Scribd Logo
Upload

Welcome to Scribd!

  • 22 views

    WS-011 Windows Server 2019/2022 Administration

    Uploaded by

    Syed Amir Iqbal
    This document provides an overview of lessons on network infrastructure services in Windows Server, including DHCP, DNS, and IPAM. It describes deploying and managing each of these services. For DHCP, it covers installing and configuring the DHCP role, creating scopes and reservations. For DNS, it discusses DNS components, zones, records, installing the DNS role, and integrating DNS with Active Directory. It also provides an overview of deploying and managing IPAM.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    WS-011 Windows Server 2019/2022 Administration

    Uploaded by

    Syed Amir Iqbal
    22 views44 pages
    This document provides an overview of lessons on network infrastructure services in Windows Server, including DHCP, DNS, and IPAM. It describes deploying and managing each of these services. For DHCP, it covers installing and configuring the DHCP role, creating scopes and reservations. For DNS, it discusses DNS components, zones, records, installing the DNS role, and integrating DNS with Active Directory. It also provides an overview of deploying and managing IPAM.

    Original Title

    91 - M03

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides an overview of lessons on network infrastructure services in Windows Server, including DHCP, DNS, and IPAM. It describes deploying and managing each of these services. For DHCP, it covers installing and configuring the DHCP role, creating scopes and reservations. For DNS, it discusses DNS components, zones, records, installing the DNS role, and integrating DNS with Active Directory. It also provides an overview of deploying and managing IPAM.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    22 views44 pages

    WS-011 Windows Server 2019/2022 Administration

    Uploaded by

    Syed Amir Iqbal
    This document provides an overview of lessons on network infrastructure services in Windows Server, including DHCP, DNS, and IPAM. It describes deploying and managing each of these services. For DHCP, it covers installing and configuring the DHCP role, creating scopes and reservations. For DNS, it discusses DNS components, zones, records, installing the DNS role, and integrating DNS with Active Directory. It also provides an overview of deploying and managing IPAM.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 44

    WS-011 Windows

    Server 2019/2022
    Administration
    Module 3: Network
    infrastructure services in
    Windows Server
    Module overview

    Lessons:
     Deploying and managing DHCP
     Deploying and managing DNS services
     Deploying and managing IPAM
    Lesson 1: Deploying and
    managing DHCP
    Lesson 1 overview

    Topics:
     Overview of the DHCP role
     Install and configure the DHCP role
     Configure DHCP options
     Demonstration: Configure the DHCP role
     Configure DHCP scopes
     Demonstration: Create and configure a DHCP scope
     DHCP AD DS authorization
     High availability options for DHCP
     DHCP Failover
    Overview of the DHCP role

    DHCP simplifies management of IP configuration on clients


    DHCP lease renewal is attempted at:
     50% of lease time
     87.5% of lease time
    DHCP for IPv6 can be
    stateful or stateless
    Install and configure the DHCP role

    To install the DHCP role:


     Windows Admin Center > Roles and Features
     Server Manager
     Add-WindowsFeature DHCP -IncludeManagementTools
    To manage a DHCP server by using Windows Admin Center, you must install the DHCP PowerShell tools
    DHCP local security groups:
     DHCP Administrators
     DHCP Users
    To create the DHCP local security groups:
     Server Manager > Post-Install Configuration Wizard
     Add-DhcpServerSecurityGroup -Computer DhcpServerName
    Configure DHCP options

    A DHCP lease can include options such as:

    Option code Name


    1 Subnet mask
    3 Router
    6 DNS servers
    15 DNS domain name

    DHCP options are applied in order:


    1. Server level
    2. Scope level
    3. Class level
    4. Reserved client level
    Demonstration:
    Configure the
    DHCP role
     Install the DHCP Server role
     Install the DHCP PowerShell tools
     Configure a DHCP server option
    Configure DHCP scopes

    Properties of a DHCP scope: DHCP PowerShell cmdlets:


     Name (mandatory)  Add-DhcpServerv4Scope
     Description  Get-DhcpServerv4Scope
     IP address range (mandatory)  Get-DhcpServerv4ScopeStatistics
     Subnet mask (mandatory)  Set-DhcpServerv4Scope
     Exclusions Properties of a DHCP reservation:
     Delay  Reservation name
     Lease duration  IP address
     Options  MAC address
     Activation  Description
    Demonstration:
    Create and
    configure a DHCP
    scope
     Create a DHCP scope
     Create a DHCP reservation
    DHCP AD DS authorization

    A DHCP server on Windows Server must be authorized in AD DS to lease IP addresses:


     To authorize a DHCP server by using Windows PowerShell, run:
    Add-DHCPServerinDC <name or IP address of DHCP server>
    A standalone server with DHCP will not lease IP addresses if an authorized DHCP server is detected
    Non-Windows DHCP servers function regardless of authorization
    High availability options for DHCP (slide 1 of 2)

    DHCP Failover:
     Newer method for high availability
     Strongly preferred to implement high availability for DHCP
    DHCP clustering:
     Is configured to run in a failover cluster
     Install the DHCP Server role on cluster nodes
     DHCP configuration information is stored on shared storage
    Split scopes:
     Involve two DHCP servers that are configured with non-overlapping scopes
     Control the primary server by configuring delay
    High availability options for DHCP (slide 2 of 2)
    DHCP Failover

    Creates a partnership between two DHCP servers


    Lease information is replicated between the partners
    Configuration modes:
     Load balance
     Hot standby
    Other configuration options:
     MCLT
     Auto state switchover interval
     Message authentication
    Lesson 2: Deploying and
    managing DNS services
    Lesson 2 overview

    Topics:
     DNS components
     What are DNS zones?
     What are DNS records?
     Demonstration: Install and configure the DNS role
     Manage DNS services
     Create records in DNS
     Configure DNS zones
     DNS forwarding
     DNS integration in AD DS
     Overview of DNS policies
     Overview of DNSSEC
    DNS components

    DNS domain names:


     Are a portion of DNS namespace
     Can be public or private
    DNS servers:
     Respond to requests from DNS resolvers
     Can access DNS information from a local database or other DNS servers
    DNS zones and resource records:
     A zone is a local copy of a DNS namespace on a DNS server
     Resource records are created and stored in a zone
    DNS resolvers:
     Request DNS information from DNS servers
     Cache results
    What are DNS zones? (slide 1 of 2)

    A DNS zone is the portion of a DNS namespace hosted on a DNS server:


     Forward lookup zones:
    o Resolve names to IP addresses
    o Can contain many other record types
     Reverse lookup zones:
    o Resolve IP addresses to names
    o Are in the in-addr.arpa namespace
     Primary zones:
    o Are authoritative for a portion of a DNS namespace
    o Are where resource records are created
     Secondary zones are read-only copies of primary zones
     Stub zones contain only the records required to locate and communicate with name servers
    What are DNS zones? (slide 2 of 2)

    Forward lookup zone -


    training
    client1 192.168.2.45
    client2 192.168.2.46
    client3 192.168.2.47

    Reverse lookup zone –


    2.168.192.in-addr.arpa
    192.168.2.45 client1
    192.168.2.46 client2
    192.168.2.47 client3
    What are DNS records?

    Forward lookup and reverse lookup zones have these records:


     Start of authority (SOA)
     Name server (NS)
    Forward lookup zones include:
     Host (A)
     Host (AAAA)
     Alias (CNAME)
     Service location (SRV)
    Reverse lookup zones include pointer (PTR) records
    Records are configured with a time to live (TTL)
    Demonstration:
    Install and
    configure the DNS
    role
     Install the DNS Server role
     Install the DNS PowerShell tools and create a
    DNS zone
     Create and verify a host record
    Manage DNS services

    Delegate administration by using the DNS Admins group


    DNS logging:
     DNS server event log
     Debug logging to text file
     Analytic logging to event log
    Aging and scavenging:
     Needs to be enabled on the zone and one DNS server
     Only applies to dynamic DNS records
    To backup a DNS zone:
     Export-DnsServerZone -Name <zone name> -Filename <zone backup file>
     Dnscmd.exe /ZoneExport <zone name> <zone backup file>
    Create records in DNS

    Manual creation methods:


     Windows Admin Center
     DNS manager
     Windows PowerShell
    Dynamic creation:
     Clients register name and IP address in a zone
     DHCP Client service performs registration
     Requires communication with a primary zone
     DHCP server can register for clients that don’t support dynamic DNS
    Configure DNS zones (slide 1 of 2)

    Active Directory-integrated zones can be replicated to:


     All DNS servers running on domain controllers in the forest
     All DNS servers running on domain controllers in the domain
     All domain controllers in the domain
     All domain controllers in a custom scope of an application partition
    You can allow zone transfers:
     To any server
     Only to servers listed as name servers
     Only to specific servers
    Secure dynamic updates ensure that only the owner of a DNS record can update it
    Configure DNS zones (slide 2 of 2)
    DNS forwarding

    Forwarders:
     Receive DNS requests, and forward requests for zones for which it is not authoritative
     Are common for external name resolution
    Conditional forwarders:
     Forward requests for a specific namespace
     Typical between partners and trusted organizations
    Stub zones:
     Have a similar role to conditional forwarders
     Are useful when you expect name servers to be updated
     Are less useful when firewalls restrict communication
    DNS integration in AD DS

    SRV records:
     Are created in DNS by the NetLogon service running on domain controllers
     Are used by clients to find AD DS services
     Contain service information:
    o Service name and port

    o Protocol
    o Host name

    Benefits of Active Directory-integrated zones:


     Multi-master updates
     Replication managed by AD DS
     Secure dynamic updates
     Detailed security
    Overview of DNS policies (slide 1 of 2)

    Use DNS policies to manipulate how a DNS server handles queries based on different factors:
     Application high availability
     Traffic management
     Split-brain DNS
     Filtering
     Forensics
     Time-of-day based redirection
    Identify elements with DNS policy objects:
     Client subnet
     Recursion scope
     Zone scope
    Overview of DNS policies (slide 2 of 2)

    Steps to resolve a host record differently for a user from a specific IP address range:
    1. Create a DNS server client subnet for the IP address range
    2. Create a DNS server zone scope for the zone containing the host record
    3. Add a host record to the zone that is specific to the zone scope
    4. Add a DNS server query resolution policy that allows the DNS server client subnet to query the zone
    scope for the zone
    You can configure the DNS policy by using Windows PowerShell
    Overview of DNSSEC

    DNSSEC secures responses to DNS requests by using digital signatures


    • Signature allows clients to verify that DNS responses are legitimate
    To deploy DNSSEC:
    1. Sign the DNS zone

    2. Configure the trust anchor distribution

    3. Configure the name resolution policy table (NRPT) on client computers (typically via Group Policy)

    DNSSEC resource record Purpose


    RRSIG Signature for a set of records
    DNSKEY Publishes the public key for a zone
    NSEC Authenticates a non-response
    NSEC3 Hash of the NSEC record
    DS Supports delegation to a child zone
    Lesson 3: Deploying and
    managing IPAM
    Lesson 3 overview

    Topics:
     What is IPAM?
     IPAM deployment requirements
     Process for deploying IPAM
     Demonstration: Install the IPAM role
     Administer IPAM
     Configure IPAM options
     Manage DNS zones with IPAM
     Configure DHCP servers with IPAM
     Use IPAM to manage IP addressing
    What is IPAM?

    Use IPAM to:


     Discover, audit, and manage IP address space
     Monitor and administer DHCP
     Monitor and administer DNS
     Collect sign-in statistics from domain controllers and network policy servers
    Data can be stored in:
     Windows Internal Database
     Microsoft SQL Server database
    IPAM deployment requirements

    The IPAM server:


     Performs data collection
     Hosts the data collection database
    The IPAM client:
     Provides a user interface for management
    IPAM topology can be centralized, distributed, or hybrid
    IPAM server requirements include:
     Must be a domain member
     Should be a single-purpose server
     Must have sufficient data storage
    Process for deploying IPAM

    To install and configure IPAM servers after selecting a deployment topology:


    1. Install the IPAM Server feature
    2. Provision the IPAM servers
    3. Configure and run server discovery
    4. Choose and manage the discovered servers
    Install the IPAM client from Remote Server Administration Tools
    Demonstration:
    Install the IPAM
    role
     Install the IPAM Server feature
     Install the IPAM Client feature
     Provision the IPAM server
     Create the IPAM GPOs
     Add the server to IPAM and view IPAM data
    Administer IPAM

    IPAM uses role-based management composed of roles, access scopes, and access policies:

    IPAM security group Description


    IPAM Administrators View all IPAM data and manage all IPAM tasks
    IPAM MSM Administrators Manage DNS and DHCP servers
    IPAM DNS Administrators Manage DNS servers, zones, and resource records
    IPAM Record Administrators Manage DNS resource records
    IPAM ASM Administrators Manage IP address spaces
    IPAM Address Record Administrators Manage individual IP address records
    IPAM DHCP Administrators Manage DHCP servers and scopes
    IPAM DHCP Scope Administrators Manage DHCP scopes
    IPAM DHCP Reservations Administrators Manage DHCP reservations
    Configure IPAM options

    GPO provisioning simplifies the configuration of managed servers and uses these GPOs:
     <Prefix>_DHCP
     <Prefix>_DNS
     <Prefix>_DC_NPS
    To create the GPOs, run the following command:
    Invoke-IpamGpoProvisioning -Domain <domain> -GpoPrefixName <prefix>
    -IpamServerFqdn <IPAMServer>
    Adding a managed server modifies security filtering on the GPOs
    Manage DNS zones with IPAM

    Use IPAM to:


     View DNS servers and zones
     Create new zones
     Create DNS records
     Manage conditional forwarders
     Open the DNS console for a managed server
    Configure DHCP servers with IPAM

    Use IPAM to configure DHCP servers by:


     Editing server properties such as logging and MAC address filtering
     Configuring server options
     Configuring and activating DHCP policies
     Launching the DHCP Management Console
    Use IPAM to configure DHCP scope details by:
     Editing scope properties
     Duplicating a scope
     Creating and managing reservations
     Configuring DHCP Failover
    Use IPAM to manage IP addressing

    Customize how you view and manage the IP address space by using any of the following views:

    View Description
    IP address blocks IP subnets that you can use to allocate addresses to DHCP
    IP address ranges Subcomponents of an IP address block that typically correlates with a DHCP
    scope
    IP addresses Information about IP addresses from DHCP and DNS servers
    IP address inventory A list of all IP addresses in the enterprise
    IP address range groups Organizes IP address ranges into logical groups that your define
    Instructor-led labs:
    Implementing and
    configuring network
    infrastructure services
    in Windows Server
     Deploying and configuring DHCP
     Deploying and configuring DNS
    Thank you

    You might also like