Research & Evidence-Based Practice Flashcards

An organization is using evidence-based capacity planning for AD DS. Which performance counter set provides the most relevant baseline data for domain controller health?

Answer: NTDS object counters in Performance Monitor

The NTDS performance object exposes counters for LDAP searches, DRA replication, Kerberos authentications, and NTLM operations—critical for AD-specific capacity planning.

After studying replication convergence issues, an administrator wants to confirm that all domain controllers hold identical values for a critical attribute. Which repadmin command compares attribute values across all DCs?

Answer: repadmin /showattr * /atts:

repadmin /showattr with the wildcard (*) queries every DC for the specified object's attribute values, revealing any replication inconsistencies.

Evidence-based monitoring practice recommends alerting on which condition to detect AD database (NTDS.dit) free-space issues before they cause domain controller failures?

Answer: Monitor the disk partition hosting NTDS.dit for less than 20% free space

The NTDS.dit database requires free disk space to perform online defragmentation and log flushing; proactive disk monitoring prevents AD database corruption.

Research into AD DS upgrade paths shows that when raising the domain functional level to Windows Server 2008, what new feature becomes available that was not present at the 2003 level?

Answer: Distributed File System Replication (DFSR) for SYSVOL

At Windows Server 2008 domain functional level, SYSVOL replication can be migrated from FRS to the more reliable DFSR mechanism.

An evidence-based approach to AD disaster recovery testing requires verifying authoritative restore capability. Which tool and method performs an authoritative restore of a deleted OU?

Answer: ntdsutil 'authoritative restore' 'restore subtree '

ntdsutil's authoritative restore command increments USN values on restored objects so they replicate outbound and overwrite the deletion on other DCs.

To verify that AD integrated DNS zones are healthy and that zone data is consistent across all domain controllers, which evidence-gathering command should be run?

Answer: dcdiag /test:DNS /DnsRecordRegistration /v

dcdiag /test:DNS with /DnsRecordRegistration /v performs a comprehensive DNS test verifying zone consistency, SRV records, and registration across all DCs.

Based on Microsoft's evidence-based guidance for AD DS forests with multiple UPN suffixes, what must be configured so that users can log on with an alternate UPN suffix?

Answer: Add the alternate UPN suffix in Active Directory Domains and Trusts, then assign it to user accounts

Alternate UPN suffixes are registered in Active Directory Domains and Trusts under the forest root, then assigned per-user in the Account tab of their AD object.