Windows Server 2008 Administration

Contents Defining Administrative Model Configuring Sites Examining Server 2008 R2 Active Directory Groups Creating Groups Managing Users with Local Security &Group Policies Managing Printers with Print Management Console

Administrative Model

Models Centralized Distributed mix all critical servers are housed in 1 or a few locations Distributed opposite of centralized model in that tasks can be divided among IT & non-IT staff members in various locations. mix mix of administrative responsibilities using both centralized and distributed admin

Creating a Site

Creating Site Subnets

Adding Domain Controllers to Sites

Establishing Site Links

Delegating Control at Site Level

Group Types Distribution Groups allow for grouping of contacts, users, or groups primarily for emailing purposes cannot be used for granting or denying access to domain-based resources Discretionary access control lists (DACLs), which are used to grant or deny access to resources or define user rights, are made up of access control entries (ACEs)

Security Groups security enabled used for assigning user rights and resource permissions or for applying computer and Active Directory-based group policies. can be defined for different levels of responsibility

Group Scopes in Active Directory Domain Local Groups to assign permissions to perform domain-based administrative tasks and to access resources hosted on domain controllers Global Groups more functional than domain local groups. Universal Groups can contain users, groups, contacts, or computers from any domain in forest

Creating Groups

Populating Groups

Group Management

Viewing Policies with Group Policy Management Console

Creating New Group Policies

enable or disable entire GPO

Block Policy Inheritance

Enforce Option

Group Policy Modeling Tool

Managing Printers with Print Management Console

Install Print Management Console

Configuring Print Management Console

Printers as Network Shared Resources

Adding Print Servers to the Print Management Console

create a custom printers view

Group Policies and Policy Management Overview Group Policy Processing - How Does It Work? Local Group Policies Security Templates Elements of Group Policy Group Policy Administrative Templates Explained Policy Management Tools Designing a Group Policy Infrastructure GPO Administrative Task

Overview mechanism used to centrally secure, configure, and deploy a common set of PC and user configurations, security settings organizations to enforce configurations, simplify desktop administration, secure access to network resources

example end-user password policy requires must exceed seven characters must be changed every 30 days  group policies can be configured to apply

How Does It Work? each policy contain specific settings to define how and when a policy will be processed In GPO

Managing Group Policy Processing with GPO Settings Within the Policies\Administrative Templates\System\GroupPolicy section of both Computer Configuration and User Configuration nodes of a GPO

Local Group Policies local group policies exist on all Windows systems Active Directory group policies only on Active Directory forest

Local Group Policies config computer and user environment.

Security Templates Includes settings for computer audit policies account management user rights assignments.

Elements of Group Policy Group Policy Objects predefined set of available settings that can be applied to Active Directory computer and/or user objects. GPO Storage and Replication GPOs are stored in both file system and Active Directory database. Each domain GPO has a corresponding folder located within sysvol\companyabc.com\Policies

Group Policy Object Replication replicated by domain controllers User Subfolder files and folders used to store the settings, Machine Subfolder files and folders used to store the settings, software, scripts, and any other policy settings specific to machine or computer object policies configured within a particular GPO ADM Subfolder created on new GPOs when legacy administrative template files are imported into a GPO. registry.pol Files settings are segmented into several sections gpt.ini File root of GPO folder Contains revision number of the GPO.

Group Policy Administrative Templates include clearly defined settings that can be set to a number of different values a new GPO is created, a base set of administrative templates are imported or referenced within that policy.

Starter GPOs contain settings available from administrative templates. security templates be used to import and export configured settings within security section of a policy used to prepopulate configured settings in Administrative Templates sections

Policy Settings configurable options made available within a particular GPO one of three values: not configured, enabled, or disabled.

Preference Settings Group Policies have two main setting nodes, configure many default or initial configuration and environmental settings for users and computers. Start menu on Windows 7

Group Policy Object Links key to deploying GPOs to a predetermined set of Active Directory computers and/or users. GPOs can be linked to Active Directory sites, domains, and organizational units (OUs).

Group Policy Link Enforcement

Group Policy Inheritance allows admin to set a common base policy across AD infrastructure while allowing other admin to apply more granular policies at a lower level that apply to subsets of users or computer

GPO Filtering only desired computers or users actually apply policy GPO security filtering where administrators can define which users, computers, or members of security groups will actually apply the group policy. GPO WMI filtering WMI filter is a query that is processed by computer objects only and be used to include or exclude particular computer objects from applying a GPO GPO status enables administrators to change the GPO

Group Policy Administrative Templates Explained

Policy Management Tools Group Policy Management Console (GPMC) Group Policy Object Editor (GPOE) gpupdate.exe

Group Policy Management Console (GPMC)

Group Policy Object Editor (GPOE)

Print Management Console

Gpupdate

GPO Administrative Tasks Installing Group Policy Management Tools Creating a GPO Central Store Verifying Usage of GPO Central Store Creating and Utilizing Starter GPOs Backing Up and Restoring Starter GPOs Creating New Domain Group Policies Managing GPO Status Creating and Linking WMI Filters to GPOs Managing GPO Security Filtering

Installing Group Policy Management Tools

Creating a GPO Central Store

Verifying Usage of GPO Central Store

Creating & Utilizing Starter GPOs

Backing Up & Restoring Starter GPOs

Saving a Starter GPO as a Cabinet File

Restoring a Starter GPO from Backup

Creating New Domain Group Policies

Creating & Configuring GPO Links

Managing GPO Status

Creating & Linking WMI Filters to GPOs

Managing GPO Security Filtering

Viewing GPO Settings & Creating Reports