Presentation is loading. Please wait.

Presentation is loading. Please wait.

Implementing and Managing Group and Computer Accounts

Published byDaniel Gunnarsson Modified over 5 years ago

Similar presentations

Presentation on theme: "Implementing and Managing Group and Computer Accounts"— Presentation transcript:

1 Implementing and Managing Group and Computer Accounts

2 Objectives Understand the purpose of using group accounts to simplify administration Create group objects using both graphical and command-line tools Manage security groups and distribution groups Explain the purpose of the built-in groups created when Active Directory is installed Create and manage computer accounts

3 Introduction to Group Accounts
A group is a container object Used to organize collections of users, computers, contacts, other groups Used to simplify administration Similar to Organizational Units except OUs are not security principals, groups are OUs can only contain objects from their parent domain, groups can contain objects from within forest

4 Group Types Security groups Distribution groups
Defined by Security Identifier (SID) Can be assigned permissions for resources In discretionary access control lists (DACLs) Can be assigned rights to perform different tasks Can also be used as entities Distribution groups Primarily used as entities Do not have associated SID

5 Group Scopes Scope refers to logical boundary of permissions to specific resources Both Security and Distribution Groups have scopes Three scopes Objects possible within each scope dependent on configured functional level of a domain Scope types are global, domain local, and universal

6 Group Scopes (continued)
Domain functional levels: Windows 2000 mixed: default configuration, supports a combination of Windows 2000, 2003 and 2008 domain controllers Windows 2000 native: supports Server 2003 and 2008 domain controllers Windows Server 2008: supports Windows Server 2008 domain only

7 Global Groups Organize groups of users, computers, groups within the same domain Usually represents a geographic location or job function group Types of objects in group related to configured functional level of the domain Depends on the types of domain controllers in environment

8 Domain Local Groups Created on domain controllers
Can be assigned rights and permissions to any resource within the same domain Can contain groups from other domains Specific objects allowed in group related to configured functional level of the domain

9 Universal Groups Typically created to aggregate users or groups in different domains Stored on domain controllers configured as global catalog servers Can be assigned rights and permissions for any resource within a forest Can only be created at the Windows 2000 native, Windows Server 2003, 2008 domain functional level

10 Universal Groups (continued)

11 Creating Group Objects
Group objects are stored in Active Directory database Variety of tools can be used can be used for creation and management Active Directory Users and Computers Command-line utilities DSADD, DSMOD, DSQUERY, etc.

12 Active Directory Users and Computers
Primary tool To create group accounts Can also be used to configure properties of group accounts Groups can be created in any built-in containers, at root of the domain object, or in custom OU objects Possible group scopes determined by the functional level the domain is configured to

13 Active Directory Users and Computers (continued)

14

15

16

17 Converting Group Types
May need to change a security group to a distribution group or vice versa Type of group can only be changed if domain functional level is Windows 2000 native or above

18 Converting Group Scopes
Scope of a group can be changed Domain functional level must be at least Windows 2000 native Supported changes Global to universal Domain local to universal Universal to global Universal to domain local

19 Command Line Utilities
An alternative to Active Directory Users and Computers Some administrators have a preference for command-line utilities Command-line utilities are more flexible for group management and creation in some situations

20 DSADD Used to create new user and group accounts Syntax is
dsadd group distinguished-name switches Switches include: -secgrp, -scope, -memberof, -members More help is available for switches and options at Windows Help and Support Center or at command-line

21 DSADD (continued)

22 DSMOD Allows various object types to be modified from the command line
Syntax is dsmod group distinguished-name switches Switches include: -desc, -rmmbr, -addmbr More help is available for switches and options at Windows Help and Support Center or command-line

23 DSMOD (continued)

24 DSQUERY Used to query various object types from the command line, returns values Syntax for groups is dsquery group query Supports wildcard character (*) Output can be piped as input to other command-line tools More help is available for switches and options at Windows Help and Support Center or command-line

25 DSMOVE Used to move or rename various object types from the command line Syntax for groups is dsmove group distinguished-name switches Switches include: -newparent, -newname Can only be used for groups within a single domain More help is available for switches and options at Windows Help and Support Center or at the command-line

26 DSRM Used to delete various object types from the command line
Syntax for groups is dsrm group distinguished-name switches Switches include: -noprompt More help is available for switches and options at Windows Help and Support Center or command-line

27 Managing Security Groups
Strategy for managing security groups uses acronym A G U DL P: Create user Accounts (A) and organize them within Global groups (G) Optional: Create Universal groups (U) and place global groups from any domain in universal groups Create Domain Local groups (DL) and add global and universal groups Assign Permissions (P) to the domain local groups

28 Determining Group Membership
Important task for administrators is to ensure that users are members of correct groups One method is via Member Of tab in the properties of a user account Only shows first level of groups (not groups of groups) Second method is to use DSGET Returns values to a query

29 Determining Group Membership (continued)
Syntax is dsget group distinguished-name switches Switches include: -members, -memberof Can also be used as dsget user to get membership information about a specific user Output can be saved to a file: dsget group distinguished-name switches >> filename

30 Built-In Groups When Windows Server Active Directory is installed
Built-in groups are created automatically Rights are pre-assigned Stored in Builtin container and Users container Use built-in groups where possible Eases implementation of security rights

31 The Builtin Container Contains a number of domain local group accounts
Allocated different user rights based on common administrative or network-related tasks

32 The Builtin Container (continued)

33 The Users Container Contains a number of domain local and global group accounts Some groups only found in the root domain of an Active Directory forest rather than in individual domains

34 The Users Container (continued)

35 Creating and Managing Computer Accounts
Computer accounts needed on Windows 2000, Server 2003, and 2008 Can be created during installation or added manually later Creation and management tools Active Directory Users and Computers System applet in Control Panel Command-line utilities

36 Resetting Computer Accounts
Secure channel Used by computers that are domain members to communicate with domain controller Uses password that is changed every 30 days Automatically synchronized between domain controller and workstation Occasional synchronization issues arise Administrator must reset computer account Using Active Directory Users and Computers or Netdom.exe command from Windows Support Tools

37 Summary Group accounts reduce administrative effort by enabling assignment of common rights and permissions to multiple users simultaneously Two group security types: Security groups Distribution groups Three types of scoping possible for groups Global groups Domain local groups Universal groups

38 Summary (continued) Group and computer accounts can be created and managed From Active Directory Users and Computers From command-line utilities Builtin and User groups and containers are automatically created at installation with specific pre-assigned rights and permissions Windows Server 2000, 2003 and 2008 require computer accounts in Active Directory

Download ppt "Implementing and Managing Group and Computer Accounts"

Similar presentations

Managing User, Computer and Group Accounts

Managing User, Computer and Group Accounts
MOAC : Installing and Configuring Windows Server 2012

MOAC : Installing and Configuring Windows Server 2012
Module 4: Implementing User, Group, and Computer Accounts

Module 4: Implementing User, Group, and Computer Accounts
Chapter 9 Chapter 9: Managing Groups, Folders, Files, and Object Security.

Chapter 9 Chapter 9: Managing Groups, Folders, Files, and Object Security.
11 WORKING WITH GROUPS Chapter 7. Chapter 7: WORKING WITH GROUPS2 CHAPTER OVERVIEW  Understand the functions of groups and how to use them.  Understand.

11 WORKING WITH GROUPS Chapter 7. Chapter 7: WORKING WITH GROUPS2 CHAPTER OVERVIEW  Understand the functions of groups and how to use them.  Understand.
6.1 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure.

6.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure.
3.1 © 2004 Pearson Education, Inc. Exam 70-290 Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.

3.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.
MCTS Guide to Configuring Microsoft Windows Server 2008 Active Directory Chapter 5: Account Management.

MCTS Guide to Configuring Microsoft Windows Server 2008 Active Directory Chapter 5: Account Management.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 3: Creating and Managing User Accounts.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 3: Creating and Managing User Accounts.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 1: Introduction to Windows Server 2003.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 1: Introduction to Windows Server 2003.
Administering Active Directory

Administering Active Directory
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts.
Hands-On Microsoft Windows Server 2003 Administration Chapter 3 Administering Active Directory.

Hands-On Microsoft Windows Server 2003 Administration Chapter 3 Administering Active Directory.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts.
By Rashid Khan Lesson 8-Crowd Control: Controlling Access to Resources Using Groups.

By Rashid Khan Lesson 8-Crowd Control: Controlling Access to Resources Using Groups.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 4: Implementing and Managing Group and Computer Accounts.
7.1 © 2004 Pearson Education, Inc. Exam 70-290 Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 7: Introducing Group Accounts.

7.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 7: Introducing Group Accounts.
3.1 © 2004 Pearson Education, Inc. Exam 70-290 Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.

3.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 3: Introducing Active Directory.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 3: Creating and Managing User Accounts.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 3: Creating and Managing User Accounts.
11 WORKING WITH COMPUTER ACCOUNTS Chapter 8. Chapter 8: WORKING WITH COMPUTER ACCOUNTS2 CHAPTER OVERVIEW  Describe the process of adding a computer to.

11 WORKING WITH COMPUTER ACCOUNTS Chapter 8. Chapter 8: WORKING WITH COMPUTER ACCOUNTS2 CHAPTER OVERVIEW  Describe the process of adding a computer to.

Similar presentations

Ads by Google