70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts Objectives Understand the purpose of using group accounts to simplify administration Create group objects using both graphical and commandline tools Understand the difference between security groups and distribution groups Understand Group Scopes: Global, Domain Local and Universal Explain the purpose of the built-in groups created when Active Directory is installed Create and manage computer accounts 2 1
Introduction to Group Accounts A group is a container object Used to refer to collections of users, computers, contacts, other groups Used to simplify administration Differences between OU and groups: OUs are not security principals, groups are OUs can only contain objects from their parent domain, groups can contain members from within forest 3 Group Type:Used to define how the group can be used within an Active Directory Domain or Forest Security groups Defined by Security Identifier (SID) Can be assigned permissions for resources Can be assigned rights to perform different tasks Can also be used as e-mail entities Distribution groups Primarily used as e-mail entities Do not have associated SID 4 2
Group Scopes Scope refers to logical boundary within which a group can be assigned permissions to a specific resource in the domain or forest Both Security and Distribution Groups have scopes Three scopes Global Domain Local Universal 5 Group Scopes (continued) Objects possible within each scope are dependent on configured functional level of a domain Three domain functional levels: Windows 2000 mixed: default configuration, supports a combination of Windows NT Server 4.0, 2000 Server, and Server 2003 domain controllers Windows 2000 native: supports a combination of Windows 2000 Server and Server 2003 domain controllers Windows Server 2003: supports Windows Server 2003 domain controllers only 6 3
Global Groups Organize groups of users, computers, groups within the same domain Usually represents a geographic location or job function group Types of objects in group is related to configured functional level of the domain Windows 2000 Mixed Functional Level Can contain user accounts from the same domain Can be added to local groups or domain local groups in any domain Windows 2000 Native or Windows 2003 Functional Level Can contain user accounts or other global groups from the same domain Can be added to Universal groups Can be added to local groups or domain local groups in any domain 7 Domain Local Groups Created on domain controllers Can be assigned rights and permissions to any resource within the same domain Can contain groups from other domains Specific objects allowed in group are related to configured functional level of the domain Windows 2000 Mixed Functional Level Can contain user accounts from any domain Can contain global groups from any domain Windows 2000 Native or Windows 2003 Functional Level Can contain users accounts from any domain Can contain Global Groups from any domain Can contain universal groups Can contain other domain local groups from the same domain 8 4
Universal Groups Typically created to aggregate users or groups in different domains Stored on domain controllers configured as global catalog servers Can be assigned rights and permissions for any resource within a forest Can only be created at the Windows 2000 native or Windows Server 2003 domain functional level Can contain user accounts from any trusted domain Can contain global group accounts from any trusted domain Can contain other universal groups. 9 Groups Scope Summary 10 5
Creating Group Objects Group objects are stored in Active Directory database Variety of tools can be used can be used for creation and management Active Directory Users and Computers Command-line utilities DSADD, DSMOD, DSQUERY, etc. 11 Active Directory Users and Computers Primary tool To create group accounts Can also be used to configure properties of group accounts Groups can be created in any built-in containers, at root of the domain object, or in custom OU objects Possible group scopes determined by the functional level the domain is configured to 12 6
Converting Group Types May need to change a security group to a distribution group or vice versa Type of group can only be changed if domain functional level is Windows 2000 native or above 13 Converting Group Scopes Scope of a group can be changed Domain functional level must be at least Windows 2000 native Supported changes Global to universal Domain local to universal Universal to global Universal to domain local 14 7
Command Line Utilities An alternative to Active Directory Users and Computers Some administrators have a preference for commandline utilities Command-line utilities are more flexible for group management and creation in some situations 15 DSADD Introduced in Windows Server 2003 Used to create new user and group accounts Syntax is dsadd group distinguished-name switches Switches include: -secgrp, -scope, -memberof, -members More help is available for switches and options at Windows Server 2003 Help and Support Center or at command-line 16 8
DSMOD Also introduced in Windows Server 2003 Allows various object types to be modified from the command line Syntax is dsmod group distinguished-name switches Switches include: -desc, -rmmbr, -addmbr More help is available for switches and options at Windows Server 2003 Help and Support Center or command-line 17 DSQUERY Also introduced in Windows Server 2003 Used to query various object types from the command line, returns values Syntax for groups is dsquery group query More help is available for switches and options at Windows Server 2003 Help and Support Center or command-line 18 9
DSMOVE Used to move or rename various object types from the command line Syntax for groups is dsmove distinguished-name switches Switches include: -newparent, -newname Can only be used for objects within a single domain More help is available for switches and options at Windows Server 2003 Help and Support Center or at the command-line 19 DSRM Used to delete various object types from the command line Syntax for groups is dsrm distinguished-name switches Switches include: -noprompt More help is available for switches and options at Windows Server 2003 Help and Support Center or command-line 20 10
Security Group Strategies (Best Practice) Windows 2000 Mixed Domain Functional Level Users should be members of Global Security Groups Global Security groups should be members of Domain Local Security Groups Permissions to resources should be assigned to Domain Local Security Groups. Windows 2000 Native and Windows 2003 Domain Functional Level Users should be members of Global Security Groups Global Security groups should be members of Universal Security Groups Universal Security Groups should be Members of Domain Local Security Groups Permissions to resources should be assigned to Domain Local Security Groups. 21 Managing Security Groups Strategy for managing security groups uses acronym A G U DL P: 1. Create user Accounts (A) and organize them within Global groups (G) 2. Optional: Create Universal groups (U) and place global groups from any domain in universal groups 3. Create Domain Local groups (DL) and add global and universal groups 4. Assign Permissions (P) to the domain local groups 22 11
Determining Group Membership Important task for administrators is to ensure that users are members of correct groups One method is via Member Of tab in the properties of a user account Only shows first level of groups (not groups of groups) Second method is to use DSGET Returns values to a query 23 Determining Group Membership (continued) Syntax is dsget group distinguished-name switches Switches include: -members, -memberof Can also be used as dsget user to get membership information about a specific user Output can be saved to a file: dsget group distinguished-name switches >> filename 24 12
Built-In Groups When Windows Server 2003 Active Directory is installed Built-in groups are created automatically Rights are pre-assigned Stored in Builtin container and Users container Use built-in groups where possible Eases implementation of security rights 25 The Builtin Container Contains a number of domain local group accounts Allocated different user rights based on common administrative or network-related tasks 26 13
The Builtin Container (continued) 27 The Builtin Container (continued) 28 14
The Users Container Contains a number of domain local and global group accounts Some groups only found in the root domain of an Active Directory forest rather than in individual domains 29 The Users Container (continued) 30 15
Creating and Managing Computer Accounts Computer accounts needed on Windows NT 4.0, 2000, XP, Server 2003 Can be created during installation or added manually later Creation and management tools Active Directory Users and Computers System applet in Control Panel Command-line utilities 31 Resetting Computer Accounts Secure channel Used by computers that are domain members to communicate with domain controller Uses password that is changed every 30 days Automatically synchronized between domain controller and workstation Occasional synchronization issues arise Administrator must reset computer account Using Active Directory Users and Computers or Netdom.exe command from Windows Support Tools (netdom is only available after installing the support pack from the OS CD \support\tools\suptools.msi) 32 16
Summary Group accounts reduce administrative effort by enabling assignment of common rights and permissions to multiple users simultaneously Two group security types: Security groups Distribution groups Three types of scoping possible for groups Global groups Domain local groups Universal groups 33 Summary (continued) Group and computer accounts can be created and managed From Active Directory Users and Computers From command-line utilities Builtin and User groups and containers are automatically created at installation with specific pre-assigned rights and permissions Windows NT 4.0, 2000, XP, and Server 2003 require computer accounts in Active Directory 34 17