Assignment # 8

Q1 Effective permissions of Esra Ali are: -Deny read permission. -Allow Create all child objects. -Allow reset password. -Deny modify owner. -Allow Delete all child Because the Deny permission overrides Allow permission and Explicit Allow override Inherited Deny.

Q2 IT department proprieties, security tab

Click Advanced button, select Auditing tab. Then click Add button.

Select success create user objects. Click OK.

Finally ..

Log event after create new user:

What type of change was made. create object Who made the change What type of change was made? create object Who made the change? Administrator What member was added? Ahmad When the change was made? 2:54 PM

Q3

Follow the steps in the wizard to add the data for both PSOs

A snapshot of Password settings container where the two of the PSO should appear

Apply HR PSO to: HR OU & Domain Admins Note that: you should make a shadow copy of HR OU using a group named HR

Apply Domain Admins PSO to Domain Admins

A snapshot of Admininstrator properties (member of Domain Admins group)

Question HR member will have HR PSO What is the resultant PSO of domain admins? Why it was chosen? Domain Admins PSO Because it has higher precedence.

Q4 Modify the Default Domain Controllers Policy GPO to enable auditing events for both successful and failed account logon events.

Q4 .. Cont. Modify the Client Computers Policy to enable auditing events for both successful and failed logon events

In server side (Fail attempt to logon-- account logon event)

In server side (Successful attempt to logon- account logon event)

Questions How many log entries? Where? -2 one in DC and other one in client computer -Account logon events created in the DC -Logon events created in the client computer

Q5 A.What does an RODC do? RODC provides a way to deploy a domain controller more securely in locations that require fast and reliable authentication services but cannot ensure physical security for a writable domain controller. Also, An RODC provides a more secure mechanism for deploying a domain controller. You can grant a no administrative domain user the right to log on to an RODC while minimizing the security risk to the Active Directory forest. You might also deploy an RODC in other scenarios where local storage of all domain user passwords is a primary threat. B.Are there any special considerations? To deploy an RODC, at least one writable domain controller in the domain must be running Windows Server 2008. In addition, the functional level for the domain and forest must be Windows Server 2003 or higher.

C. What new functionality does RODC provide C.What new functionality does RODC provide? RODC addresses some of the problems that are commonly found in branch offices. These locations might not have a domain controller. Or, they might have a writable domain controller but not the physical security, network bandwidth, or local expertise to support it. The following RODC functionality mitigates these problems: Read-only AD DS database Unidirectional replication Credential caching Administrator role separation Read-only Domain Name System (DNS) D.What are the prerequisites for RODC? -Ensure that the forest functional level is Windows Server 2003 or higher. -Run Adprep.exe commands to prepare your existing forest and domains for domain controllers. -Install Active Directory Domain Services (AD DS). -Deploy at least one writable domain controller running Windows Server 2008 or Windows Server 2008 R2

E. What does the following print screen shows E.What does the following print screen shows? What does Advance, Add and Remove button provide? -The Password Replication Policy tab. You can control how credentials caching for users, groups or computers will take place. Allow passwords for the account replicating to this RODC. -Advanced button provides more options: resultant policy , prepopulate password and view passwords are stored on RODC and Accounts that have been authenticated to RODC. -Add and remove buttons to add and remove account.

F. What does the above print screen provide F.What does the above print screen provide? Advanced window provides more options: resultant policy ,prepopulate password and view passwords are stored on RODC and Accounts that have been authenticated to RODC. G.What each of the following mean? Accounts whose passwords are stored on this Read-only Domain Controller :Current credentials that are cached on an RODC Accounts that have been authenticated to this Read-only Domain Controller : accounts have tried to authenticate to an RODC Prepopulate passwords button: prepopulate the password cache for an RODC with the passwords of user and computer accounts before the accounts try to log on in the branch office.