Prepare yourself for the Microsoft MCSA 70-412 exam. This course explores how to implement an advanced DHCP solution, implement an advanced DNS solution, and deploy and manage IP Address Management.

These notes are my personal notes from the FREE training on Pluralsight. You can get your FREE signup through technet/MSDN or Dreamspark. The title of this course is exactly the title of this post. These notes are from this specific course only. I use these as a refresher Study Guide. POWERSHELL topics andcmdlets are in purple. I have a few notes with the “DEMO” each time the training included a DEMO just so you can see how many demos there were which were really helpful. Thanks to Greg Shields @ConcentratdGreg, the trainer, contact info at the end.

All, or nearly all, sections include DEMOS so I’m not notating that separately.

1. Implement an Advanced DHCP Solution
   1. Create and configure superscopes and multicast scopes
      1. superscopes – combine multiple DHCP scopes to have broader range of addresses
      2. initial subnet didn’t have enough addresses
      3. when you run out of addresses;
         1. define by geographical location; floor, building, city, etc.
         2. assign multiple network IPs to router (downside is network admin involvement)
         3. DHCP RELAY – we’ve been there…allows DHCP traffic to cross router
         4. DEMO
            1. In DHCP, create superscope, then add multiple scopes to it
            2. Multicast scope –
               1. create Multicast scope, pick start/end IP, set TTL
               2. unlikely would be allowed on most modern networks
               3. most common use is WDS or other desktop deployments
   2. Configure DHCP filters and policies
      1. nodes in DHCP mmc
         1. filters; allow or deny by MAC
         2. then have to “enable” by checkbox
         3. can set exemptions
         4. Policies; what options will the managed machines get
            1. vendor class
            2. MAC
            3. FQDN
         5. Then set what treatment those hosts that fit the policy actually get
   3. Implement DHCPv6
      1. Not a lot of real world use yet
      2. NOT very simple
      3. built into IPv6 can auto assign anyhow. Don’t believe it read this article…IPv6 address autoconfiguration
      4. This would be used for anything beyond what the protocol can do.
      5. CANNOT assign a default gateway
      6. CAN assign most other options
      7. NOT really needed for auto assignment, more used for address control
      8. DEMO
         1. click on IPv6, right click “new scope”
         2. etc. pretty much like IPv4
         3. beware of test questions about WHY you would use it.
   4. HA for DHCP – failover and split scopes
      1. split scopes (the old way)
         1. 80% / 20% is the most common (I’m sure I’ve seen test questions that said that was wrong though).  Well the 80/20 split scope is Microsoft best practice see here.
         2. Can be messy recovering from a server outage; the DHCP databases don’t know anything about what the other one is doing.
      2. DHCP Failover
         1. one DB
         2. can use 100% of scope
      3. DEMO
         1. split scopes (split scope configuration wizard)
         2. DHCP Failover
            1. per scope
            2. “Configure Failover”
            3. set load balance or hot standby and some other settings
            4. you can enable message authentication via shared secret
            5. Configure DNS registration, can discard as well
   5. DHCP Name Protection
      1. mainly for non-windows computers (screenshot)
      2. prevents non-windows from registering a name that is already in use.
   6. DNS Registration
      1. 1. Configure DNS registration, can discard as well
2. Implement an Advanced DNS Solution
   1. Configure Security for DNS, including DNSSEC, DNS Socket Pool, and Cache Locking
      1. DNSSEC does not necessarily require certs.
      2. To enable you “sign” the zone.
      3. Key Master is the authoritative DNS server that generates and manages the key for the zone.
      4. when you create the new key, then you have all kinds of options
      5. Needs to be AD integrated zone
      6. KSK – Key Signing Key and ZSK – Zone Signing Key
      7. Trust Anchor (for authenticating non-authoritative server
      8. Then GP is used to tell clients to ask for the DNS key
      9. “name resolution policy”, checkbox for enable DNSSEC
      10. create rules to determine who it applies to
      11. DNS Socket Pool (in response to Kaminsky attack DNS vulnerability)
          1. randomizes the SOURCE PORT to not be using TCP/53 and UDP/53
          2. enabled by default, but you tweak settings like number of ports
          3. DnsCmd /config /socketpoolsize 100000
          4. DnsCme /info /socketpoolsize
      12. Cache Locking
          1. Locks cache after update in cache.
          2. cannot be overwritting by a percentage of TTL
          3. default is 100% of TTL
          4. DnsCmd /config /cachelockingpercent 50
   2. Configure DNS Logging
      1. two places it can be configured depending on what you want
      2. event logging (1)  goes into event logs
      3. debug logging (2) goes into file
   3. Configure Delegated Administration
      1. under “security” tab
      2. for you to delegate activities, you MUST have AD integrated zone (test question?)
   4. Configure recursion
      1. disabled by default
      2. servicing servers outside your network
      3. should be ON on external server to prevent DNS attacks
   5. Configure Netmask ordering
      1. common use – WSUS
      2. essentially allows DNS server give a client an address that corresponds to the subnet that they are in. For traveling users.
      3. First response goes to server with same subnet
   6. Configure Global Names Zone
      1. for needs that used to be handled by WINS
      2. short name resolution
      3. create a zone called “GlobalNames”
      4. will contain short names
      5. you have to explicitly enable on all DNS servers
      6. dnscmd servername /config /enableglobalnamessupport 1
   7. Analyze Zone level statistics
      1. Get-DNSServerStatistics -zonename company.local
      2. DNSLint
         1. graphical display of internal/external on .htm file
         2. dnslint 
3. Deploy and Manage IP Address Management – IPAM
   1. Provision IPAM via manual or GP
   2. IMPORTANT NOTE: to change  the IPAM provisioning method (like from manual to automatic) you must UNINSTALL and REINSTALL!
      1. install FEATURE
      2. configure from Server Manager
      3. choose database (internal or SQL)
      4. GPO Name prefix (manual configuration of IPAM is tedious and not recommended)
      5. run PS command Invoke-IpamGpoProvisioning -Domain ….creates the Group Policies and links them.
      6. Run IPAM server discovery
      7. Choose the ones you want and set them to managed.
         1. managed servers need to show up in “security filtering’ box on the GPO
         2. machine has to receive and apply the GP before it shows as “unblocked” and “managed”
         3. IPAM is more of a “push” instead of pulling in existing IP use
         4. IP Address block
            1. 1 or more IP ranges
         5. Add address range (block of IPs or open range that IPAM can use)
         6. can add reservations and VIPs
         7. along with normal DNS, gateway and other information
   3. Configure server discovery
   4. create and manage IP blocks and ranges
   5. migrate to IPAM
      1. tasks / import IP addresses (imports from .csv). certain mandatory columns for IPAM imports – IPAddress,IPAddressState,AssignmentType,ManagedByService,ServiceInstance,AssetTag
   6. monitor utilization of IP address space
      1. lirrlw pie chart by each range, can be adjusted for the entire server
   7. delegate IPAM administration
      1. there is an “ACCESS CONTROL” link on the very bottom left to set up roles and access.
      2. several default roles but you can create your own customized roles and set the policy settings
   8. Manage IPAM collections
      1. request new addresses (fine and allocate) “find next”
      2. RECLAIM ip addresses that are no longer used, delete resource records and DHCP reservations if exist.
      3. EVENT CATALOG – log viewer of IPAM events
      4. ADDRESS RANGE GROUPS – group by custom fields you defined during IP creation
   9. configure IPAM database storage
      1. PS Move-IPAMDatabase (moved internal IPAM DB to SQL if you want)
      2. lots of IPAM powershell commands (automation possibilities)