Windows Server 2008 R2: What's New in Active Directory

Windows Server 2008 R2: What's New in Active Directory

Table of Contents Windows Server 2008 R2: What's New in Active Directory... 1 Exercise 1 Using the Active Directory Administration Center... 2 Exercise 2 Working with Active Directory using the Active Directory PowerShell Module... 5 Exercise 3 Recovering Deleted Objects using Active Directory Recycle Bin... 8 Exercise 4 Pre-Deploying Computer Accounts using Offline Domain Join... 11

Windows Server 2008 R2: What's New in Active Directory Objectives Scenario After completing this lab, you will be better able to: Use the Active Directory Administration Center to perform administrative tasks Locate and manage objects using the Active Directory PowerShell provider Recover deleted Active Directory objects using the Active Directory Recycle Bin Perform an offline domain join for a not yet deployed computer Woodgrove Bank is an investment bank located in Baltimore, USA. Woodgrove Bank has a main office and many regional and local branch offices. Many of the branch offices are small offices and do not have local IT support, and are connected to the main office by low-bandwidth WAN connections. In addition, many users at Woodgrove Bank travel between offices, as well as to customers offices and homes for meetings regarding client accounts. Woodgrove Bank is faced with the following global challenges: Management of many servers in many offices. The need to reduce the operational cost of each branch office. The need for roaming and remote users to access company resources. Management of a large and complex Active Directory infrastructure. Prerequisites Before working on this lab, you must have: The ability to work in a command line environment An understanding of Active Directory administration tasks An understanding of Windows PowerShell concepts and tasks Estimated Time to Complete This Lab Computers used in this Lab 60 Minutes BAL-DC-01 The password for the Administrator account on all computers in this lab is: Passw0rd! Page 1 of 12

Exercise 1 Using the Active Directory Administration Center Scenario In this exercise you will use the new Active Directory Administration Center to perform some common Active Directory management tasks. By performing these tasks, you will learn how basic administration and navigation of large Active Directory structures is made easier using the new tools. Complete the following task on: BAL-DC-01 1. Explore the Administrative Center Interface Note: In this task you will use the new Active Directory Administrative Center to perform some common administrative tasks. The purpose of this exercise is to become familiar with the navigation and use of the new interface. a. On the Start menu, point to Administrative Tools and then click Active Directory Administrative Center. b. In Active Directory Administrative Center, in the Reset Password tile, in User name, type Woodgrovebank\BobSmith and then press TAB. Note: The user name is checked and a warning is displayed that the username is invalid. c. In Active Directory Administrative Center, in the Reset Password tile, in User name, type Woodgrovebank\DonHall and then press TAB. Note: Notice that the user account was validated by the tool. d. In Password and in Confirm Password type Passw0rd!2 and then click Apply. Note: The reset password tile is one of many tiles that can be added to the Overview page. Each tile allows common tasks to be completed quickly and without navigation to the actual object. e. In the upper right of the Administrative Center Overview pane, click Add Content. Note: The Add Content menu allows you to add additional task-based tiles to the Overview page. You can add the tiles that allow you to complete your most common tasks. f. In the Active Directory pane, click the fly-out menu next to Woodgrovebank (local). The fly-out menu is shown below. g. Using the fly-out menu, navigate to America\Washington\King and double-click Redmond. Note: You can use the Find in this column text box to type the first few letters of the item you are looking for to speed navigation. h. Under Redmond, click Abigail Heiford and then in the pane, click Enable. Page 2 of 12

2. Creating and Modifying User and Group Accounts Note: In this task you will use the Active Directory Administrative Center to create and modify both user and group accounts. In Active Directory Administrative Center, ensure you are in the America\Washington\King\Redmond organizational unit. a. In the pane, click New and then click User. b. In the Create User dialog box, create a new user account with the properties defined in the following table and then click OK. Note: If a property is not listed in the table, you may omit it in the dialog box. Property First Name Last Name User UPN logon Password Options Password and Confirm Password Value Alice Ciccu AliceCiccu Select Other password options and then check Password never expires. Passw0rd! Note: Note the large number of user properties you can modify in the create user dialog box. c. In the pane, click New and then click Group. d. In the Create Group dialog box, create a new group account with the properties defined in the following table and then click OK. Note: If a property is not listed in the table, you may omit it in the dialog box. Property Name Protect from Accidental Deletion Managed By Members Value RedmondSupport Checked Anna Keyes Click Edit to modify the managed by value. Use the Advanced button to search for her. Alice Ciccu Click Add to modify group membership. e. In the Contents pane, click Alice Ciccu and then in the pane, under Alice Ciccu, click Properties. Note: You may need to refresh your view by pressing F5 if do you not see Alice Ciccu. f. In the Alice Ciccu dialog box, next to Organization, click the Collapse button. g. Next to Profile, click the Close button. Note: The properties dialog box allows you to customize the available administration panes. You can add closed sections by clicking the Add Sections menu and checking the sections you want to add back in. h. Under Extensions, on the Dial-in tab, click Allow access. Page 3 of 12

Note: Many properties are accessible through the new property panels; however any additional extensions are available via the extensions panel. This ensures that any third party add-ins for Active Directory Users and Computers still function without modification. i. Click OK to close the Alice Ciccu dialog box. j. Close the Active Directory Administrative Center. Page 4 of 12

Exercise 2 Working with Active Directory using the Active Directory PowerShell Module Scenario In this exercise you will use the Windows PowerShell Integrated Scripting Environment (ISE) to administer Active Directory. As a reference, the major components of the ISE are labeled below. Complete the following task on: BAL-DC-01 1. Using the Windows PowerShell Graphical Console to Work with User and Group Accounts Note: This exercise makes extensive use of Windows PowerShell. To assist you, you can use the up arrow key to recall previous commands and use tab completion to help quickly type commands. In this task you will use the PowerShell V2 Graphical Console to perform basic user and group administrative tasks. You will begin by loading the Active Directory module, exposing over 75 Active Directory Cmdlets. You will then use these Cmdlets to administer Active Directory. a. On the Start menu, navigate to All Programs\Accessories\Windows PowerShell and then click Windows PowerShell ISE. b. To load the Active Directory module and list the available Cmdlets, in the Command Pane, type the following commands, pressing ENTER after each command: Import-Module ActiveDirectory Get-Module Get-Command *ad* c. To browse your Active Directory domain using Windows PowerShell, in the Command Pane, type the following commands, pressing ENTER after each Page 5 of 12

2. Using the Windows PowerShell Graphical Console to Work with Domains and Domain Controllers command: Note: You can press the TAB key to auto complete many of these commands and save a great deal of typing. Cd AD: PWD DIR Format-Table -Auto CD "DC=Woodgrovebank,DC=com" DIR ft a Note: This series of commands shows you how you can navigate Active Directory like a file system and format output using standard Windows PowerShell commands. d. To list the content of the users container and then enable the Guest account, in the Command Pane, type the following commands, pressing ENTER after each command: Note: If you see a repeated command, such as the third command in this series, you can use the up arrow to retrieve the previous instance of the command instead of retyping it. CD CN=Users Dir ft a Get-ADObject Filter {name -like * } Get-ADUser Filter {name -like * } Get-ADUser -Filter {name -like "*"} Select Name, Enabled Format-Table -Auto Enable-ADAccount Identity Guest Get-ADUser -Filter {name -like "*"} Select Name, Enabled Format-Table -Auto e. To display information about the user Don Hall in the Managed Objects OU, in the Command Pane, type the following commands, pressing ENTER after each one. CD.. cd OU=Managed Objects' Get-ADuser -Filter {Name -eq "Don Hall"} Get-ADuser -Filter {Name -eq "Don Hall"} Properties * f. To query information on the Domain Administrators group, in the Command Pane, type the following command and then press ENTER: Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree - Filter {Name -Like "*Domain Admins*"} -Properties * g. To add Don Hall to the Domain Administrators group, in the Command Pane, type the following command and then press ENTER: Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree - Filter {Name -Like "*Domain Admins*"} Add-ADGroupMember -Member DonHall Note: In this task you will use Cmdlets that relate to the domain and to domain controllers to display information about items such as password policies and FSMO roles. a. To query information on the Woodgrovebank.com domain, in the Command Pane, type the following command and then press ENTER: Get-ADDomain Woodgrovebank.com Note: The output of this command allows you to easily determine things such as FSMO roles. b. To query information on the domain controllers in the Woodgrovebank.com domain, in the Command Pane, type the following command and then press ENTER: Get-ADDomainController Discover Page 6 of 12

c. To query information on the domain password policy in the Woodgrovebank.com domain, in the Command Pane, type the following command and then press ENTER: Get-ADDefaultDomainPasswordPolicy Woodgrovebank.com 3. Using Windows PowerShell Graphical Console to Create and Delete Organizational Units Note: In this task you will use Cmdlets that relate to organizational units to create and delete an organizational unit. You will also use a Set Cmdlet to set properties on an organizational unit. a. To create a new organizational unit and display its properties, in the Command Pane, type the following commands, pressing ENTER after each one: New-ADOrganizationalUnit Name Europe Path DC=Woodgrovebank,DC=com Get-ADOrganizationalUnit OU=Europe,DC=Woodgrovebank,DC=com Properties * b. To delete the new organizational unit, in the Command Pane, type the following commands, pressing ENTER after each one and clicking Yes to confirm deletion. Note: Note that the first command will result in an expected failure due to insufficient permissions, which the second command will resolve. Remove-ADOrganizationalUnit OU=Europe,DC=Woodgrovebank,DC=com Set-ADOrganizationalUnit OU=Europe,DC=Woodgrovebank,DC=com ProtectedFromAccidentalDeletion $False Remove-ADOrganizationalUnit OU=Europe,DC=Woodgrovebank,DC=com Note: The ProtectedFromAccidentalDeletion property is used to add or remove an access control list to the OU which explicitly denies the delete permission for all users. This property is true by default for all container objects. c. Close Windows PowerShell ISE. Page 7 of 12

Exercise 3 Recovering Deleted Objects using Active Directory Recycle Bin Scenario In this exercise you will explore the new Active Directory Recycle Bin feature. The Active Directory Recycle Bin stores all deleted objects in a special container which allows easy recovery at a later time, preserving all object properties. Complete the following task on: BAL-DC-01 1. Enable the Active Directory Recycle Bin Feature 2. Move Objects to the Recycle Bin Note: In this task you will enable the Active Directory Recycle Bin feature. Windows Server 2008 R2 does not automatically enable features as forest and domain functional levels are increased. Each feature must now be explicitly enabled. Features are enabled using the Enable-ADOptionalFeature PowerShell Cmdlet. a. On the Start menu, point to Administrative Tools and then click Active Directory Module for Windows PowerShell. b. To check the state of the Recycle Bin Feature, in Windows PowerShell, type the following command and then press ENTER: Get-ADOptionalFeature Filter {Name Like * } Note: The EnabledScopes property is currently empty, which indicates that this feature is not enabled. The RequiredForestMode property indicates the prerequisites for enabling this feature. c. To enable the Recycle Bin feature, in Windows PowerShell, type the following command and then press ENTER: Enable-ADOptionalFeature -Identity 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=woodgrovebank,DC=com' -Scope ForestOrConfigurationSet -Target 'woodgrovebank.com' Note: This command will enable the Recycle Bin feature, which is disabled by default. d. To confirm the command, type Y and press ENTER. Note: You must confirm this action, as once enabled, you cannot disable the Recycle Bin. e. To verify the Recycle Bin feature has been enabled, in Windows PowerShell, type the following command and then press ENTER: Get-ADOptionalFeature Filter {Name Like * } Note: You can review the value of EnabledScopes to ensure that the Recycle Bin is enabled. Note: In this task you will move objects to the Recycle Bin by deleting them. All deleted objects are automatically moved to the Recycle Bin once the feature is enabled. a. On the Start Menu, point to Administrative Tools and then click Active Directory Administrative Center. b. Navigate to the America\Washington\King\Redmond organizational unit. Page 8 of 12

3. Verify Objects are Now in the Recycle Bin 4. Recover Deleted Objects c. Delete the user account Alice Ciccu. d. Delete the group account RedmondSupport. Note: You can use the search feature at the top of the window to find the group. You will also need to uncheck Protect from accidental deletion from within the group properties. e. Delete the Redmond organizational unit. f. In the Confirm Subtree Deletion dialog box, check Use delete subtree server control and then click Yes. Note: In this task you will use Windows PowerShell to query the contents of the Active Directory Recycle Bin. Objects that have been deleted are moved to this location and have their distinguished name adjusted to reflect the fact that they are a deleted object, and also to avoid conflicts when multiple objects of the same common name are deleted. a. On the Start menu, point to Administrative Tools and then click Active Directory Module for Windows PowerShell. b. To display the contents of the Recycle Bin, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject SearchBase CN=Deleted Objects,DC=Woodgrovebank,DC=Com ldapfilter (objectclass=*) -includedeletedobjects Note: This command displays the entire contents of the Recycle Bin. Leave the output of this command on the screen as you will use it in the next task. c. To verify the Alice Ciccu user object is in the Recycle Bin, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject Filter {Name Like *Alice Ciccu* } SearchScope Subtree includedeletedobjects Format-List Note: The output of this command will show the details for the Alice Ciccu user object. Note the distinguished name indicates this object is in the AD Recycle Bin. d. In Windows PowerShell, type the following command and then press ENTER: Get-ADObject Filter {Name Like *Redmond* } SearchScope Subtree IncludeDeletedObjects Format-List Note: The output of this command will show the details for the RedmondSupport user group as well as the Redmond OU. Note the distinguished name indicates this object is in the AD Recycle Bin. Note: In this task you will use the Recover-ADObject PowerShell Cmdlet to recover objects that have been deleted from Active Directory. Ensure Active Directory Module for Windows PowerShell is open. a. In Windows PowerShell, copy the objectguid value for the object Alice Ciccu to the clipboard. Note: To copy text from a command prompt, right click and then select Mark. Highlight the text to copy and then press ENTER. To paste, right click and then click Paste. b. To attempt to restore the Alice Ciccu user account, in Windows PowerShell, type the following command and then press ENTER: Note: To complete the following command, copy the value of the objectguid property from the Alice Ciccu object. Restore-ADObject Identity <objectguid> Page 9 of 12

Note: The command fails with an error message indicating that the object s parent object does not exist. You can then query for the last known parent of the object and restore that object. c. To identify the last known parent of Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER: Note: To save typing, use the up arrow key to locate the previous search command and append the additional parameters to it. Get-ADObject Filter Name Like *Alice Ciccu* SearchScope Subtree includedeletedobjects properties lastknownparent Format-List Note: This command displays the last known parent object, which, you can tell, is also in the Recycle Bin. d. To restore the OU which contains Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER: Note: To complete the following command, copy the value of the objectguid property from the Redmond object which can be found from the output of the last command in Step 3 in the Verify Objects are Now in the Recycle Bin exercise. Restore-ADObject Identity <objectguid> e. To restore the Redmond OU Objects, including Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject ldapfilter (lastknownparent=ou=redmond,ou=king,ou=washington,ou=america,dc=woodgr ovebank,dc=com) includedeletedobjects Restore-ADObject Note: This command lists all objects that have the last known parent attribute as the Redmond OU and pipes them into the Restore-ADObject Cmdlet. 5. Verify that Deleted Objects have been Recovered Note: In this task you will review Active Directory to ensure that the deleted objects have been recovered. a. If not open, on the Start Menu, point to Administrative Tools and then click Active Directory Administrative Center. Note: Ensure you refresh your view in Active Directory Administrative Center after you make changes to ensure you see those changes. b. Navigate to the America\Washington\King OU. c. Verify that the Redmond OU is present. d. Navigate to the Redmond OU. e. Verify that the user accounts, including Alice Ciccu, are present. f. Verify the group RedmondSupport is present. Page 10 of 12

Exercise 4 Pre-Deploying Computer Accounts using Offline Domain Join Scenario In this exercise you will complete the tasks required to provision an account for offline domain join. Offline domain join involves two steps. In the first step you will provision a computer account in Active Directory and save the account information in a file. In the second step you will use that file in a command that inserts the domain join information into an offline version of Windows. Complete the following task on: BAL-DC-01 1. Provision a Computer Account for Offline Domain Join Note: In this task you will use the DJoin command to provision a computer account in Active Directory for offline domain join. The result of this task is a file that can be merged into an offline copy of Windows, ensuring that the first time the computer starts it is domain joined. a. On the Start menu, click Command Prompt. b. To provision a new computer account, in the Command Prompt, type the following command and then press ENTER: DJOIN /Provision /Domain Woodgrovebank.com /Machine BAL-SRV-10 /SaveFile BAL- SRV-10.DJoin Note: This command creates a computer account in Active Directory and stores the computer account password and related information in an encrypted file. The encrypted file can then be used to offline domain join a computer. c. To display the contents of the provisioning file, in the Command Prompt, type the following command and then press ENTER: Type BAL-SRV-10.DJoin Note: The contents of the.djoin file are encrypted. 2. Verify the Computer Account has been Created in Active Directory Note: In this task you will look at Active Directory to verify that the offline domain join has correctly created the computer account for BAL-SVR-10. a. On the Start menu, point to Administrative Tools and then click Active Directory Administrative Center. b. Navigate to Woodgrovebank (local)\computers. Note: Note that the computer account BAL-SRV-10 has been created. 3. Review the Process to Perform an Offline Domain Join Note: In this task you will type the command used to perform an offline domain join operation. This command will use the contents of the saved file created in the previous task to insert domain join information into the computer s registry without having to start the operating system. This command can be run on an offline copy of Windows such as a WIM file or VHD which has been mounted. Begin this task with a command prompt window open. a. To perform an offline domain join, use the following command: Page 11 of 12

Note: Do not execute this command. It is provided for reference purposes only. DJOIN /Requestodj /LoadFile BAL-SVR-10.DJoin /WindowsPath \Mount\Windows Note: This command is used to perform the offline domain join. This command is intended to be run against an offline copy of Windows such as a WIM file or VHD that has been mounted as a drive or folder in the file system. Page 12 of 12