policy tab, click Advanced.

12. In the Advanced Password Replication Policy for ADL-DC dialog box, click Prepopulate Passwords.

13. In the Select Users Or Computers dialog, type Don Funk;kim_akers, click Check Names, and then click OK.

14. In the Prepopulate Passwords dialog box, shown in Figure 2-54, click Yes.

FIGURE 2-54 Prepopulate the passwords

15. On the Prepopulate Password Errors list, verify that Don Funk is listed as shown in Figure 2-55. This is because the Don Funk account belongs to a group that restricts its password from being replicated to the RODC. Click OK.

FIGURE 2-55 Verify the account prepopulation error

16. Verify that the kim_akers account password has been replicated to the RODC as shown in Figure 2-56 and click Close.

FIGURE 2-56 Verify the password replication

Exercise 10: Monitor replication with repadmin

In this exercise, you monitor replication settings from the command prompt with repadmin. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to MEL-DC as contoso\don_funk.

2. Right-click the Windows PowerShell item on the task bar and click Run As Administrator.

3. In the User Account Control dialog box, click Yes.

4. In the Windows PowerShell window, type the following command as shown in Figure 2-57 and press Enter to generate a replication summary:

repadmin /replsummary

FIGURE 2-57 The output of repadmin /replsummary

5. In the Windows PowerShell window, type the following command as shown in Figure 2-58 and press Enter to generate a list of accounts that have passwords replicated to RODC ADL-DC:

repadmin /prp view adl-dc reveal

FIGURE 2-58 The output of the repadmin /prp command

6. In the Windows PowerShell window, type the following command as shown in Figure 2-59 and press Enter to force the KCC to recalculate the inbound replication topology:

repadmin /kcc

FIGURE 2-59 Trigger the recalculation of the replication topology

7. In the Windows PowerShell window, type the following command as shown in Figure 2-60 and press Enter to display the most recent inbound replication activity:

repadmin /showrepl

FIGURE 2-60 View the recent replication

8. In the Windows PowerShell window, type the following command as shown in Figure 2-61 and press Enter to force the domain controller to replicate with all replication partners:

repadmin /syncall

FIGURE 2-61 Trigger synchronization

Exercise 11: Remove the RODC and reset accounts

In this exercise, you delete the RODC and configure all computer and user accounts on the RODC to be reset. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to SYD-DC as Contoso\don_funk.

2. On the Tools menu of the Server Manager console, click Active Directory Users And Computers.

3. In the Active Directory Users And Computers console, expand the Contoso.com\Domain Controllers node.

4. Right-click ADL-DC and click Delete.

5. In the Active Directory Domain Services dialog box, click Yes.

6. In the Deleting Domain Controller dialog box, click Browse.

7. Configure the Save As dialog box so that you save the file as reset_accounts.csv on the Desktop.

8. Ensure that the Reset All Passwords For User Accounts That Were Cached On This Read-Only Domain Controller, Reset All Passwords For Computer Accounts That Were Cached On This Read-Only Domain Controller, and Export The List Of Accounts That Were Cached On This Read-Only Domain Controller check boxes are selected as shown in Figure 2-62 and click Delete.

FIGURE 2-62 Delete the RODC account

9. In the Delete Domain Controller dialog box, review the warnings and click OK.

10. In the Delete Domain Controller dialog box, shown in Figure 2-63, click Yes.

FIGURE 2-63 Verify the domain controller deletion

11. Verify that ADL-DC is no longer listed as a domain controller.

12. On the desktop of SYD-DC, right-click Reset_accounts.csv and click Edit.

13. Review the list of reset accounts.

Suggested practice exercises

The following additional practice exercises are designed to give you more opportunities to practice what you’ve learned and to help you successfully master the lessons presented in this chapter.

Exercise 1 Use Windows PowerShell to create a subnet for use with an Active Directory site that uses the 10.10.100.0/24 IP address range.

Exercise 2 Use Windows PowerShell to create a site named LON-SITE that is associated with the subnet created in the previous exercise.

Exercise 3 Use Windows PowerShell to create a site link that joins LON-SITE with MEL-SITE.

Answers

This section contains the answers to the lesson review questions in this chapter.

Lesson 1

1. Correct answer: A

A. Correct. Restarting this service will reregister a specific domain controller’s SRV records in DNS.

B. Incorrect. This service allows for processes to start under alternate credentials. Restarting this service will not reregister a specific domain controller’s SRV records.

C. Incorrect. Although this service allows a domain controller to function as a domain controller, restarting this service does not reregister a specific domain controller’s SRV records.

D. Incorrect. Although a DNS server hosts SRV records, restarting this service does not reregister a specific domain controller’s SRV records.

2. Correct answer: C

A. Incorrect. You use the New-ADReplicationSubnet cmdlet to create a new Active Directory subnet.

B. Incorrect. You use the New-ADReplicationSiteLink cmdlet to create site link connecting sites.

C. Correct. You use the Move-ADDirectoryServer cmdlet to move a domain controller to a different Active Directory site.

D. Incorrect. You use the New-ADReplicationSite cmdlet to create a new Active Directory site.

3. Correct answer: D

A. Incorrect. You use the New-ADReplicationSiteLink cmdlet to create site link connecting sites.

B. Incorrect. You use the Move-ADDirectoryServer cmdlet to move a domain controller to a different Active Directory site.

C. Incorrect. You use the New-ADReplicationSite cmdlet to create a new Active Directory site.

D. Correct. You use the New-ADReplicationSubnet cmdlet to create a new Active Directory subnet. Active Directory subnets enable Active Directory to recognize IP address ranges and to use those ranges when calculating replication topologies.

4. Correct answer: A

A. Correct. You use the New-ADReplicationSite cmdlet to create a new Active Directory site. When creating the site, you can associate it with an existing subnet.

B. Incorrect. You use the New-ADReplicationSubnet cmdlet to create a new Active Directory subnet.

C. Incorrect: You use the Move-ADDirectoryServer cmdlet to move a domain controller to a different Active Directory site.

D. Incorrect. You use the New-ADReplicationSiteLink cmdlet to create site link connecting sites.

5. Correct answer: C

A. Incorrect. You use the New-ADReplicationSite cmdlet to create a new Active Directory site.

B. Incorrect. You use the New-ADReplicationSubnet cmdlet to create a new Active Directory subnet.

C. Correct. You use the New-ADReplicationSiteLink cmdlet to create site link connecting sites.

D. Incorrect. You use the Move-ADDirectoryServer cmdlet to move a domain controller to a different Active Directory site.

Lesson 2

1. Correct answer: A

A. Correct. Repadmin /prp view [DC Name] reveal lists all of the accounts that have replicated to a specific RODC. You can’t use this command with a writable domain controller.

B. Incorrect. Repadmin /replsummary provides information about the failure percentages of inbound and outbound replication in the form of a report.

C. Incorrect. Repadmin /kcc forces the KCC to recalculate inbound replication topology.

D. Incorrect. Repadmin /showrepl shows the status of the domain controller’s last attempt to perform inbound replication.

E. Incorrect. Repadmin /syncall forces the local or targeted domain controller to sync with all replication partners.

2. Correct answer: D

A. Incorrect. Repadmin /prp view [DC Name] reveal lists all of the accounts that have replicated to a specific RODC. You can’t use this command with a writable domain controller.

B. Incorrect. Repadmin /syncall forces the local or targeted domain controller to sync with all replication partners.

C. Incorrect. Repadmin /showrepl shows the status of the domain controller’s last attempt to perform inbound replication.

D. Correct. Repadmin /kcc forces the KCC to recalculate inbound replication topology.]

E. Incorrect. Repadmin /replsummary provides information about the failure percentages of inbound and outbound replication in the form of a report.

3. Correct answer: E

A. Incorrect. Repadmin /showrepl shows the status of the domain controller’s last attempt to perform inbound replication.

B. Incorrect. Repadmin /syncall forces the local or targeted domain controller to sync with all replication partners.

C. Incorrect. Repadmin /kcc forces the KCC to recalculate inbound replication topology.

D. Incorrect. Repadmin /prp view [DC Name] reveal lists all of the accounts that have replicated to a specific RODC. You can’t use this command with a writable domain controller.

E. Correct. Repadmin /replsummary provides information about the failure percentages of inbound and outbound replication in the form of a report.

4. Correct answer: B

A. Incorrect. Repadmin /showrepl shows the status of the domain controller’s last attempt to perform inbound replication.

B. Correct. Repadmin /syncall forces the local or targeted domain controller to sync with all replication partners.

C. Incorrect. Repadmin /kcc forces the KCC to recalculate inbound replication topology.

D. Incorrect. Repadmin /replsummary provides information about the failure percentages of inbound and outbound replication in the form of a report.

E. Incorrect. Repadmin /prp view [DC Name] reveal lists all the accounts that have replicated to a specific RODC. You can’t use this command with a writable domain controller.

5. Correct answer: C

A. Incorrect. Repadmin /syncall forces the local or targeted domain controller to sync with all replication partners.

B. Incorrect. Repadmin /kcc forces the KCC to recalculate inbound replication topology.

C. Correct. Repadmin /showrepl shows the status of the domain controller’s last attempt to perform inbound replication.

D. Incorrect. Repadmin /replsummary provides information about the failure percentages of inbound and outbound replication in the form of a report.

E. Incorrect. Repadmin /prp view [DC Name] reveal lists all the accounts that have replicated to a specific RODC. You can’t use this command with a writable domain controller.

6. Correct answer: C

A. Correct. When you delete the computer account of an RODC, you have the option of resetting the passwords of all user accounts that had passwords stored on the RODC. If you do this, you need to assign users new passwords and inform them of the change.

B. Incorrect. Although you can reset the passwords of user accounts, removing an RODC does not give you the option of disabling computer accounts.

C. Correct. When you delete the computer account of an RODC, you have the option of resetting computer account passwords of computer accounts that had passwords stored on the RODC. If you do this, you need to rejoin these computers to the domain.

D. Incorrect. Although you can reset the passwords of computer accounts, removing an RODC does not give you the option of disabling computer accounts.

7. Correct answer: B

A. Incorrect. The Windows Server 2003 domain functional level does not support upgrading SYSVOL replication so that it uses DFS instead of FRS.

B. Correct. The Windows Server 2008 domain functional level is the minimum required to support upgrading SYSVOL replication so that it uses DFS instead of FRS.

C. Incorrect. The Windows Server 2008 domain functional level, rather than the Window Server 2008 R2 domain functional level, is the minimum required to support upgrading SYSVOL replication so that it uses DFS instead of FRS.

D. Incorrect. The Windows Server 2008 domain functional level, rather than the Window Server 2012 domain functional level, is the minimum required to support upgrading SYSVOL replication so that it uses DFS instead of FRS.

8. Correct answer: A

A. Correct. You can use dfsrmig.exe to determine if FRS or DFS is being used for SYSVOL replication. You can also use dfsrmig.exe to migrate from using FRS to using DFS to support SYSVOL replication.

B. Incorrect. Although you use repadmin.exe to manage Active Directory replication, you can’t use repadmin.exe to determine if FRS or DFS is being used to support SYSVOL replication.

C. Incorrect. Although dcdiag.exe provides domain controller diagnostics, it cannot be used to determine if FRS or DFS is being used to support SYSVOL replication.

D. Incorrect. You use dnscmd.exe to manage DNS. You can’t use dnscmd.exe to determine if FRS or DFS is being used to support SYSVOL replication.