Get Familiar With Windows Server 2008, Server Administrator

  By Certification Magazine —

In this scenario, you should add the SrvAdmins global group from the verigon.com, east.verigon.com and west.verigon.com domains to the NutexSrvAdmins universal group. The NutexSrvAdmins universal group can contain global groups from any domain. You can ease administration by grouping global groups in a tree into one universal group in the root domain of that tree.

You should create a universal group called NutexSrvAdmins that contains the SrvAdmins in each domain of the nutex.com tree group and create a universal group called VerigonSrvAdmins that contains the SrvAdmins in each domain of the nutex.com tree group. A universal group can contain accounts from any domain within the forest in which this universal group resides, global groups from any domain within the forest in which this universal group resides and universal groups from any domain within the forest in which this universal group resides.

In this scenario, you should add the SrvAdmins global group from the nutex.com, east.nutex.com and west.nutex.com domains to the NutexSrvAdmins universal group. The NutexSrvAdmins universal group can contain global groups from any domain. You can ease administration by grouping global groups in a tree into one universal group in the root domain of that tree.

You should add the NutexSrvAdmins and VerigonSrvAdmins group as a member of the Server Operators group on dc1, dc2 and dc3 in each domain of the verigon.com tree. You can add universal or global groups into a local group. In this scenario, you should add the universal groups from each tree into the Server Operators group. The Server Operators group exists on domain controllers. Members of this group can backup and restore files, format a hard disk and shut down the computer.

You should not add the NutexSrvAdmins and VerigonSrvAdmins group as a member of the Backup Operators group on dc1, dc2 and dc3 in each domain of the verigon.com tree. Although the Backup Operators group can back up and restore all files on domain controllers in the domain, regardless of their own individual permissions on those files, this group cannot format a hard disk. The Administrators group and Server Operators group can back up and restore files and format a hard disk.

You should not add the NutexSrvAdmins and VerigonSrvAdmins group as a member of the Account Operators group on dc1, dc2 and dc3 in each domain of the verigon.com tree. Members of the Account Operators group can create, modify and delete accounts for users, groups and computers located in the Users or Computers containers and organizational units in the domain, except the Domain Controllers organizational unit. Members of this group do not have permissions to backup and restore files and format a hard disk.
 
References:

Windows Server TechCenter > Windows Server 2003 Technical Library > Windows Server 2003: Product Help > Windows Server 2003 Product Help > Active Directory > Active Directory Concepts > Understanding Active Directory > Understanding Groups > Default groups

WINDOWS SYSTEMS MANAGEMENT AND ADMINISTRATION - AGDLP reduces account management, permissions management headaches

Windows Server TechCenter > Windows Server 2003 Technical Library > Windows Server 2003: Deployment > Windows Server 2003: Deployment Whitepapers > Best Practices for Delegating Active Directory Administration (Windows Server 2003)

Objective: Monitor and maintain servers.
Sub-objective: Monitor servers for performance evaluation and optimization.

Single answer, multiple-choice

You are the administrator of your company’s application servers. One application server is used by a group of users in the accounting department. Processes on the server are causing the processor load to exceed 70 percent. Some processes are taking up more resources than other processes. Most users open the same number of processes on the server.

You want to give equal access to each process and maintain minimum resource availability while ensuring the processor load is not too great. What should you configure?
 
A.    Implement Windows System Resource Manager (WSRM) and configure an Equal_Per_Process resource allocation policy.
B.    Implement WSRM and configure an Equal_Per_User resource allocation policy.
C.    Implement WSRM and configure an Equal_Per_Session resource allocation policy.
D.    Use Windows Remote Management. Configure the service in a GPO. Add the users into the Security Filtering of the GPO.
E.    Use Windows Remote Management. Configure the service in a GPO. Add the users' computers into the Security Filtering of the GPO.
 
Answer:
A. Implement Windows System Resource Manager (WSRM) and configure an Equal_Per_Process resource allocation policy.
 
Tutorial:
You should implement Windows System Resource Manager (WSRM) and configure an Equal_Per_Process resource allocation policy. WSRM begins to manage processor resources of the application server when the combined processor load is greater than 70 percent.

WSRM does not manage the application server's resources when the processor load is low. When the demand for processor resources exceeds 70 percent of the processor load, WSRM resource allocation policies help ensure minimum resource availability. There are four built-in resource management policies:
 
•    The Equal_Per_Process resource allocation policy allows each running process to have equal treatment. A user can run multiple processes, whereas another user can run a single process, but only the processes are given equal treatment. If a server that is running five processes reaches 70 percent processor utilization, WSRM will limit each process to 20 percent of the processor resources while they are in contention. Any resources not used by low utilization processes will be allocated to other processes.
•    The Equal_Per_User resource allocation policy groups processes by the user account that is running them. Each user has a process group, and each of these process groups is given equal treatment. This is the recommended policy for application servers.
•    The Equal_Per_Session resource allocation policy allows resources to be allocated on an equal basis for each session connected to the system. This policy is used with terminal servers.
•    The Equal_Per_IISAppPool resource allocation policy allows resource to be allocated equally for each application pool of IIS. Applications that are not in an IIS application pool can only use resources that are not used by IIS application pools.
 
You should not implement WSRM and configure an Equal_Per_User resource allocation policy. In this scenario, the resources should be divided equally per process and not equally per user.

You should not implement WSRM and configure an Equal_Per_Session resource allocation policy. In this scenario, the resources should be divided equally per process and not equally per session. A single session may spawn several processes on the server.
You should not use Windows Remote Management, configure the service in GPO and add either the users or the users' computers to Security Filtering in the GPO. The Windows Remote Management (WinRM) service implements a standard Web services protocol called WS-Management that is used for software and hardware management.