Designing Server 2012 (70-413)

Explore planning and deploying a Windows Server 2012 infrastructure, designing and implementing network services and both logical and physical Active Directory infrastructures, with hands-on lab setup using virtualization tools.

Explore the philosophy behind designing and deploying a reliable, easy-to-maintain Windows Server 2012 network, focusing on design and planning to meet user needs and keep them happy.

Automate data center processes to reduce complexity, deploy and manage a virtualized infrastructure with Windows Server 2012 and Virtual Machine Manager, and design, deploy, and update server images efficiently.

Discover how to design server architectures with cross-department goals, build deployment strategies, inventory tools, and WDS-based image workflows using MAP, ADK, and SIM for Windows Server 2012.

Demonstrates downloading and installing the Windows assessment and deployment kit from the Microsoft Download Center, and using it with Windows 7, Vista, Windows Server 2008 R2, and Windows Server 2012.

Compare bare metal deployment with Windows Deployment Services, image files and unattended answer files, and wake on lan, and explore Hyper-V virtualization for multiple servers and native boot deployment.

Automated image-based installation for Windows servers delivers consistency in the installation process and enables rapid deployment of machines.

Examine the philosophy of designing a network server infrastructure, deployment phases, automated deployment components, the three deployment types, and a tour of the Microsoft assessment and planning tool kit.

Explore planning and implementing a multi-site WDS deployment with distribution points and replica servers, and learn to install, configure, and manage the image store and AD integrated or standalone modes.

Learn how multicast deployments install an operating system on multiple target computers via the WDS server, using range-based or DHCP IP allocation and unattended answer files.

Learn to pre-stage Active Directory computer accounts with Windows Deployment Services, set MAC addresses, choose boot and install images, and configure domain join and answer file setup for Server 2012.

Set up a multi-site, multi-server topology with Windows Deployment Services (WDS). Learn that WDS cannot be configured with a failover cluster, and target computers must access a specific WDS server.

Configure a multi-site WDS topology by using central store replication across servers, with group referral servers, managed via the WDS console and Windows Server 2012 datacenter.

Explore using the WDS PowerShell cmdlets on Windows Server 2012, learning to view help, run examples, script driver packages to boot images, and promote consistency across admins.

Identify the three phases of the Windows Server deployment process—consultation, design, and deployment—and note that design creates reference images while deployment pushes out the operating system.

Explore multicast deployment types and multi-site topology, and examine distribution points, as well as multi-server topology with autonomous and replica servers.

Plan and execute upgrades and migrations for Windows Server 2012 R2, focusing on role migration, server consolidation, and capacity planning.

Migrate Active Directory domain services and DNS from Windows Server 2008 R2 to Windows Server 2012 R2 by joining domain, installing AD DS and DNS, and promoting a domain controller.

Explore migrating AD objects across domains or forests with ADMT. Understand Windows Server 2012 limitations, SID history, and netdom commands that support secure cross-domain access during transitions.

Consolidate multiple servers onto a single machine through virtualization, using hypervisors such as Hyper-V to run several guest operating systems and save hardware and energy.

Explore what's new in Hyper-V on Windows Server 2012, including live migrations, failover clustering, shared virtual hard disks, and storage quality of service.

Discover how to create and configure Hyper-V virtual machines in Windows Server 2012. Manage generation types, startup memory, and dynamic memory, plus virtual disks (VHD/VHDX) and OS deployment options.

Explore how the Microsoft Assessment and Planning Toolkit aids migration and consolidation planning, featuring hands-on lab materials, sample documents, and a Windows Server 2012 readiness assessment.

Plan backups and fault tolerance for virtual machines by evaluating replication, automatic migration, offline and online backups with system center data protection and volume shadow copy service, and clustering options.

Evaluate in-place Windows Server upgrades from installation media for flexibility, but they aren’t always best. A clean installation may leverage new hardware and reduce problems, especially with automated updates.

Develop a server consolidation strategy and plan capacity and resource optimization while migrating server roles across domains, including rural migration considerations.

Designing server 2012 (70-413) chapter overview covers planning and deployment of Virtual Machine Manager services, templates, OS profiles, hardware and capability profiles, and logical networks in System Center 2012 r2.

Explore how Virtual Machine Manager centrally controls Hyper-V servers and other hypervisors, builds VM templates, and uses service templates for rapid, multi-tier deployments across Windows and Linux VMs.

Configure Hyper-V logical networks with the VMM console by creating a module network, assigning host groups, subnets, and IP address pools, and selecting a network site type.

Demonstrates using the image and template libraries in the VMM server, including importing and exporting virtual machine images (VHD/HDX), templates, and configuring library settings for indexing.

Explore hardware and capability profiles for deploying virtual machines across Citrix XenServer, VMware ESXi, and Hyper-V, and create custom hardware profiles with configured processors, memory, disks, and network settings.

Learn to create guest operating system profiles for Windows and Linux, configure DNS roles, domain joining, and initialization scripts, and explore service templates and VM templates in Virtual Machine Manager.

Explore service management practices for updating or replacing deployed services, using small operating system updates on virtual machines and pre-staged replacements to reduce downtime during larger service packs.

Review the concept of a VMM service as a specific offering, such as a website or backend database, that can be rapidly deployed by users or administrators.

Design VMM service templates and define operating system profiles to configure hardware capability profiles, manage services, organize image and template libraries, and oversee local networks.

Explore direct attached storage, NAS, and SAN options and how NAS presents as a network file server. Learn hands-on setup with FreeNAS and Windows Server 2012 file and storage services.

Compare iSCSI and Fibre Channel options for accessing shared storage, discuss subnetting for a storage area network, cost savings, CHAP authentication, IPsec protection, and Windows initiator ease.

Learn to configure Windows Server 2012 R2 as a file server with iSCSI disk sharing, creating volumes and targets, enabling mutual CHAP, and connecting initiators through the iSNS service.

Explore fibre channel considerations by examining fiber optic and copper cabling, 16 gbps speeds with plans for 32 gbps, and enabling virtual fibre channel adapters and virtual SANs in Hyper-V.

Discover storage spaces and storage pools in Windows Server 2012, pooling diverse disks to provide software-RAID-like provisioning, resiliency with parity, and failover clustering for data availability.

Demonstrates creating storage spaces, building a storage pool from multiple disks, and provisioning virtual disks in simple, mirrored, and parity configurations; enables data deduplication or ReFS on NTFS volumes.

Demonstrates configuring an NFS share from a Windows file server for Linux/UNIX access, mounting from a CentOS machine, adjusting permissions, and overview of identity mapping options (AD, LDAP, NIS).

Explore how device-specific modules (DSMs) and the multi-path I/O framework optimize storage connectivity on Windows file servers, enabling high availability or load balancing through manufacturer DSMs and the MPIO tool.

Discover how to prepare a virtual fibre channel adapter for Hyper-V by configuring its association with a virtual switch before attaching it to a virtual machine.

Explore the storage options in Windows Server 2012, including Fibre Channel, storage spaces, and data deduplication, and learn how to configure the storage name service and network file system.

Explore how DHCP, DNS, and IPAM support enterprise networks on Windows Server 2012, starting from a preconfigured system and focusing on improving performance and reliability.

Design and maintain an enterprise‑level DHCP solution with high availability, DHCP failover and clustering, interoperability, IPv6, DHCP filtering, and the management of the DHCP database and the DHCP Management Pack.

Design a highly available DHCP solution by deploying multiple DHCP servers, authorizing them in Active Directory with a domain account that has enterprise admin rights, and using DHCP Manager.

Explore three high-availability options for DHCP, including a failover cluster, and examine drawbacks like a shared storage single point of failure, urging simpler, cheaper alternatives.

Learn to set up a split scope for DHCP high availability with two servers, an 80/20 address split, wizard guided configuration, and the practical limitations prior to Windows Server 2012.

Explore the built-in dhcp failover feature in windows server 2012, configure primary and secondary servers with load balancing and a shared secret, and use powershell commands for setup.

Configure DHCP interoperability on Windows Server 2012 by authorizing DHCP with Active Directory to prevent rogue servers, enabling dynamic DNS updates, and enforcing Network Access Protection before issuing client IPs.

Review dhcpv6 considerations, including dynamic dns updates and parity with IPv4, where legacy options do not apply; compare stateful and stateless modes.

Implement dhcp filtering to control ipv4 ip address assignments by creating mac address based allow or deny lists, using wildcards, in the Windows Server dhcp management console.

Demonstrates basic DHCP database maintenance, including backing up the DHCP database, changing backup intervals via registry, and using jetpack to compact the DHCP and WINS databases.

Explore how to use the DHCP management pack within Microsoft System Center 2012 Operations Manager to monitor DHCP servers, including performance, availability, failover, and scope utilization.

To authorize a DHCP server in a domain, sign in with an enterprise administrator account in Active Directory.

Explore DHCP design components and high-availability options in Windows Server 2012, review DHCP filtering, database maintenance, and integration with Operations Manager 2012 via Management Pack to boost monitoring.

Explore design considerations for DNS infrastructure and secure name resolution with DNSSEC. Cover interoperability, IPv6, single-label DNS name resolution, zone delegation, and migration to application partitions for certification readiness.

Learn secure name resolution by enabling DNS security features, preventing cache poisoning with random source ports, validating remote responses, and forwarding queries via a DMZ DNS server with recursion disabled.

Learn how DNSSEC secures DNS traffic by validating responses and preventing cache poisoning and in-transit modifications. See how Windows Server 2012 makes implementing DNSSEC easier.

demonstrates cryptographic signing of an active directory integrated dns zone with dnssec on windows server 2012, covering dnskey and ds records, key rollover, and enabling dnssec via group policy nrpt.

Configure a pool of random source ports to harden DNS responses against cache poisoning, and use DNS cmd to adjust cache locking and TTL protections.

Explore disjointed namespaces as a DNS configuration option where the internet DNS suffix differs from the Active Directory domain, and learn when to test applications and manage added DNS overhead.

Explore how Windows Server DNS interoperates with DHCP and with UNIX/Linux DNS (BIND), enabling Active Directory integration while using BIND as secondary servers.

demonstrates migrating an active directory integrated dns zone by creating an application (directory) partition and enlisting specific dns servers to replicate, reducing replication traffic and conserving bandwidth.

Create an IPv6 resource record (AAAA) like IPv4 but with an IPv6 address. Avoid WINS because it is not compatible with IPv6; instead, explore alternatives for address resolution.

Demonstrates enabling global name support on Windows Server 2012, creating a global names zone, and adding single-label A records for IPv6 name resolution, replacing WINS with no dynamic updates.

Delegate a subdomain to a DNS server by creating a forward lookup zone and delegation. The demo explains stand-alone versus Active Directory DNS and completes delegation on Windows Server 2012.

Master single-label name resolution in Windows Server 2012 as networks transition to ipv6. Implement a global names zone in DNS, the simplest approach for network-wide single-label resolution.

Master secure name resolution and dns interoperability in enterprise environments. Learn ipv6 single-label dns name resolution, zone hierarchy, and end zone delegation as pieces of the enterprise name resolution strategy.

Study Windows Server 2012 IPAM features, including policy-based and manual provisioning and centralized versus distributed placement. Learn to configure RBAC, auditing, IP address migration, DNS server monitoring, and data collection.

Master ip address management with ipam on windows server 2012 r2, managing static addresses, dhcp reservations and policies, role-based access, and integration with virtual machine manager and sql server database.

Explore centralized and location-based IPAM deployment options, with Active Directory site filters and role-based servers; IPAM servers do not replicate data and require manual imports.

This demo contrasts group policy based IPAM provisioning with manual provisioning, using invoke-ipamprovisioning to configure DNS, DHCP, and NPS servers and firewall rules.

Provision and monitor IPAM to audit server changes and DHCP events, track IP addresses by IP address, client ID, hostname, or MAC address with saved searches and date ranges.

Explore how IPAM data collection configures automatically via task scheduler in Server 2012. Adjust schedules or manually retrieve data to track address exploration, address utilization, auditing, and service availability.

Manage multiple dhcp and dns servers from a single ipam console, automatically detecting servers and applying security filtering via group policy objects, with scopes and failover utilities.

learn how ipam handles data collection and creates events via data collection menu and task scheduler, with events automatically created when you install ipam and no additional configuration is required.

Master ipam for policy-based provisioning, oversee dhcp and dns servers, implement role-based access control and ipam auditing, and migrate ip addresses within server 2012 network infrastructure.

this introduction kicks off the third module of the Microsoft 7413 exam training series, outlining designing a remote access solution with VPN or direct access and Network Access Protection solutions.

Identify design considerations for deploying a vpn, including security certificate deployment, firewall configuration, site design, and vpn deployment with the Configuration Manager Administration Kit, aligned to business and security requirements.

Explore vpn server deployment options for Windows Server 2012, including edge vs dmz setups, vpn protocols and ipsec with certificate PKI considerations, nat64/dns64 direct access, and certificate management.

Learn how firewall placement impacts vpn traffic and which ports to open, including tcp 1723, ip protocol 47, and l2tp 1701, 500, and protocol 50.

Configure Windows Server 2012 to provide multiple VPN entry points, enabling site-to-site VPN and client access from either site, with optional load balancing for high availability.

Evaluate VPN bandwidth and security trade-offs by comparing split tunnel and full traffic routing, and disable PPTP in favor of SSTP, L2TP with IPsec, or IKE to protect traffic.

Explore the connection manager administration kit in Windows Server 2012 to create and distribute VPN profiles for mobile users, test on a laptop, and optimize domain name resolution and encryption.

Explore how to design a Windows Server 2012 vpn solution, process connections locally, and authorize clients using network policies by installing the network policy server role in a single-server setup.

Design the DNS namespace within Active Directory by choosing where to store DNS zone information. Balance domain-local access and forest-wide availability, and use application partitions for multi-domain scenarios.

Explore designing a direct access topology as a replacement for traditional VPN, covering deployment, certificates, and server-side configuration for Windows Server 2012, with domain-joined clients and fallbacks.

Use the getting started wizard to configure direct access quickly. Assess prerequisites, adapters, and network topology, then generate gpos and certificates for post deployment monitoring.

Explains three DirectAccess topologies—including an edge device behind a firewall, a DMZ, and internal network setups—and how to disable unused IPv6 transition technologies via PowerShell or a group policy object.

Assess direct access as a VPN alternative in Windows Server 2012 to replace manual connections and enable seamless, transparent access to the corporate network over the internet.

Design and migrate a direct access solution, deploy direct access, and implement enterprise certificates to secure connections.

Explore network protection concepts for Windows Server 2012, deploying the endpoint protection client with System Center Configuration Manager and noting the deprecated Network Access Protection and 7413 exam objectives.

Explore network access protection (nap) with four enforcement mechanisms—DHCP, IPsec, VPN, and 802.1x—alongside configuring nap policies in the network policy server for secure client health.

Implement IPsec in your organization to secure traffic to and from a server running a critical application, and use server-to-server connection security rules to encrypt and secure traffic.

Design and implement a secure network protection solution with Windows Server 2012, using network policy server role and network access protection. Enforce policy-driven access before clients connect to your network.

Explore the logical structure of Active Directory Domain Services, including forests and domains, and design group policy and delegation models for effective implementation.

Design and implement active directory forest and domain structures, including multi-forest and multi-domain scenarios, trust models, dns namespace considerations, and upgrades or migrations for older servers.

Explore how an Active Directory forest serves as the highest logical unit with shared schema and configuration. Compare forest models—single, organizational, resource, and restricted access—and their isolation and administrative implications.

Explore how domains serve as the primary unit in an Active Directory forest, and compare single and multiple domain models, including domain trees, regional and resource domains.

Compare single-domain and multi-domain forest models, highlighting domain trees, transitive trusts, single sign-on, and administrator autonomy across Europe, US, and R&D domains.

Explore automatic and manual trusts, forest and external trusts, shortcut and realm trusts, and how functional levels govern cross-domain authentication and single sign-on.

Explore design of forest and external trusts, including one-way and bi-directional forest trusts, external trusts, realm trusts, and shortcut trusts, with transitivity and authentication path considerations.

Establish forest trust relationships between Active Directory forests and apply selective authentication to limit cross-forest access. Route UPN suffixes and enable SID filtering to prevent unauthorized access of migrated objects.

Design DNS for active directory by selecting the DNS namespace and storage location for zone information, balancing domain versus forest zones and optional application partitions to meet availability requirements.

Upgrade or migrate your existing Active Directory Domain Services to Windows Server 2012. Choose in-place upgrades or add new domain controllers, or migrate to a new forest for mergers.

Configure an outgoing forest trust with selective authentication to allow partner organization users to access only specific resources in your domain.

Design and implement Active Directory domains, explore multiple forests, domain models, and trust relationships in multi-domain scenarios, while addressing DNS name spaces, domain controller upgrades, and hybrid and Azure coexistence.

Explore designing a group policy strategy within Active Directory, aligning GPO design with business requirements, creating an effective organizational unit hierarchy, and managing GPOs across domains for enterprise-wide control.

Gather comprehensive enterprise information to design Group Policy, identifying organizational needs, sites and locations, structure, and security requirements, and plan delegation and administration for effective policy implementation.

Design organizational units in Active Directory to support delegation, organization, and group policy design, while selecting a strategy (location-based, organization-based, or resource-based) with hybrid options.

Design an OU hierarchy by aligning with the administrative model, balancing location and division, to enable delegated control and organized group policy across users, computers, and servers.

Explore how to design additional OUs to target configurations, apply security filtering, simplify GPO processing, and migrate GPOs across domains with migration tables.

Explore how group policy objects control user and computer configurations via administrative templates and registry settings. Leverage a central ADMX-based store to distribute templates across domain controllers.

Create a central store for administrative templates on the domain controller. The Group Policy Management Console loads from this repository, replicated across domain controllers.

Minimize the number of gpos by delegation and ou design for gpo application. Test changes with the group policy result wizard and modeling wizard, document settings, and enforce change control.

Design and optimize group policy processing by coordinating inheritance, blocking inheritance, and enforcement, and applying filtering (security groups and WMI) to target users and computers across sites, domains, and OUs.

Explore configuring and filtering group policy objects in a domain with the Group Policy Console. Link GPOs to OUs like sales, IT, and marketing to target authenticated users and desktops.

Learn how slow link processing flags links under 0.5 kilobits per second and how loopback processing applies user and computer settings to specific environments, such as kiosk or lab computers.

Demonstrate configuring slow link detection and loopback processing in group policy, enabling computer-based user settings with merge or replace behavior for various environments.

Master group policy design with the Group Policy Management Console, including backup, restore, copy, and cross-domain import/export using migration tables in Active Directory environments.

Explore practical GPO management in Windows Server 2012 using the Group Policy Management Console to backup, restore, copy, and migrate policy objects across domains with a migration table editor.

Designing Server 2012 (70-413) introduces Advanced Group Policy Management (AGPM) with GPO review, version control, check-in/out, approvals, extended search, export, rollback, and TPM-backed archives for enterprise environments.

Not a best practice: deploying GPOs directly into production; minimize the number of GPOs applied to a single computer and always test GPOs in a non-production environment before implementing.

Gather information to design and implement a gpo infrastructure, map the ou hierarchy, and control policy application while enabling change management through design best practices and Active Directory group policy.

Design a permissions model with Active Directory delegation and control across the tree. Refresh fundamentals of Active Directory object security and explore advanced considerations for delegating administrative control.

Review how Active Directory uses a discretionary access control model with access control lists to grant or deny object access, comparing to NTFS permissions and enabling delegated administration.

Explore how each Active Directory object uses an access control list to define who can access it, including discretionary ACLs, security tab settings, inheritance, and delegation of control.

Designing a delegation of control model explains structuring rights in Active Directory through OU-based, role-based, and hybrid designs, with best practices like documentation, auditing, quotas, and the delegation wizard.

Learn to configure delegation of control in Active Directory, use the delegation wizard to assign permissions to organizational units, and tailor custom task permissions with extended delegation syntax.

Explore adminSDHolder, protected groups, and the security descriptor propagator to secure privileged accounts in Active Directory. Learn how Kerberos delegation and inheritable ACLs ensure proper permissions propagation.

Learn how AdminSDHolder protects security groups in Active Directory by using a unique ACL and security descriptor propagation, and how to locate and configure it with ADSI Edit.

Learn how Kerberos delegation lets applications reuse user credentials to access resources on another server. Domain administrators must explicitly trust the application for delegation, with constrained delegation for cross-domain scenarios.

Structure the OU hierarchy based on resources, creating server-specific OUs with child OUs for web, mail, and database servers to enable GPO security by server role.

Discover how to design Active Directory administrative models, understand object security and permissions, implement delegation of control for an organization, and explore advanced security concepts like the admin stakeholder concept.

Designing and implementing Active Directory domain services by examining design choices for domains and forests, group policy configuration, and permission models to delegate administrative control at scale.

Learn full direct replication of the Active Directory database, copying changes from a source domain controller to all domain controllers, and how sites control replication for design, monitoring, and troubleshooting.

Design Active Directory physical topology to optimize replication and authentication via sites, subnets, and domain controllers. Choose single or multi-site models and control replication traffic across reliable links.

Gather organization data on geographic locations, number of sites, and communication links to design Active Directory sites and determine where domain controllers and global catalog servers should reside.

Demonstrates implementing AD DS sites by planning topology, configuring sites in Active Directory Sites and Services, linking subnets, and deploying domain controllers and global catalogs for replication and logon.

Designing Active Directory sites requires planning domain controllers, automatic site coverage, and site-aware applications like DFS, fileshare, and Microsoft Exchange Server, while mapping IP subnets to sites and documenting infrastructure.

Design Active Directory replication across multi-master domain controllers using change notifications, USN versions, and KCC-generated site topologies with RPC over IP for intra-site and SMTP for intersite replication.

Implement a site link design using hub-and-spoke topology to control replication between domain controllers across sites. Set site link costs and schedules, including after-hours replication, to optimize data synchronization.

Monitor and troubleshoot replication in active directory by understanding conflict types—attribute-level, same-name creations, and orphaned objects—and using tools such as event viewer, repadmin, dcdiag, adsiedit, and ndc diags.

Identify replication failures in an Active Directory environment and use repadmin, ADSI Edit, and LDAP to verify objects across replicas and troubleshoot DNS-related issues.

Configure AD replication by adjusting site links, site schedule, replication frequency, and bridgehead servers, and understand how the site link cost directs the KCC to the lowest path route.

Design and implement Active Directory replication by configuring sites, site links, and replication models, and use utilities to monitor and troubleshoot to maintain efficient Active Directory infrastructure.

Explore hardware considerations, installation options, and the global catalog server; examine Windows Server 2012 virtualization for domain controllers and plan for high availability of Active Directory.

Plan domain controllers for reliable authentication and hosting of the Active Directory database, focusing on hardware, storage, and high availability, including server core deployment.

Demonstrates deploying an Active Directory domain controller on a server core using PowerShell to install AD DS features and promote the server with dc promo.

Designing global catalog servers explains how domain controllers become global catalogs to support universal group membership, login with cached credentials, and forest-wide searches, plus placement, replication, and schema options.

Enable the global catalog on domain controllers via Active Directory sites and services, then adjust replicated attributes and update the schema using the Active Directory schema snap-in.

Configure global catalog servers across domain controllers to improve availability and replication, placing at least two per site in multi-domain environments and enabling universal group membership caching to optimize logons.

Place domain controller roles, including schema master, domain naming master, and PDC emulator, with high availability and correct global catalog and infrastructure master setup for multi-domain forests.

Windows Server 2012 enables virtualization of domain controllers, delivering consolidation and rapid deployment. Manage security, VM generation ID, cloning, and time synchronization for Active Directory domain controllers.

Demonstrate cloning a domain controller in Windows Server 2012 using a PC clone configured XML file and PowerShell to rapidly deploy additional domain controllers.

Determine global catalog placement across sites and assess how low bandwidth connections and replication load influence placement decisions, including enabling universal group membership caching.

Design and implement domain controllers in Active Directory Domain Services, covering hardware and software requirements, placement, global catalog and single master operations, virtualization, and high-availability planning in Windows Server 2012.

Design and implement branch office infrastructures with a focus on domain controller availability and security, deploying read-only domain controllers and branch cache to ensure file access.

Design branch office networks by planning for limited administration and security, ensuring access to domain controllers, file servers, and email servers even when resources are centralized or split between locations.

Learn how read-only domain controllers provide branch-site authentication by forwarding logons to writable controllers, with controlled attribute replication and password replication policy, and optional global catalog support, one per site.

Demonstrates deploying a read-only domain controller by pre-staging for later installation, using Active Directory users and computers, with site validation and promotion via PowerShell.

Explore the password replication policy on read-only domain controllers, balancing credential caching for local branch users against security risks from caching admin credentials and offline cracking.

Learn to configure the ROTC password replication policy, decide who can cache passwords, implement location-specific groups, and prepopulate passwords to ease first logon.

Examine security considerations for read-only domain controllers (RODCs), including using filtered attributes and confidential attributes to prevent replication of sensitive data and restrict read access.

Learn how to mark Active Directory attributes as confidential, enable the hidden status with system flags, and grant read access only to approved users using dsacls or ldp.

Plan branch office infrastructures around global catalogs and dns servers. Use a read-only domain controller with universal group caching to ensure logins.

Enable universal group membership caching on domain controllers in sites without a global catalog to update membership locally; use when no GC is available, drawing data from headquarters.

Learn how branch cache optimizes file access in branch offices by caching data locally, boosting productivity and response times. Identify hash-based content retrieval in hosted and distributed cache modes.

Assess branch office infrastructure for deploying writable domain controllers with Windows Server 2008 or later, Windows Server 2012 forest functional level, and elimination of Windows Server 2003 DCs.

Design and implement branch office infrastructures using read-only domain controllers, read-only DNS and global catalog, and branch cache to optimize file and web access over limited links.