1.  Name: Hatem elbuhaisi  Name no: 120100071  University of Palestine  Miss : yasmen elboboo  Chairing Information Technology Hands-On Microsoft Windows Server 2003 Active Directory 1

2.  Explain basic security concepts in an Active Directory computer network, including discretionary access control lists (DACLs), system access control lists (SACLs), and security principals  Demonstrate the use of DACLs to control access to objects in Active Directory  Demonstrate the use of DACLs to control access to network resources  Describe the user authentication process in an Active Directory domain Hands-On Microsoft Windows Server 2003 Active Directory 2

3.  Security principals can be given permissions to access a resource  Groups can also be granted permissions  A security principal can be a user, an InetOrgPerson object, a computer, or a security group  A contact is not a security principal Hands-On Microsoft Windows Server 2003 Active Directory 3

4.  Unique binary value  Often expressed in Security Descriptor Definition Language (SDDL) format  S-1-identifier authority-subauthority identifier- domain identifier-relative identifier Hands-On Microsoft Windows Server 2003 Active Directory 4

5.  Same structure as a DACL  Determines if the access is audited  Can track changes and log ons Hands-On Microsoft Windows Server 2003 Active Directory 5

6.  “Implicit deny” occurs when no ACE is found  ACEs are normally used to grant access  Deny is used to override an allow as a member of a group  Owners always have access Hands-On Microsoft Windows Server 2003 Active Directory 6

7.  Permissions can be inherited from parent objects such as OUs  Each ACE is marked to indicate whether it was directly applied or inherited Hands-On Microsoft Windows Server 2003 Active Directory 7

8.  There is no good reason to grant permissions explicitly to individual users  In a single-domain forest, use global groups Hands-On Microsoft Windows Server 2003 Active Directory 8

9.  If using machine local accounts, use machine local groups Hands-On Microsoft Windows Server 2003 Active Directory 9

10.  If using a small number of domains and one site  Assign users to global groups  Assign global groups to domain local groups  Grant permissions to the domain local groups Hands-On Microsoft Windows Server 2003 Active Directory 10

11.  Using only universal groups works well in single-domain environments, but not in a large forest  Using domain local, global, and universal groups is the best approach for the same group to access resources in different domains Hands-On Microsoft Windows Server 2003 Active Directory 11

12.  Control can be delegated with precision using Active Directory Hands-On Microsoft Windows Server 2003 Active Directory 12

13.  Used for every tasks Hands-On Microsoft Windows Server 2003 Active Directory 13

14.  The exact and granular permissions available Hands-On Microsoft Windows Server 2003 Active Directory 14

15.  Protecting objects is essential  Most protected resources use a DACL similar in format to Active Directory objects Hands-On Microsoft Windows Server 2003 Active Directory 15

16. Hands-On Microsoft Windows Server 2003 Active Directory 16

17. Hands-On Microsoft Windows Server 2003 Active Directory 17

18.  Three possible identification factors for authentication  Something you know  Something you have  Something you are  Two-factor authentication uses a password and an additional factor to increase security, such as  SecurID  Biometric devices  Smart cards Hands-On Microsoft Windows Server 2003 Active Directory 18