Differences between revisions 25 and 48 (spanning 23 versions)
⇤ ← Revision 25 as of 2015-09-24 13:45:45 →
Size: 2442
Editor: scot
Comment:
← Revision 48 as of 2022-09-29 18:26:29 → ⇥
Size: 2799
Editor: scot
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
## page was renamed from WindowsAdministration/Lab04OuGroupLab
Line 3: Line 4:
In this lab you will create some organizational groups and users in In this lab you will use the organizational units, groups and users in your AD that we created last time to delegate control to managers of their department users. Then we will setup a share for each department and for each user. In your domain controller (Using the RSAT tools or powershell):
Line 5: Line 6:
In your primary domain:  1. Delegate control over users in the OU_Sales Organizational unit to jpatterson so that he can change their password, but nothing else.
    a. Right click on the OU, select Delegate control, Add the user.
    a. On theTasks to Delegate select only the following:
       1. Reset user passwords and force password change at next logon
       1. Reset inetOrgPerson passwords and force password change at next logon
       1. Read all inetOrgPerson information
 1. Delegate control over users in the OU_Developers Organizational unit to kthompson
    a. like the first one...
 1. Delegate control over users in the OU_CSuite Organizational unit to kthompson
    a. ...
Line 7: Line 17:
 1. Create an organizational unit named {{{OU_Contractors}}}
  a. Create a global group in the {{{OU_Contractors}}} called {{{g_contractors}}}
  a. Create a user called {{{contractor}}} and put them in {{{g_contractors}}} group.
 1. Create a user mgr in the users folder.
  a. Make mgr the Administrator for the {{{OU_Contractors}}} by using the delegation wizard. Make sure the the user has "Reset user passwords..." and "Modify the membership of a group"
   1. set his password and document it in the "password" page. Make sure there is no requirement to change the password.
   1. Make mgr a member of the server operators group and give the account remote desktop access (through system, remote add user).
  a. Start Group Policy - Find the Domain Controllers Folder/OU, right click on the Default Domain Controller Policy, click edit
   1. Navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignments
   1. Add the mgr user to the "Allow Logon through remote desktop services" list.
   1. From a command prompt or powershell type: gpupdate /force
  a. You will demonstrate mgr's ability by changing the password for "contractor" (Note: When you try to run server manager, it will ask for a username and password. Use the mgr username and password. After that you can run the tools from the menu and they will work for you correctly. If you run "Active Directory Users and Computers" directly without going through the server manager you will have to again use the mgr username and password each time you open it or any other tool.)		 Shares:
Line 20: Line 19:
In your subdomain:  1. Create a share for each group Sales, Developers and Managers and make sure the groups have read/write access to the share.
    a. On C:\ create a folder called shares, we will use this for all our shares.
    a. Create folders in c:\shares named:
       1. sales
       1. developers
       1. managers
       1. home
    a. Share and Assign permissions to the sales, developers and managers
       1. Right click on sales, select properties, sharing, Share...
       1. add the sales group and set permission level to "Read/Write" and share.
       1. Select the security tab and make sure that the sales group does not have full control. Remove if that right by clicking on edit, selecting sales and unchecking Full Control.
    a. Repeat these steps for developers and managers.
 2. Create shares for users: Follow the directions at https://www.petenetlive.com/KB/Article/0000739 to complete this.
Line 22: Line 33:
 1. Create a domain local group called {{{dl_temporary}}} in the users folder.
  a. Add {{{g_contractors}}} group to the {{{dl_temporary}}} group.
Line 26: Line 35:
 1. Document the OU structures added and Groups added to each domain on the domains page.
 1. Do this in a new section called "Organizational Units" and "Groups"
 1. Document the delegations for control that you made in the "Organizational Units" section.
 1. Document the Share created and its purpose in a new section called "Shared Resources"
Line 31: Line 41:
||Video Shows: OU structures and groups created in the instructions ||20 ||
||Video Shows: A remote login event using the mgr user. ||30 ||
||Video Shows: the mgr user changing the password for the contractor user. ||30 ||
||Video talks through the required documentation. ||20 ||		 ||Video Shows: Login as one of the manager users using remote desktop and change a user's password for which they have been delegated control || 40 ||
||Video Shows: Login as the user you changed the password for and show that it worked. || 10 ||
||Video Shows: Shares by going to \\cptr230a and showing shares. Access shares that the manager should have access too, and show that they are denied access to shares they shouldn't have access to. || 40 ||
||Video talks through the required documentation. || 10 ||

Lab 04

Instructions

In this lab you will use the organizational units, groups and users in your AD that we created last time to delegate control to managers of their department users. Then we will setup a share for each department and for each user. In your domain controller (Using the RSAT tools or powershell):

  1. Delegate control over users in the OU_Sales Organizational unit to jpatterson so that he can change their password, but nothing else.
    1. Right click on the OU, select Delegate control, Add the user.
    2. On theTasks to Delegate select only the following:
      1. Reset user passwords and force password change at next logon
      2. Reset inetOrgPerson passwords and force password change at next logon
      3. Read all inetOrgPerson information
  2. Delegate control over users in the OU_Developers Organizational unit to kthompson
    1. like the first one...
  3. Delegate control over users in the OU_CSuite Organizational unit to kthompson
    1. ...

Shares:

  1. Create a share for each group Sales, Developers and Managers and make sure the groups have read/write access to the share.
    1. On C:\ create a folder called shares, we will use this for all our shares.
    2. Create folders in c:\shares named:
      1. sales
      2. developers
      3. managers
      4. home
    3. Share and Assign permissions to the sales, developers and managers
      1. Right click on sales, select properties, sharing, Share...
      2. add the sales group and set permission level to "Read/Write" and share.
      3. Select the security tab and make sure that the sales group does not have full control. Remove if that right by clicking on edit, selecting sales and unchecking Full Control.
    4. Repeat these steps for developers and managers.

  2. Create shares for users: Follow the directions at https://www.petenetlive.com/KB/Article/0000739 to complete this.

Documentation

  1. Document the delegations for control that you made in the "Organizational Units" section.
  2. Document the Share created and its purpose in a new section called "Shared Resources"

Video Grade Guide

Topics

Points

Video Shows: Login as one of the manager users using remote desktop and change a user's password for which they have been delegated control

40

Video Shows: Login as the user you changed the password for and show that it worked.

10

Video Shows: Shares by going to \\cptr230a and showing shares. Access shares that the manager should have access too, and show that they are denied access to shares they shouldn't have access to.

40

Video talks through the required documentation.

10

WindowsAdministration/Lab04DelegationAndShares (last edited 2024-10-03 19:39:01 by scot)