1. Module 3: Planning Administrative Access

2. Overview Determining the Appropriate Administrative Model Designing Administrative Group Strategies Planning Local Administrative Access Planning Remote Administrative Access

3.  Determining the Appropriate Administrative Model Choosing Centralized Administrative Models Choosing Decentralized and Hybrid Administrative Models Identifying Network Resource Administrative Tasks Identifying Administrative Tasks Defining Security Management Tasks

4. Choosing Centralized Administrative Models Centralized Administration ! ! ? ? i i

5. Choosing Decentralized and Hybrid Administrative Models Decentralized Resource Administration Human Resources Dept. Centralized User Account Administration Decentralized Administration Hybrid Administration

6. Identifying Network Resource Administration Tasks Network Resources Account Administration ! ! ? ? i i Resource Administration Backup Administration

7. Identifying Administrative Tasks Storage Management Batch/Output Management Problem Management Performance Management Security Management Change and Configuration Management Change and Configuration Management Event Management

8. Defining Security Management Tasks Secure Physical Systems and Devices Manage Users, Groups, and Policies Define and Implement Authentication and Data Transmission Security Control and Monitor Access to Shared Resources Create and Implement an Audit Policy Create and Implement a Backup and Recovery Plan Create and Implement Desktop Policies Storage Management Batch/Output Management Problem Management Performance Management Change and Configuration Management Event Management Security Management

9.  Designing Administrative Group Strategies Creating Custom Groups Nesting Groups Managing Administration Memberships

10. Custom Groups Default Group Rights: Backup Restore Rights: Backup Rights: Restore Backup Operators Backup Only Restore Only Creating Custom Groups

11. Nesting Groups Employee Reviewers (Universal Group) Employee Records (Domain Local Group) Sales Mgrs (Global Group) IS Mgrs (Global Group) Product Mgrs (Global Group) All Managers (Global Group) Human Resources (Global Group) Rights and permissions to modify employee records allocated to group Rights and permissions to modify employee records allocated to group

12. Managing Administration Memberships Using Restricted Groups Monitoring Memberships

13.  Planning Local Administrative Access Controlling Physical Administration Points Planning Logical Security Settings Using the RunAs Service

14. Controlling Physical Administration Points Physical Security Smart Card Logon Access Cert ReaderReader Smart Card

15. Planning Logical Security Settings Restrictive Logon Hours Xy!2#Hv*j Strong Passwords Workstation Restrictions Active Directory User Account Options Smart Card

16. Running Applications Providing Alternate Credentials Using the RunAs Service User Account Process User Account Process User Account Process Administrative Account Process

17. Demonstration: Using the RunAs Service

18.  Planning Remote Administrative Access Encrypted Authentication and Data Transmission Customizing Microsoft Management Console Using Terminal Services for Remote Administration Using Telnet for Remote Administration

19. Encrypted Authentication and Data Transmission Securing Authentication Securing PPP and PPTP Connections Securing L2TP Connections Design Decisions

20. Customizing Microsoft Management Console Save As RemoteAdminConsole.msc Restricting Access to MMC Distributing MMC

21. Using Terminal Services for Remote Administration Server Running Terminal Services Administrator Computer Running Terminal Services Client Encrypted Screen Data Encrypted Keyboard and Mouse Data User Rights Administrator Security Data Encryption Additional Security Considerations

22. Using Telnet for Remote Administration

23. Lab A: Planning Secure Administrative Access

24. Review Determining the Appropriate Administrative Model Designing Administrative Group Strategies Planning Local Administrative Access Planning Remote Administrative Access