Making Identity and Access Management Real – The Early Days Brian Lauge Pedersen Senior Technology Specialist

The Infrastructure Optimization Model Customer Challenges Implementing Solutions What Will We Cover?

Understanding Identity Management Challenges Implementing Active Directory Implementing Password Security Implementing Security Templates Agenda

Overview – The Core IO Model CROSS-MODEL ENABLERS IdentityIdentity Presence Presence Rights ManagementRights Management Network AccessNetwork Access Desktop, Device, and Server Management Security and Networking Identity and Access Management Data Protection and Recovery IT Management and Security Process

Identity and Access Management No common identity management model Identity management for user identification Centralized configuration and authentication, information protection infrastructure Centralized administration, federated identity management No server- based identity or access management Users operate in admin mode Limited or inconsistent use of passwords at the desktop Minimal enterprise access standards Active Directory for authentication and authorization Users have access to admin mode Security templates applied to standard images Desktops not managed by policy Policy and security templates used to manage desktops for security and settings Directory and certificate-based information protection infrastructure Certificate provisioning and authorization for mobile devices Centrally manage users provisioning across heterogeneous systems Federated identity management across organizational and platform boundaries

Contoso Identity Management Today User name Password

Key Challenges No single sign-on Non-standard computers and servers Passwords managed non-securely IT strained due to company growth

Provide single sign-on to network resources Enforce password security Implement scalable centralized management Our Goals: Optimize IDAM

Active Directory The Solution – Active Directory Provide single sign-on Enforce password security Implement scalable centralized management Robust replication Application- friendly Enforces security Simplified administration Scalable infrastructure

Understanding Identity Management Challenges Implementing Active Directory Implementing Password Security Implementing Security Templates Agenda

OU design DNS design Domain design Forest design Active Directory Planning

Active Directory Domains Boundary of Authentication Boundary of Policies Boundary of Replication CONTOSO.COM

Domain Design Options Single domain structure Regional domains structure

Additional Domain Considerations Management of multiple service administrator groups Group Policy consistency Access control and auditing settings consistency Increased likelihood of objects moving between domains Solution: Single domain structure

Organizational Units – An Overview CONTOSO.COM OU Admin Organized For: Administration Same Requirements Delegation Group Policy Configuration Security Organized For: Administration Same Requirements Delegation Group Policy Configuration Security OU Security OU Policy

Organizational Unit Design Delegation of administration Scope Group Policy application Delegation of administration Scope Group Policy application Contoso.com Administrative Workstations Users Desktops Laptops SQL Servers Exchange Servers Print Servers Standard Users Power Users Data Entry Users Servers

Active Directory Deployment Deployed first forest root domain controller Deployed second domain controller Configured and verified DNS Configured global catalog settings Reviewed operations master roles

Demo Reviewing the Organizational Unit Structure Review the OU Structure demonstration

Understanding Identity Management Challenges Implementing Active Directory Implementing Password Security Implementing Security Templates Agenda

Insufficient expiration policy Multiple passwords to remember Passwords written down Calls to helpdesk for password resets Username: aaronc Password: aaronc Username: aaronc Password: aaronc Password Challenges Weak passwords and desktop security Username: aaronc Password: abc123 Username: aaronc Password: abc123 Username: aaronc Password: P$7k#yZ Username: aaronc Password: P$7k#yZ Username: acon Password: password Username: acon Password: password

Password Security Solutions Solution: Group Policy Password policy Credential mapping Password synchronization Password reset Password change

Password Security Solutions - Notes Solution: Group Policy Password policy Credential mapping Password synchronization Password reset Password change

Password Security Solutions - Notes Solution: Group Policy Password policy Credential mapping Password synchronization Password reset Password change

Demo Setting Group Policy Password Options Configure Default Domain Policy Verify Group Policy Application demonstration

Understanding Identity Management Challenges Implementing Active Directory Implementing Password Security Implementing Security Templates Agenda

Group Policy Security Templates Compatws.inf Secure*.inf Hisec*.inf

Demo Implementing Security Templates Create Security Template Create Desktops GPO and Apply Security Template demonstration

What Have We Accomplished? Desktop, Device, and Server Management Security and Networking Identity and Access Management Data Protection and Recovery IT Management and Security Process CROSS-MODEL ENABLERS IdentityIdentity Presence Presence Rights ManagementRights Management Network AccessNetwork Access

Deployed Active Directory Implemented password security Configured security templates Session Summary

Visit TechNet at: Visit the following site for additional information: For More Information

For the latest titles, visit: Microsoft Press Publications

Self-study learning tool free to anyone Determines skills gaps Provides learning plans Post your score—see how you stack up Visit: Readiness with Skills Assessment

Become a Microsoft Certified Professional What are MCP certifications? Validation in performing critical IT functions. Why Certify? WW recognition of skills gained via experience. More effective deployments with reduced costs What Certifications are there for IT Pros? MCP, MCSE, MCSA, MCDST, MCDBA.

For more information please visit Introducing: TechNet Plus Direct! All the benefits of TechNet Plus for 30% less, TechNet Plus Direct subscribers receive… Online Benefits Portal – New! Immediate download access: software and betas – New! 2 free Professional Support Incidents Managed Newsgroups and Online Concierge The TechNet Library containing the KB, security updates, service packs, resource kits, and more …TechNet Plus Direct is available exclusively online without media shipments Available Now!

Live Events and Online Webcast series Microsoft Professional Blogs Directory Chats, Newsgroups, Forums and Virtual Labs Local Locator for Professional User Groups Where Else Can I Get Help?