C UNIT 4. Active Directory User Accounts

Transcription

1 UN 4 Active irectory User Accounts

2 efinitions User individual granted access to the system with the following User properties Groups associated with the user Profile path Login script Home directory Groups logical collection of users Accounts Logical construct containing all information that defines a user to the 2008 environment

3 efinitions esources All equipment attached to the workstation or network Home irectories dedicated locations on a file server for a specific user to store files Policy a set of configurations that allows an administrator to restrict a user s access and rights ih Profile file containing a user s environmental settings and preferences

4 Local User Accounts Used to access the local computer only and are stored in the local Security Account Manager (SAM) database on the local computer Never replicated to other computers N have domain access

5 User omain Accounts Accounts used to access Active irectory or network based resources, such as shared folders or printers Account information i for these users is stored in the Active irectory database and replicated to all domain controllers within the same domain A subset of the domain user account information is replicated to the global catalog, which is then replicated to other global catalog servers throughout the forest

6 User/Group Name ules he name must be unique to the machine for local l accounts (or unique to the domain in the case of domain accounts) he username cannot be the same as a group name he name may be up to 20 characters, upper or lowercase or a combination of both

7 User/Group Name ules o avoid confusion with special syntax characters, names may not include any of the following: " / \[]:; =, + *? < > he name may include spaces and periods, but may not consist entirely of spaces or periods N: Names including spaces have to be enclosed in quotes forbothscriptingor command line use. Better to avoid using spaces

8 Accounts User and group accounts are managed using the Active irectory Users and omputers snap in omputer Management snap ins Account operations opy elete isable ename

9 User Account ptions User Must hange Password at Next Logon Forces a user to change their password the next time they log on and afterward the box will be unchecked. User annot hange Password f checked, prevents the user from changing the account s password.

10 User Account ptions Password Never xpires f checked, the user account ignores the password expiration policy, and thepassword for the account never expires Account s isabled f checked, the account is disabled and no one can log on to it until it is enabled (it is not, however, removed from the database)

11 Built in User Accounts Automatically created during the install Built in in user accounts can be local accounts or domain accounts, depending on whether the server is configured as a standalone server or a domain controller When you install a domain controller, the ability to create and manipulate local accounts is disabled By default, two built in user accounts are created on a Windows Server 2008 computer Administrator account Guest account

12 AMNSA Full control of computer, domain or forest depending on thecontext Used to establish administrative structure and createotheraccounts accounts Should be renamed Should be secured with iha complex password an be disabled, d but cannot be dl deletedd Should not be used for every day user tasks

13 GUS AUN esigned to allow temporary access to the network isabled by default, but cannot be deleted Should be secured with a complex password if enabled

14 AUHNAN

15 Group Accounts Groups are implemented to allow administrators to assign rights and permissions tomultiple users simultaneously A group can be defined as a collection of user or computer accounts that is used to simplify the assignment of rights or permissions to network resources

16 Group Accounts When a user logs on, an access token is created that identifies the user and all of the user s s group memberships his access token is used to verify a user s permissions i when the user attempts t to access a local l or network resource By using groups, multiple users can be given the same permission level for resources on the network Since a user s access token is only generated when they first log on to the network from their workstation, if you add a user to a group, they will need to log off and log back on again for that change to take effect

17 istribution groups Group ypes Non security related groups created for the distribution of information ypically used with applications to provide a list of users (Microsoft xchange) annot be used to assign access permissions Applications must be able to work with Active directory Security groups reated for purposes of granting resource access permissions to multiple users Primarily used to grant access to resources an also be used like a distribution group for e mail, if the group has an e mail address assigned Groups can be converted from security to distribution and back again as long a functional level is set to windows 2003 native or higher

18 Group Nesting Users can be members of more than one group. Groups can contain other Active irectory objects, such as computers, and other groups. Groups containing groups is called group nesting.

19 LAL GUPS nly on non Active irectory databases SAM database omain members local security databases ypically used in peer to peer (workgroup) networks Used to grant system rights and access to resources available on the local computer

20 MAN LAL GUPS alid members user accounts, computer accounts, global groups, universal groups fromany domain, and domain local groups from the same domain. Used to assign permissions to resources in the local domain. nce you assign permissions i to this group, you can use it to grant those permissions to other groups or users.

21 GLBAL GUPS alid members User accounts, computer accounts, and other global lgroups Used primarily to organize users Users are typically assigned to global groups based on job role, task, or title ou can use them to organize users who have similar il functions and therefore similar requirements on the network.

22 UNSAL GUPS alid members user accounts, computer accounts, global lor universal groups Used to organize users or groups of users in global groups Larger organizations typically y use universal groups to group accounts from different domains hanges to universal group membership lists are replicated to all global catalog servers throughout the forest

23 FAUL GUPS Built in security groups Pre defined permissions Administrators, Backup perators, Guests, Power Users, emote esktop, Network onfiguration and Users Placed in Built in and Users containers by default Groups are sometimes added when services are installed such as: HP Admins and HP Users NSAdmins and NS UpdateProxy

24 SPAL N GUPS Anonymous Logon no used id or password required veryone means everyone Authenticated Users logon with valid user id and password nteractive currently logged on the local computer Network all currently connected network users

25 Group Scope

26 AGULP Microsoft approach tousing groups: add Accounts to Global groups. add those global groups to Universal groups. Add universal groups to omain Local groups. Finally, assign Permissions to the domain local groups.

27 efault Groups Account perators an create, modify and deleteaccounts forusers, groups, and computers in all containers and Us annot modify administrators, i domain admins and enterprise admin groups Administrators i t omplete and unrestricted access to the computer or domain controller Backup perators an bypass security and back up and restore all files on the computer

28 efault Groups Guests Same privileges as members of the Users group isabled by default Print perators an manage printers and document queues Server perators an log on a server interactively, create and delete shares, start and stop some services, back up and restore files, format the disk, shutdown the computer and modify the system date and time

29 efault Groups Users Allows general access to run applications, i use printers, shut down and start the computer and use network shares for which h they are assigned permissions i NSAdmins Permits administrative access to the NS server service omain Admins an perform administrative tasks on any computer anywhere in the domain

30 efault Groups omain omputers ontains all computers and is used tomake computer management easier through group policies omain ontrollers ontains all computers installed in the domain as a domain controller omain Guests Members include all domain guests omain Users Members include all domain users Used to assign permissions to all users in the domain.

31 efault Groups nterprise Admins Allows the global administrative privileges associated with this group, such as the ability to create and delete domains Schema Admins Members can manage and modify the Active irectory schema controlled access to resources throughout h the forest or domain. Authenticated Users allow controlled access to resources throughout the forest or domain veryone allow access to resources to al users and guests

32 reating and Managing Groups reating and managing groups is usually done with Active Ati irectory Users and omputers Batch files omma Separated alue irectory xchange (S) LAP ata nterchange Format irectory xchange (LF) Windows Script Host (WSH)

33 USNG S omma separated values. Header record must be defined using a distinguished name and schema attributes. ntries in the remainder of the file must follow the order of the header record. nce the file is created, use csvde ii ff file.txt to import the users. annot createusers with passwords. annot modify existing user accounts.

34 USNG LF Line separated values. bject entries are separated by a hyphen. nce the file is created, use ldifde i i f f file.txt to import the users. annot create users with ihpasswords. an modify passwords once users are created. an be used to import, export, and modify Active irectory objects.

35 USNG WSH Allows you towritescripts tocreateusers and other Active irectory objects. Scripts can be BScript or Jscript. Allows for highly customized solutions that automate the creation of user accounts.

36 Special dentity Groups and Local Groups Authenticated Users Used to allow controlled access to resources throughout the forest or domain. veryone Used to provide access to resource for all users and guest. Not recommended to not assign this group to resources.

37 Group mplementation Plan A plan that states who has the ability and responsibility to create, delete, and manage groups. A policy that states how domain local, global, and universal groups are to be used. A policy that states guidelines for creating new groups and deleting old groups. A naming standards document to keep group names consistent. A standard for group nesting.

38 Summary hree types of user accounts exist in Windows Server 2008: Local user accounts reside on a local computer and are not replicated to other computers by Active irectory. omain user accounts are created and stored in Active irectory and replicated to all domain controllers within a domain. Built in user accounts are automatically created when the operating system is installed and when a member server is promoted to a domain controller.

39 Summary he Administrator account is a built in in domain account that serves as the primary supervisory account in Windows Server t can be renamed, but it cannot be deleted. he Guest account is a built in account used to assign temporary access to resources. t can be renamed, but it cannot be deleted. his account is disabled by default and the password can be left blank.

40 Summary Windows Server 2008 group options include two types (security and distribution) and three scopes (domain local, global, and universal). omain local groups are placed on the AL of resources and assigned permissions. hey typically contain global groups in their membership list.

41 Summary Global groups are used to organize domain users according to their resource access needs. Global groups are placed in the membership list of domain local groups, which arethen assigned the desired permissions to resources.

42 Summary Universal groups are used to provide access to resources anywhere in the forest. heir membership lists can contain global groups and users from any domain. hanges to universal group membership lists are replicated to all global catalog servers throughout the forest.

43 Summary herecommended permission assignment strategy (AGULP) places users needing access permissions in a global group, the global group in a universal group, and the universal group in a domain local group and then assigns permissions to the domain local group.

44 Summary Group nesting is the process of placing group accounts in the membership of othergroup accounts forthepurpose of simplifying permission assignments. Multiple users and groups can be created in Active irectory by using several methods. Windows Server 2008 offers the ability to use batch files, S, LF, and WSH to accomplish your administrative goals.

45 Lab 4 n this lab you will: 1. reate Administrative Accounts 2. est Group Memberships Abilities 3. reateglobal and Universal Groups 4. Use dsadd.exe 5. Answer the Lab Questions