What is The Role of the System Administrator?
The person who is responsible for setting up and maintaining the system or
server is called as the system administrator. System administrators may be
members of an information technology department. Most of the following
discussion also applies to network and Windows system admins.Duties of a system administrator
The duties of a system administrator are wide-ranging, and vary widely from one organization to another. Sysadmins are usually charged with installing, supporting, and maintaining servers or other computer systems, and planning for and responding to service outages and other problems. Other duties may include scripting or light programming, project management for systems-related projects.The system administrator is responsible for following things:
- User administration (setup and maintaining account)
- Maintaining system
- Verify that peripherals are working properly
- Quickly arrange repair for hardware in occasion of hardware failure
- Monitor system performance
- Create file systems
- Install software
- Create a backup and recover policy
- Monitor network communication
- Update system as soon as new version of OS and application software comes out
- Implement the policies for the use of the computer system and network
- Setup security policies for users. A sysadmin must have a strong grasp of computer security (e.g. firewalls and intrusion detection systems)
- Documentation in form of internal wiki
- Password and identity management
Cloud computing and sysadmin
Cloud computing is nothing but a large number of computers connected through the Internet/Wan. Cloud computing is now part of technology and sysadmin must lean:- Automation software such as puppet, chef, etc.
- Cloud infrastructure such as AWS, Openstack etc.
- Network services in cloud such as Content delivery networks (Akamai, Cloud Front etc) and DNS servers.
- Source control
- Designing best practices for backups, and whole infrastructure.
What is so special about the system administrator account?
The root account has full (unrestricted) access, so he/she can do anything with system. For example, root can remove critical system files. In addition, there is no way you can recover file except using tape backup or disk based backup systems.Many tasks for system administration can be automated using Perl/Python or shell scripts. For example:
- Create new users
- Resetting user passwords
- Lock/unlock user accounts
- Monitor server security
- Monitor special services etc.
Most important skill to a system administrator
Problem solving, period. This can some time lead into all sorts of constraints and stress. When workstation or server goes down, you are called to solve the problem. You should able to quickly and correctly diagnose the problem. You must figure out what is wrong and how best it can be fixed in small amount of time.System administrators are not...
- Cookie cutting software engineers.
- Developers.
- It is not usually within your duties to design new applications software.
- But, you must understand the behavior of software in order to deploy it and to troubleshoot problems, and generally should be good at several programming languages used for scripting or automation of routine tasks such as shell, awk, perl, python etc.
Questions for a System Administrator
Position:
All of the questions below are very
common and must be prepared for before facing any interview for a System-Server
Administrator position.
Q: What is Active Directory?
A: Active Directory provides a centralised control for network
administration and security. Server computers configured with Active Directory
are known as domain controllers. Active Directory stores all information and
settings for a deployment in a central database, and allows administrators to
assign policies and deploy and update software.
Q: What is a Domain?
A: A domain is defined as a logical group of network objects
(computers, users, devices) that share the same Active Directory database. A
tree can have multiple domains.
Q: What is Domain Controller?
A: A domain controller (DC) or network domain controller is a
Windows-based computer system that is used for storing user account data in a
central database. It is the centrepiece of the Windows Active Directory service
that authenticates users, stores user account information and enforces security
policy for a Windows domain.
A domain controller allows system
administrators to grant or deny users access to system resources, such as
printers, documents, folders, network locations, etc., via a single username
and password.
Q: What is Group Policy?
A: Group Policy allows you to implement specific configurations
for users and computers. Group Policy settings are contained in Group Policy
objects (GPOs), which are linked to the following Active Directory service
containers: sites, domains, or organizational units (OUs).
Q: What are GPOs (Group Policy
Objects)?
A: A Group Policy Object (GPO) is a collection of settings that
control the working environment of user accounts and computer accounts. GPOs
define registry-based policies, security options, software installation and
maintenance options, script options, and folder redirection options.
There are two kinds of Group Policy
objects:
·
Local
Group Policy objects are stored on individual computers.
·
Nonlocal
Group Policy objects, which are stored on a domain controller,
are available only in an Active Directory environment.
Q: What is LDAP?
A: LDAP (Light-Weight Directory Access Protocol) determines how
an object in an Active Directory should be named. LDAP is the industry standard
directory access protocol, making Active Directory widely accessible to
management and query applications. Active Directory supports LDAPv2 and LDAPv3.
Q: Where is the AD database stored?
A: The AD database is stored in C:\Windows\NTDS\NTDS.DIT.
Q: What is the SYSVOL folder?
A: The SYSVOL folder stores the server copy of the domain’s
public files that must be shared for common access and replication throughout a
domain.
All AD databases are stored in a SYSVOL folder and it’s only created in an NTFS partition. The Active Directory Database is stored in the %SYSTEM ROOT%NDTS folder.
All AD databases are stored in a SYSVOL folder and it’s only created in an NTFS partition. The Active Directory Database is stored in the %SYSTEM ROOT%NDTS folder.
Q: What is Garbage collection?
A: Garbage collection is the online defragmentation of the
Active Directory which happens every 12 hours.
Q: When do we use WDS?
A: Windows Deployment Services is a server role used to deploy
Windows operating systems remotely. WDS is mainly used for network-based OS
installations to set up new computers.
Q: What is DNS and which port number
is used by DNS?
A: The Domain Name System (DNS) is used to resolve
human-readable hostnames like www.intenseschool.com into machine-readable IP
addresses like 69.143.201.22.
DNS servers use UDP port 53 but DNS
queries can also use TCP port 53 if the former is not accepted.
Q: What are main Email Servers and
which are their ports?
A: Email servers can be of two types:
Incoming Mail Server (POP3, IMAP,
HTTP)
The incoming mail server is the
server associated with an email address account. There cannot be more than one
incoming mail server for an email account. In order to download your emails,
you must have the correct settings configured in your email client program.
Outgoing Mail Server (SMTP)
Most outgoing mail servers use SMTP
(Simple Mail Transfer Protocol) for sending emails. The outgoing mail server
can belong to your ISP or to the server where you setup your email account.
The main email ports are:
·
POP3 – port 110
·
IMAP – port 143
·
SMTP – port 25
·
HTTP – port 80
·
Secure SMTP (SSMTP) – port 465
·
Secure IMAP (IMAP4-SSL) – port 585
·
IMAP4 over SSL (IMAPS) – port 993
·
Secure POP3 (SSL-POP) – port 995
Q: What do Forests, Trees, and
Domains mean?
A: Forests, trees, and domains are the logical divisions in an
Active Directory network.
A domain is defined as a logical
group of network objects (computers, users, devices) that share the same active
directory database.
A tree is a collection of one or
more domains and domain trees in a contiguous namespace linked in a transitive
trust hierarchy.
At the top of the structure is the
forest. A forest is a collection of trees that share a common global catalog,
directory schema, logical structure, and directory configuration. The forest
represents the security boundary within which users, computers, groups, and
other objects are accessible.
Q: Why do we use DHCP?
A: Dynamic Host Configuration Protocol assigns dynamic IP
addresses to network devices allowing them to have a different IP address each
time they are connected to the network.
Q: What are Lingering Objects?
A: A lingering object is a deleted AD object that still remains
on the restored domain controller in its local copy of Active Directory. They
can occur when changes are made to directories after system backups are
created.
When restoring a backup file, Active
Directory generally requires that the backup file be no more than 180 days old.
This can happen if, after the backup was made, the object was deleted on
another DC more than 180 days ago.
Q: How can we remove Lingering
Objects?
A: Windows Server 2003 and 2008 have the ability to manually
remove lingering objects using the console utility command REPADMIN.EXE
.
.
Q: Why should you not restore a DC
that was backed up 6 months ago?
A: When restoring a backup file, Active Directory generally
requires that the backup file be no more than 180 days old. If you attempt to
restore a backup that is expired, you may face problems due to lingering
objects.
Q: How do you backup AD?
A: Backing up Active Directory is essential to maintain the
proper health of the AD database.
Windows Server 2003
You can backup Active Directory by
using the NTBACKUP tool that comes built-in with Windows Server 2003 or use any
3rd-party tool that supports this feature.
Windows Server 2008
In Server 2008, there isn’t an
option to backup the System State data through the normal backup utility. We
need to use the command line to backup Active Directory.
1. Open up your command prompt by
clicking Start, typing “cmd” and then hit Enter.
2. In your command prompt, type
“wbadmin start systemstatebackup -backuptarget:e:” and press Enter.
3. Input “y” and press Enter to
start the backup process.
When the backup process has finished
you should get a message that the backup completed successfully. If it did not
complete properly you will need to troubleshoot.
Tips for Preparing for an Interview
·
Study: Before an interview, do a quick recap of relevant
technologies.
·
Update
resume: Read your resume through; don’t
copy and paste your anything in it. You must be aware of your strengths and
weaknesses.
·
Prepare
professional certifications: One of
the best ways to prove the technical skills mentioned in your resume is through
certifications. This gives a new employer an easy way to understand your
knowledge level.
·
Update
LinkedIn profile: Update your LinkedIn profile
regularly; make sure that your work experience, qualifications, and project
details match your resume.
Q. Please describe the technical environment of your current (or most
recent) position.
A. When describing the technical environment that you currently support, be sure to include the number of users you support, the number of IT staff, the technical infrastructure including servers, types of connections, desktop operating systems, your job duties, and your work schedule.
You should be prepared to talk about each of the positions you have listed on your résumé in this way. Also be prepared with a follow-up statement of your most significant accomplishment.
Q. How do you keep your technical knowledge and skills current?
A. Keeping your skills current demonstrates initiative and a desire to perform at high standards. Be prepared with a list of resources including professional groups.
Q. Please describe your greatest technical challenge and how you overcame it.
A. Ah, an opportunity for a story. Great examples to draw on: how you taught yourself a new operating system, the installation of a complex system, integration of multiple systems, building of an e-commerce web site.
Q. What are some of the tools you use to make your job easier?
A. All network administrators have a bag of tricks. You should share some of your trade secrets as a way of demonstrating that you can be efficient in your job as a network administrator. These can include ghosting tools, troubleshooting tools, and documentation tools.
Q. How do you document your network?
A. One of the toughest parts of network administration is keeping track of an always changing environment. You must have basic documentation for user administration, file system planning, and address planning. Share your documentation with your interviewer.
Planning Questions
The interviewer will be interested in your network planning methodologies. The following questions provide insight into these skills.
Q. What are some of the things you need to take into consideration when planning an upgrade from one network operating system to another?
A. This is the mother of all planning activities because it will affect so many resources. The key here is testing and backups and that’s what the interviewer wants to hear. Other considerations include:
Network documentation
Ensuring that your hardware meets the minimum hardware requirements for the new operating system
Creating a test network for testing the compatibility of applications, hardware, and drivers with the new operating system
Gathering all updated drivers and patches/service packs required for upgrade compatibility
Identifying workflow issues before converting
Separating workstation conversions from server conversions
Ensuring you have backups of data and the servers so that you can revert back
Network addressing scheme
Q. Describe the backup/restore policy you use most.
A. First of all, the interviewer wants to ensure that you do backups! There are different methods, but the most common backup strategy used is to perform incremental backups Monday through Thursday and a normal backup on Friday. An alternative backup strategy is to perform differential backups Monday through Thursday and a normal backup on Friday.
Q. How would you ensure that your servers are secure?
A. Security always begins at the physical level—it makes little difference that you’ve provided all the security the operating system and software can provide if someone can walk away with the box or the portable hard drive. The next step is to ensure you have the latest service packs for the operating system and applications running on the server.
Installation
Q. What steps do you go through as part of your server installation process?
A. The interviewer wants to know whether your typical work habits are to just jump in or whether you do some planning. You obviously want to ensure that your hardware meets the minimum requirements, that you have all the right drivers for the new operating system, and whether you need a ROM upgrade for your hardware. Depending on how many installations you’ve done, you may have a process that you like to follow. If you do, describe it to the interviewer.
Q. How do you determine which file system is best for your environment?
A. This question tests how well you plan for a variety of different environments. The key here is to take into consideration the file format support required for backward compatibility with other operating systems like NetWare or older versions of Windows NT. You’ll also want to make sure there’s enough disk space for drivers and files that must reside in the system partition, as well as space for a dump file if anything goes wrong.
Q. What’s the first thing you should do after installing the network operating system?
A. This is a test of your security skills. The first thing you should do is either change the password on the administrator account or change the name of the account itself.
Q. You just installed a service pack on the e-mail, SQL, print, and file servers. You rebooted all the servers, and now the service pack installation is complete. What’s the final step for the evening?
A. The interviewer wants to make sure that testing is an integral part of your routine whenever you install software or make updates to systems. You may also want to review the Event Viewer logs and look for any errors that have been registered. It’s a good idea to also examine the administrative interfaces for SQL and the e-mail server to satisfy yourself that no anomalies have appeared there.
Configuration
Ninety percent of your day is spent configuring network services, whether it’s installing applications, creating users, or adding printers.
Q. What methods are available for configuring a WINS server for use by various Microsoft computers?
A. This question demonstrates to the interviewer that you are familiar with the various methods for configuring routing using WINS. You can either configure the WINS server manually or by way of a Dynamic Host Configuration Protocol Server.
Q. A user has left the company and you need to create a new user with the same rights and permissions. What are some of the ways to create the new user?
A. By asking you to describe multiple ways of getting the job done, the interviewer can assess your experience level with the operating system. Some of the correct answers to this question include the following:
You could copy an existing user’s account to create a new account. However, the rights and permissions for the new, copied account will be based purely on its group memberships, not permissions g
ranted strictly to the original account itself.
Using Active Directory, you could use the CSVDE.exe program to create a new account with specific group memberships; however, this program is usually intended for bulk creation of accounts in your domain.
You could create the new account from scratch, assigning group permissions or individual rights manually.
Q. What are some of the alternative ways for mapping a drive letter to a file server if you wish to connect to one of the server’s shared folders?
A. This question tests your experience by asking for alternate methods of getting the job done. In addition to mapped drives you can use a Universal Naming Convention path: \\servername\ sharename. You can also browse the Network Neighborhood.
Q. You shared a printer from your NT server. What could you do to ensure that the printer is easily accessible to your Windows 98 clients?
A. You may have to support older clients on your network. This question tests your experience with older technology. In this case, you should load the Windows 98 printer drivers on the share point.
Q. How large can I make a file allocation table partition using the NT operating system?
A. This question tests your familiarity with system capabilities and limitations. The maximum FAT partition size is 4 gigabytes.
Q. Is it necessary for an NT client computer to use the server’s name in that UNC path?
A. There are typically multiple ways of accomplishing the same task. Thank goodness, because you sometimes need them while troubleshooting. Using very basic questions, the interviewer can assess your real knowledge and experience with various operating systems. In this case, you can also use the server’s TCP/IP address.
Q. We are creating a web site on our NT server using Internet Information Server 4.0. We expect users to log on anonymously. How many client access licenses must we purchase to allow up to 100 simultaneous connections to our web site?
A. This is a trick question to see if you understand the concept of user licensed connections. Anonymous logons on IIS 4.0 do not require client access licenses.
Troubleshooting
Q. A user contacts you and reports that their Windows 2000 workstation is having trouble connecting to the Web. You run the ipconfig command on the computer and you find that the computer is not referencing the correct primary DNS server. What must you do to remedy this?
A. Using this question, the interviewer can assess your routing troubleshooting skills, an essential part of network administration. In this case, you would want to check the primary DNS setting in the IP configuration of the computer. If ipconfig shows a setting for the default DNS server other than what you want, this means the computer’s IP configuration is incorrect. Therefore, the Windows 2000 client computer needs to be reconfigured.
Q. Users are complaining of slow performance when they run server-based applications.
The server has the following specifications:
> Compaq 1600
> 800 MHz Pentium 3
> 256MB of RAM
> 18GB EIDE hard drive
> 10/100 NIC
> Connected to a Cisco switch
The performance monitor shows the following:
Memory Pages/Sec: 5
Physical Disk % Disk Time: 20 percent
Processor % Processor Time: 90 percent
What is the best way to improve the system’s performance?
A. This question tests your knowledge of server optimization. In this case, the recommendation should be to upgrade the processor. Microsoft recommends you do so if the CPU utilization averages over 70 to 75 percent.
Q. A user is having trouble sharing a folder from their NT Workstation. What is a likely cause?
A. The interviewer is testing your basic knowledge of rights. In order to share a folder you must be logged on as an administrator, server operator (in a domain), or power user (in a workgroup).
Q. You’ve shared a folder and set the share permissions to “Everyone = Full Control.” However, none of the users can save information in the folder. What’s the likely cause?
A. This is another question that tests your knowledge of permissions. The likely cause is that someone has set the NTFS permissions in a more restrictive manner than the share permissions. Between those two categories of permissions, the more restrictive of the two always applies to users accessing the folder over the network.
Q. What is the most likely cause for the failure of a user to connect to an NT remote access server?
A. Supporting remote users may be a big part of your job. It’s important to understand the proper configuration and troubleshooting of the NT RAS. In this case, the user must be granted the RAS dial-in permission.
Q. A remote user in Montana, who is not technical and is scared to death of computers, calls for help. The user logged in to your network via the terminal server. You determine that the solution to the user’s problem requires an edit of a hidden read-only file, deleting a system file in the winnt\system32 folder, and creating a simple batch file on the user’s computer. What tools would you use to resolve this problem?
A. This question tests your ability for remote troubleshooting. An administrator can edit these files on the user’s computer by connecting to it over the network via the Computer Management console in Windows 2000. Using this console, you can access the administrative shares (C$, D$, and so on) that represent the partitions on the user’s computer. From there, you can edit or create any files necessary to repair the problem.
Windows NT Networking Questions
Windows NT is still the most popular operating system around. You should be comfortable with this environment to be able to respond to the following questions that an interviewer may ask you.
Q. Why is Windows Internet Name Server needed in a Windows NT domain?
A. An important part of network administration is setting up the server and clients so they can find one another. WINS is necessary to achieve NetBIOS name resolution. Your desktop clients can then log on to the domain, and the domain controllers can authenticate to one another.
Q. What is the normal replication interval between the primary domain controll
er and the backup domain controller?
A. The PDC waits five minutes after a change in the domain database before “pulsing,” or notifying, the BDCs.
Q. How can you synchronize a BDC immediately?
A. Within the server manager, select the BDC’s account, choose the Computer menu, and select Synchronize With Primary Domain Controller.
Q. Users change their passwords in the NT domain every 30 days. Our primary domain controller is in New York, but we have users in our California office. When a California user changes their password, will they be able to use the new password immediately, or must they wait for replication to occur to a backup domain controller in California?
A. You must have a firm grasp of replication. In this case, waiting for a replication will not be necessary. If a BDC doesn’t recognize a user’s password, it will automatically appeal to the PDC to establish its validity.
Q. I’ve created logon scripts for my users on the primary domain controller. I’ve correctly mapped them in the properties of my users’ accounts. Some run, some do not. What should I check next?
A. The scripts should be replicated to all of your backup domain controllers. The domain controller that validates the logon is the one that runs the script.
Q. Is it possible to create a domain account from an NT member server?
A. Yes. By using User Manager for Domains, you can create the account from the member server. The account will actually be created on the primary domain controller, however.
Q. Someone just dropped a safe on our primary domain controller. What should we do next?
A. You should promote one of your backup domain controllers to become the primary domain controller.
Q. After the promotion, what happens if we bring the old PDC back online?
A. When the old PDC gets back online, its Netlogon service will fail. You can resolve this through Server Manager by first demoting it to a backup domain controller and then promoting it to a primary domain controller.
Q. One of your users logs on to the domain from his NT Workstation. Due to a network failure the following day, he is unable to contact a domain controller when he tries to log on. Can the user log on with his domain account?
A. Yes. He will be able to log on with locally cached credentials.
Q. Someone deleted the account of one of my backup domain controllers in Server Manager. When the BDC boots up, it is unable to authenticate to the primary domain controller, and its Netlogon service fails. What can I do?
A. Either restore the account from a backup or reinstall the backup domain controller from scratch.
Q. How can I promote one of my member servers to become a backup domain controller?
A. You can’t. You must reinstall the entire operating system as a domain controller (either a backup or primary domain controller).
Q. Does it matter which of my domain controllers I upgrade to Windows 2000 first?
A. Yes. You must upgrade the primary domain controller to Windows 2000 before any of the backup domain controllers.
Q. What about the member servers and workstations? Must I upgrade them in any particular order?
A. No. member servers and workstations can be upgraded in any order.
Active Directory
In order to manage an Active Directory Services environment, you must be comfortable with planning, security and permissions, authentication, and synchronization. The following questions may be asked by the interviewer to assess your experience with performing these functions.
Q. What rights must your logged-in account have when creating a Windows 2000 forest?
A. You must understand rights and permissions thoroughly. In this instance, the account must have administrative rights on the Windows 2000 server used to create the new forest.
Q. What rights must your account have when adding a domain to an existing forest?
A. In this case, you must be a member of the Enterprise Administrators group.
Q. My account has the proper rights, but when I try to create a new domain I get an error message stating that the Domain Naming Master cannot be contacted. What does this mean?
A. An experienced network administrator will be able to readily troubleshoot for problems such as this one. This scenario can mean network connectivity issues or a failed Domain Naming Master, which is the domain controller for the forest root domain.
Q. Why is Domain Name System (DNS) so important to an Active Directory forest?
A. As a network administrator you must understand name resolution. DNS is critical to your forest because it possesses all of the service (SRV) records. These records indicate the TCP/IP address and port necessary to locate a specific service offered by a server.
Q. Does the DNS server have to be a Windows 2000 server?
A. This is a trick question. DNS is independent of Windows 2000 and so the answer is no. To support Active Directory, the DNS server must support two BIND (Berkeley Internet Name Domain) version standards: 4.9.6 (SRV records) and 8.1.2 (dynamic updates).
Q. What rights does a user need in order to create computer accounts in an Active Directory domain?
A. By default, a user only needs to be recognized as a member of the Authenticated Users group to add workstations to a domain. This permission is established in the Default Domain Controllers policy, and permits users to create up to ten accounts.
Q. Is it possible to have entirely separate domain name spaces within the same forest?
A. When it comes to Active Directory, you must have a thorough understanding of forest limitations. In this case, you can have multiple domain name spaces within the same forest.
Q. Do clocks synchronize automatically between Windows 2000 computers?
A. This question tests your understanding of Active Directory synchronization. Clocks do synchronize only within a domain. The Primary Domain Controller Emulator handles this task for you. But there is no server that automatically synchronizes clocks between your separate domains.
Q. To create Group Policy objects in a domain, what group must you be a member of?
A. You must be a member of the Group Policy Creator Owners group in your domain to create these objects.
Q. Is it possible to prevent the application of a Group Policy to a user account within one of our organizational units?
A. To prevent the application of a
Group Policy to a user, you would deny the Read and Apply Group Policy permissions to the user in that organizational unit.
Q. Is it possible to schedule replication between two domain controllers in Active Directory?
A. This question assesses your knowledge of configuration options for domain controllers within Active Directory. In this case, place the domain controllers in different sites. Then set the schedule on the Site Link object that connects the sites.
Q. My Windows 98 users cannot search for published objects in our Active Directory domain. How do I add this capability to their computers?
A. Add the DSClient utility to their computers from the Windows 2000 Server CD.
Q. What are some of the ways of propagating permissions set on an Active Directory object to lower-level child objects?
A. Administering security is a big part of an administrator’s job. One way to accomplish this task is the following: On the Security tab of the parent object, click the Advanced button. Using the special permissions list, be sure to select “Apply onto…This object and all child objects.” Another method is to use the Delegation of Control Wizard.
Q. An organization is running a web site using Internet Information Server 5.0 on a Windows 2000 Server. The site allows both Anonymous and Integrated Windows authentication. When our domain users connect to the site, which authentication method is used?
A. Understanding authentication modes is a critical part to troubleshooting and effectively securing resources. In this case, they will authenticate as the Anonymous account. An exception to this would be seen if the Anonymous account lacked permissions to a particular resource on the web site, in which case Integrated Windows authentication would be attempted.
Q. How can I move the Active Directory database and log files to a different drive on the domain controller?
A. This can be accomplished by rebooting the domain controller using Directory Services Restore Mode and running the ntdsutil tool.
Q. An administrator accidentally deleted an entire organizational unit containing 200 users from our domain. How can you recover the organizational unit?
A. Everyone has these types of situations. You must know how to recover from these mistakes. In this case, rebooting a domain controller using Directory Services Restore Mode and conducting an authoritative restore of the OU from a backup will solve the problem.
Q. We demoted our Primary Domain Controller Emulator to become a member server in our domain. What do we need to do to transfer the PDC Emulator role to another domain controller?
A. This question tests how well you understand how the PDC Emulator works. In this situation, the role was automatically transferred when the former PDC Emulator was demoted.
A. When describing the technical environment that you currently support, be sure to include the number of users you support, the number of IT staff, the technical infrastructure including servers, types of connections, desktop operating systems, your job duties, and your work schedule.
You should be prepared to talk about each of the positions you have listed on your résumé in this way. Also be prepared with a follow-up statement of your most significant accomplishment.
Q. How do you keep your technical knowledge and skills current?
A. Keeping your skills current demonstrates initiative and a desire to perform at high standards. Be prepared with a list of resources including professional groups.
Q. Please describe your greatest technical challenge and how you overcame it.
A. Ah, an opportunity for a story. Great examples to draw on: how you taught yourself a new operating system, the installation of a complex system, integration of multiple systems, building of an e-commerce web site.
Q. What are some of the tools you use to make your job easier?
A. All network administrators have a bag of tricks. You should share some of your trade secrets as a way of demonstrating that you can be efficient in your job as a network administrator. These can include ghosting tools, troubleshooting tools, and documentation tools.
Q. How do you document your network?
A. One of the toughest parts of network administration is keeping track of an always changing environment. You must have basic documentation for user administration, file system planning, and address planning. Share your documentation with your interviewer.
Planning Questions
The interviewer will be interested in your network planning methodologies. The following questions provide insight into these skills.
Q. What are some of the things you need to take into consideration when planning an upgrade from one network operating system to another?
A. This is the mother of all planning activities because it will affect so many resources. The key here is testing and backups and that’s what the interviewer wants to hear. Other considerations include:
Network documentation
Ensuring that your hardware meets the minimum hardware requirements for the new operating system
Creating a test network for testing the compatibility of applications, hardware, and drivers with the new operating system
Gathering all updated drivers and patches/service packs required for upgrade compatibility
Identifying workflow issues before converting
Separating workstation conversions from server conversions
Ensuring you have backups of data and the servers so that you can revert back
Network addressing scheme
Q. Describe the backup/restore policy you use most.
A. First of all, the interviewer wants to ensure that you do backups! There are different methods, but the most common backup strategy used is to perform incremental backups Monday through Thursday and a normal backup on Friday. An alternative backup strategy is to perform differential backups Monday through Thursday and a normal backup on Friday.
Q. How would you ensure that your servers are secure?
A. Security always begins at the physical level—it makes little difference that you’ve provided all the security the operating system and software can provide if someone can walk away with the box or the portable hard drive. The next step is to ensure you have the latest service packs for the operating system and applications running on the server.
Installation
Q. What steps do you go through as part of your server installation process?
A. The interviewer wants to know whether your typical work habits are to just jump in or whether you do some planning. You obviously want to ensure that your hardware meets the minimum requirements, that you have all the right drivers for the new operating system, and whether you need a ROM upgrade for your hardware. Depending on how many installations you’ve done, you may have a process that you like to follow. If you do, describe it to the interviewer.
Q. How do you determine which file system is best for your environment?
A. This question tests how well you plan for a variety of different environments. The key here is to take into consideration the file format support required for backward compatibility with other operating systems like NetWare or older versions of Windows NT. You’ll also want to make sure there’s enough disk space for drivers and files that must reside in the system partition, as well as space for a dump file if anything goes wrong.
Q. What’s the first thing you should do after installing the network operating system?
A. This is a test of your security skills. The first thing you should do is either change the password on the administrator account or change the name of the account itself.
Q. You just installed a service pack on the e-mail, SQL, print, and file servers. You rebooted all the servers, and now the service pack installation is complete. What’s the final step for the evening?
A. The interviewer wants to make sure that testing is an integral part of your routine whenever you install software or make updates to systems. You may also want to review the Event Viewer logs and look for any errors that have been registered. It’s a good idea to also examine the administrative interfaces for SQL and the e-mail server to satisfy yourself that no anomalies have appeared there.
Configuration
Ninety percent of your day is spent configuring network services, whether it’s installing applications, creating users, or adding printers.
Q. What methods are available for configuring a WINS server for use by various Microsoft computers?
A. This question demonstrates to the interviewer that you are familiar with the various methods for configuring routing using WINS. You can either configure the WINS server manually or by way of a Dynamic Host Configuration Protocol Server.
Q. A user has left the company and you need to create a new user with the same rights and permissions. What are some of the ways to create the new user?
A. By asking you to describe multiple ways of getting the job done, the interviewer can assess your experience level with the operating system. Some of the correct answers to this question include the following:
You could copy an existing user’s account to create a new account. However, the rights and permissions for the new, copied account will be based purely on its group memberships, not permissions g
ranted strictly to the original account itself.
Using Active Directory, you could use the CSVDE.exe program to create a new account with specific group memberships; however, this program is usually intended for bulk creation of accounts in your domain.
You could create the new account from scratch, assigning group permissions or individual rights manually.
Q. What are some of the alternative ways for mapping a drive letter to a file server if you wish to connect to one of the server’s shared folders?
A. This question tests your experience by asking for alternate methods of getting the job done. In addition to mapped drives you can use a Universal Naming Convention path: \\servername\ sharename. You can also browse the Network Neighborhood.
Q. You shared a printer from your NT server. What could you do to ensure that the printer is easily accessible to your Windows 98 clients?
A. You may have to support older clients on your network. This question tests your experience with older technology. In this case, you should load the Windows 98 printer drivers on the share point.
Q. How large can I make a file allocation table partition using the NT operating system?
A. This question tests your familiarity with system capabilities and limitations. The maximum FAT partition size is 4 gigabytes.
Q. Is it necessary for an NT client computer to use the server’s name in that UNC path?
A. There are typically multiple ways of accomplishing the same task. Thank goodness, because you sometimes need them while troubleshooting. Using very basic questions, the interviewer can assess your real knowledge and experience with various operating systems. In this case, you can also use the server’s TCP/IP address.
Q. We are creating a web site on our NT server using Internet Information Server 4.0. We expect users to log on anonymously. How many client access licenses must we purchase to allow up to 100 simultaneous connections to our web site?
A. This is a trick question to see if you understand the concept of user licensed connections. Anonymous logons on IIS 4.0 do not require client access licenses.
Troubleshooting
Q. A user contacts you and reports that their Windows 2000 workstation is having trouble connecting to the Web. You run the ipconfig command on the computer and you find that the computer is not referencing the correct primary DNS server. What must you do to remedy this?
A. Using this question, the interviewer can assess your routing troubleshooting skills, an essential part of network administration. In this case, you would want to check the primary DNS setting in the IP configuration of the computer. If ipconfig shows a setting for the default DNS server other than what you want, this means the computer’s IP configuration is incorrect. Therefore, the Windows 2000 client computer needs to be reconfigured.
Q. Users are complaining of slow performance when they run server-based applications.
The server has the following specifications:
> Compaq 1600
> 800 MHz Pentium 3
> 256MB of RAM
> 18GB EIDE hard drive
> 10/100 NIC
> Connected to a Cisco switch
The performance monitor shows the following:
Memory Pages/Sec: 5
Physical Disk % Disk Time: 20 percent
Processor % Processor Time: 90 percent
What is the best way to improve the system’s performance?
A. This question tests your knowledge of server optimization. In this case, the recommendation should be to upgrade the processor. Microsoft recommends you do so if the CPU utilization averages over 70 to 75 percent.
Q. A user is having trouble sharing a folder from their NT Workstation. What is a likely cause?
A. The interviewer is testing your basic knowledge of rights. In order to share a folder you must be logged on as an administrator, server operator (in a domain), or power user (in a workgroup).
Q. You’ve shared a folder and set the share permissions to “Everyone = Full Control.” However, none of the users can save information in the folder. What’s the likely cause?
A. This is another question that tests your knowledge of permissions. The likely cause is that someone has set the NTFS permissions in a more restrictive manner than the share permissions. Between those two categories of permissions, the more restrictive of the two always applies to users accessing the folder over the network.
Q. What is the most likely cause for the failure of a user to connect to an NT remote access server?
A. Supporting remote users may be a big part of your job. It’s important to understand the proper configuration and troubleshooting of the NT RAS. In this case, the user must be granted the RAS dial-in permission.
Q. A remote user in Montana, who is not technical and is scared to death of computers, calls for help. The user logged in to your network via the terminal server. You determine that the solution to the user’s problem requires an edit of a hidden read-only file, deleting a system file in the winnt\system32 folder, and creating a simple batch file on the user’s computer. What tools would you use to resolve this problem?
A. This question tests your ability for remote troubleshooting. An administrator can edit these files on the user’s computer by connecting to it over the network via the Computer Management console in Windows 2000. Using this console, you can access the administrative shares (C$, D$, and so on) that represent the partitions on the user’s computer. From there, you can edit or create any files necessary to repair the problem.
Windows NT Networking Questions
Windows NT is still the most popular operating system around. You should be comfortable with this environment to be able to respond to the following questions that an interviewer may ask you.
Q. Why is Windows Internet Name Server needed in a Windows NT domain?
A. An important part of network administration is setting up the server and clients so they can find one another. WINS is necessary to achieve NetBIOS name resolution. Your desktop clients can then log on to the domain, and the domain controllers can authenticate to one another.
Q. What is the normal replication interval between the primary domain controll
er and the backup domain controller?
A. The PDC waits five minutes after a change in the domain database before “pulsing,” or notifying, the BDCs.
Q. How can you synchronize a BDC immediately?
A. Within the server manager, select the BDC’s account, choose the Computer menu, and select Synchronize With Primary Domain Controller.
Q. Users change their passwords in the NT domain every 30 days. Our primary domain controller is in New York, but we have users in our California office. When a California user changes their password, will they be able to use the new password immediately, or must they wait for replication to occur to a backup domain controller in California?
A. You must have a firm grasp of replication. In this case, waiting for a replication will not be necessary. If a BDC doesn’t recognize a user’s password, it will automatically appeal to the PDC to establish its validity.
Q. I’ve created logon scripts for my users on the primary domain controller. I’ve correctly mapped them in the properties of my users’ accounts. Some run, some do not. What should I check next?
A. The scripts should be replicated to all of your backup domain controllers. The domain controller that validates the logon is the one that runs the script.
Q. Is it possible to create a domain account from an NT member server?
A. Yes. By using User Manager for Domains, you can create the account from the member server. The account will actually be created on the primary domain controller, however.
Q. Someone just dropped a safe on our primary domain controller. What should we do next?
A. You should promote one of your backup domain controllers to become the primary domain controller.
Q. After the promotion, what happens if we bring the old PDC back online?
A. When the old PDC gets back online, its Netlogon service will fail. You can resolve this through Server Manager by first demoting it to a backup domain controller and then promoting it to a primary domain controller.
Q. One of your users logs on to the domain from his NT Workstation. Due to a network failure the following day, he is unable to contact a domain controller when he tries to log on. Can the user log on with his domain account?
A. Yes. He will be able to log on with locally cached credentials.
Q. Someone deleted the account of one of my backup domain controllers in Server Manager. When the BDC boots up, it is unable to authenticate to the primary domain controller, and its Netlogon service fails. What can I do?
A. Either restore the account from a backup or reinstall the backup domain controller from scratch.
Q. How can I promote one of my member servers to become a backup domain controller?
A. You can’t. You must reinstall the entire operating system as a domain controller (either a backup or primary domain controller).
Q. Does it matter which of my domain controllers I upgrade to Windows 2000 first?
A. Yes. You must upgrade the primary domain controller to Windows 2000 before any of the backup domain controllers.
Q. What about the member servers and workstations? Must I upgrade them in any particular order?
A. No. member servers and workstations can be upgraded in any order.
Active Directory
In order to manage an Active Directory Services environment, you must be comfortable with planning, security and permissions, authentication, and synchronization. The following questions may be asked by the interviewer to assess your experience with performing these functions.
Q. What rights must your logged-in account have when creating a Windows 2000 forest?
A. You must understand rights and permissions thoroughly. In this instance, the account must have administrative rights on the Windows 2000 server used to create the new forest.
Q. What rights must your account have when adding a domain to an existing forest?
A. In this case, you must be a member of the Enterprise Administrators group.
Q. My account has the proper rights, but when I try to create a new domain I get an error message stating that the Domain Naming Master cannot be contacted. What does this mean?
A. An experienced network administrator will be able to readily troubleshoot for problems such as this one. This scenario can mean network connectivity issues or a failed Domain Naming Master, which is the domain controller for the forest root domain.
Q. Why is Domain Name System (DNS) so important to an Active Directory forest?
A. As a network administrator you must understand name resolution. DNS is critical to your forest because it possesses all of the service (SRV) records. These records indicate the TCP/IP address and port necessary to locate a specific service offered by a server.
Q. Does the DNS server have to be a Windows 2000 server?
A. This is a trick question. DNS is independent of Windows 2000 and so the answer is no. To support Active Directory, the DNS server must support two BIND (Berkeley Internet Name Domain) version standards: 4.9.6 (SRV records) and 8.1.2 (dynamic updates).
Q. What rights does a user need in order to create computer accounts in an Active Directory domain?
A. By default, a user only needs to be recognized as a member of the Authenticated Users group to add workstations to a domain. This permission is established in the Default Domain Controllers policy, and permits users to create up to ten accounts.
Q. Is it possible to have entirely separate domain name spaces within the same forest?
A. When it comes to Active Directory, you must have a thorough understanding of forest limitations. In this case, you can have multiple domain name spaces within the same forest.
Q. Do clocks synchronize automatically between Windows 2000 computers?
A. This question tests your understanding of Active Directory synchronization. Clocks do synchronize only within a domain. The Primary Domain Controller Emulator handles this task for you. But there is no server that automatically synchronizes clocks between your separate domains.
Q. To create Group Policy objects in a domain, what group must you be a member of?
A. You must be a member of the Group Policy Creator Owners group in your domain to create these objects.
Q. Is it possible to prevent the application of a Group Policy to a user account within one of our organizational units?
A. To prevent the application of a
Group Policy to a user, you would deny the Read and Apply Group Policy permissions to the user in that organizational unit.
Q. Is it possible to schedule replication between two domain controllers in Active Directory?
A. This question assesses your knowledge of configuration options for domain controllers within Active Directory. In this case, place the domain controllers in different sites. Then set the schedule on the Site Link object that connects the sites.
Q. My Windows 98 users cannot search for published objects in our Active Directory domain. How do I add this capability to their computers?
A. Add the DSClient utility to their computers from the Windows 2000 Server CD.
Q. What are some of the ways of propagating permissions set on an Active Directory object to lower-level child objects?
A. Administering security is a big part of an administrator’s job. One way to accomplish this task is the following: On the Security tab of the parent object, click the Advanced button. Using the special permissions list, be sure to select “Apply onto…This object and all child objects.” Another method is to use the Delegation of Control Wizard.
Q. An organization is running a web site using Internet Information Server 5.0 on a Windows 2000 Server. The site allows both Anonymous and Integrated Windows authentication. When our domain users connect to the site, which authentication method is used?
A. Understanding authentication modes is a critical part to troubleshooting and effectively securing resources. In this case, they will authenticate as the Anonymous account. An exception to this would be seen if the Anonymous account lacked permissions to a particular resource on the web site, in which case Integrated Windows authentication would be attempted.
Q. How can I move the Active Directory database and log files to a different drive on the domain controller?
A. This can be accomplished by rebooting the domain controller using Directory Services Restore Mode and running the ntdsutil tool.
Q. An administrator accidentally deleted an entire organizational unit containing 200 users from our domain. How can you recover the organizational unit?
A. Everyone has these types of situations. You must know how to recover from these mistakes. In this case, rebooting a domain controller using Directory Services Restore Mode and conducting an authoritative restore of the OU from a backup will solve the problem.
Q. We demoted our Primary Domain Controller Emulator to become a member server in our domain. What do we need to do to transfer the PDC Emulator role to another domain controller?
A. This question tests how well you understand how the PDC Emulator works. In this situation, the role was automatically transferred when the former PDC Emulator was demoted.
No comments:
Post a Comment