Unit 7 NT1330 Client-Server Networking II Date: 7/26/2016 ITT TECHNICAL INSTITUTE NT1330 Client-Server Networking II Date: 7/26/2016 Instructor: Williams Obinkyereh

Class Agenda 1 Learning Objectives Lesson Presentation, Discussions and video. Assignments and Lab Activities. Break Times. 10 Minutes break in every 1 Hour. Note: Submit all Assignment and labs due today.

Class Agenda 2 Theory : Unit 6:00pm-8:00pm) Lab : (8:15pm to 11:00pm) Text book: Windows Server 2008 Active Directory Configuration MOAC 70-640-Lesson 6

Security Planning and Administrative Delegation Lesson 6

Skills Matrix Technology Skill Objective Domain Objective # Creating an OU Structure Maintain Active Directory accounts 4.2

Naming Standard User logon names will follow a corporate naming standard. You will usually create a naming standards document to outline the rules for naming all Active Directory objects.

Create strong passwords: At least eight characters in length. Contains uppercase and lowercase letters, numbers, and non-alphabetic characters. At least one character from each of the previous character types. Differs significantly from other previously used passwords.

Strong Passwords A strong password should not be left blank or contain any of the following information: Your user name, real name, or company name. A complete dictionary word. You can use group policies to enforce strong passwords

Authentication is the process of proving who you are. There are multiple methods of authentication: What you know (password or PIN). Who you are (retinal scan or thumb print). What you have (smart card). Some of these methods can be used so that users no longer need to remember passwords.

Administrative Accounts You should not use an account possessing administrative privileges for daily tasks, such as browsing the Web or monitoring email. Administrative accounts should be reserved for tasks that require administrator privileges.

Run as Administrator and Runas Command The recommended solution for reducing the risks associated with the Administrator account is to use a standard user account and the Run as administrator option in the GUI or The runas command-line tool when it is necessary to perform an administrative task.

Using Run As from the GUI From the Start button, navigate to the application you wish to run. Press and hold the Shift key and right-click the desired application. Select the Run as administrator option. Again, emphasize that for administrators, you should have two accounts.

Organizational Units Can be created to represent your company’s functional or geographical model. Can be used to delegate administrative control over a container’s resources to lower-level or branch office administrators. Can be used to apply consistent configuration to client computers, users and member servers.

Creating an Organizational Unit To create an organizational unit, you would use the Active Directory Users and Computers console.

Delegation of Control Creating OUs to support a decentralized administration model gives you the ability to allow others to manage portions of your Active Directory structure, without affecting the rest of the structure. Delegating authority at a site level affects all domains and users within the site. Delegating authority at a domain level affects the entire domain. Delegating authority at the OU level affects only that OU and its hierarchy.

Delegation of Control Using the Delegation of Control Wizard, you utilize a simple interface to delegate permissions for domains, OUs, or containers.

Verifying and Removing AD Permissions Must Enable Advanced Features in Active Directory Users and Computers. Found in the View menu. Then right-click an OU or an account and select Properties. Select the Security tab. Demonstrate difference between Advanced View and non-Advanced View. Show that the security tab shows up and additional containers show up when in Advanced mode.

Verifying and Removing AD Permissions Review how permissions work. Permissions are cumulative when added together from users and groups. Also Deny always wins out.

Moving Objects within Active Directory Windows Server 2008 allows you to restructure your Active Directory database by moving leaf objects such as users, computers, and printers between OUs, in addition to moving OUs into other OUs to create a nested structure. When you move objects between OUs in a domain, permissions that are assigned directly to objects remain the same. Objects inherit permissions from the new OU.

Unit 6 Assignments and Labs Unit 7. Assignment 1. AD Password Policy Planning Unit 7. Lab 1. Employing Security Concepts Unit 7. Exercise 1. AD OU Planning Scenario