Microsoft Windows Server 2012 Certification - Exam 70-411

Explore enterprise patching strategies, from Windows Update options to WSUS and System Center Configuration Manager, and learn to deploy patches via internal servers, catalogs, or scripts.

Install WSUS on Windows Server 2012, a built-in service, configure upstream and downstream servers, choose autonomous or replica mode, allocate patch storage, and manage the WSUS database and post-install steps.

Configure Windows Server Update Services after installation, addressing connectivity, firewall, and proxy requirements. Define synchronization schedules, product selections, and computer groups, then manage updates with auto-approval rules and PowerShell.

Configure clients to use wsus through a linked group policy object, point to the internal update server, enable automatic updates, and assign client-side targeting to a wsus group.

Configure WSUS to generate status reports, monitor synchronization, and manage patches using group policy, remove unused or superseded updates, and deploy across multiple servers via replica or autonomous mode.

Compare wsus to sccm patch capabilities to select the right tool. See wsus groups, auto approval, and reporting, versus sccm’s granular deployment, maintenance windows, and detailed status reporting.

Learn how file server resource manager analyzes storage usage, enforces granular quotas for groups, classifies data, and applies policies such as rights management services.

Install and configure the file server resource manager in Windows Server 2012 using the graphical user interface or PowerShell, enabling quotas, storage reports, email notifications, and data classification.

Learn to manage storage reports with FSRM, including built-in reports, periodic and on-demand generation, quota triggers, auditing, and delivery by email or CSV and text formats, with scheduling.

Configure FSRM folder-level quotas based on physical disk space, restrict access with NTFS security, and use templates with hard or soft quotas and actions at 85, 95, and 100 percent.

Enable file screening with fsrm to control data storage by defining data type groups, setting patterns, and applying templates; block, monitor, and notify with email and events.

Classify data with FCI to identify sensitive information, apply governance via dynamic access control and classification rules, and base properties in Active Directory.

Trigger file actions by data classification, using NTFS alternate data streams and security descriptors, with management tasks and policies from Active Directory and the data classification toolkit.

Configure file management tasks with the file server resource manager, covering three main task types, and enable custom actions, file expiration, and scheduled execution with variables.

Explore DFS components including the DFS namespace and DFS replication, and learn to troubleshoot file services and manage mapped drives across large organizations.

Explore the distributed file system (dfs) namespace architecture, including domain-based and standalone namespaces, Active Directory integration, folder targets, site-aware redirection, and failback for high availability.

Install and configure DFS namespaces on Windows Server 2012, performing initial configuration, role-based deployment, and Active Directory integrated management to create namespace routes, links, and targets.

Discover how distributed file system replication with RDC sends only file changes to multiple servers, reducing bandwidth, with last writer wins and limited use for open files.

Discover how to tune and troubleshoot DFSR in Windows Server 2012 by managing staging quotas, topology, health and propagation tests, and monitoring event logs for replication issues.

Evaluate when to use distributed file system namespace and replication versus other solutions, noting DFSR's strengths for multi-target data and its limitations: only replicating closed files and last-writer-wins.

Discover how to clone a DFS database in Windows Server 2012 by exporting DFS database and configuration, then using PowerShell and Robocopy to export, copy, and import replica data.

Explore recovering a DFS database when corruption occurs, including fast rebuild using local file and update sequence information, conflict handling, and the automated recovery improvements in Windows Server 2012.

Explore data protection options in Windows Server 2012, including EFS, BitLocker, and RMS, and compare symmetric and asymmetric encryption to safeguard sensitive files.

Enable encrypted file system in an organization, configure PKI and Active Directory recovery agents, and back up private keys to prevent data loss.

Explore how to deploy and manage encrypted file system (efs) across a domain, configure recovery agents and roaming profiles, and use cipher to back up certificates.

Explore BitLocker full-volume encryption, TPM integration, and options like PIN, smart card, USB key, and Active Directory to protect the OS volume and data drives.

Deploy and use bit locker on Windows Server 2012, enabling it locally or via PowerShell, with recovery keys stored in Active Directory and policies for operating system and data drives.

Discover how bitlocker network unlock on windows server 2012 lets a tpm-protected machine boot without user interaction by using a local network unlock server and efi-aware hardware.

Enable advanced auditing across Windows Server via local and domain policies to track logon events, object access, and process activity, then monitor security logs for intrusion detection.

Master DNS concepts with a practical review of DNS queries, server roles, zones, and dynamic DNS; learn hierarchical namespace, delegation, recursion, caching, and forwarders for enterprise DNS management.

Explore dns zone configuration types, including primary and secondary zones, and active directory integrated storage or text files, plus split dns, stop zones, and stub zones for large namespaces.

Explore advanced resource record management with aging and scavenging in DNS, including dynamic updates, DHCP lease behavior, no refresh interval, and per-zone settings to prune stale records safely.

Explore advanced DNS configuration and troubleshooting for multiple DNS zones and suffixes, including global name zones with alias records to resolve single-label names, using DNS Server Manager and Event Viewer.

Explore advanced domain controller backup and recovery, including system state backups, tombstones, and the recycle bin for undeleting objects, with domain controller restoration strategies.

Optimize the Active Directory database and perform cleanup through offline defragmentation and domain controller management. Restore services and complete database maintenance to keep the directory healthy.

Identify domain controller types and when to use them, including PDC emulator, RID master, infrastructure master, schema master, domain naming master, global catalog, and RODCs with one-way replication considerations.

Learn how universal groups are stored across forest via the global catalog and how enabling universal group membership caching reduces replication by caching memberships locally with MSDS cache membership value.

Learn how snapshots on Windows Server 2012 Hyper-V affect domain controllers, and how VM generation IDs in Active Directory guard USN and RID integrity to protect replication.

Clone domain controllers quickly on Windows Server 2012 Hyper-V by using a DC clone config file and the VM generation ID.

Discover how to deploy managed service accounts and group managed service accounts in Windows Server 2012, enabling automatic password synchronization in Active Directory for services.

Configure fine grained password policies in Windows Server 2012 via the Active Directory administrative center, setting minimum password length, password history, minimum and maximum password age, and lockout rules.

Identify services in Active Directory using service principal names (SPNs); list, view, and manage SPNs with Set-SPN on domain controllers, understanding service type slash instance name and optional port.

Discover how Active Directory virtual accounts give each service its own identity, enabling granular auditing and avoiding manual account creation or password management; network access uses the computer account.

Explore how active directory creates and tombstones objects, replicates deletions across domain controllers, and enforces a 180-day tombstone lifetime, with viewing and restoring using ldp and the is_deleted flag.

Enable the Active Directory recycle bin and move beyond tombstone deletion with a two-phase delete that preserves attributes. Restore objects with PowerShell or the Active Directory Administrative Center.

Learn to restore deleted Active Directory objects using PowerShell and the Active Directory Administrative Center, including finding deleted objects and restoring to original or new locations in Windows Server 2012.

Configure Kerberos policy settings in the default domain policy to govern ticket granting and service ticket lifetimes, renewals, and clock skew, while enforcing logon restrictions.

Explore how group policy objects define computer and user settings with administrative templates and registry. Link GPOs to domain or OU and apply them in local site domain OU order.

Learn to apply no override and block inheritance on group policy objects to enforce domain and organizational unit policies, including nested organizational units, while balancing troubleshooting complexity.

Learn to apply and secure group policy objects with security filtering and WMI filtering. Remove authenticated users and grant access to specific groups or machines.

Create custom administrative templates by designing ADMX and ADML files that configure registry settings and display text for group policy, including language variations and central store distribution.

Convert legacy ADM files to ADMX files to reduce replication traffic, and choose between manual ADMX creation or a partner tool to generate ADMX equivalents.

Deploy software with group policy using folder redirection and scripts, at computer or user level, with publish or assign options, and redirect folders to server for roaming profiles and VDI.

Learn to use group policy preferences to configure initial user and computer settings with item-level targeting, covering drive mappings, start menu options, control panel settings, and environment variables.

Back up and restore group policy objects (gpos) using the built-in group policy management console and PowerShell, including import, copy, and foundational gpos for efficient deployment.

Learn to troubleshoot group policy application, use loopback processing, manage slow links, run gpupdate and gpresult, model scenarios, and resolve Active Directory and file system version mismatches.

Configure group policy slow link detection to control policy application on slow links using a 500 kilobits per second threshold and network location awareness.

learn how to remotely force group policy updates using the group policy management console or PowerShell, including gpupdate, invoke-gpupdate, and OU-level granularity with remote scheduled tasks.

Explore the types of remote access and why they matter for accessing corporate resources—virtual private network tunnels, site-to-site links, and remote desktop gateway enable connectivity beyond the premises.

Examine the main types of virtual private network technologies, focusing on encapsulation, authentication, integrity, and encryption over public networks, with pptp, l2tp/ipsec, sstp, ikev2, and eap-tls.

Install and configure the remote access service on Windows Server 2012, enabling VPN and Direct Access with AD authentication, DHCP, and secure network routing between external and internal networks.

Deploy and configure a vpn with remote access, network address translation, and authentication options, including radius integration, ip addressing via dhcp, and certificate-based security in a lab environment.

Monitor and troubleshoot remote access with the connection manager administration kit to deploy VPN connections. Resolve certificate name mismatches and trusted roots; verify policy settings and firewall ports.

Explore how Windows Server 2012 web application proxy publishes internal services externally as a reverse proxy, enabling single sign-on and pre-authentication in a DMZ.

Learn to install and configure web application proxy in pass-through mode, publish internal web services externally, and manage certificates and federation service settings using remote access tools.

Explore direct access as an always-on, seamless alternative to traditional VPN, establishing client and IT infrastructure tunnels and using DNS suffix policies to route corporate resources.

Install direct access on Windows Server 2012 via server manager, configure DNS and WPAD, create a direct access client group, and bind a port 443 certificate to enable remote access.

Configure direct access for clients via the remote access management console and enable direct access; apply security groups, group policy objects, dns suffixes, and offline domain join support.

Learn to troubleshoot DirectAccess by verifying group policy delivery, ensuring clients join the domain computers group, and using the server dashboard to check status, certificates, and remote client reports.