1. 7.1 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Active Directory contains information about all objects on a network  Each object has a unique set of attributes  Attributes are used by administrators to locate objects  To locate objects in Active Directory  Use the Find dialog box in the Active Directory Users and Computers console  The Find dialog box provides a number of options used to search for Active Directory objects (Skill 1) Searching for Active Directory Objects on a Network

2. 7.2 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Using the Find dialog box  You can specify a single attribute or multiple attributes to locate an object  You can even specify partial values for the objects you are trying to locate Searching for Active Directory Objects on a Network (3) (Skill 1)

3. 7.3 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  To locate objects using Active Directory  You must have Read permission for the object in question  Your computers must have certain components enabled  Windows Server 2003, Windows 2000, Windows XP, Windows NT with the Active Directory client enabled  Windows 95/98 with the Active Directory client and Active Desktop enabled Searching for Active Directory Objects on a Network (4) (Skill 1)

4. 7.4 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-2 Setting search attributes (Skill 1)

5. 7.5 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  You can use the Advanced tab in the Find dialog box to make the search more specific by searching on multiple conditions  Field: You can specify the search field you are looking for based on the attribute of the object you are searching  Condition: You can specify various wildcards, such as Starts with and Ends with, to narrow down the search  Value: Requires you to specify a value for the attribute Searching for Active Directory Objects on a Network (5) (Skill 1)

6. 7.6 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  When administrators search for users, computers, or printers  They use the Start menu, or choose Entire Directory in the In list box in the Find dialog box in the Active Directory Users and Computers console  They are searching the global catalog  Once they enter the search criteria and select Find Now  The search request is routed to the default global catalog port (3268) and sent to the global catalog  The global catalog allows searching for directory information in all domains in a forest Searching for Active Directory Objects on a Network (7) (Skill 1)

7. 7.7 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-3 Using the Advanced tab to search for an object based on a condition (Skill 1)

8. 7.8 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-4 Filtering the search results (Skill 1)

9. 7.9 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  On a Windows Server 2003 network, administrators provide access security for Active Directory objects by setting object permissions  Object permissions  Provide users with access to the objects they will need to use to perform their jobs  Prevent users from accessing objects that are outside of their areas of responsibility or that would represent a security vulnerability Setting Standard Active Directory Object Permissions (Skill 2)

10. 7.10 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  A crucial component of managing Active Directory objects is to assign permissions to users and groups depending on the needs and policies of your organization  Great care must be taken when you assign permissions, particularly when you take into account the multiple groups in which a user may be a member Setting Standard Active Directory Object Permissions (4) (Skill 2)

11. 7.11 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  A user’s effective permissions are a combination of the permissions assigned to all groups to which he or she belongs  Assigning different permissions to different groups can change the effective permissions for a user  A denied permission overrides an allowed permission that has been assigned to either a user or group Setting Standard Active Directory Object Permissions (5) (Skill 2)

12. 7.12 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  Two categories of permissions  Standard permissions include the most commonly assigned permissions such as Read and Write  Special permissions are used to achieve a more specific level of control over objects than standard permissions Setting Standard Active Directory Object Permissions (6) (Skill 2)

13. 7.13 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  You assign security permissions for objects and their attributes in the Active Directory Users and Computers console  You use the Security tab on the Properties dialog box for an object to assign security permissions to objects  You can view the Security tab only after you enable Active Directory’s advanced features  Select Advanced Features on the View menu in the Active Directory Users and Computers console Setting Standard Active Directory Object Permissions (7) (Skill 2)

14. 7.14 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  By default, Active Directory objects inherit their access control lists from the security descriptor for the parent container object  This means that you do not need to apply permissions every time you create a new child object unless you want to change the inherited permissions  The administration of Active Directory objects is simplified by inheritance Setting Standard Active Directory Object Permissions (9) (Skill 2)

15. 7.15 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  You can change the inherited permissions  Open the Advanced Security Settings for dialog box  Clear the check box: Allow inheritable permissions from the parent to propagate to this object and all child objects. Include these with entries explicitly defined here Setting Standard Active Directory Object Permissions (10) (Skill 2)

16. 7.16 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-7 The Advanced Security Settings for SERVERA dialog box (Skill 2)

17. 7.17 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  After you clear the check box, a message box provides two options  The Copy button allows you to copy the permissions from the parent object  The Remove button removes all previously inherited permissions from the object Setting Standard Active Directory Object Permissions (11) (Skill 2)

18. 7.18 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-8 Preventing permission inheritance (Skill 2)

19. 7.19 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Assigning permissions  After you choose Copy or Remove, you can make changes to the allowed permissions for a child object or remove users or groups from the Permissions list  Although this can provide a finer degree of control over objects, the maintenance required increases the administrative burden, so changing inherited permissions should be used cautiously Setting Standard Active Directory Object Permissions (12) (Skill 2)

20. 7.20 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Active Directory provides a centralized database for all network resources  It can be used as a single location where network users can find information about network resources  The process of adding resources to the directory is known as publishing Publishing Resources in Active Directory (Skill 3)

21. 7.21 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Publishing  Publishing ensures that searchable attributes for a resource are included in the Active Directory database  Resources that can be published include users, computers, shared folders, and network services  Commonly used attributes (user and computer names) are published automatically  Other directory data (information about shared folders) must be manually published  Publishing resources ensures that users can use object attributes to quickly and easily locate network objects Publishing Resources in Active Directory (2) (Skill 3)

22. 7.22 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-9 Publishing a shared folder (Skill 3)

23. 7.23 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-10 The published folder in the OU (Skill 3)

24. 7.24 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Publishing  Only Windows 2000 and Windows Server 2003 network printers are published automatically in Active Directory  You must manually publish information about printers running on down-level operating systems Publishing Resources in Active Directory (3) (Skill 3)

25. 7.25 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Publishing  When you manually publish a printer, you create a new PrintQueue object in the Active Directory Users and Computers console  To view PrintQueue objects and other sub-objects  Open the View menu and select the Users, Groups, and Computers as containers command  Open the Computers folder and select any computer to display its sub-objects, including printers Publishing Resources in Active Directory (4) (Skill 3)

26. 7.26 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Publishing  To publish printers, you must be a member of the Printer Operators, Domain Admins, or Enterprise Admins group  Printers you want to publish must be shared  You must have the Manage Printers permission for the printer to share or publish it  You can also use the Pubprn.vbs script that is stored in the %systemroot%\System32 folder to publish a printer Publishing Resources in Active Directory (5) (Skill 3)

27. 7.27 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  In Windows Server 2003, you can publish network services information in Active Directory  When you publish service information, administrators can manage the service from a central location rather than having to go to each individual server or computer  A set of services is published in Active Directory by default, but you can add to this list as necessary Publishing Network-enabled Services (Skill 4)

28. 7.28 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Publishing services  Creates a service-centric model that allows clients to more easily access services, because they will not need to store the location of the resource  Any published service can be made available from any Windows Server 2003 server  A specific computer does not need to be used to perform a task  Users need to know only the name of the service they want to use Publishing Network-enabled Services (2) (Skill 4)

29. 7.29 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  You use the Services container in the Active Directory Sites and Services console to publish and manage network services information  The Services container does not appear in the console by default  To view it, toggle on the Show Services command on the View menu  Services are published using programming interfaces, such as ADSI Publishing Network-enabled Services (6) (Skill 4)

30. 7.30 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-13 Displaying the Services container (Skill 4)

31. 7.31 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-14 Changing permissions for a service certificate template (Skill 4)

32. 7.32 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Depending on the size and infrastructure of the organization, objects can be moved  Within a domain  Between domains  Between sites  Moving Active Directory objects from one container to another within a domain is performed in the Active Directory Users and Computers console Moving Active Directory Objects Within a Domain (Skill 5)

33. 7.33 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Restrictions apply to moving objects in Active Directory  After an object has been moved to a new container  It ceases to retain the permissions of the old container  It inherits the permissions of the new container  Permissions assigned directly to the object remain with the object even after you move it to a new location Moving Active Directory Objects Within a Domain (2) (Skill 5)

34. 7.34 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  You can use the Dsmov.exe utility at the command prompt to move objects within a domain  You must be a member of the Domain Admins or Enterprise Admins group, or have the appropriate authority to perform this procedure Moving Active Directory Objects Within a Domain (3) (Skill 5)

35. 7.35 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-15 The Move dialog box (Skill 5)

36. 7.36 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-16 The user object in its new location (Skill 5)

37. 7.37 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Two command-line utilities are available to move objects such as users, computers, and OUs across domains  Movetree utility  Is included in the \Support\Tools folder on the Windows Server 2003 installation CD  You must first install it, because it is not available by default  Does not un-join the computer from its previous domain or join it to its new domain, so computer accounts are typically invalid after the move  Netdom utility is the suggested tool for moving computer accounts Moving Active Directory Objects Between Domains (Skill 6)

38. 7.38 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Security ID (SID)  Every object has a unique SID in the domain  When an object is moved between domains, the SID for that object becomes invalid and a new SID is created for the object in the new domain  The old SID information, including the security settings, is stored in SIDHistory, a security field available in Windows 2000 Server and Windows Server 2003 Moving Active Directory Objects Between Domains (2) (Skill 6)

39. 7.39 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Security ID (SID)  The information in SIDHistory is used when users log on to a network  During logon, along with the new SIDs, the old SIDs in the SIDHistory field are also considered and added to the access token for the objects  This helps users to retain some of their old access permissions  In contrast to SID, the GUID (a unique reference number for an object) remains unchanged after you move an object from one domain to another Moving Active Directory Objects Between Domains (3) (Skill 6)

40. 7.40 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Movetree  To move objects between domains, you must run the Movetree utility from the command prompt  Alternatively, you can create a batch file and run the file from the Start menu  To view the complete syntax for the Movetree command, enter Movetree /? at the command prompt Moving Active Directory Objects Between Domains (4) (Skill 6)

41. 7.41 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  As an administrator, you must control replication and monitor server performance to ensure users are able to log on within a reasonable amount of time  You may occasionally need to move domain controllers between sites to create an efficient replication topology and accomplish this task Moving a Domain Controller Between Sites (Skill 7)

42. 7.42 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Although the first domain controller is always created in the Default-First-Site-Name site, you can create subsequent domain controllers in any site and later move them to other sites  You move domain controllers between sites in the Active Directory Sites and Services console Moving a Domain Controller Between Sites (2) (Skill 7)

43. 7.43 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-18 The Move Server dialog box (Skill 7)

44. 7.44 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-19 The domain controller in its new location (Skill 7)

45. 7.45 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Netdom  Used to move workstations and member servers between domains  This utility is installed along with the Movetree utility when you install the Windows Server 2003 Support Tools from the Windows Server 2003 CD  Domain controllers cannot be moved across domains  To move a domain controller from one domain to another  Demote the domain controller to a member server  Use Netdom to move it to the required domain Moving a Domain Controller Between Sites (3) (Skill 7)

46. 7.46 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Delegation of control  The process of giving other users or administrators permissions for Active Directory objects to distribute the administrative load  Decentralizes administration to various levels of the organization, thus reducing the centralized administrative burden Delegating Active Directory Permissions (Skill 8)

47. 7.47 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Delegation of control is available at all levels of the hierarchy  You can delegate the ability to modify all domain objects  You can delegate the ability to modify all OU objects  You can even delegate control over just a single object  Delegation at the OU level is more common than delegation at the object level  To delegate control to OUs or containers, you use the Delegation of Control Wizard Delegating Active Directory Permissions (2) (Skill 8)

48. 7.48 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-22 The Users or Groups screen in the Delegation of Control Wizard (Skill 8)

49. 7.49 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Guidelines for effectively managing Active Directory  Understand the policies and requirements of your organization before you plan the delegation of control  Make sure that users who are delegated tasks are fully aware of Active Directory and its functions  Delegate control at the domain, site, or OU level, rather than over individual objects Delegating Active Directory Permissions (3) (Skill 8)

50. 7.50 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Guidelines for effectively managing Active Directory  Deny permissions sparingly  Make sure you provide the correct permissions to users to enable them to perform their duties properly  Document your Active Directory object control decisions  Serves as a future reference  Helps you to better manage Active Directory objects Delegating Active Directory Permissions (4) (Skill 8)

51. 7.51 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks Figure 7-23 The Tasks to Delegate screen (Skill 8)

52. 7.52 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  Recovery Console command-line interface  One of several useful tools available for troubleshooting  Used to resolve complex system problems when a full system boot is not available  Not installed by default  Two ways to install it  Run the winnt32 /cmdcons command from the I386 folder on the Windows Server 2003 installation CD  Launch the Recovery Console after you boot the computer from the Windows Server 2003 Server CD Troubleshooting Active Directory (Skill 9)

53. 7.53 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 7: Performing Active Directory Administrative Tasks  To access the Recovery Console, log on using the Administrator account  Recovery Console tasks  Starting and stopping services  Formatting drives  Copying files from the installation CD to local hard disks Troubleshooting Active Directory (2) (Skill 9)