1. Review on Active Directory

2. Aim Enable users to find network resources easily Central and easy administration of users and resources in a domain Improve security by controlling access on resources and restrictions placed on user and computer configuration

3. Structure Hierarchical structure Forest Tree

4. Necessary components Domain controller(s) as central repository of the domain and provides access control DNS server for locating resources Other computers: servers and workstations added to domain by domain administrator

5. Protocols used Kerberos for network authentication Lightweight Directory Access Protocol (LDAP) to provide directory service (to get information about objects)

6. Information obtained from LDAP

8. Entry in AD dn: cn=John Doe,dc=example,dc=com cn: John Doe givenName: John sn: Doe telephoneNumber: +1 888 555 6789 telephoneNumber: +1 888 555 1234 mail: john@example.com manager: cn=Barbara Doe,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top

9. Search information in AD

14. Group Policy Rules to define settings of either users and computers Hundreds of settings can be defined Each setting has 3 possible states: –Not configured –Disabled –Enabled

15. Group Policy Apply to

16. Property of Group Policy Policy setting inherited by child containers A container can have multiple policies being applied Which policy setting comes into effect depends on it precedence of the policy

17. Group Policy Management Tool Download from Microsoft for easy management of group policy

18. Log on Procedure Authentication –User at log on –Computer at machine start Issue of Access Token –AD gathers all group policy applied to the user and computer and returns a list of SID to user’s computer –The LSA uses the SIDs to form an access token

19. Content of Access Token To show identity and privilege Name SID of user Groups SID of groups user belongs Logon SID (valid for a certain duration)

20. Request for use of network resources Authenticate the user’s request by comparing the Access Token to the Security Descriptor of an object

21. Content of Security Descriptor SID of owner SID of group (seldom used in Windows) DACL –SID, Rights –Deny on top System ACL

22. Update of Access Token Every 30 minutes or as set in the group policy

23. Samples of Group Policy A package called Common Scenario provided by Microsoft –Lightly managed –Mobile –Multi-user –App station –Task station –Kiosk