InterviewQuestionsforSystemAdministrator/NetworkAdministrator

GeneralQuestions
Q.Pleasedescribethetechnicalenvironmentofyourcurrent(ormostrecent)position.
A.Whendescribingthetechnicalenvironmentthatyoucurrentlysupport,besuretoincludethenumberofusersyousupport,the
numberofITstaff,thetechnicalinfrastructureincludingservers,typesofconnections,desktopoperatingsystems,yourjobduties,and
yourworkschedule.
Youshouldbepreparedtotalkabouteachofthepositionsyouhavelistedonyourrsuminthisway.Alsobepreparedwitha
followupstatementofyourmostsignificantaccomplishment.
Q.Howdoyoukeepyourtechnicalknowledgeandskillscurrent?
A.Keepingyourskillscurrentdemonstratesinitiativeandadesiretoperformathighstandards.Bepreparedwithalistofresources
includingprofessionalgroups.
Q.Pleasedescribeyourgreatesttechnicalchallengeandhowyouovercameit.
A.Ah,anopportunityforastory.Greatexamplestodrawon:howyoutaughtyourselfanewoperatingsystem,theinstallationofa
complexsystem,integrationofmultiplesystems,buildingofanecommercewebsite.
Q.Whataresomeofthetoolsyouusetomakeyourjobeasier?
A.Allnetworkadministratorshaveabagoftricks.Youshouldsharesomeofyourtradesecretsasawayofdemonstratingthatyou
canbeefficientinyourjobasanetworkadministrator.Thesecanincludeghostingtools,troubleshootingtools,anddocumentation
tools.
Q.Howdoyoudocumentyournetwork?
A.Oneofthetoughestpartsofnetworkadministrationiskeepingtrackofanalwayschangingenvironment.Youmusthavebasic
documentationforuseradministration,filesystemplanning,andaddressplanning.Shareyourdocumentationwithyourinterviewer.

PlanningQuestions
Theinterviewerwillbeinterestedinyournetworkplanningmethodologies.Thefollowingquestionsprovideinsightintotheseskills.
Q.Whataresomeofthethingsyouneedtotakeintoconsiderationwhenplanninganupgradefromonenetworkoperating
systemtoanother?
A.Thisisthemotherofallplanningactivitiesbecauseitwillaffectsomanyresources.Thekeyhereistestingandbackupsandthats
whattheinterviewerwantstohear.Otherconsiderationsinclude:

Networkdocumentation
Ensuringthatyourhardwaremeetstheminimumhardwarerequirementsforthenewoperatingsystem
Creatingatestnetworkfortestingthecompatibilityofapplications,hardware,anddriverswiththenewoperatingsystem
Gatheringallupdateddriversandpatches/servicepacksrequiredforupgradecompatibility
Identifyingworkflowissuesbeforeconverting
Separatingworkstationconversionsfromserverconversions
Ensuringyouhavebackupsofdataandtheserverssothatyoucanrevertback
Networkaddressingscheme

Q.Describethebackup/restorepolicyyouusemost.
A.Firstofall,theinterviewerwantstoensurethatyoudobackups!Therearedifferentmethods,butthemostcommonbackup

strategyusedistoperformincrementalbackupsMondaythroughThursdayandanormalbackuponFriday.Analternativebackup
strategyistoperformdifferentialbackupsMondaythroughThursdayandanormalbackuponFriday.
Q.Howwouldyouensurethatyourserversaresecure?
A.Securityalwaysbeginsatthephysicallevelitmakeslittledifferencethatyouveprovidedallthesecuritytheoperatingsystem
andsoftwarecanprovideifsomeonecanwalkawaywiththeboxortheportableharddrive.Thenextstepistoensureyouhavethe
latestservicepacksfortheoperatingsystemandapplicationsrunningontheserver.

Installation
Q.Whatstepsdoyougothroughaspartofyourserverinstallationprocess?
A.Theinterviewerwantstoknowwhetheryourtypicalworkhabitsaretojustjumpinorwhetheryoudosomeplanning.You
obviouslywanttoensurethatyourhardwaremeetstheminimumrequirements,thatyouhavealltherightdriversforthenew
operatingsystem,andwhetheryouneedaROMupgradeforyourhardware.Dependingonhowmanyinstallationsyouvedone,you
mayhaveaprocessthatyouliketofollow.Ifyoudo,describeittotheinterviewer.
Q.Howdoyoudeterminewhichfilesystemisbestforyourenvironment?
A.Thisquestiontestshowwellyouplanforavarietyofdifferentenvironments.Thekeyhereistotakeintoconsiderationthefile
formatsupportrequiredforbackwardcompatibilitywithotheroperatingsystemslikeNetWareorolderversionsofWindowsNT.
Youllalsowanttomakesuretheresenoughdiskspacefordriversandfilesthatmustresideinthesystempartition,aswellasspace
foradumpfileifanythinggoeswrong.
Q.Whatsthefirstthingyoushoulddoafterinstallingthenetworkoperatingsystem?
A.Thisisatestofyoursecurityskills.Thefirstthingyoushoulddoiseitherchangethepasswordontheadministratoraccountor
changethenameoftheaccountitself.
Q.Youjustinstalledaservicepackontheemail,SQL,print,andfileservers.Yourebootedalltheservers,andnowthe
servicepackinstallationiscomplete.Whatsthefinalstepfortheevening?
A.Theinterviewerwantstomakesurethattestingisanintegralpartofyourroutinewheneveryouinstallsoftwareormakeupdatesto
systems.YoumayalsowanttoreviewtheEventViewerlogsandlookforanyerrorsthathavebeenregistered.Itsagoodideatoalso
examinetheadministrativeinterfacesforSQLandtheemailservertosatisfyyourselfthatnoanomalieshaveappearedthere.

Configuration
Ninetypercentofyourdayisspentconfiguringnetworkservices,whetheritsinstallingapplications,creatingusers,oradding
printers.
Q.WhatmethodsareavailableforconfiguringaWINSserverforusebyvariousMicrosoftcomputers?
A.ThisquestiondemonstratestotheinterviewerthatyouarefamiliarwiththevariousmethodsforconfiguringroutingusingWINS.
YoucaneitherconfiguretheWINSservermanuallyorbywayofaDynamicHostConfigurationProtocolServer.
Q.Auserhasleftthecompanyandyouneedtocreateanewuserwiththesamerightsandpermissions.Whataresomeofthe
waystocreatethenewuser?
A.Byaskingyoutodescribemultiplewaysofgettingthejobdone,theinterviewercanassessyourexperiencelevelwiththe
operatingsystem.Someofthecorrectanswerstothisquestionincludethefollowing:

Youcouldcopyanexistingusersaccounttocreateanewaccount.However,therightsandpermissionsforthenew,copied
accountwillbebasedpurelyonitsgroupmemberships,notpermissionsg
rantedstrictlytotheoriginalaccountitself.
UsingActiveDirectory,youcouldusetheCSVDE.exeprogramtocreateanewaccountwithspecificgroupmemberships;
however,thisprogramisusuallyintendedforbulkcreationofaccountsinyourdomain.
Youcouldcreatethenewaccountfromscratch,assigninggrouppermissionsorindividualrightsmanually.

Q.Whataresomeofthealternativewaysformappingadrivelettertoafileserverifyouwishtoconnecttooneoftheservers
sharedfolders?
A.Thisquestiontestsyourexperiencebyaskingforalternatemethodsofgettingthejobdone.Inadditiontomappeddrivesyoucan
useaUniversalNamingConventionpath:\\servername\sharename.YoucanalsobrowsetheNetworkNeighborhood.
Q.YousharedaprinterfromyourNTserver.Whatcouldyoudotoensurethattheprinteriseasilyaccessibletoyour
Windows98clients?
A.Youmayhavetosupportolderclientsonyournetwork.Thisquestiontestsyourexperiencewitholdertechnology.Inthiscase,
youshouldloadtheWindows98printerdriversonthesharepoint.
Q.HowlargecanImakeafileallocationtablepartitionusingtheNToperatingsystem?
A.Thisquestiontestsyourfamiliaritywithsystemcapabilitiesandlimitations.ThemaximumFATpartitionsizeis4gigabytes.
Q.IsitnecessaryforanNTclientcomputertousetheserversnameinthatUNCpath?
A.Therearetypicallymultiplewaysofaccomplishingthesametask.Thankgoodness,becauseyousometimesneedthemwhile
troubleshooting.Usingverybasicquestions,theinterviewercanassessyourrealknowledgeandexperiencewithvariousoperating
systems.Inthiscase,youcanalsousetheserversTCP/IPaddress.
Q.WearecreatingawebsiteonourNTserverusingInternetInformationServer4.0.Weexpectuserstologonanonymously.
Howmanyclientaccesslicensesmustwepurchasetoallowupto100simultaneousconnectionstoourwebsite?
A.Thisisatrickquestiontoseeifyouunderstandtheconceptofuserlicensedconnections.AnonymouslogonsonIIS4.0donot
requireclientaccesslicenses.

Troubleshooting
Q.AusercontactsyouandreportsthattheirWindows2000workstationishavingtroubleconnectingtotheWeb.Yourunthe
ipconfigcommandonthecomputerandyoufindthatthecomputerisnotreferencingthecorrectprimaryDNSserver.What
mustyoudotoremedythis?
A.Usingthisquestion,theinterviewercanassessyourroutingtroubleshootingskills,anessentialpartofnetworkadministration.In
thiscase,youwouldwanttochecktheprimaryDNSsettingintheIPconfigurationofthecomputer.Ifipconfigshowsasettingforthe
defaultDNSserverotherthanwhatyouwant,thismeansthecomputersIPconfigurationisincorrect.Therefore,theWindows2000
clientcomputerneedstobereconfigured.
Q.Usersarecomplainingofslowperformancewhentheyrunserverbasedapplications.
Theserverhasthefollowingspecifications:
>Compaq1600
>800MHzPentium3
>256MBofRAM
>18GBEIDEharddrive
>10/100NIC
>ConnectedtoaCiscoswitch
Theperformancemonitorshowsthefollowing:
MemoryPages/Sec:5
PhysicalDisk%DiskTime:20percent
Processor%ProcessorTime:90percent
Whatisthebestwaytoimprovethesystemsperformance?
A.Thisquestiontestsyourknowledgeofserveroptimization.Inthiscase,therecommendationshouldbetoupgradetheprocessor.
MicrosoftrecommendsyoudosoiftheCPUutilizationaveragesover70to75percent.

Q.AuserishavingtroublesharingafolderfromtheirNTWorkstation.Whatisalikelycause?
A.Theintervieweristestingyourbasicknowledgeofrights.Inordertoshareafolderyoumustbeloggedonasanadministrator,
serveroperator(inadomain),orpoweruser(inaworkgroup).
Q.YouvesharedafolderandsetthesharepermissionstoEveryone=FullControl.However,noneoftheuserscansave
informationinthefolder.Whatsthelikelycause?
A.Thisisanotherquestionthattestsyourknowledgeofpermissions.ThelikelycauseisthatsomeonehassettheNTFSpermissions
inamorerestrictivemannerthanthesharepermissions.Betweenthosetwocategoriesofpermissions,themorerestrictiveofthetwo
alwaysappliestousersaccessingthefolderoverthenetwork.
Q.WhatisthemostlikelycauseforthefailureofausertoconnecttoanNTremoteaccessserver?
A.Supportingremoteusersmaybeabigpartofyourjob.Itsimportanttounderstandtheproperconfigurationandtroubleshootingof
theNTRAS.Inthiscase,theusermustbegrantedtheRASdialinpermission.
Q.AremoteuserinMontana,whoisnottechnicalandisscaredtodeathofcomputers,callsforhelp.Theuserloggedinto
yournetworkviatheterminalserver.Youdeterminethatthesolutiontotheusersproblemrequiresaneditofahiddenread
onlyfile,deletingasystemfileinthewinnt\system32folder,andcreatingasimplebatchfileontheuserscomputer.What
toolswouldyouusetoresolvethisproblem?
A.Thisquestiontestsyourabilityforremotetroubleshooting.Anadministratorcaneditthesefilesontheuserscomputerby
connectingtoitoverthenetworkviatheComputerManagementconsoleinWindows2000.Usingthisconsole,youcanaccessthe
administrativeshares(C$,D$,andsoon)thatrepresentthepartitionsontheuserscomputer.Fromthere,youcaneditorcreateany
filesnecessarytorepairtheproblem.

WindowsNTNetworkingQuestions
WindowsNTisstillthemostpopularoperatingsystemaround.Youshouldbecomfortablewiththisenvironmenttobeableto
respondtothefollowingquestionsthataninterviewermayaskyou.
Q.WhyisWindowsInternetNameServerneededinaWindowsNTdomain?
A.Animportantpartofnetworkadministrationissettinguptheserverandclientssotheycanfindoneanother.WINSisnecessaryto
achieveNetBIOSnameresolution.Yourdesktopclientscanthenlogontothedomain,andthedomaincontrollerscanauthenticateto
oneanother.
Q.Whatisthenormalreplicationintervalbetweentheprimarydomaincontroll
erandthebackupdomaincontroller?
A.ThePDCwaitsfiveminutesafterachangeinthedomaindatabasebeforepulsing,ornotifying,theBDCs.
Q.HowcanyousynchronizeaBDCimmediately?
A.Withintheservermanager,selecttheBDCsaccount,choosetheComputermenu,andselectSynchronizeWithPrimaryDomain
Controller.
Q.UserschangetheirpasswordsintheNTdomainevery30days.OurprimarydomaincontrollerisinNewYork,butwehave
usersinourCaliforniaoffice.WhenaCaliforniauserchangestheirpassword,willtheybeabletousethenewpassword
immediately,ormusttheywaitforreplicationtooccurtoabackupdomaincontrollerinCalifornia?
A.Youmusthaveafirmgraspofreplication.Inthiscase,waitingforareplicationwillnotbenecessary.IfaBDCdoesntrecognizea
userspassword,itwillautomaticallyappealtothePDCtoestablishitsvalidity.
Q.Ivecreatedlogonscriptsformyusersontheprimarydomaincontroller.Ivecorrectlymappedtheminthepropertiesof
myusersaccounts.Somerun,somedonot.WhatshouldIchecknext?
A.Thescriptsshouldbereplicatedtoallofyourbackupdomaincontrollers.Thedomaincontrollerthatvalidatesthelogonistheone
thatrunsthescript.

Q.IsitpossibletocreateadomainaccountfromanNTmemberserver?
A.Yes.ByusingUserManagerforDomains,youcancreatetheaccountfromthememberserver.Theaccountwillactuallybe
createdontheprimarydomaincontroller,however.
Q.Someonejustdroppedasafeonourprimarydomaincontroller.Whatshouldwedonext?
A.Youshouldpromoteoneofyourbackupdomaincontrollerstobecometheprimarydomaincontroller.
Q.Afterthepromotion,whathappensifwebringtheoldPDCbackonline?
A.WhentheoldPDCgetsbackonline,itsNetlogonservicewillfail.YoucanresolvethisthroughServerManagerbyfirstdemoting
ittoabackupdomaincontrollerandthenpromotingittoaprimarydomaincontroller.
Q.OneofyouruserslogsontothedomainfromhisNTWorkstation.Duetoanetworkfailurethefollowingday,heisunable
tocontactadomaincontrollerwhenhetriestologon.Cantheuserlogonwithhisdomainaccount?
A.Yes.Hewillbeabletologonwithlocallycachedcredentials.
Q.SomeonedeletedtheaccountofoneofmybackupdomaincontrollersinServerManager.WhentheBDCbootsup,itis
unabletoauthenticatetotheprimarydomaincontroller,anditsNetlogonservicefails.WhatcanIdo?
A.Eitherrestoretheaccountfromabackuporreinstallthebackupdomaincontrollerfromscratch.
Q.HowcanIpromoteoneofmymemberserverstobecomeabackupdomaincontroller?
A.Youcant.Youmustreinstalltheentireoperatingsystemasadomaincontroller(eitherabackuporprimarydomaincontroller).
Q.DoesitmatterwhichofmydomaincontrollersIupgradetoWindows2000first?
A.Yes.YoumustupgradetheprimarydomaincontrollertoWindows2000beforeanyofthebackupdomaincontrollers.
Q.Whataboutthememberserversandworkstations?MustIupgradetheminanyparticularorder?
A.No.memberserversandworkstationscanbeupgradedinanyorder.

ActiveDirectory
InordertomanageanActiveDirectoryServicesenvironment,youmustbecomfortablewithplanning,securityandpermissions,
authentication,andsynchronization.Thefollowingquestionsmaybeaskedbytheinterviewertoassessyourexperiencewith
performingthesefunctions.
Q.WhatrightsmustyourloggedinaccounthavewhencreatingaWindows2000forest?
A.Youmustunderstandrightsandpermissionsthoroughly.Inthisinstance,theaccountmusthaveadministrativerightsonthe
Windows2000serverusedtocreatethenewforest.
Q.Whatrightsmustyouraccounthavewhenaddingadomaintoanexistingforest?
A.Inthiscase,youmustbeamemberoftheEnterpriseAdministratorsgroup.
Q.Myaccounthastheproperrights,butwhenItrytocreateanewdomainIgetanerrormessagestatingthattheDomain
NamingMastercannotbecontacted.Whatdoesthismean?
A.Anexperiencednetworkadministratorwillbeabletoreadilytroubleshootforproblemssuchasthisone.Thisscenariocanmean
networkconnectivityissuesorafailedDomainNamingMaster,whichisthedomaincontrollerfortheforestrootdomain.
Q.WhyisDomainNameSystem(DNS)soimportanttoanActiveDirectoryforest?
A.Asanetworkadministratoryoumustunderstandnameresolution.DNSiscriticaltoyourforestbecauseitpossessesallofthe
service(SRV)records.TheserecordsindicatetheTCP/IPaddressandportnecessarytolocateaspecificserviceofferedbyaserver.
Q.DoestheDNSserverhavetobeaWindows2000server?
A.Thisisatrickquestion.DNSisindependentofWindows2000andsotheanswerisno.TosupportActiveDirectory,theDNS

servermustsupporttwoBIND(BerkeleyInternetNameDomain)versionstandards:4.9.6(SRVrecords)and8.1.2(dynamic
updates).
Q.WhatrightsdoesauserneedinordertocreatecomputeraccountsinanActiveDirectorydomain?
A.Bydefault,auseronlyneedstoberecognizedasamemberoftheAuthenticatedUsersgrouptoaddworkstationstoadomain.This
permissionisestablishedintheDefaultDomainControllerspolicy,andpermitsuserstocreateuptotenaccounts.
Q.Isitpossibletohaveentirelyseparatedomainnamespaceswithinthesameforest?
A.WhenitcomestoActiveDirectory,youmusthaveathoroughunderstandingofforestlimitations.Inthiscase,youcanhave
multipledomainnamespaceswithinthesameforest.
Q.DoclockssynchronizeautomaticallybetweenWindows2000computers?
A.ThisquestiontestsyourunderstandingofActiveDirectorysynchronization.Clocksdosynchronizeonlywithinadomain.The
PrimaryDomainControllerEmulatorhandlesthistaskforyou.Butthereisnoserverthatautomaticallysynchronizesclocksbetween
yourseparatedomains.
Q.TocreateGroupPolicyobjectsinadomain,whatgroupmustyoubeamemberof?
A.YoumustbeamemberoftheGroupPolicyCreatorOwnersgroupinyourdomaintocreatetheseobjects.
Q.IsitpossibletopreventtheapplicationofaGroupPolicytoauseraccountwithinoneofourorganizationalunits?
A.Topreventtheapplicationofa
GroupPolicytoauser,youwoulddenytheReadandApplyGroupPolicypermissionstotheuserinthatorganizationalunit.
Q.IsitpossibletoschedulereplicationbetweentwodomaincontrollersinActiveDirectory?
A.ThisquestionassessesyourknowledgeofconfigurationoptionsfordomaincontrollerswithinActiveDirectory.Inthiscase,place
thedomaincontrollersindifferentsites.ThensetthescheduleontheSiteLinkobjectthatconnectsthesites.
Q.MyWindows98userscannotsearchforpublishedobjectsinourActiveDirectorydomain.HowdoIaddthiscapabilityto
theircomputers?
A.AddtheDSClientutilitytotheircomputersfromtheWindows2000ServerCD.
Q.WhataresomeofthewaysofpropagatingpermissionssetonanActiveDirectoryobjecttolowerlevelchildobjects?
A.Administeringsecurityisabigpartofanadministratorsjob.Onewaytoaccomplishthistaskisthefollowing:OntheSecuritytab
oftheparentobject,clicktheAdvancedbutton.Usingthespecialpermissionslist,besuretoselectApplyontoThisobjectandall
childobjects.AnothermethodistousetheDelegationofControlWizard.
Q.AnorganizationisrunningawebsiteusingInternetInformationServer5.0onaWindows2000Server.Thesiteallows
bothAnonymousandIntegratedWindowsauthentication.Whenourdomainusersconnecttothesite,whichauthentication
methodisused?
A.Understandingauthenticationmodesisacriticalparttotroubleshootingandeffectivelysecuringresources.Inthiscase,theywill
authenticateastheAnonymousaccount.AnexceptiontothiswouldbeseeniftheAnonymousaccountlackedpermissionstoa
particularresourceonthewebsite,inwhichcaseIntegratedWindowsauthenticationwouldbeattempted.
Q.HowcanImovetheActiveDirectorydatabaseandlogfilestoadifferentdriveonthedomaincontroller?
A.ThiscanbeaccomplishedbyrebootingthedomaincontrollerusingDirectoryServicesRestoreModeandrunningthentdsutiltool.
Q.Anadministratoraccidentallydeletedanentireorganizationalunitcontaining200usersfromourdomain.Howcanyou
recovertheorganizationalunit?
A.Everyonehasthesetypesofsituations.Youmustknowhowtorecoverfromthesemistakes.Inthiscase,rebootingadomain
controllerusingDirectoryServicesRestoreModeandconductinganauthoritativerestoreoftheOUfromabackupwillsolvethe
problem.
Q.WedemotedourPrimaryDomainControllerEmulatortobecomeamemberserverinourdomain.Whatdoweneedtodo
totransferthePDCEmulatorroletoanotherdomaincontroller?

A.ThisquestiontestshowwellyouunderstandhowthePDCEmulatorworks.Inthissituation,therolewasautomaticallytransferred
whentheformerPDCEmulatorwasdemoted.