1DV416 Windowsadministration I, 7.5hp MODULE 3 ACTIVE DIRECTORY PART 2

Transcription

1 1DV416 Windowsadministration I, 7.5hp MODULE 3 ACTIVE DIRECTORY PART 2

2 Jacob Lindehoff 2 Lecture content Today's lecture Active Directory Installation Joining the domain Centralized user management OU ProJile Groups Additional Domain Controllers FSMO

3 Jacob Lindehoff 3 Ac+ve Direcotry Verify the NetBIOS name Verify TCP / IP settings NTFS, as well as hard drive space Planning of the logical structure Planning of the physical structure Verify existing DNS servers Add Role Active Directory Domain Services Run Post- Setup Wizard to Promote to DC Verify DNS service

4 Installation Name or company\user Jacob Lindehoff 4

5 AD and DNS Sign on Locate Global Catalog Domain Controller DNS Client DC Jacob Lindehoff 5

6 Jacob Lindehoff 6 What is the purpose of the Global Catalog Optimization, contains parts of the AD database A GC contains several domains AD- content all objects, not all attributes Table of content for directory Required for users to be able to log in Membership of universal groups

7 Jacob Lindehoff 7 Domain user Account: DC A Replication A AD B DC B A AD B Klient kalmar.se User: A User: B User: A User: B Client Member server

8 Jacob Lindehoff 8 User Account Template Create an account template for accounts with similar general information: Use Copy to create new accounts Individual User Account Inactive Template Account Individual tasks: Name: Donald Name: Johansson Login Name: dj22ay General Information: Class: NS Location: Teknikum Focus: Data Individual User Account Individual tasks: Name: Per Name: Svensson Login Name: ps11ga

9 Jacob Lindehoff 9 Home folder: Member server Filserver User As home folder User Bs home folder HD Client 3. Client User A Domain User B DC AD

10 Jacob Lindehoff 10 Login Script Runs when the user logs on to a computer \\domaincontroler\netlogon Replicated to all domain controllers Only Jile name, not the path Example mounts Printer etc.

11 User ProJile Roaming Mandatory Use Group Policy Jacob Lindehoff 11

12 Organizational Units: Sorting and organizing Apply group policies Delegate administrative control Jacob Lindehoff 12

13 What should I use OU for? Organizing Delegation of administration Group Policies How should you build the OU structure? In view of point 2 & 3 Delegation Group Policies Jacob Lindehoff 13

14 Standard containers in Active Directory: Builtin Computers Domain Controllers (OU) ForeignSecurityPrincipals Users Jacob Lindehoff 14

15 PredeJined User Accounts in Active Directory: Exempel Administrator Guest IUSR_servername IWAM_servername krbtg TsInternetUser Jacob Lindehoff 15

16 Jacob Lindehoff 16 PredeJined goups in built- in containern: Administrators Account Operators Server Operators Backup Operators Print Operators Users Replicator

17 Jacob Lindehoff 17 PredeJined groups in users containern: Enterprise Admins Schema Admins Domain Admins Group Policy Owners Domain Users Domain Guest Domain Controllers Domain Computers Cert Publishers DnsUpdateProxy RAS and IAS Servers

18 Jacob Lindehoff 18 Implicit groups Groups representing users at different context Users connect automatically Can not be manually Example Anonymous Logon Authenticated Users Creator Owner Enterprise Domain Controllers Everyone Interactive Network Self Service

19 Domain Groups: created on domain controllers stored in Active Directory used to control access to resources in a domain DC AD Jacob Lindehoff 19

20 Jacob Lindehoff 20 Active Directory supports three group types: Domain local groups (Local Domain) Authorize within a single domain Members may come from the entire forest Global groups (Global) Authorize in the whole forest Members may only come from the same domain as the group Universal groups (Universal) Authorize the whole forest Members may come from the entire forest

21 Jacob Lindehoff 21 There are two different group ranges of group types: Distribution Group The group acts as an e- mail list They are also known as Distribution Lists in Exchange Does not support ACL Ignored during the login process Security Group E- mail List You also can apply in an ACL All security- groups controlled during the login process

22 Jacob Lindehoff 22 Extra domain controller Redundancy Load balance Remote/Branch OfJices Installation options DNS Global Catalog RODC

23 Read Only Domain Controller, RODC Reduces attack surface Only selected password is replicated Read- only copy of the domain Suitable of remote/branch ofjice Can be installed by a standard user Jacob Lindehoff 23

24 Jacob Lindehoff 24 Flexible Single Master Operation (Operation Masters): Schema Master (scope, the whole forest) Domain Naming Master (scope, the whole forest) PDC Advertiser (scope, the current domain) RID Master (scope, the current domain) Infrastructure Master (scope, the current domain) How many roles do you get if you have a forest with 12 domains? + 1 Schema Master 1 Domain Naming Master 12 PDC Advertisers 12 RID Masters 12 Infrastructure Masters 38 FSMO roles

25 Jacob Lindehoff 25 Schema Master (scope, the whole forest): modifying the Schema Schema manager ntdsutil Domain Naming Master (scope, the whole forest): check for changes in the namespace handles adding and removal of domains in the forest The Jirst domain controller is By default, the holders of the Schema Master and Domain naming master roles. DC First DC in the forest

26 PDC Advertiser (scope, its own domain): used to obtain backward compatibility with Windows NT Windows NT BDC Windows NT BDC Windows NT BDC Windows 2000/2003 PDC Advertiser Windows 2000/2003 DC Windows 2000/2003 DC Jacob Lindehoff 26

27 Jacob Lindehoff 27 Flexible Single Master Opera+on RID Master (scope, its own domain): there is only one Relative- IdentiJier (RID) per domain all security principals in one domain has a Security IdentiJier (SID) System uses the SID Exempel: SID S SID E SID Q

28 Jacob Lindehoff 28 Flexible Single Master Opera+on RID Master (scope, its own domain) forts.: domain controllers have 512 RID number for own use threshold is set to 100 RID is used to create unique SIDs DC holding FSMO role RID Master DC DC RID- Pool

29 Jacob Lindehoff 29 Flexible Single Master Opera+on Infrastructure Master (scope, its own domain): also known as "Infrastructure Daemon" is used to maintain references to objects in other domains, known as "phantoms". Domain controller that is the holder of FSMO role "Infrastructure daemon" A B1 B2 B3 B C C1 C1 Members in group C1 B1 B2 B3 1. Ex: There are three user accounts in domain B and are members of a group in the domain C 2. "Infrastructure daemon" in the domain C is used to refer to "phantoms" in domain B user accounts

30 Jacob Lindehoff 30 Infrastructure Master DC, with the global catalog DC, with Infrastructure Master role DC 1. Compare name data in the global catalog, which automatically gets updates from all objects in all domains and therefore have no incorrect data. 2. Infrastructure daemon updates all their items with the updates that it can Jind in the global catalog, and then replicate the changes to all domain controllers in its own domain.

31 Jacob Lindehoff 31 Tools for the administration of the FSMO roles: GUI Active Directory Users and Computers (only domain roles) Active Directory Domains and Trusts (only DN master) Active Directory Schema (only Schema Master) Command Tools NTDSUTIL command (all roles) When should you use NTDSUTIL and Active Directory Users and Computers

32 Jacob Lindehoff 32 Who has permission to move the FSMO roles? FSMO Role Member of Schema Schema Admins Domain Naming Enterprise Admins RID PDC Emulator Domain Admins Infrastructure

33 Jacob Lindehoff 33 FSMO- role Who holds the role? How do you move a role?

34 Jacob Lindehoff 34 Slow boot - DC Active Directory Initial Synchronization Requirements DCs have any FSMO role AD replication Have FSMO role been moved? This feature can be turnend off during testing regedit [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\NTDS\Parameters] "Repl Perform Initial Synchronizations"=dword: