Module 3: Planning Administrative Access

Overview Determining the Appropriate Administrative Model Designing Administrative Group Strategies Planning Local Administrative Access Planning Remote Administrative Access

 Determining the Appropriate Administrative Model Choosing Centralized Administrative Models Choosing Decentralized and Hybrid Administrative Models Identifying Network Resource Administrative Tasks Identifying Administrative Tasks Defining Security Management Tasks

Choosing Centralized Administrative Models Centralized Administration ! ! ? ? i i

Choosing Decentralized and Hybrid Administrative Models Decentralized Resource Administration Human Resources Dept. Centralized User Account Administration Decentralized Administration Hybrid Administration

Identifying Network Resource Administration Tasks Network Resources Account Administration ! ! ? ? i i Resource Administration Backup Administration

Identifying Administrative Tasks Storage Management Batch/Output Management Problem Management Performance Management Security Management Change and Configuration Management Change and Configuration Management Event Management

Defining Security Management Tasks Secure Physical Systems and Devices Manage Users, Groups, and Policies Define and Implement Authentication and Data Transmission Security Control and Monitor Access to Shared Resources Create and Implement an Audit Policy Create and Implement a Backup and Recovery Plan Create and Implement Desktop Policies Storage Management Batch/Output Management Problem Management Performance Management Change and Configuration Management Event Management Security Management

 Designing Administrative Group Strategies Creating Custom Groups Nesting Groups Managing Administration Memberships

Custom Groups Default Group Rights: Backup Restore Rights: Backup Rights: Restore Backup Operators Backup Only Restore Only Creating Custom Groups

Nesting Groups Employee Reviewers (Universal Group) Employee Records (Domain Local Group) Sales Mgrs (Global Group) IS Mgrs (Global Group) Product Mgrs (Global Group) All Managers (Global Group) Human Resources (Global Group) Rights and permissions to modify employee records allocated to group Rights and permissions to modify employee records allocated to group

Managing Administration Memberships Using Restricted Groups Monitoring Memberships

 Planning Local Administrative Access Controlling Physical Administration Points Planning Logical Security Settings Using the RunAs Service

Controlling Physical Administration Points Physical Security Smart Card Logon Access Cert ReaderReader Smart Card

Planning Logical Security Settings Restrictive Logon Hours Xy!2#Hv*j Strong Passwords Workstation Restrictions Active Directory User Account Options Smart Card

Running Applications Providing Alternate Credentials Using the RunAs Service User Account Process User Account Process User Account Process Administrative Account Process

Demonstration: Using the RunAs Service

 Planning Remote Administrative Access Encrypted Authentication and Data Transmission Customizing Microsoft Management Console Using Terminal Services for Remote Administration Using Telnet for Remote Administration

Encrypted Authentication and Data Transmission Securing Authentication Securing PPP and PPTP Connections Securing L2TP Connections Design Decisions

Customizing Microsoft Management Console Save As RemoteAdminConsole.msc Restricting Access to MMC Distributing MMC

Using Terminal Services for Remote Administration Server Running Terminal Services Administrator Computer Running Terminal Services Client Encrypted Screen Data Encrypted Keyboard and Mouse Data User Rights Administrator Security Data Encryption Additional Security Considerations

Using Telnet for Remote Administration

Lab A: Planning Secure Administrative Access

Review Determining the Appropriate Administrative Model Designing Administrative Group Strategies Planning Local Administrative Access Planning Remote Administrative Access