Configuring and Troubleshooting Access Lesson 12

Skills Matrix Technology SkillObjective Domain SkillDomain # Accessing Local and Network Resources Configure and troubleshoot access to resources 2.6 Understanding and Configuring Remote Assistance Configure and troubleshoot remote access Remote Assistance 4.3 Configuring Remote Assistance Through Group Policy Remote Assistance4.3 Using Remote DesktopRemote Desktop4.3

Skills Matrix Technology SkillObjective Domain SkillDomain # Configuring Remote Desktop Through Group Policy Remote Desktop4.3 Understanding and Configuring Virtual Private Networks VPN connections4.3 Configuring VPN Connections VPN connections4.3 Troubleshooting Networking with Command-Line Tools Troubleshoot connectivity issues 4.4

Skills Matrix Technology SkillObjective Domain SkillDomain # Using Windows Network Diagnostics Use the Network Connections Diagnostics tool 4.4 Troubleshooting Networking Troubleshoot connectivity issues Configure and troubleshoot wireless networking Troubleshoot access to network resources Accessing Local and Network Resources Troubleshoot access to network resources 4.7

Skills Matrix Technology SkillObjective Domain SkillDomain # Understanding PermissionsFiles and folders4.7 Configuring NTFS Permissions Files and folders4.7 Configuring Network Sharing Printers Configure Network Discovery and Sharing 4.7

Remote Assistance – Enables a technology professional or other user to connect to your computer remotely. The connected user (herein called the assistant, also called an expert) can view your computer screen and chat using text messages. Understanding and Configuring Remote Assistance

Configuring Remote Assistance Settings Locally Understanding and Configuring Remote Assistance Click Start, right-click Computer, and then click Properties. Click Remote settings in the task list. Provide credentials, and then click OK. Click the Remote tab.

Configuring Remote Assistance Settings Locally (cont.) Understanding and Configuring Remote Assistance Remote Assistance Settings dialog box

Click Start. In the Start Search text box, key msra and then press Enter. The Windows Remote Assistance Wizard appears. Click Invite someone you trust to help you. The How do you want to invite someone to help you? page appears. Inviting Remote Assistance Understanding and Configuring Remote Assistance

Click one of the following:  Use to send an invitation  Save this invitation as a file  Click an existing invitation Inviting Remote Assistance (cont.) Understanding and Configuring Remote Assistance

On the Choose a password for connecting to your computer page, key a password in the Password text box and confirm it. Click Next. Your mail client appears with a pre-created message and subject. The invitation file is automatically attached. Inviting Remote Assistance (cont.) Understanding and Configuring Remote Assistance

Three conditions must be met in order to offer Remote Assistance.  You must be added to the list of helpers in the Offer Remote Assistance Group Policy setting.  Windows Firewall must except msra.exe and raserver.exe.  Windows Firewall must allow communication on DCOM port 135 (TCP). Offering Remote Assistance Understanding and Configuring Remote Assistance

This procedure assumes that you are a support professional offering to assist a user. Click Start. In the Start Search text box, key msra, and then press Enter. The Windows Remote Assistance Wizard appears. Click Offer to help someone. The Choose a way to connect to the other person’s computer page appears. Offering Remote Assistance (cont.) Understanding and Configuring Remote Assistance

Do one of the following:  Use the Enter an invitation file location text box.  Select an existing invitation.  Use the Type a computer name or IP address option. Offering Remote Assistance (cont.) Understanding and Configuring Remote Assistance

You access Remote Assistance Group Policy settings in the Windows Settings > Administrative Templates > System > Remote Assistance node in Group Policy objects. Configuring Remote Assistance Through Group Policy Understanding and Configuring Remote Assistance

Remote Desktop – Enables you to connect to a computer (computer A) from a remote computer (computer B) over a network. Remote Desktop can be an excellent tool for remote administration of servers. Remote Desktop Using Remote Desktop

Before you can connect to a computer using Remote Desktop, you must first:  Add the user account with which you want to connect to the target computer to the Remote Desktop Users group of the target computer.  Configure the firewall to allow Remote Desktop connections.  Ensure that the target computer allows Remote Desktop connections. Remote Desktop (cont.) Using Remote Desktop

In the Remote Desktop section, select one of the following:  Don’t allow connections to this computer  Allow connections from computers running any version of Remote Desktop (less secure)  Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure) Configuring Remote Desktop Settings Locally Using Remote Desktop

Network Level Authentication (NLA) – A reordering of the normal authentication process. Ordinarily, to authenticate to a server, you contact the server and then provide your credentials. In NLA, you provide your user name and password first. Only after that procedure is completed is the server contacted for authentication. Configuring Remote Desktop Settings Locally (cont.) Using Remote Desktop

Click Select Users. To enable a user or group to connect to this computer remotely, click Add. In the Enter the object names to select text box, key the user or group name, and then click Check Names. Configuring Remote Desktop Settings Locally (cont.) Using Remote Desktop

To search for a user, click Advanced. Add as many users and groups as you want, and then click OK. Configuring Remote Desktop Settings Locally (cont.) Using Remote Desktop

Configuring Remote Desktop Session Settings Locally Using Remote Desktop Settings on the General tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.) Using Remote Desktop Settings on the Display tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.) Using Remote Desktop Settings on the Local Resources tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.) Using Remote Desktop Settings on the Programs tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.) Using Remote Desktop Settings on the Experience tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.) Using Remote Desktop Settings on the Advanced tab of the Remote Desktop Connection dialog box

Open the Remote Desktop Connection dialog box. In the General tab in the Computer combo box, type the FQDN or the IP address of the computer to which you want to connect. Click Connect. Connecting to a Computer Using Remote Desktop Using Remote Desktop

In the User Name text box, key the user name of the user that you want to use to connect to the target computer in the form domain/user name. Click OK. Connecting to a Computer Using Remote Desktop (cont.) Using Remote Desktop

You can configure Terminal Services Group Policy settings in the Computer Configuration > Administrative Templates > Windows Components > Terminal Services folder and sub- folders of GPOs. Configuring Remote Desktop Through Group Policy Using Remote Desktop

Virtual private network (VPN) – Private network established within a public network, most frequently the Internet. In an enterprise, it is most often used by users logging in from remote locations, such as their homes, to the enterprise domain through the Internet. Virtual Private Networks Understanding and Configuring Virtual Private Networks

To emulate point-to-point links, VPNs encapsulate data in a package that contains a header with routing information and a payload of encrypted data. Virtual Private Networks (cont.) Understanding and Configuring Virtual Private Networks

From an implementation standpoint, there are three basic requirements for establishing a VPN.  User Authentication and Auditing  IP Address Assignment  Data Encryption Virtual Private Networks (cont.) Understanding and Configuring Virtual Private Networks

Enabling a User to Connect to a VPN Server Using ADUC Understanding and Configuring Virtual Private Networks Dial-in tab of an example user’s Properties dialog box

Connecting to a VPN Server Through RRAS Understanding and Configuring Virtual Private Networks From the Routing and Remote Access console, Expand ServerName. Right-click Remote Access Policies, and then click New Remote Access Policy. Click Next. The Policy Configuration Method page appears.

Connecting to a VPN Server Through RRAS (cont.) Understanding and Configuring Virtual Private Networks Ensure that Use the wizard to set up a typical policy for a common scenario is selected. In the Policy name text box, key a name for the policy. Click Next. The Access Method page appears.

Connecting to a VPN Server Through RRAS (cont.) Understanding and Configuring Virtual Private Networks Select one of the following options:  VPN  Dial-up  Wireless  Ethernet

Connecting to a VPN Server through RRAS (cont.) Understanding and Configuring Virtual Private Networks Select one of the following:  User – Select this option to accept users according to the settings for each user.  Group – Select this option to add a group to the list of groups to authenticate, and then click Add. You can add more than one group.

Connecting to a VPN Server Through RRAS (cont.) Understanding and Configuring Virtual Private Networks Select one of the following to choose which authentication scheme to use.  Extensible Authentication Protocol (EAP) – EAP is typically used for wireless network authentication, but is falling out of use in favor of WEP and WEP2.

Connecting to a VPN Server Through RRAS (cont.) Understanding and Configuring Virtual Private Networks Select one of the following to choose which authentication scheme to use (cont.).  Microsoft Encrypted Authentication version 2 (MS-CHAPv2) – This is the default.  Microsoft Encrypted Authentication (MS- CHAP) – This is used for backward-compatibility reasons.

Connecting to a VPN Server Through RRAS (cont.) Understanding and Configuring Virtual Private Networks Configure the following check boxes according to which encryption methods you want to support.  Basic encryption (IPSec 56-bit DES or MPEE 40- bit)  Strong encryption (IPSec 56-bit DES or MPPE 56- bit)  Strongest encryption (IPSec Triple DES or MPPE 128-bit)

Configuring a VPN Client Connection Using Remote Desktop In the Internet address text box, key the IP address of your VPN server (for example, ) or its fully qualified domain name (FQDN) (for example, vpn12.contoso.com).

Connecting to a Domain Using a VPN Connection Understanding and Configuring Virtual Private Networks Click Start, and then click Connect To. The Connect to a Network Wizard appears. Select the VPN connection in the list of network connections, and then click Connect. A Connect ConnectionName Connection dialog box may appear. Provide your credentials, and then click Connect.

Local and Network Resources Accessing Local and Network Resources Resources in an enterprise come in two varieties.  Local resources – Include anything on or connected to your computer that is not part of a network  Network resources – Include shared folders and files, printers, routers, gateways, DHCP servers, and many others

Understanding Permissions Accessing Local and Network Resources NTFS – File system used by Windows Vista and other, more recent versions of Windows to determine how data is stored on the hard-drives NTFS permissions – Part of NTFS that controls user access and control over files and folders

Understanding Permissions (cont.) Accessing Local and Network Resources Each file or folder in NTFS has separate permissions. The permissions are determined by access control entries (ACEs). There is an ACE for each user and each permission on each object. Files and folders can also have ACEs for groups as well as individual users.

Understanding Permissions (cont.) Accessing Local and Network Resources The permissions under Permissions for Garrett Vargas are examples of standard permissions.

Configuring Permissions for a Folder Accessing Local and Network Resources Security tab in the Properties dialog box of an example folder

Configuring Permissions for a Folder (cont.) Accessing Local and Network Resources Permissions dialog box for an example folder

Configuring NTFS Permissions for a Folder Accessing Local and Network Resources Permission Entry dialog box for an example folder

Configuring Permission Inheritance for a Folder or File Accessing Local and Network Resources In the Security tab of the FolderName Properties dialog box, click Advanced. The Advanced Security Settings for the FolderName dialog box appears. Click Edit. Another Advanced Security Settings for the FolderName dialog box appears. Select the Include inheritable permissions from this object's parent check box.

Configuring Permission Inheritance for a Folder or File (cont.) Accessing Local and Network Resources Configure the Replace all existing inheritable permissions on all descendants with inheritable permissions from this object check box. Select the user or group for which you want to configure permission inheritance, and then click Edit.

Configuring Permission Inheritance for a Folder or File (cont.) Accessing Local and Network Resources Select one of the following from the Apply to list-box.  This folder only  This folder, subfolder and files  This folder and subfolders  This folder and files

Configuring Permission Inheritance for a Folder or File (cont.) Accessing Local and Network Resources Select one of the following from the Apply to list-box (cont.).  Subfolder and files only  Subfolders only  Files only Configure the Apply these permissions to objects and/or containers within this container only check box.

Determining Effective Permissions Accessing Local and Network Resources Effective Permissions tab for an example folder

Determining Effective Permissions (cont.) Accessing Local and Network Resources Effective Permissions tab for an example folder with an example user selected

Enabling Network Discovery Accessing Local and Network Resources For other users to see shares on your computer, network discovery must be enabled. Click Start, and then click Control Panel. Click Network and Internet. Click Network and Sharing Center. Under Sharing and Discovery, expand the Network and Discovery section by clicking the down arrow on the right.

Enabling Network Discovery (cont.) Accessing Local and Network Resources Click Turn on network discovery, and then click Apply. A User Account Control dialog box appears Provide administrator credentials, and then click OK.

Enabling File Sharing Accessing Local and Network Resources Open the Network and Sharing Center. In the Network and Sharing Center under Sharing and Discovery, expand the File Sharing section. Click Turn on file sharing, and then click Apply. A User Account Control dialog box appears. Provide administrator credentials, and then click OK.

Enabling Public Folder Sharing Accessing Local and Network Resources Open the Network and Sharing Center.  Under Sharing and Discovery, expand the Public Folder Sharing section.

Enabling Public Folder Sharing (cont.) Accessing Local and Network Resources Select one of the following, and then click Apply.  Turn on sharing so anyone with network access can open files  Turn on sharing so anyone with network access can open, change, and create files  Turn off sharing

Creating a Network Share Using the File Sharing Wizard Accessing Local and Network Resources Right-click the folder that you want to share, and then click Share. In the drop-down text box, do one of the following:  To specify a particular user or group with which to share the folder, type the user name or group name and then click Add.  To share the folder with everyone, click the down arrow on the right, select Everyone, and then click Add.

Creating a Network Share Using the File Sharing Wizard (cont.) Accessing Local and Network Resources In the drop-down text box, do one of the following (cont.):  To browse for users or groups with which to share the folder, click the down arrow on the right and then select Find. Use the Select Users or Groups dialog box to select the user or group.

Creating a Network Share Using the File Sharing Wizard (cont.) Accessing Local and Network Resources Permission levels  Reader – The user or group is granted the following standard permissions: Read & execute, List folder contents, and Read.  Contributor – The user or group is granted the following standard permissions: Modify, Read & execute; List folder contents; Read; and Write.  Co-owner – Select this option if you want the user or group to have full control over the shared folder.

Printer Sharing Accessing Local and Network Resources Open the Network and Sharing Center. Under Sharing and Discovery, expand the Printer Sharing section. Click Turn on printer sharing, and then click Apply. A User Account Control dialog box appears. Provide administrator credentials, and then click OK.

Troubleshooting Networking Most network troubleshooting first involves determining where the network is failing. You should always check the simple stuff first, such as unplugged cables or out-of-range wireless connections.

Using Ping Troubleshooting Networking Example output from the Ping command

Using IPConfig to Display TCP/IP Settings Troubleshooting Networking Example output from the IPConfig command

Using IPConfig to Release and Renew a DHCP IP Address Troubleshooting Networking If you suspect a problem with an IP address, you can use IPConfig to release the old IP address and obtain a new IP address.  ipconfig /release  ipconfig /renew

Using IPConfig to Flush the DNS Resolver Cache Troubleshooting Networking You can use IPConfig to clear the DNS resolver cache so that you can be assured when troubleshooting that the DNS resolver cache is not the problem.  ipconfig /flushdns

Using Net View Troubleshooting Networking Example output from the Net View command

Using Net View (cont.) Troubleshooting Networking Example output from the Net View command

Using TraceRt Troubleshooting Networking Example output from the TraceRt command

Using PathPing Troubleshooting Networking Example output from the PathPing command

Using NSLookup Troubleshooting Networking Example output from the NSLookup command

Using Windows Network Diagnostics Troubleshooting Networking Windows Network Diagnostics (WND) – Part of the Windows Diagnostic Infrastructure (WDI). It can help users solve some wireless and other networking issues. By helping users to solve problems, WND can reduce calls to the help desk.

Using Windows Network Diagnostics (cont.) Troubleshooting Networking Some common problems that WND can help users to solve:  Receiving a weak wireless signal  Having a disabled wireless card  Not receiving an IP address assignment  Typing an incorrect security key  Using invalid certificates when logging on  Experiencing hardware or driver issues

Starting Windows Network Diagnostics Troubleshooting Networking You can manually start WND to help troubleshoot networking issues. Click Start, and then click Control Panel. Under Network and Internet, click View network status and tasks. In the tasks list, click Diagnose and Repair.

Summary Remote Assistance enables support technicians to help clients remotely by viewing and controlling users’ desktops. You learned how to configure Remote Assistance settings locally and through Group Policy. You learned how to invite and offer remote assistance. You Learned

Summary Remote Desktop enables you to connect to a computer from another computer over a network, such as a local area network or a virtual private network. You learned how to configure Remote Desktop settings locally and through Group Policy using Terminal Services policy settings. You learned how to connect to a computer using Remote Desktop. You Learned (cont.)

Summary Virtual Private Networks are private networks established on public networks, such as the Internet. You can grant users permission to connect to a VPN server either through the Active Directory Users and Computers console or by using the Routing and Remote Access console. You learned how to enable a user or group to connect to a VPN server. You Learned (cont.)

Summary You learned how to configure a VPN client connection. You learned how to troubleshoot access denied messages. NTFS permissions control user access and level of control over files and folders. NTFS permissions are implemented using special permissions and standard permissions. You Learned (cont.)

Summary You learned how to configure permissions for a file or folder. You learned how to configure permission inheritance for a folder or file. You learned how to determine effective permissions on a particular object for a particular user. You Learned (cont.)

Summary Network sharing controls access to local resources by network users. You learned how to enable network discovery. You learned how to enable file sharing, public folder sharing, and printer sharing. You learned how to create a network share using the File Sharing Wizard. You Learned (cont.)

Summary You learned how to troubleshoot networking using command-line tools and the Network Connections Diagnostic tool. You learned how to use Ping, IPConfig, Net View, TraceRT, PathPing, and NSlookup. You Learned (cont.)