1. Local Administrator Meeting 2-25-03 Brian Drendel

2. What will we talk about today? n Announcements –Win2k Migration Progress –Key Server Retired –New WinXP Ghost Image –Site Netbios Block n Fermilab Active Directory Structure n Beams Division OU Structure n Administering the BD OU

3. Win2k Migration Progress n Win2k Migration Progress –Workstations: n 458 Users/463 Computers in Fermi n 95 computers on Beams browse list –Servers n Win2k: www-bdnew, Beamssrv1, Beams-Fmpro, beams- prt-srv, beams-backup, Beams-flexlm n WinNT: Beams-cdrom, beamsappsrv1, beamsappsrv2 –Further Concerns n Macintoshes n BD-Controls Domain

4. No more Key Server! n Announcements –Win2k Migration Progress –Key Server Retired –New WinXP Ghost Image –Site Netbios Block n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

5. Key Server Retired n Key Server Retired Feb. 17 th. –Email warnings –Help desk tickets –Key server error messages.

6. Casper the friendly ghost image! n Announcements –Win2k Migration Progress –Key Server Retired –New WinXP Ghost Image –Site Netbios Block n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

7. Casper the friendly ghost image! n Latest Drive Image –Office XP Pro –Exceed 8 n Kerberos FTP n Jim Smedinghoff custom ACNET configuration n Remote Registry Service –Needed for SP Management –Turn it back on

8. Site Netbios Block n Announcements –Win2k Migration Progress –Key Server Retired –New WinXP Ghost Image –Site Netbios Block n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

9. Site Netbios Block n Network –NetBIOS Block n 137, 138, 139, 445 ports blocked in three stages –Fermi DCs –Site with exemptions for servers –Entire Site –Possible solution for offsite connectivity n VPN –Site VPN in Beta –BD Controls VPN –Cross Platform

10. Win2k Domain Structure at Fermilab n Announcements n Fermilab Active Directory Structure –Root Domain –Child Domains –Organizational Units (OU) –BD OU n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

11. Active Directory n Active Directory allows us to organize and manage domain objects: –Users –Computers –Printers –Global Groups –Shares n What does the Fermilab Active Directory structure look like?

12. Root Domain n The Root Win2k Domain is called WIN.FNAL.GOV. –Contains two Domain Controllers (FCC and WH). –Owned, managed and maintained by Computing Division. –BD has no administrative access to this domain. –Functions of Domain: n Used only for security. n Can push policies down to other OUs –Legal Banner –Minimum password length

14. Child Domains n Announcements n Fermilab Active Directory Structure –Root Domain –Child Domains –Organizational Units (OU) –BD OU n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

15. Child Domains n Active Directory Objects are connected to the Win.fnal.gov domain via separate child domains. n Child Domains: –Have a two way transitive trust with Win. –Must be approved by Computer Security. n Fermi Domain: All users and computers at Fermilab n Other Domains: Critical System??? n Computer Security does not allow: –Unattached Domains. –Child Domains of the Child Domains.

16. Child Domains n Fermi Child Domain –Contains all users, computers, printers, global groups and shares for the entire Fermilab Windows desktop community. –Contains all Child Domain user accounts. –Domain Controllers scattered throughout the site. n The BD Domain Controller is called Bert.

18. Organizational Units n Announcements n Fermilab Active Directory Structure –Root Domain –Child Domains –Organizational Units (OU) –BD OU n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

19. Organizational Units n Child Domains are further broken down into Organizational Units (OUs). –Each Division has its own OU. –Management to each OU is delegated to managers in their respective Divisions. –BD OU n Has all Beams Division users, computers, printers, global groups and shares. n Managed by the BD/Networking Group.

21. BD OU n Announcements n Fermilab Active Directory Structure –Root Domain –Child Domains –Organizational Units (OU) –BD OU n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples

22. BD OU Management n The BD OU is further broken down into Sub-OUs for: –Computers –Users –Groups –Printers –File Shares

24. BD OU in Detail n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure –Win2k Admin Guide –Users –Computers –Printers –Global Groups –Shares n Local Admin Administrative Setup n Administrative Task Examples

25. Win2k Admin Guide n The Win2k Admin guide covers administration of the BD OU. –Covers specific details for administration by: n BD Active Directory Administrators (BD\Network Group) n Local Administrators n More detail can be found in my Win2k Admin Guide Document located at http://www- bdnew.fnal.gov/network/Win2k- Adminguide/Adminguide.htm http://www- bdnew.fnal.gov/network/Win2k- Adminguide/Adminguide.htm

27. Users n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure –Win2k Admin Guide –Users –Computers –Printers –Global Groups –Shares n Local Admin Administrative Setup n Administrative Task Examples

28. Users n We now want to take a few moments to explore each of the subOUs within the Fermi\BD OU. –Users –Computers –Printers –Shares –Global Groups

29. User’s OU n The BD User’s OU is further divided by the org chart. –Each department/group has their own OU. –Each department/group OU is further broken down into a General and Special OU. –Management of Users is covered in the users portion of the Win2k Admin Guide: http://www-bdnew.fnal.gov/network/Win2k- Adminguide/users.htm http://www-bdnew.fnal.gov/network/Win2k- Adminguide/users.htm

31. 5 Types of Fermi Domain Accounts n There are five types of users in the Fermi Domain: –Users: –Admins: –Managers: –Captive Accounts: –Service Accounts:

32. User Accounts n Every user that wants to access Fermi Domain resources has a user account. –All of your everyday work. –The account does not have administrative privileges across multiple computers. –Equivalent of your Kerberos Principal. n Cannot share your password n Cannot send your password over the network. –User accounts are cloned to the Fermi Domain to maintain Beams Domain access. –Username has the format of Fermi\{username}. –Users live in AD in the Fermi\BD\Users\{Department or Group}\General –Only Computing Division creates accounts. –You can apply for a user account at http://www-bdnew.fnal.gov/network/add_user.asphttp://www-bdnew.fnal.gov/network/add_user.asp. http://www-bdnew.fnal.gov/network/add_user.asp

33. Admin accounts n Every users that needs administrative access to objects in the Fermi Domain needs an Admin account. –Not for your everyday work. –The account is delegated administrative functions in the domain. –A user must be a registered sysadmin ( https://miscomp.fnal.gov/sysadmindb/). https://miscomp.fnal.gov/sysadmindb/ –Can be used by LOCALADMINS n Manage desktop computers. n Manage Departmental SubOU. –Username has the format of Fermi\{username}-admin –CD stores these accounts in a separate location in AD. –You can apply for a user account at http://www- bdnew.fnal.gov/network/add_user.asp http://www- bdnew.fnal.gov/network/add_user.asp. http://www- bdnew.fnal.gov/network/add_user.asp

34. Manager Accounts n Each Division assigns no more than three administrators to perform advanced Active Directory Administration for their respective Division. –The account is used to create active directory structure, move users and create group policy. –Username has the format of Fermi\{username}-mgr –CD stores these accounts in a separate location in AD –These accounts are assigned. There is no web application form.

35. Captive Accounts n These are domain accounts that require a shared login to a dedicated console. –Computing Security does not allow users to share their account passwords, so user accounts can not be used for this function. –These accounts need Win2k Policy Committee and CD Security approval. –Accounts names are of the form Fermi\bd-cap- {function}. –Accounts are stored in Active Directory in Fermi\BD\Users\{Department or Group}\Special –Accounts can be applied for at http://computing.fnal.gov/pcmanagers/captivefor m.html. http://computing.fnal.gov/pcmanagers/captivefor m.html http://computing.fnal.gov/pcmanagers/captivefor m.html

36. Service Accounts n When accounts are required to run applications, a shared service account is used. –Computing Security does not allow users to share their account passwords, so user accounts can not be used for this function. –Win2k Policy Committee and CD Security approval. –A Shared Service Account has the following requirements: n Run software as an unattended service, like Unix daemons n Use Domain account authentication n Usage of this account over the network n Sharing of the account password between multiple administrators –These accounts need Accounts names are of the form Fermi\bd- srv-{function}. –Accounts are stored in Active Directory in Fermi\BD\Users\{Department or Group}\Special –Accounts can be applied for at http://www- win2k.fnal.gov/pub/Docs/Sharing_service_accounts.doc. http://www- win2k.fnal.gov/pub/Docs/Sharing_service_accounts.dochttp://www- win2k.fnal.gov/pub/Docs/Sharing_service_accounts.doc

37. Users OU Fermi\BD\Users\{Department or Group}\General. Users are stored in Active Directory in Fermi\BD\Users\{Department or Group}\General.

38. Computers n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure –Win2k Admin Guide –Users –Computers –Printers –Global Groups –Shares n Local Admin Administrative Setup n Administrative Task Examples

39. BD Computers OU n The BD Group OU is further divided by the org chart. –Each department/group has their own OU. –Each department/group OU is further broken down into a Desktop, Laptop and Server OU. n The GPO applied on Servers different from Desktops, different from laptops. –Management of Computers is covered in the computers portion of the Win2k Admin Guide: http://www-bdnew.fnal.gov/network/Win2k- Adminguide/computers.htm http://www-bdnew.fnal.gov/network/Win2k- Adminguide/computers.htm

41. Computers OU Computers are stored in Fermi\BD\Computers\{Departm ent or Group}\{Computer Type}.

42. Printers n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure –Win2k Admin Guide –Users –Computers –Printers –Global Groups –Shares n Local Admin Administrative Setup n Administrative Task Examples

43. Printers n Printers are published in Active Directory. –The Win2k Print queues still live on beams-prt-srv –Additionally, the printers are published in Active Directory. n Makes adding printers easier for the client computers. –Management of Printers is covered in the printers portion of the Win2k Admin Guide: http://www-bdnew.fnal.gov/network/Win2k- Adminguide/printers.htm http://www-bdnew.fnal.gov/network/Win2k- Adminguide/printers.htm

45. Printers Computers are stored in Fermi\BD\Printers\

46. Global Groups n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure –Win2k Admin Guide –Users –Computers –Printers –Global Groups –Shares n Local Admin Administrative Setup n Administrative Task Examples

47. Global Groups n Win2k Domain permissions are assigned by global groups. –Beams Domain global groups are cloned to the Fermi Domain to maintain Beams Domain access. –Global groups follow the naming convention Fermi\BD {group name}. –Management of Global Groups is covered in the global groups portion of the Win2k Admin Guide: http://www- bdnew.fnal.gov/network/Win2k- Adminguide/groups.htm http://www- bdnew.fnal.gov/network/Win2k- Adminguide/groups.htm

49. Global Groups Computers are stored in Fermi\BD\Global Groups\

50. Shares n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure –Win2k Admin Guide –Users –Computers –Printers –Global Groups –Shares n Local Admin Administrative Setup n Administrative Task Examples

51. Shares n Server shares can be published to Active Directory. –The share still lives on the server. –Published to Active Directory for client convenience. –Allows us to collect share from multiple servers and put them in one place. –Management of Shares is covered in the shares portion of the Win2k Admin Guide: http://www- bdnew.fnal.gov/network/Win2k- Adminguide/shares.htm http://www- bdnew.fnal.gov/network/Win2k- Adminguide/shares.htm

52. Shares Shares are published in Fermi\BD\Global Shares\

53. Setting up for AD Management n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup –Install AD Tool –Configure AD Tool –Add Fermi\user-admin account to local computers –Enable Remote Registry on local computers. n Administrative Task Examples

54. Administrative Tools n To manage our Active Directory and Computers, we need: –Active Directory Management n An Fermi\user-admin account n The AD User and Computer management tool. –Desktop Management (option) n Fermi\User-admin account in administrators group n Remote Registry Service. –Installation and setup of management tools is covered in the administrative tools portion of the Win2k Admin Guide: http://www- bdnew.fnal.gov/network/Win2k- Adminguide/tools.htm http://www- bdnew.fnal.gov/network/Win2k- Adminguide/tools.htm

56. Administrative Tools: Install n The Active Directory Users and Computers tool runs as a snap-in tool in the MMC. n The tool can be run on any Win2k or WinXP (must be SP1) desktop or laptop computer that is in the Fermi Domain. n There are two versions: –Win2k: Obtained from the Win2k Server CD. –WinXP: Downloaded from Microsoft. n We will walk through the installation on a WinXP SP1 client computer.

57. Active Directory Users and Computers Installation n Login to your WinXP desktop using your local administrator account n Check the Service pack level –Start->Run

58. Active Directory Users and Computers Installation n Type winver in the open field.

59. Active Directory Users and Computers Installation n WinXP needs to be at SP1 level or later.

60. Active Directory Users and Computers Installation n If you need to install WinXP SP1, then you can do so from \\Beamssrv1\WinXP-Setup\WinXP SP1 + hotfixes.bat.

61. Active Directory Users and Computers Installation n When prompted for username and password, do not forget to use the form Fermi\{username} for your username.

62. Active Directory Users and Computers Installation n Follow online directions to complete SP1 installation followed by a reboot.

63. n We will now install the Active Directory Users and Computers tool. n Login to your local administrator account and browse the network to Beamssrv1. Active Directory Users and Computers Installation

64. n Again, you are prompted for your Fermi Domain credentials. n Wouldn’t it be nice not to have to do this? Stay tuned!

65. n Go to the installation directory as shown here (different for Win2k than WinXP). n Run adminpak.msi n Note the installation is faster if you copy the entire directory to your PC and run it locally. Active Directory Users and Computers Installation

66. n Click NEXT> at the welcome screen.

67. Active Directory Users and Computers Installation n Select to agree to the license agreement. n Click NEXT>.

68. Active Directory Users and Computers Installation n When the installation has completed, click FINISH.

69. Configure the AD Tool! n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup –Install AD Tool –Configure AD Tool –Add Fermi\user-admin account to local computers –Enable Remote Registry on local computers. n Administrative Task Examples

70. Active Directory Users and Computers Configuration n The Active Directory Users and Computers tool needs to be configured for use. n We will –Add the tool to an MMC Console –Save the MMC configuration –Later we will use the tool using runas with Fermi\user-admin (more on admin accounts later) credentials.

71. Active Directory Users and Computers Configuration n Logon to either your Fermi\user account or your local admin account. n Click Start -> Run.

72. Active Directory Users and Computers Configuration n Type MMC in the run window, then click OK.

73. Active Directory Users and Computers Configuration n In the MMC Console file menu, click File -> Add/Remove Snap-in…

74. Active Directory Users and Computers Configuration n Click the Add button.

75. Active Directory Users and Computers Configuration n Select the Active Directory Users and computers (only once) n Click Add n Click Close 1 1 23

76. Active Directory Users and Computers Configuration n The Add/Remove Snap in window now shows the Active Directory Users and Computers tool n Click OK.

77. Active Directory Users and Computers Configuration n The MMC console now shows the Active Directory Users and Computers Tool. n From the file menu, click File -> Save As.

78. Active Directory Users and Computers Configuration n Save the file to a location that is not in your profile (i.e. not on your desktop) n C:\AdminTools\Act ive Directory.MMC in my example.

79. Setting up for Desktop Management n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup –Install AD Tool –Configure AD Tool –Add Fermi\user-admin account to local computers –Enable Remote Registry on local computers. n Administrative Task Examples

80. Administration of client computers n To better manage your desktop computers we will make two more configuration changes. –Add your Fermi\{user}-admin account to the administrator group on all computers that you manage. –Turn on the Remote Registry Service on all computers that you manage. n These changes need to occur on all desktops that you want to manage.

81. Add Fermi\user-admin to Administrators Group n Start the User Account applet in the control panel. –Start->Settings->Control Panel->User Accounts

82. Add Fermi\user-admin to Administrators Group n In the User Accounts applet, click the Advanced Tab, then the Advanced button. 1 2

83. Add Fermi\user-admin to Administrators Group n Select Groups. n Double-click on Administrators. 1 2

84. Add Fermi\user-admin to Administrators Group n In the Administrators Properties window, click the Add button.

85. Add Fermi\user-admin to Administrators Group n Type your Fermi\user-admin account in the object name field. n Click OK. 1 2

86. Add Fermi\user-admin to Administrators Group n Type your Fermi\user account in the object name field. n Click OK. n With the Fermi\user- admin account in the Administrators group, you won’t have to do this anymore!

87. Add Fermi\user-admin to Administrators Group n Verify that your Fermi\user-admin account in the members list n Click OK. n Repeat for your other desktops.

88. Setting up the Remote Registry Service n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup –Install AD Tool –Configure AD Tool –Add Fermi\user-admin account to local computers –Enable Remote Registry on local computers n Administrative Task Examples

89. Remote Registry Service n Right-Click My Computer and select Manage. Right-click

90. Remote Registry Service n Find Services. n Double-click on Remote Registry

91. Remote Registry Service n Set startup type to Automatic. n Click the Apply button to enable the service for future logins. n Click the Start button to start the service. 1 2 3

92. Putting it all together! n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples –Fermi\user-admin for desktop support –Start the AD Tool –Reset a user password –Reset a computer –Delete a computer –Computer Management

93. Admin Tasks n How can you use your Fermi\user- admin account to administer users and computers in your department? –Local logon to desktops that you manage –Administration over the network using the Active Directory Users and Computers tool.

94. Using Fermi\user-admin on client computers n On any desktop computer that you manage, logon to your Fermi\user-admin account. n You know have –Access to all “local administrator” resources on Beamssrv1. –Have administrative privileges on the local computer.

95. Putting it all together! n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples –Fermi\user-admin for desktop support –Start the AD Tool –Reset a user password –Reset a computer –Delete a computer –Computer Management

96. Starting the Active Directory Users and Computers n Login to your Fermi\user account on the desktop that you are managing your users and computers from. –You do NOT need to login to your Fermi\user-admin account. n Right-click and select Run as on the Active Directory shortcut that you made in the previous step. Right-click

97. Starting the Active Directory Users and Computers n Pass your Fermi\user- admin account credentials as shown here.

98. Starting the Active Directory Users and Computers n You are now ready to manage Active Directory Objects!!!

99. Password amnesia? n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples –Fermi\user-admin for desktop support –Start the AD Tool –Reset a user password –Reset a computer –Delete a computer –Computer Management

100. Reset User Password n To reset a password, we will browse through Active Directory to Fermi\BD\Users

101. Reset User Password n Browse to your Department/group OU. n Go to the General OU. n Right-click on the user and select reset password. Right-click

102. Reset User Password n Type in the new password and confirm it. n Make sure to check the box that requires the user to change their password on next logon. n Click OK. 3 4 1 2

103. Reset User Password n You will be notified that the password change was successful. n Click OK.

104. After a fresh ghost image! n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples –Fermi\user-admin for desktop support –Start the AD Tool –Reset a user password –Reset a computer –Delete a computer –Computer Management

105. Reset Computer before rejoining to the Domain n To reset a password, we will browse through Active Directory to Fermi\BD\Computers

106. Reset Computer before rejoining to the Domain n Browse to your Department/group OU. n Go to the Desktop or Laptop OU. n Right-click on the computer and select reset account. Right-click

107. Reset Computer before rejoining to the Domain n Click OK when asked to reset the computer account.

108. Reset Computer before rejoining to the Domain n You will be notified that the computer account reset was successful. n Click OK.

109. Renaming or retiring a computer? n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples –Fermi\user-admin for desktop support –Start the AD Tool –Reset a user password –Reset a computer –Delete a computer –Computer Management

110. Delete a Computer Account n Browse through Active Directory to Fermi\BD\Computers

111. Delete a Computer Account Right-click n Browse to your Department/group OU. n Go to the Desktop or Laptop OU. n Right-click on the computer and select delete.

112. Delete a Computer Account n Click OK when asked to delete the computer account.

113. The Power of Computer Management n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples –Fermi\user-admin for desktop support –Start the AD Tool –Reset a user password –Reset a computer –Delete a computer –Computer Management

114. Computer Management n Browse through Active Directory to Fermi\BD\Computers

115. Computer Management Right-click n Browse to your Department/group OU. n Go to the Desktop or Laptop OU. n Right-click on the computer and select manage.

116. Computer Management n The Computer Management Tool is launched.

117. Computer Management n Application, Security and System entries can be viewed through the Event Viewer.

118. Computer Management n Local user accounts and local groups can be managed through computer management.

119. Computer Management n The Device Manager can be viewed in read-only mode.

120. Computer Management n Partitions can be viewed with the Disk Manageme nt.

121. Computer Management n Services can be stopped, started or configured.

122. What did we talk about today? n Announcements n Fermilab Active Directory Structure n Beams Division OU Structure n Local Admin Administrative Setup n Administrative Task Examples