Unit 6 NT1330 Client-Server Networking II Date: 7/19/2016 ITT TECHNICAL INSTITUTE NT1330 Client-Server Networking II Date: 7/19/2016 Instructor: Williams Obinkyereh

Class Agenda 1 Learning Objectives Lesson Presentation, Discussions and video. Assignments and Lab Activities. Break Times. 10 Minutes break in every 1 Hour. Note: Submit all Assignment and labs due today.

Class Agenda 2 Theory : Unit 6:00pm-8:00pm) Lab : (8:15pm to 11:00pm) Text book: Windows Server 2008 Active Directory Configuration MOAC 70-640-Lesson 5

Active Directory Administration Lesson 5

Skills Matrix Technology Skill Objective Domain Objective # Creating Users, Computers, and Groups Automate creation of Active Directory accounts 4.1 Maintain Active Directory accounts 4.2

Understanding User Accounts Three types of user accounts can be created and configured in Windows Server 2008: Local accounts. Domain accounts. Built-in user accounts.

Local Accounts Used to access the local computer only and are stored in the local Security Account Manager (SAM) database on the computer where they reside. Never replicated to other computers, nor do these accounts have domain access.

Domain Accounts Accounts used to access Active Directory or network-based resources, such as shared folders or printers. Account information for these users is stored in the Active Directory database and replicated to all domain controllers within the same domain. A subset of the domain user account information is replicated to the global catalog, which is then replicated to other global catalog servers throughout the forest.

Built-in User Accounts Automatically created when Microsoft Windows Server 2008 is installed. Built-in user accounts are created on a member server or a standalone server. When you install Windows Server 2008 as a domain controller, the ability to create and manipulate these accounts is disabled.

Built-in User Accounts By default, two built-in user accounts are created on a Windows Server 2008 computer: Administrator account. Guest account. Built-in user accounts can be local accounts or domain accounts, depending on whether the server is configured as a standalone server or a domain controller.

Creating and Managing User Accounts User accounts are usually created and managed with Active Directory Users and Computers.

Group Accounts Groups are implemented to allow administrators to assign rights and permissions to multiple users simultaneously. A group can be defined as a collection of user or computer accounts that is used to simplify the assignment of rights or permissions to network resources. Emphasize that when assigning rights, it is always preferred to assign first to groups before assigning to users.

Group Accounts By using groups, multiple users can be given the same permission level for resources on the network. Since a user’s access token is only generated when they first log on to the network from their workstation, if you add a user to a group, they will need to log off and log back on again for that change to take effect. Troubleshooting 101. You must log off to get new tokens when added to a group.

Group Types Distribution groups – Non-security-related groups created for the distribution of information to one or more persons. Security groups - Security-related groups created for purposes of granting resource access permissions to multiple users. You cannot assign rights and permissions to a distribution group.

Group Nesting Users can be members of more than one group. Groups containing groups is called group nesting.

Group Scopes Global Domain Local Universal

Using Global and Domain Local Groups These groups can include users, computers, and other global groups from the same domain. You can use them to organize users who have similar functions and therefore similar requirements on the network. Domain local These groups can include users, computers, and groups from any domain in the forest. They are most often utilized to grant permissions for local resources and may be used to provide access to any resource in the domain in which they are located.

Universal Groups These groups can include users and groups from any domain in the AD DS forest and can be employed to grant permissions to any resource in the forest. A universal group can include users, computers, and global groups from any domain in the forest. Changes to universal group membership lists are replicated to all global catalog servers throughout the forest.

Creating and Managing Groups Creating and managing groups is usually done with Active Directory Users and Computers.

Creating Users and Groups Active Directory Users and Computers. Batch files. Comma-Separated Value Directory Exchange (CSVDE). LDAP Data Interchange Format Directory Exchange (LDIFDE). Windows Script Host (WSH).

Unit 6 Assignments and Labs Unit 6. Assignment 1. AD User/Group Design Scenario Unit 6. Exercise 1. AD User and Group Account Creation Unit 6. Lab 1. Creating and Managing Users and Groups