MCSA Windows Server

85 phút

DNS, DHCP và File Server

DNS Server

Cấu hình DNS Zone

Forward Lookup Zone:

# Tạo Primary Zone
Add-DnsServerPrimaryZone -Name "abc.local" `
    -ReplicationScope "Domain"

# Tạo record A
Add-DnsServerResourceRecordA -Name "server01" `
    -ZoneName "abc.local" `
    -IPv4Address "192.168.1.10"

# Tạo CNAME
Add-DnsServerResourceRecordCName `
    -Name "www" `
    -HostNameAlias "server01.abc.local" `
    -ZoneName "abc.local"

# Tạo MX record
Add-DnsServerResourceRecordMX -Preference 10 `
    -Name "." `
    -MailExchange "mail.abc.local" `
    -ZoneName "abc.local"

# Tạo SRV record
Add-DnsServerResourceRecord -Srv `
    -Name "_sip._tcp" `
    -DomainName "sipserver.abc.local" `
    -Priority 10 `
    -Weight 100 `
    -Port 5060 `
    -ZoneName "abc.local"

Reverse Lookup Zone:

# Tạo Reverse Zone cho 192.168.1.x
Add-DnsServerPrimaryZone -NetworkId "192.168.1.0/24" `
    -ReplicationScope "Domain"

# Tạo PTR record
Add-DnsServerResourceRecordPtr `
    -Name "10" `
    -ZoneName "1.168.192.in-addr.arpa" `
    -PtrDomainName "server01.abc.local"

Conditional Forwarders

# Forward queries cho domain cụ thể
Add-DnsServerConditionalForwarderZone `
    -Name "partner.local" `
    -MasterServers 10.0.0.1, 10.0.0.2

# Xem forwarders
Get-DnsServerForwarder

DNS Forwarders

# Set external forwarders
Set-DnsServerForwarder -IPAddress "8.8.8.8", "8.8.4.4", "1.1.1.1"

# Root hints
Get-DnsServerRootHint

DNS Scavenging

# Enable scavenging
Set-DnsServerScavenging -ScavengingState $true `
    -RefreshInterval 7.00:00:00 `
    -NoRefreshInterval 7.00:00:00 `
    -ScavengingInterval 7.00:00:00

# Set aging cho zone
Set-DnsServerZoneAging -Name "abc.local" `
    -Aging $true `
    -RefreshInterval 7.00:00:00 `
    -NoRefreshInterval 7.00:00:00

Test DNS

# Test resolution
Resolve-DnsName server01.abc.local
Resolve-DnsName google.com -Server 8.8.8.8

# DNS query
nslookup server01.abc.local
nslookup -type=MX abc.local

# Kiểm tra DNS server
Get-DnsServerZone
Get-DnsServerResourceRecord -ZoneName "abc.local"
Test-DnsServer -IPAddress 192.168.1.10 -ZoneName "abc.local"

DHCP Server

Cài đặt và cấu hình

# Cài DHCP role
Install-WindowsFeature -Name DHCP -IncludeManagementTools

# Authorize DHCP trong AD
Add-DhcpServerInDC -DnsName "dhcp01.abc.local" `
    -IPAddress 192.168.1.10

# Tạo Scope
Add-DhcpServerv4Scope `
    -Name "LAN-Scope" `
    -StartRange 192.168.1.100 `
    -EndRange 192.168.1.200 `
    -SubnetMask 255.255.255.0 `
    -State Active

# Set Scope Options
Set-DhcpServerv4OptionValue `
    -ScopeId 192.168.1.0 `
    -Router 192.168.1.1 `
    -DnsServer 192.168.1.10 `
    -DnsDomain "abc.local"

# Set lease duration
Set-DhcpServerv4Scope -ScopeId 192.168.1.0 `
    -LeaseDuration 8.00:00:00

Reservations

# Đặt trước IP cho MAC
Add-DhcpServerv4Reservation `
    -ScopeId 192.168.1.0 `
    -IPAddress 192.168.1.50 `
    -ClientId "00-11-22-33-44-55" `
    -Description "Printer HP"

# Xem reservations
Get-DhcpServerv4Reservation -ScopeId 192.168.1.0

Exclusions

# Loại trừ IP range
Add-DhcpServerv4ExclusionRange `
    -ScopeId 192.168.1.0 `
    -StartRange 192.168.1.100 `
    -EndRange 192.168.1.120

DHCP Failover

# Cấu hình failover giữa 2 DHCP servers
Add-DhcpServerv4Failover `
    -Name "DHCP-Failover" `
    -PartnerServer "dhcp02.abc.local" `
    -ScopeId 192.168.1.0 `
    -SharedSecret "SecretKey123" `
    -Mode LoadBalance `
    -LoadBalancePercent 50

Monitor DHCP

# Xem scopes
Get-DhcpServerv4Scope

# Xem leases
Get-DhcpServerv4Lease -ScopeId 192.168.1.0

# Statistics
Get-DhcpServerv4Statistics

# Xem options
Get-DhcpServerv4OptionValue -ScopeId 192.168.1.0

File Server

Chia sẻ thư mục

# Tạo folder
New-Item -ItemType Directory -Path "D:\Shares\IT" -Force
New-Item -ItemType Directory -Path "D:\Shares\HR" -Force
New-Item -ItemType Directory -Path "D:\Shares\Public" -Force

# Share folder
New-SmbShare -Name "IT" -Path "D:\Shares\IT" `
    -FullAccess "COMPANY\Domain Admins" `
    -ChangeAccess "COMPANY\IT_Admins" `
    -ReadAccess "COMPANY\Domain Users"

New-SmbShare -Name "HR" -Path "D:\Shares\HR" `
    -FullAccess "COMPANY\Domain Admins" `
    -ChangeAccess "COMPANY\HR_Users"

New-SmbShare -Name "Public" -Path "D:\Shares\Public" `
    -ChangeAccess "COMPANY\Domain Users"

# Xem shares
Get-SmbShare
Get-SmbShareAccess -Name "IT"

NTFS Permissions

# Disable inheritance
icacls "D:\Shares\IT" /inheritance:d

# Remove default permissions
icacls "D:\Shares\IT" /remove:g "BUILTIN\Users"

# Grant permissions
icacls "D:\Shares\IT" /grant "COMPANY\IT_Admins:(OI)(CI)M"
icacls "D:\Shares\IT" /grant "COMPANY\Domain Admins:(OI)(CI)F"
icacls "D:\Shares\IT" /grant "COMPANY\Domain Users:(OI)(CI)R"

# OI = Object Inherit (files)
# CI = Container Inherit (folders)
# F = Full, M = Modify, R = Read, W = Write

Quotas

# Cài FSRM
Install-WindowsFeature -Name FS-Resource-Manager `
    -IncludeManagementTools

# Áp dụng quota template
New-FsrmQuotaTemplate -Name "500MB User" `
    -Size 500MB `
    -SoftLimit $false

New-FsrmQuota -Path "D:\Shares\Users" `
    -Template "500MB User"

# Hard quota vs Soft quota
# Hard: Chặn khi vượt quota
# Soft: Cảnh báo nhưng không chặn

File Screening

# Chặn file .mp3, .mp4, .exe trong Public
New-FsrmFileGroup -Name "Media Files" `
    -IncludePattern @("*.mp3", "*.mp4", "*.avi", "*.mkv")

New-FsrmFileScreenTemplate -Name "No Media" `
    -IncludeGroup "Media Files" `
    -Active $true

New-FsrmFileScreen -Path "D:\Shares\Public" `
    -Template "No Media"

DFS (Distributed File System)

DFS Namespace:

# Cài DFS
Install-WindowsFeature -Name FS-DFS-Namespace, `
    FS-DFS-Replication -IncludeManagementTools

# Tạo Namespace
New-DfsnRoot -Path "\\abc.local\Shares" `
    -TargetPath "\\FS01\Shares" `
    -Type DomainV2

# Tạo Folder với targets
New-DfsnFolder -Path "\\abc.local\Shares\IT" `
    -TargetPath "\\FS01\IT"

New-DfsnFolderTarget -Path "\\abc.local\Shares\IT" `
    -TargetPath "\\FS02\IT"

DFS Replication:

# Tạo Replication Group
New-DfsReplicationGroup -GroupName "RG-IT"

Add-DfsrMember -GroupName "RG-IT" `
    -ComputerName "FS01", "FS02"

Add-DfsrConnection -GroupName "RG-IT" `
    -SourceComputerName "FS01" `
    -DestinationComputerName "FS02"

Add-DfsrMemberToReplicatedFolder -GroupName "RG-IT" `
    -FolderName "IT" `
    -ComputerName "FS01", "FS02"

Print Server

Cài đặt

Install-WindowsFeature -Name Print-Server `
    -IncludeManagementTools

# Thêm printer driver
Add-PrinterDriver -Name "HP Universal Printing PS"

# Thêm printer
Add-Printer -Name "HP LaserJet 01" `
    -DriverName "HP Universal Printing PS" `
    -PortName "IP_192.168.1.50"

# Chia sẻ printer
Set-Printer -Name "HP LaserJet 01" -Shared $true `
    -ShareName "HP-LJ-01"

# Set permissions
Grant-PrinterAccess -Name "HP LaserJet 01" `
    -UserName "COMPANY\Sales_Team" `
    -PrinterPermission Print

Backup và Restore

Windows Server Backup

# Cài feature
Install-WindowsFeature Windows-Server-Backup

# Backup schedule
$policy = New-WBPolicy
$target = New-WBDisk -DiskPath "\\.\PhysicalDrive1"
Add-WBBackupTarget -Policy $policy -Target $target

$filespec = New-WBFileSpec -FileSpec "D:\Shares"
Add-WBFileSpec -Policy $policy -FileSpec $filespec

$time = New-WBBackupSchedule -TimesOfDay 23:00 `
    -DaysOfWeek Monday, Tuesday, Wednesday, Thursday, Friday
Set-WBSchedule -Policy $policy -Schedule $time

Set-WBPolicy -Policy $policy

# Backup ngay
Start-WBBackup -Policy $policy

# Xem versions
Get-WBBackupSet

# Restore
Start-WBRecovery -BackupSet $backup

Bài tập thực hành

Hãy triển khai DNS, DHCP và File Server!

Bài tập 1

1Triển khai Infrastructure ServicesSetup DNS, DHCP, File Server