BitLocker drive encryption (BDE): a disk encryption method provided in Windows that can use the TPM to securely store the cryptographic material used in the encryption.
BitLocker To Go: feature that enables users to encrypt removable USB devices, such as flash drives and external hard disks.
data recovery agent (DRA): a use that can recover EFS encrypted files for a domain.
decryption: the process of converting data from encrypted format back to its original format.
Encrypting File System (EFS): a file encryption method that can encrypt files on an NTFS volume that cannot be used unless the user has access to the keys required to decrypt the information.
encryption: the process of converting data into a format that cannot be read by another user.
Network Unlock: a new feature in Windows 8 and Windows Server 2012 that provides an automatic unlock of operating system volumes at system reboot when connected to a trusted wired corporate network.
pre-provisioning: allows BitLocker to be enabled before the operating system is installed.
Trusted Platform Module (TPM): a microchip that is built into a computer. It is used to store cryptographic information, such as encryption keys.
caching-only server: a DNS server that receives client requests, and as the other DNS servers fulfill DNS queries, the server adds the information to its cache.
conditional forwarding: forward specific queries to other DNS servers based on the DNS domain names in the query.
dnscmd.exe: a command-line utility that allows an administrator to display and change properties of the DNS servers, zones, and resource records.
Domain Name System (DNS): a naming service that is used by TCP/IP network and is an essential service used by the Internet.
forward lookup zone: used primarily to resolve host names to IP addresses.
forwarder: another DNS server that requests are sent to for resolution.
aging: the process in DNS of using timestamps to track the age of dynamically registered resource records.
Canonical Name (CNAME) records: sometimes referred to as an alias, maps an alias DNS domain name to another primary or canonical name.
DNS zone database: made up of a collection of resource records, which are sued to answer DNS queries.
dynamic updates: resource records for the clients are automatically created and updated at the host’s primary DNS server.
Host (A and AAAA) records: maps a host name to an IP address.
Pointer (PTR) records: maps an IP address to a host name
round robin: a DNS balancing mechanism that distributes network load among multiple servers by rotating resource records retrieved from a DNS server.
scavenging: the mechanism to remove stale resource records.
secure dynamic updates: only updates from the same computer can update a registration for a resource record.
Service Location (SRV) records: maps a DNS domain name to a specified list of host computers that offer a specific type of service, such as Active Directory domain controllers.
Start of Authority (SOA) record: specifies authoritative information about a DNS zone, including the primary name server, the e-mail of the domain administrator, the domain serial number, and the expiration and reload timers of the zone.
Challenge Handshake Authentication Protocol (CHAP): a challenge-response authentication that uses the industry standard md5 hashing scheme to encrypt the response.
Extensible Authentication Protocol (EAP-MS-CHAPv2): a universal authentication framework that allows third-party vendors to develop custom authentication schemes including retinal scans, voice recognition, fingerprint identifications, smart cards, Kerberos, and digital certificates.
IKEv2: a tunneling protocol that uses IPsec Tunnel Mode protocol over UDP port 500.
Microsoft CHAP version 2 (MS-CHAP v2): an authentication method that provides two-way authentication (mutual authentication).
network address translation (NAT): used to hide an entire IP address space behind a single IP address.
Password Authentication Protocol (PAP): an authentication method that uses plain text (unencrypted passwords). PAP is the least secure authentication and is not recommended.
Point-to-Point Tunneling Protocol (PPTP): a VPN protocol based on the legacy Point-to-Point protocol used with modems.
preauthentication: The process by which users and devices are authenticated before they access an application.
remote access server (RAS): a server that enables users to connect remotely to a network using various protocols and connection types.
Routing and Remote Access (RRAS): Microsoft’s implementation of the remote access server.
Routing Information Protocol (RIP): a dynamic route definition protocol, typically used on only very small networks

DirectAccess: a feature introduced with Windows 7 and Windows Server 2008 R2 that provides seamless intranet connectivity to DirectAccess client computers when they are connected to the Internet
access client: a computer or device that contacts or connects to a RADIUS client, which requires authentication and authorization to connect.
authentication, authorization, and accounting (AAA): features provided by RADIUS servers to authenticate, authorize, and audit remote access to the network.
authorization: the process that determines what a user is permitted to do on a computer system or network.
Network Policy Server (NPS): Microsoft’s implementation of the RADIUS server defined in RFC 2865 and 2866.
RADIUS clients: are servers (such as servers running RRAS) and devices (such as wireless access points and 802.1X switch) that forward RADIUS requests to a RADIUS server.
RADIUS proxy: a server that forwards authentication and accounting messages to other RADIUS servers.