An access mask is a 32-bit value that specifies which operations by the user or group are allowed, denied, or audited in an access control entry (ACE) of an access control list (ACL). It is also used to request access rights when an object is opened.

Access control entry (ACE) is an entry in an object’s discretionary access control list (DACL) that grants permissions to a user or group. It is also an entry in an object’s system access control list (SACL) that specifies the security events to be audited for a user or group.

Multicast boundaries are administrative barriers to the forwarding of IP multicast traffic. Without boundaries, an IP multicast router forwards all appropriate IP multicast traffic. Administrators can create multicast boundaries by a range of IP addresses known as a multicast scope, by the value of the Time to Live (TTL) field in the IP header, or by the rate of multicast traffic.

A network sniffer is a hardware and software diagnostic tool. It can also be used to decipher passwords, which may result in unauthorized access to network accounts. Plain text passwords are highly vulnerable to network sniffers.

Reverse lookup is a type of query in which a client computer uses another computer’s address and tries to determine the DNS name of the computer. This type of query is important for programs that implement security based on the connecting Fully Qualified Domain name (FQDN), and is also used for troubleshooting a TCP/IP network. Reverse lookup uses the A, SOA, NS, MX, SRV, PTR, and CNAME DNS resource records to perform reverse lookups.

Remote Desktop for Administration is a component of Windows Server 2003 Terminal Services, which is designed for server management. It is a convenient and efficient service for remote management, as it can be used on an already busy server without noticeably affecting CPU performance. Administrators can fully administer computers running Windows Server 2003 family operating systems from computers running earlier versions of Windows by installing the Remote Desktop Connection.

Note: Remote Desktop for Administration does not require purchasing special licenses for client computers that access the server.

The parent-child trust is a two-way transitive trust. It is established implicitly (automatically) when a child domain is added to a tree.

Often referred to as a cross-link trust, the shortcut trust is a transitive trust, which can be one-way or two-way. This trust is explicitly (manually) created by administrators between two domains in a same forest to improve a user’s logon time. This trust is extremely useful whenever two domain trees separate the domains.

Replication is a process through which the changes made to a replica on one domain controller are synchronized to replicas on all other domain controllers in the network. Each domain controller stores three types of replicas:
•Schema partition: This partition stores definitions and attributes of objects that can be created in the forest. Changes made in this partition are replicated to all the domain controllers in all the domains in the forest.

•Configuration partition: This partition stores the logical structure of the forest deployment. It includes the domain structure and replication topology. Changes made in this partition are replicated to all the domain controllers in all the domains in the forest.

•Domain partition: This partition stores all the objects in a domain. Changes made in this partition are replicated to all the domain controllers within the domain.
Note: Windows supports a new type of directory partition named Application directory partition. This partition is available only to the Windows 2003 (or above) domain controllers. The applications and services use this partition to store application-specific data.

Creating, modifying, moving, or deleting an object triggers a replication between domain controllers. Replications are of two types:
•Intrasite: In the intrasite (within a site) replication, the data is not compressed, as the replication mostly uses LAN connections. This saves the computer’s CPU time of processing data. In the intrasite replication, the replication partners poll each other periodically and notify each other when changes need to be replicated, and then pull the information for processing. Active Directory uses the remote procedure call (RPC) transport protocol for intrasite replication.

•Intersite: As intersite (between sites) replication uses WAN connections, a large amount of data is compressed to save bandwidth. For the same reason, the replication partners do not notify each other when changes need to be replicated. Instead, administrators configure the replication schedule to update the information. Active Directory uses the IP or SMTP protocol for intersite replication.
For intrasite replication to take place, the connection object is required. Active Directory automatically creates and deletes connection objects as and when required. Connection objects can be created manually to force replication.

The synchronization log stores information about the synchronization of contents. The log contains the following synchronization information:

• The success and failure information for the overall synchronization operation.
• The time of the next synchronization if scheduled synchronization is enabled.
• The update packages that have been downloaded or updated since the last synchronization.
• The synchronization log can be accessed from the SUS
• The update packages that have been downloaded or updated since the last synchronization.
• AdministraThe synchronization log can be accessed from the SUS tion console or can be directly accessed by using the text editor.

The name of the synchronization log file is historySync.xml. The file is located in the SUS installation folder under VRootAutoUpdateAdministration.

Terminal Service Manager is a utility that is used to view information about Terminal servers in trusted domains. It provides information about all sessions, users, and processes for each Terminal server. By using Terminal Service Manager, a user can perform the following tasks:

• Connect to another session.
• Disconnect from a session.
• Log off a user from a session.
• Send a message to a user.
• End a process.
• Reset a session.

The Active Directory Migration Tool (ADMT) is used to migrate from an earlier implementation of Windows NT to Windows Server 2003 or Windows 2000 Server. ADMT supports not only migration from Windows NT 4.0 to Active Directory but also interforest and intraforest migrations. ADMT is designed to migrate an Active Directory schema from one forest to another, regardless of whether a change in operating systems is involved.

ADMT 2.0 has many new features such as a command-line interface and a better interface to work with Microsoft Exchange Server. ADMT also supports a user-account password migration.

Microsoft Baseline Security Analyzer (MBSA) is a tool that includes a graphical and command line interface that can perform local or remote scans of Windows systems. It runs on computers running Windows 2000, Windows XP, or Windows Server 2003 operating system. MBSA scans for common security misconfigurations in Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Internet Information Server (IIS) 4.0 and above, SQL Server 7.0 and 2000, and Office 2000 and 2002. It also scans for missing hot fixes in several Microsoft products, such as Windows 2000, Windows XP, SQL Server etc.

HFNETCHK.EXE is a command-line utility that checks the patch status of one or more machines across the network. Earlier HFNETCHK was a separate command-line utility. However, its latest version is built into MBSA version 1.1, and is used by MBSA to display information in a graphical format. Users can run the HFNETCHK utility using the MBSACLI.EXE /hf command. The MBSACLI.EXE program is installed as a part of MBSA.

DNS server is a computer that runs the Domain Name System (DNS) service. It contains host name-to-IP address mappings, IP address-to-host name mappings, information about the domain tree structure, etc. A DNS server is also used to resolve DNS client queries.