Administering Active Directory. Administering Active Directory. Reading. Review: Organizational Units. Review: Domains. Review: Domain Trees

Transcription

1 Reading Read over the Active Directory material in your Network+ Guide I will be providing important materials Administering Active Directory If you don t understand certain concepts, please ask for help! Review: Domains Review: Organizational Units A set of resources which share a directory (security) database How do I know when I should break a set of resources into multiple domains? When you want them to be managed separately! Different policies, different settings, etc. By default, the Administrator account only is an admin for the SINGLE domain Separate domain controllers A container which can be used to organize items INSIDE a domain Main reason: organize a single domain into logical administrative units How do I know when I should use OUs (rather than domains?) When you want to break resources down for organization/management purposes, but they are administered together Same domain controller(s) Same policies, same settings, etc. Administrator should have control over all items in the domain, even though separate OUs Review: Domain Trees Administering Active Directory Hierarchical arrangement of domains When we break resources down into multiple domains All Domains in a tree share two-way trusts They share a namespace Meaning, their names are all relative to root domain E.g., Bayside.net After AD is installed on a server, management tools are automatically installed Look at the Administrative Tools menu to discover a number of new entries such as: Active Directory Users and Computers Active Directory Sites and Services Active Directory Domains and Trusts 1

2 Exploring Active Directory Users and Computers MMC snap-in that lets you manage users/groups/computers Default containers (OUs) in AD Figure 3-3: Creating a new object in Active Directory Table 3-2: Objects available in Active Directory Users and Computers Creating New User Accounts Creating New User Accounts Important to set standards: Establishing a naming convention Controlling password ownership Including additional required attributes UPN Figure 3-7: Creating new user object 2

3 Modifying User Account Attributes Creating Computer Accounts Computer account: for a computer in the domain If we are controlling USER accounts, why is it important to have accounts for COMPUTERS as well? Table 3-4: Properties of a user account object 2 ways to create: Created automatically when client joins the domain Remember when we joined? Can be preconfigured before the client installation Why? One reason is so that an ADMIN account is not required when the client is actually added Creating Group Objects KEY POINT: Groups vs. OUs? Group Container object used to organize a collection of users, computers, contacts, or other groups into a single security principal I.e., we can assign rights to groups, instead of users Main differences between an OU and a group (in Active Directory!): Groups are used for PERMISSIONS to resources Not used for policies OUs can be used to apply POLICIES to sets of objects Not used for permissions to resources OUs can be used to delegate authority You can let someone else manage part of the tree Group Types Group Memberships Windows 2003 allows the creation of two group types: Security group For permissions (as well as ) Distribution group list only Depending upon which type of group is created, groups can contain: Users Contacts Other groups Computers 3

4 In this class Creating a Group Object We will manage single-domain networks This makes sense, given what you may encounter in the real world Two basic rules, to conform to best practices: Group USERS together using GLOBAL groups Group RESOURCES together using DOMAIN LOCAL groups New idea: Can put resources into groups, to give permission to an entire set of resources at once! Figure 3-13: Creating a new group object Understanding the Built-in in Local Groups Table 3-6: Local groups and their rights Table 3-7: Standard permissions available in Windows 2000 Active Directory Figure 3-17: Viewing the Security tab of an Active Directory object Figure 3-18: Viewing the advanced permissions 4

5 Permission Inheritance Delegating Authority By default, all child objects inside a container object inherit the permissions from the parent object E.g., if I give a user permission to change the settings of a particular OU, then they can automatically change the settings of everything inside the OU Using inheritance properly can cut down on the amount of work you have to do! It is possible to give (some or all) administrator rights to any user/group you want You can limit these permissions to only a certain part of the tree Allows you to delegate authority for certain areas, to cut down on the administrator s work E.g., why not let the sales manager add and delete user accounts, ONLY in the sales OU? This default inheritance of permissions can be modified by blocking the inheritance at a container or object level Step 1: Design an OU structure that makes delegation possible Step 2: Delegate authority as you wish Delegating Authority Over Active Directory Objects Implementing Delegation Figure 3-20: Overriding inherited permissions To make the delegation quicker and easier, Windows provides the Delegation of Control Wizard This wizard: Guides you through the process of determining the permissions that you want to delegate Then configures the permissions for the object and child objects Implementing Delegation Figure 3-21: Delegating an administrative task in Active Directory 5