INF220x Security Practical Exercises

Transcription

1 INF220x Security Practical Exercises This course comes with a virtual lab environment where you can practice what you learn. In most cases, the userid is Adatum\Administrator and the password is Pa55w.rd, but read the instructions carefully. Remember in the lab environment you can copy information to the virtual machines by using the Actions > Paste Content window. Before you paste the content, be sure your cursor is where you want the copied data. And, be sure to check the hyphens (dashes) in PowerShell code. Those characters may not copy correctly. NOTE: These practical exercises are designed to provide you experience as a working System Administrator. The lab steps are not written to be prescriptive, because as part of your day to day tasks you will need to troubleshoot and test different configurations. No one set of steps will be applicable in all cases, you will need to adjust for your situation. These steps were tested when the course was released. You may find changes to the interface as well as changes in how procedures are implemented.

2 4 Just Enough Administration Configure JEA In this exercise, you will deploy JEA so that DNS technical support staff are only able to perform troubleshooting-related tasks when connected to specific servers, rather than having full administrative rights over any computer to which they connect. Prepare the environment 1. If not signed in already, sign on to LON-DC1 as Adatum\Administrator with the password Pa55w.rd. 2. In the Tools menu of the Server Manager console, click Active Directory Users and Computers. 3. In the Active Directory Users and Computers console, expand Adatum.com in the navigation pane, click the IT OU, right-click the IT OU, click New, and then click Group. 4. In the New Object Group dialog box, type DNSOps in the group name, and then click OK. 5. Right-click on the IT group Beth Burke user, and then click Add to a group. 6. In the Select Groups dialog box, type DNSOps, and then click OK. 7. On the Active Directory Domain Services dialog box, click OK. 8. Close Active Directory Users and Computers. Create a role-capability file 1. On LON-DC1, click the Start hint, and then click Windows PowerShell ISE. 2. Maximize the Windows PowerShell ISE window. 3. In the Windows PowerShell pane, type the following commands, pressing CD c:\program Files\WindowsPowerShell\Modules

3 Mkdir DNSOps CD DNSOps New-ModuleManifest.\DNSOps.psd1 Mkdir RoleCapabilities CD RoleCapabilities New-PSRoleCapabilityFile -Path.\DNSOps.psrc ISE DNSOps.psrc Configure a role capability file 1. Before making the changes to the role capability file take a few minutes to look through the different properties that can be configured. 2. In the DNSOps.psrc script pane of the Windows PowerShell ISE, make the following changes. VisibleCmdlets Name = Restart-Service ; Parameters Name= Name ; ValidateSet = DNS }} VisibleFunctions = Add-DNSServerResourceRecord, Clear- DNSServerCache, Get-DNSServerResourceRecord, Remove- DNSServerResourceRecord VisibleExternalCommands = C:\Windows\System32\ping.exe 3. Click Save. Create a session-configuration file In the Windows PowerShell pane of the Windows PowerShell ISE, type the following commands, pressing New-PSSessionConfigurationFile -Path.\DNSOps.pssc -Full Ise DNSOps.pssc Configure a session configuration file

4 1. Before making the changes to the session configuration file take a few minutes to look through the different properties that can be configured. 2. In the DNSOps.pssc script pane of the Windows PowerShell ISE, navigate to the line that is SessionType = Default and change it to SessionType = RestrictedRemoteServer 3. Navigate to the line that is #RunAsVirtualAccount = $true and remove the # so that the line is no longer commented out. 4. Uncomment and change the RoleDefinitions line. RoleDefinitions ADATUM\DNSOps RoleCapabilities = DNSOps };} 5. Click Save. Create the JEA endpoint 1. In the Windows PowerShell pane of the Windows PowerShell ISE, type the following commands, pressing Enter after each command. Register-PSSessionConfiguration -Name DNSOps -Path.\DNSOps.pssc Restart-Service WinRM Get-PSSessionConfiguration 2. Verify that DNSOps is listed as a Windows PowerShell endpoint. Test an administrator remote session 1. If not signed in already, sign on to LON-SVR1 as Adatum\Administrator with the password Pa55w.rd. 2. Click Start, and then click Windows PowerShell. 3. In the Windows PowerShell window, type the following commands, pressing Enter-PSSession -ComputerName LON-DC1

5 (get-command).count Ping lon-dc1 Exit-PSSession 4. Notice you have full capabilities. 5. Sign out of LON-SVR1. Test a JEA administrative remote session 1. Sign in to LON-SVR1 as Adatum\Beth with the password Pa55w.rd. 2. Click Start, and then click Windows PowerShell. 3. In the Windows PowerShell window, type the following commands, pressing Enter-PSSession -ComputerName LON-DC1 -ConfigurationName DNSOps (Get-Command).count Get-DNSServerResourceRecord -zonename Adatum.com Add-DNSServerResourceRecord -zonename Adatum.com -A -Name MEL- SVR1 -IPv4Address Get-DNSServerResourceRecord -zonename Adatum.com Restart-service DNS # The next two commands fail Restart-Service WinRM Ipconfig Ping lon-dc1 Notice you have only a limited number of commands. Also, you cannot restart the WinRM service or run the ipconfig command. As you have time continue exploring. Use Exit-PSsession to close the session.