5/16/2001 -- This exam is an elective for the Windows 2000 MCSE stream and tests your knowledge of Active Directory design concepts in applying them to specific design scenarios. In this exam you won't get the same detailed technical treatment as you would during the Win2K MCSE core exams, but at the same time this isn't an exam you can fake it through. In order to pass you will need a good knowledge of AD design concepts and be able to apply them to the situations presented. Here is my list of top 10 tips for this exam:

1. Understand the New Exam Format
Microsoft's design exams use a scenario-based exam format that you need to be familiar with before you take the exam. Fortunately there are a couple of resources on Microsoft's Web site that can assist. Click here for a sample exam for these new kind of questions. Click here for a FAQ relating to the question format.
The exam itself has four scenarios, each with approximately 10 related questions to answer. The amount of text you will need to read is very, very large (see tip #2) -- the last thing you want to do is waste time trying to understand the question formats.

2. Take Good Notes During the Exam
As you read your way through each case study, make good use of the writing paper supplied at the testing center. There is so much to read in each of the four case studies that you can't afford the time to read the case study again completely when attempting to answer every question. Of course, you may be forced to do this due to the unexpected nature of some of the questions, but it would be handy to be able to refer to your notes. As you read through the case study, keep track of the relevant factors in the information provided that will affect your AD design. Much of the design rules of thumb you'll need to consider are presented in the next few points.

3. See the Forest Through the Trees
As you probably know, both forests and trees are domains in Win2K. Obviously, for this exam you need to know the difference between the two.

A tree features a contiguous namespace -- that is, all lower-level domains are based on the name of the root domain. For example, in a given tree you might have mycompany.com as the root domain, with eng.mycompany.com and mktg.mycompany.com as the lower domains. In contrast, if you have two domains called mycompany.com and yourcompany.com, these can't be in the same tree and would need to be in a forest instead.

A forest is a collection of one of more AD trees. Automatically each domain in a forest has a two-way trust with every other domain in the forest. If this isn't satisfactory and you need to have more control over trusts created between domains, then you need to put these domains into different forests.

Similarly, each forest has a common schema, which is only updateable by members of the Schema Admins group in the root domain of the forest. Conversely, if you need to have different schemas then this means you must be considering different forests.

Know both in and out before attempting to sit this exam.

Domains were the building block of Windows NT. All changes in account details in the domain and are replicated to all domain controllers in the domain. If the underlying network isn't able to handle the replication traffic along a relatively slow link, then this may mean that you need to create smaller domains so that this link isn't wasted with domain replication traffic.

Account polices, audit policies and Kerberos ticket policies are configured at the domain level, which means that if you need different policies in these areas then you are considering multiple domains. Also, you may have multiple domains if you upgrade in place from NT 4.0. One option you typically might consider when upgrading is to convert your existing NT 4.0 resource domains into OUs. This reduces the number of domains to support (and keep in mind each additional domain costs more and more resources) and instead you can delegate admin control of those resources to the OU.

Within a site, communications between domain controllers are configured automatically. You need to explicitly configure links between sites.

6. Remember Domain Controller Redundancy
Domain controllers are, of course, used to process logons to AD. You would typically design for at least one domain controller per site to ensure responsive logons. For redundancy purposes, it is also a good idea to have at least two domain controllers per domain.

7. Know the What, When and Why of Operations Masters
You need to know what each of these actually do, then which are per-forest (schema master and domain naming master) and which are per-domain (infrastructure master, RID master and PDC emulator). Don't forget that because these are AD functions, all operations masters must already be domain controllers. The infrastructure master, which maintains user to group to user references, is typically the most loaded server, so it is recommended NOT to place this on the same server as the Global Catalog.

For this exam, you need to know whether an existing DNS is available for the company, and whether it can use SRV records and DDNS (UNIX hosts need to use BIND 8.2.1 and above to support this). If it doesn't support these or can't be reasonably upgraded, then an option is to delegate a subdomain that is used by AD and hosted on Win2K servers. This subdomain can then support DDNS and SRV records. For example, you might have to create a subdomain called win2k.mycompany.com.

Another decision point is whether you have an Internet presence and whether your internal DNS should share the same name as the external DNS. If they are, this makes things easy for the users to access the company Web site on the Internet, but makes more work for the firewall configuration. If the names are different, your users will be confused about having to access, for example, www.mycompany.com for the external site and www.myco.com for the internal site.

As an aside, one of the many differences between Microsoft's OUs in AD and Novell's OUs in NDS is that, in NDS, you can assign rights to the OU, which then means that all users within the OU then have these rights as well (since an object is always the security equivalent of the container object in which it belongs). Unfortunately, AD uses groups for this instead of OUs, so you can't assign rights to an OU in Windows 2000 and expect these to be available to the objects contained within it.

Well, there we have it. This should be a good start for your exam preparations. Good luck!