Training Guide Configuring Advanced Windows Server 2012 R2 Services(2014)

---

Lesson summary

IPAM enables you to centrally manage DHCP and DNS servers.

You cannot deploy the IPAM server on a domain controller. You should not deploy a DNS or DHCP server on the IPAM server if you want to manage those servers using IPAM.

The IPAM server must be a member of an Active Directory domain and can only manage DHCP and DNS servers that are members of the same forest.

You can use IP address tracking to search the IPAM database on the basis of IP address, MAC address, computer name, or user name.

Members of the Domain Admins and Enterprise Admins groups have full administrative access to the IPAM server. There are five local security groups on the IPAM server that you can use to delegate administrative privileges.

The IPAM role available with Windows Server 2012 R2 can use a SQL Server 2012 instance to host the IPAM database.

Lesson review

Answer the following questions to test your knowledge of the information in this lesson. You can find the answers to these questions and explanations of each answer choice in the “Answers” section at the end of this chapter.

1. You need to give a user the ability to view IP address tracking information stored in your organization’s IPAM server without adding him or her to the IPAM Administrators group. To which of the following IPAM-related security groups could you add this user to grant this privilege?

A. IPAM Users

B. IPAM IP Audit Administrators

C. IPAM MSM Administrators

D. IPAM ASM Administrators

2. You need to give a user the ability to manage the IP Address Space on an IPAM server without adding the user to the IPAM Administrators group. To which of the following IPAM-related security groups could you add this user to grant this privilege?

A. IPAM MSM Administrators

B. IPAM Users

C. IPAM ASM Administrators

D. IPAM IP Audit Administrators

3. You want to use IPAM’s IP address tracking feature to determine which IP addresses a computer with a specific MAC address was assigned by your organization’s DHCP servers during a particular week. Which of the following categories should you search on to accomplish this goal?

A. IP address

B. Client ID

C. Host name

D. User name

4. You are in the process of configuring IPAM. You have run the discovery process and discovered three servers that host the DHCP server role. The server’s IPAM Access Status is listed in the IPAM Server Inventory as Blocked. Which of the following steps should you take so that this status changes to unblocked? (Choose two.)

A. Ensure that you have provisioned the GPOs using the Invoke-IpamGPOProvisioning cmdlet.

B. Verify that Group Policy is applied correctly to the server hosting the IPAM server role.

C. Verify that Group Policy is applied correctly to the three servers hosing the DHCP server role.

D. Restart the IPAM server.

Practice exercises

The goal of this section is to provide you with hands-on practice with the following:

Configuring DNSSEC

Configuring NRPT

Creating GlobalNames zone

Configuring advanced DNS server options

Configuring a DHCP superscope

Deploying a split scope

Configuring DHCP Name Protection

Setting up a multicast scope

Enabling DHCP failover

Configuring and deploying IPAM

To perform the exercises in this section, you need access to an evaluation version of Windows Server 2012 R2. You should also have access to virtual machines SYD-DC, MEL-DC, CBR-DC, and ADL-DC, the setup instructions for which are described in the Introduction. You should ensure that you have a checkpoint of these virtual machines that you can revert to at the end of the practice exercises. You should revert the virtual machines to this initial state prior to beginning these exercises.

Exercise 1: Configure MEL-DC

In this exercise, you configure MEL-DC to be a member of the contoso.com domain. To complete this exercise, perform the following steps:

1. Ensure that SYD-DC is started.

2. Start MEL-DC and sign on as Administrator with the password Pa$$w0rd.

3. On the Local Server node of the Server Manager console, verify that the local IP address is set to 10.10.10.40 and then click on the WORKGROUP link next to Workgroup.

4. On the Computer Name tab of the System Properties dialog box, click Change.

5. In the Computer Name/Domain Changes dialog box, click Domain and type contoso.com as shown in Figure 3-25 and then click OK.

FIGURE 3-25 Join the domain

6. In the Windows Security dialog box, type the user name don_funk and the password Pa$$word and then click OK.

7. On the Computer Name/Domain Changes dialog box, shown in Figure 3-26, click OK.

FIGURE 3-26 Verify the domain join

8. In the dialog box that informs you that you need to restart the computer to apply changes, click OK.

9. Click Close on the System Properties dialog box.

10. Click Restart Now on the Microsoft Windows dialog box.

11. When MEL-DC restarts, sign in as contoso\don_funk with the password Pa$$w0rd.

Exercise 2: Configure DNSSEC

In this exercise, you configure DNSSEC on the contoso.com zone. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to SYD-DC as contoso\don_funk.

2. From the Tools menu of the Server Manager console, click DNS.

3. In the DNS Manager console, expand the SYD-DC\Forward Lookup Zones node and click the Contoso.com node.

4. Verify that the records present in the Contoso.com zone match those shown in Figure 3-27.

FIGURE 3-27 The unsigned DNS zone

5. On the Action menu, click DNSSEC and click Sign The Zone.

6. On the DNS Security Extensions (DNSSEC) page of the Zone Signing Wizard, click Next.

7. On the Signing Options page, click Use Default Settings To Sign The Zone as shown in Figure 3-28 and click Next.

FIGURE 3-28 Configure zone signing options

8. On the DNS Security Extensions (DNSSEC) page, verify that the Key Master is set to SYD-DC as shown in Figure 3-29 and click Next.

FIGURE 3-29 Verify the Key Master is SYD-DC

9. On the Signing The Zone page of the Zone Signing Wizard, click Finish.

10. On the Action menu of the DNS Manager console, click Refresh and verify the presence of the new DNS records as well as the DNSSEC icon on the zone as shown in Figure 3-30.

FIGURE 3-30 View the signed DNS zone

Exercise 3: Configure the name resolution policy

In this exercise, you configure the Group Policy so that clients will verify the integrity of DNS records in the contoso.com zone. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to SYD-DC as contoso\don_funk.

2. On the Tools menu of the Server Manager console, click Group Policy Management.

3. In the Group Policy Management Console, expand the Forest: Contoso.com node, expand the Domains node, expand the Contoso.com node, and click Default Domain Policy as shown in Figure 3-31. Click OK on the Group Policy Management Console dialog box.

FIGURE 3-31 Configure the Name Resolution Policy

4. On the Action menu, click Edit.

5. In the Group Policy Management Editor, expand the Computer Configuration\Policies\Windows Settings node and click Name Resolution Policy.

6. In the Name Resolution Policy area, type contoso.com in the text box next to the Suffix drop-down menu, select the Enable DNSSEC in This Rule check box, and select the Require DNS Clients To Check That Name And Address Data Has Been Validated By The DNS Server as shown in Figure 3-32. Click Create.

FIGURE 3-32 Configure the Name Resolution Policy

7. In the Group Policy Management Editor, scroll down to view the Name Resolution Policy Table and verify that the settings match those shown in Figure 3-33. Click Apply.

FIGURE 3-33 Verify the Name Resolution Policy

8. Close the Group Policy Management Editor and the Group Policy Management Console.

9. On the taskbar, click the Windows PowerShell icon.

10. Type the following command and press Enter to force a Group Policy update

Gpupdate /force

11. Type the following command and press Enter to verify that an RRSIG record exists for mel-dc.contoso.com as shown in Figure 3-34:

resolve-dnsname mel-dc.contoso.com –server syd-dc -dnssecok

FIGURE 3-34 Verify the DNS record

12. Close the Windows PowerShell window.

Exercise 4: Increase the size of the DNS socket pool

In this exercise, you increase the size of the DNS socket pool. To complete this exercise, perform the following steps:

1. When signed on to SYD-DC as contoso\don_funk, right-click the Windows PowerShell icon on the taskbar and click Run As Administrator. Click Yes in the User Account Control dialog box.

2. Type the following command and press Enter to view the currently configured DNS socket pool site:

(Get-DNSServer).ServerSetting.SocketPoolSize

3. Type the following command and press Enter to change the DNS socket pool size to 4,000:

Dnscmd /config /socketpoolsize 4000

4. Type the following command and press Enter:

Restart-Service DNS

5. Type the following command and press Enter to verify the new DNS socket pool size:

(Get-DNSServer).ServerSetting.SocketPoolSize

Exercise 5: Modify DNS Cache Locking

In this exercise, you verify the current DNS Cache Locking setting, change this setting, and then verify the change. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to SYD-DC as contoso\don_funk and have an elevated Windows PowerShell window open.

2. Type the following command and press Enter to verify the size of the current DNS cache locking setting as shown in Figure 3-35:

get-DNSServerCache

FIGURE 3-35 View the DNS Server cache settings

3. Configure the cache locking percentage to 80 percent by typing the following command and pressing Enter:

Set-DNSServerCache –LockingPercent 80

4. Restart the DNS Server service to apply the changes by typing the following command and pressing Enter:

Restart-Service DNS

5. Verify the alterations to the cache locking by typing the following command as shown in Figure 3-36 and pressing Enter:

get-DNSServerCache

FIGURE 3-36 Verify the DNS server cache settings

Exercise 6: Create and manage a GlobalNames zone

In this exercise, you configure single-name resolution by configuring a GlobalNames zone. You then create a record in the GlobalNames zone. To complete this exercise, perform the following steps:

1. While signed on to SYD-DC as contoso\don_funk, open the DNS Manager console by clicking DNS in the Tools menu of the Server Manager console.

2. In the DNS Manager console, click the Forward Lookup Zones node under SYD-DC.

3. On the Action menu, click New Zone.

4. On the Welcome page of the New Zone Wizard, click Next.

5. On the Zone Type page, click Primary Zone, ensure that Store The Zone In Active Directory is selected, and click Next.

6. On the Active Directory Zone Replication Scope page, click To All DNS Servers Running On Domain Controllers In This Forest: Contoso.com and click Next.

7. In the Zone Name page, type GlobalNames, as shown in Figure 3-37, and click Next.

FIGURE 3-37 The zone name

8. On the Dynamic Update page, click Do Not Allow Dynamic Updates and click Next.

9. On the Completing The New Zone Wizard page, click Finish.

10. Switch to the elevated Windows PowerShell window, type the following command, and press Enter.

Set-DNSServerGlobalNameZone –ComputerName SYD-DC –Enable $True

11. Type the following command and press Enter to verify that the GlobalNameZone is enabled as shown in Figure 3-38:

Get-DNSServerGlobalNameZone

FIGURE 3-38 Verify the DNS configuration

12. Switch to the DNS Manager console and click the GlobalNames zone under Forward Lookup Zones.

13. On the Action menu, click New Alias (CNAME).

14. In the New Resource Record dialog box, configure the following information, as shown in Figure 3-39, and click OK:

Alias Name (Uses Parent Domain If Left Blank): Bondi

Fully Qualified Domain Name (FQDN) For Target Host: syd-dc.contoso.com

FIGURE 3-39 The CNAME record

Exercise 7: Configure and view the DNS event log

In this exercise, you configure event logging for the DNS service. To complete this exercise, perform the following steps:

1. While signed on to SYD-DC as contoso\don_funk, open the DNS Manager console.

2. In the DNS Manager console, right-click SYD-DC and click Properties.

3. On the SYD-DC Properties dialog box, click the Event Logging tab.

4. On the Event Logging tab, ensure that All Events are selected as shown in Figure 3-40 and click OK.

FIGURE 3-40 The DNS event log settings

5. In the Tools menu of the Server Manager console, click Event Viewer.

6. In the Event Viewer Console, expand the Applications And Service Logs node and click DNS Server.

7. In the DNS Server log, look for Event ID 7646 which confirms that the zone contoso.com is now signed with DNSSEC as shown in Figure 3-41.

FIGURE 3-41 The DNS event

8. View the DNS event in the event log.

Exercise 8: Verify netmask ordering and disable recursion

In this exercise, you verify that netmask ordering is enabled on the DNS server hosted on SYD-DC. You also disable recursion. To complete this exercise, perform the following steps:

1. While signed on to SYD-DC as contoso\don_funk, switch to the DNS Manager console.

2. In the DNS Manager console, right-click the SYD-DC node and click Properties.

3. On the SYD-DC Properties dialog box, click the Advanced tab.

4. On the Advanced Tab of the SYD-DC Properties dialog box, select Disable Recursion (Also Disables Forwarders) and verify that Enable Netmask Ordering is enabled as shown in Figure 3-42.

FIGURE 3-42 Enable netmask ordering

5. Click OK to close the SYD-DC Properties dialog box.

6. Close the DNS Manager console.

Exercise 9: Install and activate the DHCP role

In this exercise, you install the DHCP role on MEL-DC and SYD-DC. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to SYD-DC as contoso\don_funk.

2. In the Server Manager console on SYD-DC, click the All Servers node.

3. On the Manage menu, click Add Servers

4. In the Add Servers dialog box, click Find Now.

5. In the Add Servers dialog box, click MEL-DC and click the arrow to add it to the Selected box as shown in Figure 3-43. Click OK.

FIGURE 3-43 Add servers

6. Right-click SYD-DC and click Start Performance Counters.

7. Right-click MEL-DC and click Start Performance Counters.

8. In the Manage menu of the Server Manager console, click Add Roles And Features.

9. On the Before You Begin page of the Add Roles And Features Wizard, click Next.

10. On the Select Installation Type Page, click Role-Based or Feature-Based Installation and click Next.

11. On the Select Destination Server page, click MEL-DC.contoso.com as shown in Figure 3-44 and click Next.

FIGURE 3-44 Select a server to manage

12. On the Select Server Roles page, click the DHCP Server check box.

13. In the Add Roles And Features Wizard dialog box, click Add Features.

14. On the Select Server Roles page, click Next three times and then click Install.

15. When the installation completes, click Close on the Installation Progress page of the Add Roles And Features Wizard.

16. On the Manage menu, click Add Roles And Features.

17. On the Before You Begin page of the Add Roles And Features Wizard, click Next twice.

18. In the Select Destination Server page, click SYD-DC.contoso.com and click Next.

19. On the Select Server Roles page, click the DHCP Server check box as shown in Figure 3-45.

FIGURE 3-45 Add the DHCP server role

20. On the Add Roles And Features Wizard dialog box, click Add Features and then click Next three times. Click Install and then click Close.

21. In the Server Manager console on SYD-DC, click the DHCP Server node.

22. Next to the There Are 2 Jobs With New Notifications message, click More.

23. In the All Servers Task Details dialog box, shown in Figure 3-46, click the Complete DHCP Configuration link next to MEL-DC.

FIGURE 3-46 The post-deployment configuration notice

24. On the Description page of the DHCP Post-Install Configuration Wizard, click Next.

25. On the Authorization page, verify that the user credentials are set to CONTOSO\don_funk as shown in Figure 3-47, click Commit, and then click Close.

FIGURE 3-47 Configure the credentials

26. In the All Servers Task Details dialog box, click the Complete DHCP Configuration link next to SYD-DC.

27. On the Description page of the DHCP Post-Install Configuration Wizard, click Next.

28. On the Authorization page, verify that CONTOSO\don_funk is listed as the credentialed user, click Commit, and then click Close.

29. Verify that the Stage is listed as complete on the All Servers Task Details And Notifications dialog box as shown in Figure 3-48 and then click the close icon on the title bar.

FIGURE 3-48 Verify the completion of tasks

Exercise 10: Create a DHCP superscope

In this exercise, you create a DHCP superscope. To complete this exercise, perform the following steps:

1. Ensure that you are signed on to SYD-DC with the contoso\don_funk user account.

2. On the Tools menu of the Server Manager console, click DHCP.

3. In the DHCP console, expand Syd-dc.contoso.com and click IPv4 as shown in Figure 3-49.

FIGURE 3-49 The DHCP console

4. On the Action menu, click New Scope.

5. On the Welcome To The New Scope Wizard page, click Next.

6. On the Scope Name page, in the Name text box, type Scope-A and click Next.

7. On the IP Address Range page, in the Start IP Address text box, enter the following information as shown in Figure 3-50 and click Next three times:

Start IP Address: 192.168.200.10

End IP Address: 192.168.200.230

Length: 24

Subnet Mask: 255.255.255.0

FIGURE 3-50 The IP Address Range

8. On the Configure DHCP Options page, verify that Yes, I Want To Configure These Options Now is selected and click Next.

9. On the Router (Default Gateway) page, type 192.168.200.1 as shown in Figure 3-51 and click Add. Click Next three times.

FIGURE 3-51 Configure the default gateway

10. On the Activate Scope page, click No, I Will Activate This Scope Later, click Next, and then click Finish.

11. In the DHCP console, click the IPv4 node, and on the Action menu click New Scope.

12. On the Welcome To The New Scope Wizard page, click Next.

13. On the Scope Name page, in the Name text box, type Scope-B and click Next.

14. On the IP Address Range page, in the Start IP Address text box, enter the following information and click Next three times:

Start IP Address: 192.168.201.10

End IP Address: 192.168.201.230

Length: 24

Subnet Mask: 255.255.255.0

15. On the Configure DHCP Options page, verify that the Yes, I Want To Configure These Options Now option is selected and click Next.

16. On the Router (Default Gateway) page, type 192.168.201.1 as shown in Figure 3-52 and click Add. Click Next three times.

FIGURE 3-52 Configure the default gateway

17. On the Activate Scope page, click No, I Will Activate This Scope Later, click Next, and click Finish.

18. In the DHCP console, click the IPv4 node. On the Action menu, click New Superscope.

19. On the Welcome To The New Superscope Wizard page, click Next.

20. On the Superscope Name page, type the name SYD-Superscope and click Next.

21. On the Select Scopes page, hold the Ctrl key and click [192.168.200.0] Scope-A and [192.168.201.0] Scope-B as shown in Figure 3-53. Click Next.

FIGURE 3-53 Create a superscope

22. On the Completing The New Superscope Wizard page, click Finish.

23. In the DHCP console, click Superscope SYD-Superscope as shown in Figure 3-54, and, on the Action menu, click Activate.

FIGURE 3-54 Verify the superscope creation

Exercise 11: Create a split scope

In this exercise, you configure a split scope that is hosted on SYD-DC and MEL-DC. To complete this exercise, perform the following steps:

1. In the DHCP console on SYD-DC, click the DHCP node, and on the Action menu click Add Server.

2. In the Add Server dialog box, click This Authorized DHCP Server and click Mel-dc.contoso.com as shown in Figure 3-55. Click OK.

FIGURE 3-55 Add an additional DHCP server

3. In the DHCP console, expand Mel-dc.contoso.com and click the IPv4 node.

4. On the Action menu, click New Scope.

5. On the Welcome To The New Scope Wizard page, click Next.

6. On the Scope Name page, type SplitScope-A and click Next.

7. On the IP Address Range page, enter the following as shown in Figure 3-56 and click Next three times:

Start IP Address: 192.168.210.100

End IP Address: 192.168.210.180

Length: 24

Subnet Mask: 255.255.255.0

FIGURE 3-56 The address range

8. On the Configure DHCP Options page, verify that the Yes, I Want To Configure These Options Now option is selected and click Next.

9. On the Router (Default Gateway) page, type 192.168.210.1 as shown in Figure 3-57 and click Add. Click Next three times.

FIGURE 3-57 The default gateway address

10. On the Activate Scope page, select the Yes, I Want To Activate This Scope Now option, click Next, and then click Finish.

11. In the DHCP console, click the IPv4 node under Syd-dc.contoso.com.

12. On the Action menu, click New Scope.

13. On the Welcome To The New Scope Wizard, click Next.

14. On the Scope Name page, type SplitScope-B and click Next.

15. On the IP Address Range page, enter the following and click Next three times:

Start IP Address: 192.168.210.181

End IP Address: 192.168.210.200

Length: 24

Subnet Mask: 255.255.255.0

16. On the Configure DHCP Options page, verify that the Yes, I Want To Configure These Options Now option is selected and then click Next.

17. On the Router (Default Gateway) page, type 192.168.210.1 and click Add. Click Next three times.

18. On the Activate Scope page, select the Yes, I Want To Activate This Scope Now option, click Next, and then click Finish.

19. Verify that the DHCP console appears as shown in Figure 3-58.

FIGURE 3-58 Verify the DHCP configuration

Exercise 12: Configure DHCP Name Protection

In this exercise, you configure DHCP Name Protection using the graphical user interface (GUI) and using Windows PowerShell. To complete this exercise, perform the following steps:

1. In the DHCP console on SYD-DC, click the IPv4 node under the Syd-dc.contoso.com node.

2. On the Action menu, click Properties.

3. In the IPv4 Properties dialog box, click the DNS tab.

4. On the DNS tab, shown in Figure 3-59, click Configure.

FIGURE 3-59 The DNS tab

5. On the Name Protection dialog box, check the Enable Name Protection check box as shown in Figure 3-60 and click OK.

FIGURE 3-60 Enable Name Protection

6. Click OK to close the IPv4 Properties dialog box.

7. In an elevated Windows PowerShell window, type the following command as shown in Figure 3-61 and press Enter to verify the status of Name Protection on the DHCP server running on MEL-DC:

Get-DhcpServerv4DnsSetting –Computer MEL-DC

FIGURE 3-61 Verify the Name Protection status

8. In a Windows PowerShell window, type the following command and press Enter to enable Name Protection on the DHCP server hosted on mel-dc.contoso.com:

Set-DhcpServerv4DnsSetting –Computer MEL-DC –NameProtection $true

9. Verify that Name Protection is now enabled on MEL-DC by reissuing the following command as shown in Figure 3-62:

Get-DhcpServerv4DnsSetting –Computer MEL-DC

FIGURE 3-62 Verify Name Protection is enabled

Exercise 13: Create new multicast scopes

In this exercise, you create a new multicast scope that will be hosted on the DHCP server SYD-DC. To complete this exercise, perform the following steps:

1. In the DHCP console on SYD-DC, click the IPv4 node under Syd-dc.contoso.com.

2. In the Action menu, click New Multicast Scope.

3. On the Welcome To The New Multicast Scope Wizard page, click Next.

4. On the Multicast Scope Name page, enter the name Multicast-A and click Next.

5. On the IP Address Range page, configure the following settings as shown in Figure 3-63 and click Next three times:

Start IP Address: 230.100.0.10

End IP Address: 230.100.0.230

FIGURE 3-63 A new multicast range

6. On the Activate Multicast Scope page, shown in Figure 3-64, click Yes, click Next, and click Finish.

FIGURE 3-64 Activate a multicast scope

Exercise 14: Configure DHCP failover

In this exercise, you configure DHCP failover. To complete this exercise, perform the following steps:

1. In the DHCP console on SYD-DC, expand the Syd-dc.contoso.com node and click the IPv4 node.

2. On the Action menu, click Configure Failover.

3. On the Introduction To DHCP Failover page of the Configure Failover Wizard, clear the Select All check box, hold down the Ctrl key and click 192.168.200.0 and 192.168.201.0 as shown in Figure 3-65. Click Next.

FIGURE 3-65 Configure the scopes for failover

4. On the Specify The Partner Server To Use For Failover page, click Add Server.

5. In the Add Server dialog box, select This Authorized DHCP Server and click Mel-dc.contoso.com as shown in Figure 3-66. Click OK and then click Next.

FIGURE 3-66 Add a failover server

6. On the Create A New Failover Relationship page, click the Mode drop-down menu and set it to Hot Standby. Enable the State Switchover Interval and set it to 60 Minutes as shown in Figure 3-67. Type the Shared Secret as Pa$$w0rd. Click Next, click Finish, and click Close.

FIGURE 3-67 Create a failover relationship

7. In the DHCP console, click the IPv4 node under Syd-dc.contoso.com, and on the Action menu, click Properties.

8. On the Failover tab, verify that the settings listed match Figure 3-68 and click Delete.

FIGURE 3-68 Delete a failover relationship

9. On the Delete Failover Relationship dialog box, click OK and click Close.

10. Click OK to close the IPv4 Properties dialog box.

Exercise 15: Install the IPAM feature

In this exercise, you join server ADL-DC to the domain and install the IPAM feature. To complete this exercise, perform the following steps:

1. Ensure that SYD-DC and MEL-DC remain powered on.

2. Turn on ADL-DC and sign on as Administrator with the password Pa$$w0rd.

3. Open a Windows PowerShell window by clicking the Windows PowerShell icon on the Desktop taskbar.

4. Type the following command and press Enter to join ADL-DC to the contoso.com domain.

Netdom join ADL-DC /domain:contoso.com

5. Restart ADL-DC and sign on as contoso\don_funk.

6. Click on Add Roles And Features on the Manage menu of the Server Manager console.

7. On the Before You Begin page of the Add Roles And Features Wizard, click Next twice.

8. On the Select Destination Server page, ensure that ADL-DC.contoso.com is selected and click Next twice.

9. On the Select Features page, click IP Address Management (IPAM) Server as shown in Figure 3-69.

FIGURE 3-69 Add the IPAM feature

10. On the Add Roles And Features Wizard dialog box, click Add Features, click Next, and then click Install. When the installation completes, click Close.

Exercise 16: Configure IPAM GPOs and server discovery

In this exercise, you configure IPAM-related GPOs. To complete this exercise, perform the following steps:

1. While signed on to ADL-DC, click the IPAM node in the Server Manager console.

2. On the IPAM Server Tasks section, click Provision The IPAM Server.

3. On the Before You Begin page of the Provision IPAM Wizard, click Next.

4. On the Select Provisioning Method page, click Group Policy Based, and in the GPO Name Prefix box type IPAM as shown in Figure 3-70. Click Next.

FIGURE 3-70 Choose a provisioning method

5. On the Summary page, click Apply and then click Close.

6. On the IPAM Server Tasks section of the Server Manager console, click Configure Server Discovery.

7. In the Configure Server Discovery dialog box, click Add as shown in Figure 3-71 and click OK.

FIGURE 3-71 Configure discovery

8. On the IPAM Server Tasks section of the Server Manager console, click Start Server Discovery.

9. Wait 15 minutes for server discovery to complete before starting Exercise 17.

Exercise 17: Configure servers to be managed by IPAM

In this exercise, you configure servers so that they can be managed centrally by IPAM. To complete this exercise, perform the following steps:

1. On the IPAM Server Tasks section, click Select Or Add Servers To Manage And Verify IPAM Access.

2. Both SYD-DC and MEL-DC should be present as shown in Figure 3-72.

FIGURE 3-72 The server inventory

3. Right-click the Windows PowerShell icon on the taskbar and click Run As Administrator.

4. On the User Account Control dialog box, click Yes.

5. In the Windows PowerShell window, type the following command and press Enter:

Invoke-IpamGpoProvisioning –Domain contoso.com –GpoPrefixName IPAM –IpamServerFqdn
ADL-DC.contoso.com –DelegatedGpoUser "contoso\don_funk"

6. When prompted, type Y for Yes, and press Enter.

7. Switch to SYD-DC and ensure that you are signed on as contoso\don_funk.

8. Open an elevated Windows PowerShell prompt, type the following command, and press Enter:

gpupdate /force

9. On SYD-DC, on the Tools menu of the Server Manager console, click Active Directory Users And Computers.

10. Expand the Contoso.com domain and click the Computers container.

11. On the Action menu, click New, and click Group.

12. On the New Object – Group dialog box, enter the following information as shown in Figure 3-73 and click OK:

Group Name: IPAM_Managed_Servers

Group Scope: Universal

Group Type: Security

FIGURE 3-73 Create a security group

13. Right-click the IPAM_Managed_Servers group and click Properties.

14. On the Members tab of the IPAM_Managed_Servers Properties dialog box, click Add.

15. On the Select Users, Contacts, Computers, Service Accounts, Or Other Objects dialog box, click Object Types.

16. On the Object Types dialog box, select the Computers check box and click OK.

17. In the Select Users, Contacts, Computers, Service Accounts, Or Other Objects dialog box, type SYD-DC; MEL-DC, click Check Names, and click OK.

18. Verify that both MEL-DC and SYD-DC are listed as members of the group as shown in Figure 3-74 and click OK.

FIGURE 3-74 Verify group membership

19. On the Tools menu of the Server Manager console on SYD-DC, click Group Policy Management.

20. In the Group Policy Management Console, expand Forest: Contoso.com, Domains, Contoso.com, and click IPAM_DNS.

21. On the Group Policy Management Console pop-up box, click OK.

22. Under Security Filtering, click Add.

23. In the Select User, Computer, Or Group dialog box, type IPAM_Managed_Servers and click OK.

24. Verify that the Group Policy Management Console matches Figure 3-75.

FIGURE 3-75 Group policy filtering

25. Click the IPAM_DHCP policy and click OK to dismiss the Group Policy Management Console.

26. Under Security Filtering, click Add.

27. In the Select User, Computer, Or Group dialog box, type IPAM_Managed_Servers and click OK.

28. Click the IPAM_DC_NPS policy and click OK to dismiss the Group Policy Management Console.

29. Under Security Filtering, click Add.

30. In the Select User, Computer, Or Group dialog box, type IPAM_Managed_Servers and click OK.

31. Restart SYD-DC and MEL-DC to refresh the group membership of these computers.

32. Sign on to each computer as contoso\don_funk, open an elevated Windows PowerShell prompt and type the following command:

Gpupdate /force

33. After you have updated the Group Policy, run the following command on SYD-DC and MEL-DC to verify that the IPAM-related Group Policy Objects apply to the computer as shown in Figure 3-76:

Gpresult /r /scope computer

FIGURE 3-76 Verify the Group Policy application

34. On ADL-DC, open the Server Manager console, click the IPAM node, and when Overview is selected, click Select Or Add Servers To Manage And Verify IPAM Access.

35. When IPv4 is selected, right-click SYD-DC, and click Refresh Server Access Status.

36. Right-click MEL-DC and click Refresh Server Access Status.

37. Wait until the task completes and then click the Refresh icon on the taskbar and verify that both servers are listed as Unblocked, as shown in Figure 3-77.

FIGURE 3-77 Verify the manageability status

Exercise 18: Manage servers using IPAM

In this exercise, you configure SYD-DC and MEL-DC to be managed by IPAM. To complete this exercise, perform the following steps:

1. On ADL-DC, in the Server Manager console, with the Server Inventory section of the IPAM area selected, right-click Mel-dc, and click Edit Server.

2. In the Add Or Edit Server dialog box, set the Manageability Status to Managed as shown in Figure 3-78 and click OK.

FIGURE 3-78 Configure the server manageability

3. Right-click SYD-DC, and click Edit Server.

4. In the Add Or Edit Server dialog box, set the Manageability Status to Managed, and click OK.

5. Verify that both servers now have the status of Managed and Unblocked as shown in Figure 3-79.

FIGURE 3-79 Verify successful configuration

Exercise 19: Use IPAM to create a DHCP scope

In this exercise, you use IPAM to create a DHCP scope on MEL-DC. To complete this exercise, perform the following steps:

1. While signed on to ADL-DC as contoso\don_funk, click the IPAM node in the Server Manager console, and then click DNS and DHCP under Monitor and Manage.

2. Right-click Mel-dc.contoso.com, and click Create DHCP Scope.

3. In the Create DHCP Scope dialog box, enter the following information as shown in Figure 3-80 and click OK:

Scope Name: IPAM_Scope_A

Start IP Address: 192.168.250.10

End IP Address: 192.168.250.230

Subnet Mask: 255.255.255.0

FIGURE 3-80 Create a DHCP scope

Exercise 20: Use IPAM to manage IP addresses

In this exercise, you use IPAM to manage IP addresses, including creating address blocks, creating reservations, and managing DNS records. To complete this exercise, perform the following steps:

1. While signed on to ADL-DC as contoso\don_funk, click the IPAM node in the Server Manager console, and then click IP Address Blocks under IP Address Space.

2. Click Tasks, and click Add IP Address Block.

3. In the Add Or Edit IPv4 Address Block dialog box, enter the following information as shown in Figure 3-81 and click OK:

Network ID: 172.16.10.0

Prefix Length: 24

Description: Perth Office

FIGURE 3-81 Add an IPv4 address block

4. Click the IP Address Inventory node. In the Tasks menu, click Add IP Address.

5. In the Add IPv4 Address dialog box shown in Figure 3-82, enter the following information and click OK:

IP Address: 172.16.10.20

MAC Address: AA-BB-CC-DD-EE-00

Device Type: Host

Device Name: PER-DC

Forward Lookup Zone: Contoso.com

Forward Lookup Primary Server: SYD-DC.contoso.com

FIGURE 3-82 Configure a DNS record

6. Right-click the PER-DC IP Address Inventory Record, and click Create DNS Host Record.

7. Click the Windows PowerShell icon on the taskbar.

8. In the Windows PowerShell window, type the following command to verify that the DNS record has been created as shown in Figure 3-83:

Resolve-dnsname per-dc.contosoc.com

FIGURE 3-83 Verify the DNS record

Suggested practice exercises

The following additional practice exercises are designed to give you more opportunities to practice what you’ve learned and to help you successfully master the lessons presented in this chapter.

Exercise 1 Use IPAM to create a DHCP scope on SYD-DC for the 172.16.10.0 /24 IP Address Range.

Exercise 2 Reset the DNS socket pool on SYD-DC to its original value.

Exercise 3 Create a new DNS zone named Margiestravel.com and configure it to use DNSSEC.

Answers

This section contains the answers to the lesson review questions in this chapter.

Lesson 1

1. Correct answer: C

A. Incorrect. This method cannot be used with a DHCP server hosted on the Windows Server 2008 R2 operating system. Hot standby mode has the primary DHCP server respond to DHCP clients except in the case when the primary server is unavailable, at which point the hot standby server begins leasing addresses.

B. Incorrect. This method cannot be used with a DHCP server hosted on the Windows Server 2008 R2 operating system. Load sharing has each partner DHCP server lease addresses from the scope to DHCP clients. In the event that one DHCP server fails, the other DHCP server utilizes the whole scope after the maximum client lead time period has elapsed.

C. Correct. In a split scope, part of the scope is hosted on one DHCP server, and a smaller part is hosted on a second DHCP server. Traditionally the split between the first and second DHCP servers is 80/20. Use this option when one or both DHCP servers are not running the Windows Server 2012 operating system.

D. Incorrect. Superscopes enable you to combine existing scopes for administrative purposes. They are often implemented when there are multiple logical subnets used on the same physical network. Superscopes do not provide high availability.

2. Correct answer: C

A. Incorrect. Load sharing has each partner DHCP server lease addresses from the scope to DHCP clients. In the event that one DHCP server fails, the other DHCP server utilizes the whole scope after the maximum client lead time period has elapsed. This does not meet the requirement that the second server not lease addresses unless the first is unavailable.

B. Incorrect. In a split scope, part of the scope is hosted on one DHCP server, and a smaller part is hosted on a second DHCP server. Traditionally the split between the first and second DHCP servers is 80/20. Use this option when one or both DHCP servers are not running the Windows Server 2012 operating system. This does not meet the requirement that the second server be able to lease addresses from the entire scope if necessary.

C. Correct. Hot standby mode has the primary DHCP server respond to DHCP clients except in the case when the primary server is unavailable, at which point the hot standby server begins leasing addresses.

D. Incorrect. Superscopes enable you to combine existing scopes for administrative purposes. They are often implemented when there are multiple logical subnets used on the same physical network. Superscopes do not provide high availability.

3. Correct answer: A

A. Correct. Superscopes enable you to combine existing scopes for administrative purposes. They are often implemented when there are multiple logical subnets used on the same physical network. Superscopes do not provide high availability.

B. Incorrect. Split scopes are high-availability solutions. In a split scope, part of the scope is hosted on one DHCP server, and a smaller part is hosted on a second DHCP server. Traditionally, the split between the first and second DHCP servers is 80/20. Use this option when one or both DHCP servers are not running the Windows Server 2012 operating system.

C. Incorrect. Load sharing mode is a high-availability solution. Load sharing has each partner DHCP server lease addresses from the scope to DHCP clients. In the event that one DHCP server fails, the other DHCP server utilizes the whole scope after the maximum client lead time period has elapsed.

D. Incorrect. Hot standby mode is a high-availability solution. Hot standby mode has the primary DHCP server respond to DHCP clients except in the case when the primary is unavailable at which point the hot standby server begins leasing addresses.

4. Correct answer: B

A. Incorrect. In a split scope, part of the scope is hosted on one DHCP server, and a smaller part is hosted on a second DHCP server. Traditionally the split between the first and second DHCP servers is 80/20. Use this option when one or both DHCP servers are not running the Windows Server 2012 operating system. This solution does not distribute IP addresses in a load-balanced manner.

B. Correct. Load sharing has each partner DHCP server lease addresses from the scope to DHCP clients. In the event that one DHCP server fails, the other DHCP server utilizes the whole scope after the maximum client lead time period has elapsed.

C. Incorrect. Hot standby mode has the primary DHCP server respond to DHCP clients except in the case when the primary server is unavailable, at which point the hot standby server begins leasing addresses. This solution does not distribute IP addresses in a load-balanced manner.

D. Incorrect. Superscopes enable you to combine existing scopes for administrative purposes. They are often implemented when there are multiple logical subnets used on the same physical network. Superscopes do not provide high availability.

Lesson 2

1. Correct answer: B

A. Incorrect. Members of the IPAM Users group are unable to view IP address tracking information. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

B. Correct. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

C. Incorrect. Members of the IPAM MSM Administrators group are unable to view IP address tracking information. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

D. Incorrect. Members of the IPAM ASM Administrators group are unable to view IP address tracking information. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

2. Correct answer: C

A. Incorrect. Only members of the IPAM ASM Administrators group and the IPAM Administrators group are able to manage the IP address space on an IPAM server.

B. Incorrect. Only members of the IPAM ASM Administrators group and the IPAM Administrators group are able to manage the IP address space on an IPAM server.

C. Correct. Members of the IPAM ASM Administrators group are able to manage the IP address space on an IPAM server.

D. Incorrect. Only members of the IPAM ASM Administrators group and the IPAM Administrators group are able to manage the IP address space on an IPAM server.

3. Correct answer: B

A. Incorrect. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

B. Correct. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

C. Incorrect. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

D. Incorrect. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

4. Correct answers: A and C

A. Correct. These servers need to have the appropriate IPAM-related GPOs apply to them before their status can change to unblocked. This involves creating the GPOs using the Invoke-IpamGPOProvisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

B. Incorrect. These servers need to have the appropriate IPAM-related GPOs apply to them before their status can change to unblocked. This involves creating the GPOs using the Invoke-IpamGPOProvisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

C. Correct. These servers need to have the appropriate IPAM-related GPOs apply to them before their status can change to unblocked. This involves creating the GPOs using the Invoke-IpamGPOPRovisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

D. Incorrect. Restarting the IPAM server does not alter the blocked status of the servers that you want to manage. These servers need to have the appropriate IPAM-related GPOs apply to them. This involves creating the GPOs using the Invoke-IpamGPOPRovisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

Lesson 3

1. Correct answer: B

A. Incorrect. Members of the IPAM Users group are unable to view IP address tracking information. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

B. Correct. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

C. Incorrect. Members of the IPAM MSM Administrators group are unable to view IP address tracking information. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

D. Incorrect. Members of the IPAM ASM Administrators group are unable to view IP address tracking information. This information can only be viewed by users that are members of the IPAM IP Audit Administrators and IPAM Administrators local groups.

2. Correct answer: C

A. Incorrect. Only members of the IPAM ASM Administrators group and the IPAM Administrators group are able to manage the IP Address space on an IPAM server.

B. Incorrect. Only members of the IPAM ASM Administrators group and the IPAM Administrators group are able to manage the IP Address space on an IPAM server.

C. Correct. Members of the IPAM ASM Administrators group are able to manage the IP address space on an IPAM server.

D. Incorrect. Only members of the IPAM ASM Administrators group and the IPAM Administrators group are able to manage the IP address space on an IPAM server.

3. Correct answer: B

A. Incorrect. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

B. Correct. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

C. Incorrect. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

D. Incorrect. You track by client ID when you know a computer’s MAC address to determine which IP addresses the computer was assigned.

4. Correct answers: A and C

A. Correct. These servers need to have the appropriate IPAM-related GPOs applied to them before their status can change to unblocked. This involves creating the GPOs using the Invoke-IpamGPOProvisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

B. Incorrect. These servers need to have the appropriate IPAM-related GPOs applied to them before their status can change to unblocked. This involves creating the GPOs using the Invoke-IpamGPOProvisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

C. Correct. These servers need to have the appropriate IPAM-related GPOs applied to them before their status can change to unblocked. This involves creating the GPOs using the Invoke-IpamGPOPRovisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.

D. Incorrect. Restarting the IPAM server does not alter the blocked status of the servers that you want to manage. These servers need to have the appropriate IPAM-related GPOs applied to them. This involves creating the GPOs using the Invoke-IpamGPOPRovisioning cmdlet and then ensuring that they apply to the servers that host the services that IPAM will manage.