Question 1

Branch offices use Internet Connection Sharing (ICS). A new administrator on a Windows 2000 Server receives “Access is denied” when using Windows Update → Product Updates. He must update the server using his own account. What is the appropriate fix?

Accepted Answer

Introduction / Context: Installing updates via Windows Update on Windows 2000 requires local administrative rights because updates modify protected system files, services, and registry areas. An “Access is denied” error at Product Updates typically indicates insufficient local permissions, not a networking block from ICS or mail protocols like POP3/SMTP. Given Data / Assumptions: Server is Windows 2000; user is configuring it as a file server. Internet access is via ICS; Product Updates page is reachable. Error is “Access is denied,” suggesting authorization rather than connectivity. Concept / Approach: Grant the administrator’s account membership in the local Administrators group on that server. Local admin rights satisfy Windows Update’s elevation requirements. Using a domain administrator account is unnecessary if local admin rights suffice, especially in environments practicing least privilege. ICS mail protocol openings are irrelevant to Windows Update and will not resolve an authorization error. Step-by-Step Solution: On the server, open Computer Management → Local Users and Groups → Groups.Add the user (or a domain group) to the Administrators group.Log off/on or run with elevated rights; retry Windows Update Product Updates.Verify updates install successfully and server reboots if required. Verification / Alternative check: Confirm the user can now initiate and complete Windows Update installations; review Windows Update logs to ensure no permission-related failures remain. Why Other Options Are Wrong: POP3/SMTP access: unrelated to Windows Update. Log on as domain admin: over-privileged; local admin is sufficient and preferable. None of above: incorrect because granting local admin rights resolves the issue. Common Pitfalls: Confusing connectivity issues with authorization; granting domain-wide admin rights when local rights suffice; forgetting to verify proxy/IE security settings if other errors appear. Final Answer: Give the administrator’s user account local administrator privileges on the Windows 2000 Server.

Question 2

Windows 2000 Server (Disk Management, RAID-5 recovery): A four-disk stripe set with parity was converted to a dynamic RAID-5 volume months ago. Today, access is slow and Disk Management shows the third disk status as “Missing.” To recover the degrad…

Accepted Answer

Introduction / Context: When a Windows 2000 dynamic RAID-5 volume reports that one member disk is “Missing,” the array is operating in a degraded state and performance will drop because parity reconstruction is required for reads. The safest first response is to confirm whether the disk is truly failed or simply offline or disconnected, and then use Disk Management's built-in recovery steps before replacing hardware. Given Data / Assumptions: Dynamic disks are used; the RAID-5 set was converted from a stripe with parity. The third disk shows status “Missing,” not “Failed.” Users noticed slower access since yesterday (consistent with degraded RAID-5). Goal: recover the volume without unnecessary rebuilds or data loss. Concept / Approach: In Windows 2000 Disk Management, “Missing” indicates the OS cannot currently see the disk (cable/power/offline), whereas “Failed” indicates the dynamic disk database is reachable but the device reports failure. The correct first action is to ensure power/cabling is intact and then use Reactivate Disk, which attempts to bring the dynamic disk online and rejoin it to the set without a full replacement. Step-by-Step Solution: Physically verify the third disk: check power, data cables, controller visibility.Open Disk Management; right-click the “Missing” disk and choose Reactivate Disk.Confirm the disk status transitions to Online and the RAID-5 volume returns to Healthy/Regenerating.Allow RAID-5 to resynchronize if needed; monitor event logs for disk errors. Verification / Alternative check: If Reactivate Disk fails or the disk repeatedly drops, run hardware diagnostics and consider replacing the disk. After replacement, use Disk Management to repair the volume by adding the new disk so parity can rebuild. Why Other Options Are Wrong: Replace the disk immediately: Premature; “Missing” may be cabling/power, not failure. Repair Volume before reactivation: Repair requires an available target; Reactivate is the proper first step for a “Missing” disk. Create extended partition and let auto-repair: Not a supported or reliable workflow for dynamic RAID-5 recovery. None of the above: Incorrect because reactivation is the standard first step. Common Pitfalls: Confusing “Missing” with “Failed,” replacing disks unnecessarily, or attempting a repair while the original member is simply offline due to a loose cable. Final Answer: Verify the third disk is attached and powered on; then use Disk Management to Reactivate Disk

Question 3

Windows 2000 Server (mirrored system volume): Volume C (boot/system) is mirrored to dynamic Disk 1. Disk Management now shows Volume C = Failed Redundancy and Disk 1 = Missing. Reactivating Disk 1 does not restore health. What is the correct next ac…

Accepted Answer

Introduction / Context: Fault tolerance with software mirroring (RAID-1) in Windows 2000 uses dynamic disks. If a mirror partner is “Missing,” and reactivation fails, treat that side as unavailable. Proper repair is to remove the failed mirror member, replace the physical disk, and then mirror the healthy side to the new disk so the array can resynchronize cleanly and safely. Given Data / Assumptions: System/boot volume C: is mirrored. Disk 1 status = Missing; reactivation unsuccessful. Goal: restore redundancy without risking the good copy. Windows 2000 Disk Management is the tool in use. Concept / Approach: When a mirror member is irrecoverable (Missing and not reactivating), the safe path is: remove the broken mirror leg (leaving C: healthy on the remaining disk), replace the failed hardware, convert/initialize the new disk as dynamic, and then add the mirror back so Windows rebuilds from the good copy to the replacement. Step-by-Step Solution: Right-click the mirrored volume and select Remove Mirror for the Missing side.Physically replace Disk 1; initialize it in Disk Management and convert to dynamic.Right-click C: and choose Add Mirror; select the new Disk 1.Allow synchronization to complete; verify status becomes Healthy (Mirrored). Verification / Alternative check: Event Viewer logs and Disk Management status should show a rebuild in progress. After completion, test boot paths if mirror was the system/boot volume. Why Other Options Are Wrong: Automatic regeneration after simple replacement (no remove/add): Not reliable; Disk Management requires explicitly removing and re-adding the mirror target. Manually copying files to recreate a mirror: Not how software RAID-1 works; use Add Mirror to rebuild. Rescan/delete data on Disk 1: Unnecessary and risky; removing the mirror and re-adding is the supported process. None of the above: Incorrect because the remove-replace-add workflow is correct. Common Pitfalls: Pulling the wrong disk, trying to force reactivation repeatedly, or attempting to clone files rather than letting the mirroring engine rebuild block-by-block. Final Answer: Remove the mirror on Disk 1, replace Disk 1, then add the mirror back to the new Disk 1

Question 4

Windows 2000 Server performance baselining: Server runs many 32-bit apps and two 16-bit apps (APP1.EXE and APP2.EXE) configured to run in separate memory spaces. In System Monitor, which process instances should you add to chart CPU usage for the tw…

Accepted Answer

Introduction / Context: On Windows NT/2000, 16-bit Windows applications execute within NTVDM (NT Virtual DOS Machine) processes. If 16-bit apps are configured to run in separate memory spaces, each app gets its own NTVDM process. For accurate performance baselines, counters must target the actual processes consuming CPU cycles. Given Data / Assumptions: Two 16-bit apps: APP1.EXE and APP2.EXE. Each is set to run in a separate memory space (distinct NTVDM processes). Goal: chart CPU usage by those 16-bit apps in System Monitor. Concept / Approach: 16-bit executables do not appear as independent Process object instances under their own names. Instead, their execution is encapsulated by ntvdm.exe instances. With separate memory spaces, PerfMon exposes distinct “NTVDM,” “NTVDM #1,” “NTVDM #2,” etc. You must select those individual NTVDM instances to capture CPU usage per 16-bit application. Step-by-Step Solution: Open System Monitor and select the Process object.Choose the % Processor Time counter.Add the two distinct NTVDM instances (e.g., NTVDM 1 and NTVDM #2) corresponding to APP1 and APP2.Optionally, rename display labels for clarity to map each NTVDM instance to its app. Verification / Alternative check: Use Task Manager or Process Explorer to confirm two separate ntvdm.exe processes exist while each 16-bit app is running. Temporarily close one app and observe the corresponding NTVDM instance's CPU dropping to validate mapping. Why Other Options Are Wrong: Adding APP1/APP2 directly: Their names do not appear as Process instances; they execute inside NTVDM. Adding a single “NTVDM” only: Would aggregate both apps if they share a space; separate memory spaces require selecting the distinct NTVDM instances. Mixing APP names with NTVDM: Redundant and still incorrect for per-app attribution. None of the above: Incorrect; the two NTVDM instances are the right choice. Common Pitfalls: Assuming 16-bit apps show as unique processes, or misinterpreting a single NTVDM when apps run in a shared memory space. Final Answer: Add the NTVDM 1 and NTVDM #2 instances to the Processor Time counter for the Process object

Question 5

Windows 2000 boot failure (“NTLDR is missing”): The server uses separate NTFS system and boot partitions. You need to restore NTLDR without losing configuration changes since installation. What is the correct procedure?

Accepted Answer

Introduction / Context: “NTLDR is missing” indicates that the boot loader cannot be found or accessed on the system volume. On Windows 2000, repairing the boot loader via the Recovery Console allows you to restore NTLDR without overwriting applications or system configuration, preserving your post-install changes. Given Data / Assumptions: System and boot partitions are NTFS and separate. Only NTLDR is missing or damaged; the OS files and configuration should remain intact. Admin wants to avoid a full reinstall. Concept / Approach: Use the Windows 2000 Server CD to access the Repair options and launch Recovery Console. From there, copy the NTLDR file (and if necessary, NTDETECT.COM) from the CD to the root of the active system partition. This surgical repair restores the boot loader while keeping registry, drivers, and installed apps untouched. Step-by-Step Solution: Boot from the Windows 2000 Server CD and select Repair → Recovery Console.Log on to the Windows installation with Administrator credentials.Copy NTLDR from the CD's i386 folder to the root of the system partition (often C:\).If needed, also copy NTDETECT.COM and verify BOOT.INI entries. Verification / Alternative check: After copying, remove the CD and reboot. The system should proceed to the Windows boot menu or load normally. Check the Event Log for disk or file system errors that may have caused the initial corruption. Why Other Options Are Wrong: Full reinstall: Overkill and risks overwriting configuration. sfc /scanboot: System File Checker does not run at pre-boot to restore NTLDR in this scenario. File Signature Verification: Diagnostics only, not a boot loader repair method. None of the above: Incorrect because Recovery Console copy is the appropriate fix. Common Pitfalls: Copying to the wrong partition, ignoring BOOT.INI errors, or failing to verify disk health after restoring NTLDR. Final Answer: Boot from the Windows 2000 Server CD, choose Repair, open Recovery Console, and copy NTLDR from the CD to the root of the system volume

Question 6

Integrating Windows 2000 Server into an existing Windows NT 4.0 domain: You need the new computer to be a domain controller in the current NT 4.0 domain. What is the correct upgrade sequence to introduce Windows 2000 Active Directory?

Accepted Answer

Introduction / Context: In a Windows NT 4.0 domain, only the Primary Domain Controller (PDC) holds the writable SAM database. To introduce Windows 2000 Active Directory into an NT domain, you must first upgrade the NT PDC to Windows 2000; this server becomes the first Windows 2000 domain controller and creates the AD forest/domain. Given Data / Assumptions: Existing single NT 4.0 domain with multiple NT servers as DCs. Goal: add Windows 2000 Server as a domain controller for that domain. No disruption of domain accounts and trusts. Concept / Approach: The supported path is to install a new NT 4.0 server as a Backup Domain Controller (BDC) in the existing domain. Then promote that BDC to become the PDC (so you do not touch the original PDC). Finally, in place, upgrade that promoted PDC to Windows 2000 Server and run the Active Directory Installation Wizard (DCPROMO) as part of the upgrade, bringing the domain into AD. Step-by-Step Solution: Install the new server as NT 4.0 BDC and let it fully synchronize.Promote the new BDC to PDC (now it holds writable SAM).Upgrade that PDC to Windows 2000 Server, installing Active Directory.Add additional Windows 2000 DCs as needed and decommission old NT DCs. Verification / Alternative check: After upgrade, validate logons, replication, and policies. Ensure the domain functional state is consistent and clients continue to authenticate. Why Other Options Are Wrong: Creating a new domain with the same name: Causes conflicts; not supported. Shutting down PDC and creating a new AD domain: Disruptive and invalid approach. Installing Windows 2000 as a replica in NT domain: Replica DCs only exist after AD is established by upgrading the PDC. None of the above: Incorrect because option A is the standard sequence. Common Pitfalls: Upgrading the production PDC directly without a fallback, skipping full synchronization before promotion, or not planning DNS integration required by AD. Final Answer: Install NT 4.0 as a BDC in the existing domain, promote it to PDC, then upgrade that server to Windows 2000 Server

Question 7

Storage redesign (Windows 2000 dynamic disks): Current configuration is a 4×100 GB striped volume (RAID-0). Using only the existing four disks, you must add fault tolerance while keeping as much capacity as possible. What is the correct reconfigurat…

Accepted Answer

Introduction / Context: A striped set (RAID-0) maximizes performance and space but has no redundancy—any single disk failure destroys the volume. Given four equal-sized disks and a requirement to add fault tolerance while preserving maximum usable capacity, Windows 2000 software RAID-5 is the best fit on existing hardware. Given Data / Assumptions: Four 100 GB disks currently configured as one stripe (RAID-0). Need fault tolerance and to maximize total capacity. Only existing hardware may be used (no fifth disk). Concept / Approach: RAID-5 provides block-level striping with distributed parity. Usable capacity with n disks is (n − 1) * min(disk size), so with four 100 GB disks, you get ~300 GB usable and can withstand a single disk failure. Migration from a stripe to RAID-5 requires backup, recreation, and restore in Windows 2000. Step-by-Step Solution: Back up all data from the current striped volume.Delete the RAID-0 volume in Disk Management.Create a new RAID-5 volume using all four disks (convert to dynamic if not already).Restore data to the new RAID-5 volume and verify integrity. Verification / Alternative check: Validate parity rebuild behavior by simulating a disk removal in a maintenance window (if policy permits) or reviewing event logs during a controlled resync to ensure fault tolerance works as expected. Why Other Options Are Wrong: Convert to dynamic alone: Does not add redundancy. Mirroring (RAID-1): With four disks likely yields 2 mirrors → only ~200 GB usable, not maximizing space. Spanned volumes: Provide capacity but no fault tolerance. None of the above: Incorrect because RAID-5 meets both requirements on existing hardware. Common Pitfalls: Attempting in-place conversion without backup, misunderstanding that spanned volumes are not redundant, or underestimating rebuild time and ensuring backups are current. Final Answer: Back up data, delete the stripe, create a RAID-5 volume on the four disks, and restore the data

Question 8

Installing Windows 2000 on a multiprocessor system with a vendor-supplied custom HAL: The customized Hardware Abstraction Layer is provided on a floppy disk. At what point and how should you install the custom HAL?

Accepted Answer

Introduction / Context: The Hardware Abstraction Layer (HAL) is foundational to how Windows interfaces with CPUs, APICs, and chipset features. On multiprocessor systems with special requirements, vendors may supply a tailored HAL. Windows 2000 permits specifying this during Setup to ensure the correct kernel/ACPI/interrupt model is used from the outset. Given Data / Assumptions: Multiprocessor hardware with a vendor-supplied HAL on floppy. Fresh Windows 2000 installation. Need to ensure the correct HAL is in place at install time. Concept / Approach: The correct time to specify or override HAL selection is during the text-mode portion of Setup. This phase allows manual selection and loading of the computer type/HAL from external media so the remainder of Setup uses the appropriate kernel interfaces. Post-install hot-swapping the HAL is unsupported and unsafe. Step-by-Step Solution: Begin Windows 2000 text-mode Setup.At the prompt to specify special drivers/computer type, supply the vendor's HAL from the floppy.Confirm Setup recognizes the custom HAL and proceeds with correct multiprocessor/ACPI model.Complete GUI-mode Setup. Verification / Alternative check: After installation, verify in Device Manager → Computer node which HAL is in use (e.g., ACPI Multiprocessor PC) and that all CPUs are recognized in Task Manager/Performance. Why Other Options Are Wrong: Copying or replacing the HAL after text-mode: Risky and not supported; the kernel and HAL are chosen early. Emergency Repair: Intended for fixing damaged installs, not swapping HALs. Device Manager: HAL is not a PnP-swappable component. None of the above: Incorrect because text-mode Setup is the right time. Common Pitfalls: Confusing storage driver injection (also in text-mode) with later driver updates; both must occur early for boot-critical components. Final Answer: Install the customized HAL during the text-mode portion of Windows 2000 Setup

Question 9

Windows 2000 (processor affinity): You want a specific application to run only on one CPU in a multiprocessor system. What is the correct way to assign the process to a single processor?

Accepted Answer

Introduction / Context: Processor affinity lets administrators constrain a process to run on a subset of available CPUs. This can mitigate cache thrashing, isolate workloads, or troubleshoot CPU-specific issues. Windows 2000 exposes per-process affinity controls via Task Manager for interactive adjustments. Given Data / Assumptions: Multiprocessor (or multicore) Windows 2000 system. Administrative rights to manage processes. Goal: bind one application to a single CPU. Concept / Approach: Task Manager allows modifying a running process’s CPU mask. The correct method is to locate the process on the Processes tab, right-click it, select Set Affinity…, and check only the desired CPU. This sets the affinity mask until the process restarts (or policy tools reapply it). Step-by-Step Solution: Open Task Manager → Processes tab.Right-click the target process and choose Set Affinity…Uncheck all but one CPU (e.g., CPU 0).Confirm and monitor CPU usage to verify adherence. Verification / Alternative check: Use Performance Monitor to chart % Processor Time per CPU and confirm the process stays on the selected CPU. Command-line tools or registry-based service affinity can be used for persistent settings. Why Other Options Are Wrong: Executable Properties: No GUI option there for CPU assignment in Windows 2000. Task Manager Options/Performance views: Visual and global settings, not per-process affinity controls. None of the above: Incorrect because Task Manager → Set Affinity is valid. Common Pitfalls: Expecting affinity to persist across restarts without reapplication; using affinity to mask broader performance problems. Final Answer: Right-click the application's process in Task Manager, choose Set Affinity, and select the target processor

Question 10

Proxy and intranet access design: Research and Executive users authenticate to a Windows 2000 Proxy Server for Internet access, but then must also authenticate to reach your internal intranet site. Users without proxy accounts cannot reach the intra…

Accepted Answer

Introduction / Context: Web proxy authentication is often required for outbound Internet access, but internal intranet sites should normally be reachable without passing through the external proxy or requiring proxy credentials. Browsers and WinINET clients can be configured to bypass the proxy for local (intranet) addresses, ensuring direct LAN access using standard Windows authentication if needed. Given Data / Assumptions: Proxy requires user credentials for Internet access. Internal intranet server is reachable on the LAN. Some users lack proxy accounts and should still access intranet. Concept / Approach: Configure the proxy settings to “Bypass proxy server for local addresses” or add the intranet FQDN/IP patterns to the proxy exception list. This allows direct connections to the intranet server, avoiding the proxy’s authentication gate while keeping proxy enforcement for external sites. Step-by-Step Solution: Open Internet Options → Connections → LAN settings.Check “Bypass proxy server for local addresses.”Optionally add intranet hostnames or domains to the Exceptions list.Test intranet access; ensure Internet sites still route via proxy. Verification / Alternative check: Use netstat or proxy logs to confirm intranet traffic no longer hits the proxy. Validate Single Sign-On to the intranet via Integrated Windows Authentication if applicable. Why Other Options Are Wrong: Moving servers: Topology changes are unnecessary; this is a client configuration issue. Using port 81: Arbitrary and unrelated to the dual-auth problem. None of the above: Incorrect because proxy bypass for local addresses solves it. Common Pitfalls: Forgetting to include both short hostnames and FQDNs in exceptions, or proxy-chaining intranet traffic inadvertently causing authentication prompts. Final Answer: Configure each client to bypass the proxy server for local addresses

Question 11

Windows 2000 (insufficient space on system partition for app logs): An application writes very large logs to %SystemRoot%\Temp and cannot change its log path. The system partition lacks free space, but a second disk is available. How can you run the…

Accepted Answer

Introduction / Context: Some legacy applications hard-code log or temp locations (e.g., %SystemRoot%\Temp). When the system partition is short on space, Windows 2000 supports NTFS mount points that let you graft another volume into a folder path, effectively expanding capacity at that exact directory without changing the application configuration. Given Data / Assumptions: Application writes to %SystemRoot%\Temp and cannot change the path. System partition lacks space; a second disk is available. Goal: increase capacity at that specific path without breaking the app. Concept / Approach: Create a new NTFS volume on the second disk and mount it as a folder at %SystemRoot%\Temp. This mount point makes the application write to the new volume transparently. Shortcuts or shares do not redirect file system I/O; only an NTFS mount point ensures the path resolves to a different volume at the kernel level. Step-by-Step Solution: Add the second disk and initialize it in Disk Management.Create and format a new NTFS partition.Empty %SystemRoot%\Temp (back up and delete transient files as allowed).In Disk Management, assign “Mount in the following empty NTFS folder” → select %SystemRoot%\Temp. Verification / Alternative check: Confirm that the new volume appears as a mounted folder and that free space reflects the new volume’s capacity. Run the application to verify log creation and monitor space consumption on the mounted partition. Why Other Options Are Wrong: Creating a share or shortcut: Does not redirect file system writes at the same path; the app will still write to the original volume. Mounting the system partition elsewhere (option c): Reverses the direction and fails to relieve space at %SystemRoot%\Temp. None of the above: Incorrect because NTFS mount points solve the exact constraint. Common Pitfalls: Leaving existing files in %SystemRoot%\Temp so the mount fails (folder must be empty), or assuming mapped drives/shortcuts change the path for app I/O. Final Answer: Add a second disk; create and format a partition, then mount that partition as %SystemRoot%\Temp

Question 12

Windows 2000 Server performance has degraded on a 12-GB FAT32 primary partition hosting shared folders after nine months of steady usage with constant workload. What is the most effective first action to restore file retrieval speed without changing…

Accepted Answer

Introduction / Context: On Windows 2000 Server, file servers running for months on FAT32 volumes commonly encounter fragmentation. Even when the number of users, access frequency, and average file sizes remain constant, daily file creates, deletes, and edits fragment files and directories, increasing disk seeks and reducing throughput. This question asks for the best first remedial action that restores performance without redesigning storage or altering client behavior. Given Data / Assumptions: Operating system: Windows 2000 Server. Volume: 12-GB primary partition formatted as FAT32. Workload: steady user count and access frequency for nine months. Symptom: slower file retrieval from shared folders compared to initial install. Goal: restore performance with minimal change risk. Concept / Approach: File fragmentation spreads a file’s clusters across the disk surface, causing extra head movement. On FAT32, directory structures and free-space maps also become fragmented. The lowest-risk, high-impact step is to defragment the affected volume. Defragmentation consolidates files and free space, reducing seeks and improving read performance. Converting to NTFS can help long-term with better metadata handling and reliability, but conversion is not required to resolve the immediate symptom and introduces change risk. Dynamic disks alter partitioning/management but do not directly improve read performance. Moving the paging file onto the same busy partition can worsen contention. Step-by-Step Solution: 1) Confirm the slowdown is general file access degradation, not network or memory pressure.2) Measure fragmentation using the built-in Disk Defragmenter analysis.3) Schedule and run defragmentation during low usage windows.4) Re-measure performance and fragmentation; optionally defragment again if necessary.5) Plan periodic defragmentation as preventive maintenance. Verification / Alternative check: Post-defrag, average disk queue length and average disk sec/read should decrease. User feedback and server counters will reflect shorter file open times. Compare before/after with Performance Monitor logs to verify improvement. Why Other Options Are Wrong: Convert to dynamic disk: Changes volume management but does not fix fragmentation or directly speed reads. Convert to NTFS: Beneficial for security and reliability; however, not required to correct the immediate slowdown and carries change risk. Move the paging file to this partition: Increases contention on the same disk, likely worsening performance. None of the above: Invalid because defragmentation directly addresses the cause. Common Pitfalls: Blaming the network stack for local disk fragmentation; migrating to NTFS prematurely without backups; defragmenting during peak hours causing additional contention. Final Answer: Defragment the disk that contains the shared folders

Question 13

A newly installed multi-process database application on Windows 2000 Server stops responding to queries. Before restarting the application, what is the safest way to terminate it so that all related child processes are closed cleanly?

Accepted Answer

Introduction / Context: Complex server applications often spawn multiple helper or worker processes. When such an application freezes, terminating only the parent process can leave orphaned children holding locks, ports, or shared memory. Windows 2000 Task Manager and other tools provide different termination scopes; choosing the correct one avoids partial cleanup and inconsistent state. Given Data / Assumptions: Application is multi-process (spawns child processes). Server OS: Windows 2000 Server. Symptom: application stops responding to queries. Goal: cleanly close all related processes before restart. Concept / Approach: Terminating the process tree ensures the parent and all child processes are closed in one action, freeing resources like file handles, sockets, and database locks. Killing only the top process may leave children running, causing port binding conflicts or data file contention when the application restarts. Ending Explorer.exe disrupts the shell but does not help service-style applications and may complicate recovery. Step-by-Step Solution: 1) Identify the application's main executable (Application.exe) and confirm child processes exist.2) Use Task Manager or an administrative tool (e.g., tskill/pskill) to choose “End Process Tree.”3) Wait for handles to release; confirm that all child processes terminated.4) Restart the application service or executable and verify normal operation. Verification / Alternative check: Check that the application's TCP/UDP ports are free (e.g., with netstat) and that no child processes remain. Logs should show a clean restart without “address already in use” or “file locked” errors. Why Other Options Are Wrong: End task / End process only: May leave child processes running and resources locked. End Explorer.exe too: Unnecessary; affects shell stability without addressing the hung service. None of the above: Incorrect because ending the process tree is the appropriate scope. Common Pitfalls: Force-killing database engines without checking for child workers; restarting immediately and encountering the same lock/port issues due to orphans. Final Answer: End the Application.exe process tree

Question 14

Windows 2000 Terminal Services on a domain controller returns “The local policy of this system does not allow you to log on interactively.” Users cannot connect, but administrators can. Which user right must you grant to allow users to connect to th…

Accepted Answer

Introduction / Context: On Windows 2000, Terminal Services in application mode on a domain controller enforces local security policies strictly. The error “does not allow you to log on interactively” indicates users lack a required logon right. Admins often can connect because they already possess the needed rights via built-in groups. Given Data / Assumptions: Terminal Services installed on a domain controller. Users receive the interactive logon policy error; administrators can connect. Goal: enable user connections securely via policy. Concept / Approach: In Windows 2000, Terminal Services connections check the “Log on locally” user right on domain controllers (later systems add a distinct “Allow log on through Terminal Services” right). Granting this right to an appropriate group (e.g., a TS Users group) enables non-admin users to log on via Terminal Services. “Log on as a service” applies to running services, not interactive sessions. “Log on over the network” affects network access to shares, not console/TS logons. Copying profiles or home folders does not change policy rights. Step-by-Step Solution: 1) Open Domain Controller Security Policy or Local Security Policy (on the DC hosting TS).2) Navigate to Local Policies → User Rights Assignment.3) Add the appropriate user group to “Log on locally.”4) Force policy update (secedit /refreshpolicy or reboot) and test a user connection. Verification / Alternative check: Attempt a Terminal Services logon using a test user from the granted group; the session should establish successfully without policy denials in the Security log. Why Other Options Are Wrong: Log on as a service: For service accounts only. Log on over the network: Governs SMB/RPC access, not TS interactive sessions. Copy profiles/home folders: Storage changes do not grant logon rights. Common Pitfalls: Granting overly broad rights (e.g., Everyone) on a domain controller; failing to scope the right to a specific group of TS users. Final Answer: Grant users the right to log on locally

Question 15

You replace an integrated 10-Mb Ethernet adapter with a new 100-Mb PCI adapter on Windows 2000 Server. After reboot, System log errors say the new adapter is missing or not working. What should you do to resolve hardware conflict and ensure the new …

Accepted Answer

Introduction / Context: When adding a new PCI network adapter to replace an onboard NIC, Windows may still enumerate and load the original adapter. This can cause resource conflicts, binding confusion, or drivers competing for the same role, resulting in “missing/not working” errors for the new device. The safest fix is to disable the onboard adapter cleanly. Given Data / Assumptions: Integrated (onboard) 10-Mb NIC remains present. New 100-Mb PCI NIC is installed. System reports the new adapter is missing/not working. Goal: initialize the new NIC, avoid conflicts. Concept / Approach: Disabling the onboard adapter in Device Manager prevents Windows from loading its driver and competing for resources. Removal attempts can be reversed by PnP on the next boot; outright file deletion from driver cache is risky and unnecessary. A new hardware profile won’t resolve a persistent resource/binding conflict. The clean, supported approach is to disable the device (or turn it off in BIOS), then verify the new adapter's driver and bindings (TCP/IP, client for Microsoft Networks, file and printer sharing). Step-by-Step Solution: 1) Open Device Manager and expand Network adapters.2) Right-click the onboard NIC → Disable.3) Confirm the PCI NIC shows as working; install/verify correct driver.4) Rebind protocols/services to the new NIC; verify link, IP configuration, and connectivity. Verification / Alternative check: Check Event Viewer for cleared errors; confirm “Media State: connected,” valid IP, and successful ping/SMB access. Optionally disable in BIOS for permanent deactivation. Why Other Options Are Wrong: Create a new hardware profile: Does not remove the conflict. Remove device: Windows may re-detect and reinstall the onboard NIC on reboot. Delete driver files: Unsupported and risky; may break future reinstall or rollback. Common Pitfalls: Leaving both adapters enabled without clear binding order; deleting system driver caches causing repair installs. Final Answer: Use Device Manager to disable the integrated 10-Mb Ethernet adapter

Question 16

A Windows 2000 dynamic RAID-5 (converted from a stripe set with parity) shows degraded performance and Disk Management reports the third disk status as “Missing.” What is the first action you should take to recover the RAID-5 volume?

Accepted Answer

Introduction / Context: Dynamic RAID-5 volumes in Windows 2000 tolerate a single disk failure. However, a disk can appear as “Missing” due to temporary cabling, power, or controller issues—not necessarily a failed disk. Reactivating a “Missing” dynamic disk can restore it to “Online” if the underlying cause was transient, allowing the RAID-5 set to resynchronize without replacement. Given Data / Assumptions: Dynamic RAID-5 volume across four disks; the third disk shows “Missing.” Performance suddenly slower than the previous day, consistent with degraded RAID. No explicit evidence yet of physical disk failure. Goal: recover volume with minimal disruption and data integrity preserved. Concept / Approach: Windows marks a dynamic disk as “Missing” when it was present but cannot be contacted (power/cable/temporary removal). If the device is still healthy and connectivity is restored, Reactivating the disk in Disk Management brings it online, updating the dynamic disk database. Only if the disk truly fails should replacement and parity rebuild proceed. Attempting “Repair” without first ensuring availability may fail or mislead the admin into unnecessary replacement. Step-by-Step Solution: 1) Physically verify the third disk’s power and data connections; check controller/ports.2) In Disk Management, right-click the “Missing” disk → Reactivate Disk.3) If it returns “Online,” allow RAID-5 to resync; monitor event logs and performance.4) If reactivation fails and SMART/diagnostics indicate failure, replace the disk and perform a rebuild. Verification / Alternative check: After reactivation, the volume status should transition from “Degraded” to healthy as parity resynchronizes. Event Viewer will log successful reactivation and reconstruction progress. Why Other Options Are Wrong: Replace immediately: Premature if the disk is only disconnected; try reactivation first. Repair before reactivation: The OS cannot repair a disk that is not online. Create extended partition for auto repair: Not a supported recovery path for dynamic RAID-5. Common Pitfalls: Assuming “Missing” means failed; replacing a good disk unnecessarily; mixing basic/dynamic operations during recovery. Final Answer: Verify power/connection for the third disk and use Disk Management to reactivate the disk

Question 17

After installing a new tape-drive driver on Windows 2000 Server, the system blue-screens at logon with “IRQL_NOT_LESS_OR_EQUAL.” You must restore service quickly and safely. Which recovery action should you use first?

Accepted Answer

Introduction / Context: The IRQL_NOT_LESS_OR_EQUAL stop error commonly indicates a faulty or incompatible kernel-mode driver. Right after a new tape driver installation, the priority is rapid restoration of service on a file server. Windows 2000 provides several rollback mechanisms; choosing the least invasive, fastest working option limits downtime. Given Data / Assumptions: New hardware driver was installed immediately prior to BSOD. System boots to the point of applying the new driver, then fails. Users depend on this server during business hours. Goal: quick, reliable restoration without deeper repairs. Concept / Approach: Last Known Good Configuration restores the previous control set (services/drivers start list) used in the last successful logon. It is specifically designed for issues introduced by newly enabled drivers or services. It is fast, non-destructive, and often sufficient. Safe Mode or Recovery Console are valid but typically second-line options requiring manual removal/disable. Emergency Repair is more intrusive and slower. Step-by-Step Solution: 1) Reboot and press F8 to access Advanced Options.2) Select “Last Known Good Configuration.”3) Allow Windows to boot using the prior control set (without the problematic driver).4) Once stable, uninstall or roll back the tape driver and obtain a correct version. Verification / Alternative check: Successful boot without the BSOD confirms the driver start entry was rolled back. Event logs should no longer show the tape driver loading. Perform a test backup only after reinstalling a verified driver. Why Other Options Are Wrong: Emergency Repair: Heavier than needed and may modify system files broadly. Safe Mode / Recovery Console: Work, but take longer and require manual intervention; use if Last Known Good fails. Common Pitfalls: Repeatedly rebooting into normal mode (which sets the faulty control set as “good” if a logon occurs), making rollback harder; forgetting to re-test with a verified driver. Final Answer: Restart using Last Known Good Configuration

Question 18

You have 10 Windows 2000 domain controllers (two hosting DNS), 10 member servers, ~1,000 clients, and TCP/IP only across 10 subnets. All hosts must resolve names via DNS, register dynamically, and remain resilient if a server fails. How should you c…

Accepted Answer

Introduction / Context: Windows 2000 introduced Active Directory–integrated (ADI) DNS zones, which store zone data in the directory. ADI zones are multi-master: any domain controller running DNS can accept updates and replicate them using AD replication, which is ideal for dynamic registrations and resilience. Given Data / Assumptions: Two domain controllers already host DNS. All clients use TCP/IP only and must register/resolve dynamically. Resiliency is required: service must continue if one DNS server fails. Concept / Approach: Configuring at least two DNS servers to host the zone as Active Directory–integrated yields multi-master update capability. Clients can register with either DNS server; changes replicate via AD. Standard primary/secondary is single-master, making updates dependent on the primary’s availability and introducing transfer lag. Multiple standard primaries for the same zone are invalid and cause conflicts. Step-by-Step Solution: 1) Convert the domain’s forward lookup zone to AD-integrated on one DC.2) Install DNS on at least one additional DC and also host the same zone as AD-integrated.3) Verify dynamic updates are allowed (secure if desired).4) Point client TCP/IP settings (and DCs) to both DNS servers for redundancy. Verification / Alternative check: Confirm updates on one DNS server appear on the other after AD replication; test client registrations (ipconfig /registerdns) and resolvability if one server is offline. Why Other Options Are Wrong: Standard primary + secondaries: Single-master, not ideal for resilient dynamic updates. Mixing standard and AD-integrated primaries: Not a recommended or coherent design. One ADI + one secondary: Works but keeps a single-master update point; less resilient for updates. Multiple standard primaries: Invalid for the same zone. Common Pitfalls: Leaving DCs pointing at themselves for DNS only; not enabling secure dynamic updates; forgetting reverse lookup zones for PTR registration. Final Answer: Configure at least two servers with Active Directory–integrated primary zones

Question 19

On a Windows 2000 RRAS (dial-up/VPN) server, you require mutual authentication and encryption of data between RAS clients and the server. Which authentication protocol should you select to meet both requirements?

Accepted Answer

Introduction / Context: Remote access security in Windows 2000 relies on negotiated authentication protocols that determine password exchange strength, mutual authentication capability, and whether session keys for encryption are derived. Selecting the correct protocol is crucial to enforce both identity assurance and confidentiality of traffic. Given Data / Assumptions: Server: Windows 2000 RRAS. Requirement: mutual authentication (server verifies client, client verifies server) and data encryption. Goal: choose the strongest applicable built-in method for that era. Concept / Approach: MS-CHAP v2 provides improved authentication over MS-CHAP v1 and classic CHAP, including mutual authentication and stronger keying material. It negotiates session keys used by MPPE to encrypt data streams. PAP sends credentials in cleartext; SPAP is proprietary and lacks mutual authentication. CHAP (RFC 1994) validates the client to the server but not the server to the client and does not inherently guarantee encryption unless paired with an encryption scheme; Windows implementations pair encryption robustly with MS-CHAP v2. Step-by-Step Solution: 1) Enable RRAS and configure remote access policies to allow MS-CHAP v2.2) Ensure clients are set to prefer MS-CHAP v2 and require encrypted authentication.3) Confirm MPPE encryption settings (40/56/128-bit as supported) are enabled.4) Test a connection to verify mutual authentication prompts and encrypted link establishment. Verification / Alternative check: RRAS logging and client status should show MS-CHAP v2 in use and MPPE encryption active. Packet traces will indicate encrypted PPP payloads after authentication. Why Other Options Are Wrong: CHAP: No mutual server authentication; weaker in this scenario. PAP: Cleartext credentials; fails security requirements. SPAP: Proprietary with limited security; no mutual authentication guarantee. Common Pitfalls: Allowing fallback to insecure methods; misconfiguring policies so clients negotiate weaker authentication; forgetting to require encryption in connection properties. Final Answer: MS-CHAP v2

Question 20

Your network uses TCP/IP only. Some remote-access clients see “IPX/SPX compatible computer reported error 733: The PPP control protocol for the network is not available,” yet they still connect to TCP/IP services. How do you prevent this warning fro…

Accepted Answer

Introduction / Context: Error 733 occurs when a PPP client attempts to negotiate a network control protocol (NCP) that the server does not support. In this case, the environment is TCP/IP-only, but the client is attempting to bring up IPX/SPX over PPP. The connection proceeds using TCP/IP, but the IPX NCP negotiation fails, generating the warning. Given Data / Assumptions: RRAS server supports only TCP/IP, not IPX/SPX. Clients still connect and can use TCP/IP services. Undesired warning message appears during connection establishment. Concept / Approach: The fix is to stop the client from attempting to negotiate unsupported protocols. On Windows dial-up/VPN connection properties, uncheck IPX/SPX (and NetBEUI, if present) so only TCP/IP is bound and negotiated. This prevents the PPP negotiation from proposing IPX NCP at all, eliminating error 733. Enabling IPX on the server contradicts the TCP/IP-only design. Assigning IPX addresses on clients will not help if the server refuses IPX. Step-by-Step Solution: 1) On the client, open the connection's Networking tab.2) Uncheck “NWLink IPX/SPX/NetBIOS Compatible Transport Protocol.”3) Ensure only “Internet Protocol (TCP/IP)” remains enabled.4) Reconnect; the warning should no longer appear, and TCP/IP services will continue to function. Verification / Alternative check: Reconnect and confirm the absence of the message; review RAS logs for negotiated protocols showing only IPCP (IP Control Protocol) succeeding. Why Other Options Are Wrong: Assign IPX address or enable IPX on server: Contradicts the TCP/IP-only policy and adds unnecessary complexity. Disable multilink: Unrelated to protocol negotiation errors. Common Pitfalls: Leaving legacy protocols enabled in client connection properties; troubleshooting servers unnecessarily when the issue is client-side negotiation. Final Answer: Configure the client to use only TCP/IP for the remote connection

Windows 2000 Server Questions