ren C:\WINDOWS\System32\dllcache\atmfd.dll x-atmfd.bak執行完之後會出現檔案保護的提醒，取消忽略之後就可以暫時安心了 ?
ren C:\WINDOWS\SERvicePackFiles\i386\atmfd.dll x-atmfd.bak
ren C:\WINDOWS\System32\atmfd.dll x-atmfd.bak
% cli #進入命令模式
> config #或是 edit，進入編輯模式接著可以開始設定，基於安全的考量，我們會把http跟telnet關閉，只留下ssh跟https
delete system services web-management http接著設定允許介面存取服務(應該是這樣翻吧XD)
delete system services telnet
set system services ssh
set system services web-management https interface ae0.0
set security zones security-zone untrust host-inbound-traffic system-services ssh
set security zones security-zone untrust host-inbound-traffic system-services https
接著加入允許存取的IPset policy-options prefix-list management-hosts 123.123.123.123/32接著加入防火牆存取過濾，設定允許的IP存取ssh跟https
set firewall family inet filter filter-management term block_unauthorised from source-address 0.0.0.0/0
set firewall family inet filter filter-management term block_unauthorised from source-prefix-list management-hosts except
set firewall family inet filter filter-management term block_unauthorised from protocol tcp destination-port [ssh https]
set firewall family inet filter filter-management term block_unauthorised then discard
set firewall family inet filter filter-management term accept_default then accept
set firewall family inet6 filter filter-management6 term block_unauthorised from source-address ::/0
set firewall family inet6 filter filter-management6 term block_unauthorised from source-prefix-list management-hosts except
set firewall family inet6 filter filter-management6 term block_unauthorised from destination-port [ssh https]
set firewall family inet6 filter filter-management6 term block_unauthorised then discard
set firewall family inet6 filter filter-management6 term accept_detault then accept
接著將規則加入到loopback介面
set interfaces lo0 unit 0 family inet filter input filter-management
set interfaces lo0 unit 0 family inet6 filter input filter-management6
最後不要忘記套用，打完收工commit
這個教訓讓我學到 3 個寶貴的經驗：確實，如果虛擬化的話，這是個很關鍵很重要，而且必須要注意的事情。
- DC 可以安裝在 VM 裡，但只有壹台 DC 時，VM 的 宿主(Host) 不要加入網域！
- 沒事不要手動將 DC 儲存狀態或關閉，反正主機重開機時會自動將 VM 重啟！
- DC 至少要兩台，兩台都在 VM 裡的話，不要一起關機！
Microsoft has no requirements that at least one DC be physical. They do have a recommendation that there is at least one but this is to ensure that you always have access to the domain in the event the virtualization HOST is unavailable....這部分跟保哥的提醒跟建議是相同的，所以這沒問題。
I have also heard folks talk about the PDCe should be a physical machine. My question is “Why”? The PDCe isn’t magical but the one thing that can make it different from other DC’s is that it can use from 2% – 12% more physical resources than other DC’s. So with that thought in mind, manage your platforms on your DC’s. If you are doing your due diligence on your platforms to ensure they aren’t being overloaded then it shouldn’t matter where your PDCe is running.在AD 5大角色中，PDCe 比其他DC會需要更多的系統資源，但是如果你的DC並沒有系統負載過高或是效能不足的情況發生，那麼你的DC是實體化還是虛擬化都沒多大的差別了。