Windows Server 2008 Configuration Part 1 Lab Manual Presented By

Module 5 – Delegating Administrative TasksRequirementsUse the DC1 that was created in Exercise 1.Exercise 1: Delegate Administrative Tasks1.2.3.4.5.6.7.Logon to DC1 with Administrative PermissionsRight-Click Employees OU and choose Delegate Control to launch the Delegation of Control WizardClick NextOn the Users Or Groups page, click the Add buttonUsing the Select dialog, type Help Desl and then click OKClick NextOn the Tasks To Delegate page, select Reset User Passwords And Force Password Change At NextLogon task8. Click Next9. Review the summary of the actions that have been performed and click FinishExercise 2: View Delegated Permissions1.2.3.4.5.6.7.8.9.10.11.Right-Click the Employees OU and Choose PropertiesClick OK to close the Properties dialog boxClick the View menu and Select Advanced FeaturesRight-Click the Employees OU and choose PropertiesClick the Security tabClick the Advanced buttonIn the Permission Entries list, select the first permission assigned to the Help DeskClick the Edit ButtonIn the Permission Entry dialog box, locate the permission that is assigned, and then click OKRepeat steps 7-9 for the second permission entry assigned to the Help DeskRepeat steps 2 – 10 to view the ACL of a user in the Employees OU and to examine the inheritedpermissions assigned to the Help Desk12. Open the command prompt type dsacls “ou employees,dc contoso,dc com” and press Enter13. Locate the permission assigned to the Help Desk Copyright 2010 - Idea Dudes LLCPage 13

Module 6– Automating The Creation of User AccountsRequirementsUse the DC1 that was created in Exercise 1First Level Employees, GroupsA global security group in the Groups OU named SalesExercise 1: Create Users with a User Account 18.19.Log on to DC1 as AdministratorOpen ADUC and expand the domainRight-Click Employees OU and choose New and select UserFirst Name Box type SalesLast Name Box type TemplateUser Logon Name type salestemplate click NextType Pa w0rd in the Password box and Confirm Password boxSelect Account Is Disabled check box , Click NextClick FinishBring up Properties of the salestemplate accountClick Organization TabIn the Department box , type SalesIn the Company box, type Final Vision, Inc.Click the MemberOf tabClick Add ButtonType Sales and click OKClick Profile TabProfile Path box, type \\DC1\profiles\%username%Click OKExercise 2: Create a User with the Dsadd Command1. Open a command prompt2. Type dsadd user “cn Mike Tyson,ou Employees,dc finalvision,dc com” –samid Mike.Tyson –pwd* -mustchpwd yes –hmdir \\DC1\users\%username%\documents -hmdir U:3. You will be prompted to enter a password a password for the user twice. Type Pa w0rd4. Open ADUC and confirm Mike’s account is configured as entered Copyright 2010 - Idea Dudes LLCPage 14

Exercise 3: Import Users with CSVDE1. Open Notepad and create the following file , Enter the following linesDN,objectClass, sAMAccountName,sn,givenName,userPrincipalName“cn Lisa Turro,OU Employees,DC FinalVision,DC vision.com“cn Steve Austin,OU Employees,DC FinalVision,DC @finalvision.com2.3.4.5.Save the file to your Documents folder as Newusers.csvOpen a command promptType cd %userprofile%\Documents and press ENTERCsvde –I –f Newusers.csv –ka. –k continues when an error occurs6. Open ADUC snapin and confirm that users were created7. Examine accounts to ensure all information was createdExercise 4: Import Users with LDIFDE1. Open Notepad and create the following file , Enter the following linesDN: CN April Vow, OU Employees, DC FinalVision,DC ComchangeType: addCN: April VowobjectClass: usersAMAccountName: april.vowuserPrincipalName: april.vow@finalvision.comgivenName: Aprilsn: VowdisplayName: Vow, Aprilmail: april.vow@finalvision.comdescription: Sales Representative in USAtitle: Sales Representativedepartment: Salescompany: Final Vision, Inc.DN: CN April Vow, OU Employees, DC FinalVision,DC ComchangeType: addCN: Tony GuptaobjectClass: usersAMAccountName: Tony.GuptauserPrincipalName: tony.gupta@finalvision.comgivenName: Tonysn: GuptadisplayName: Gupta, Tonymail: Tony.Gupta@finalvision.comdescription: Sales Representative in Indiatitle: Sales Representativedepartment: Salescompany: Final Vision, Inc. Copyright 2010 - Idea Dudes LLCPage 15

2.3.4.5.6.7.Save the file to your Documents folder as Newusers.ldfOpen a command promptType cd %userprofile%\Documents and Press ENTERType ldifde –I –f newusers.ldf –k and Press ENTEROpen ADUC and verify accounts have been createdConfirm the user properties are populated Copyright 2010 - Idea Dudes LLCPage 16

Module 7– Creating Users with Windows PowerShell and VBScriptRequirementsUse the DC1 that was created in Exercise 1First Level Employees, GroupsA global security group in the Groups OU named SalesExercise 1: Install Windows PowerShell1.2.3.4.5.6.7.Logon to DC1 as AdministratorClick the Features node of the Server ManagerClick Add Features linkSelect Windows PowerShell from the Features list, Click NextClick InstallWhen the installation is complete, click CloseRight-Click Windows PowerShell in the Windows PowerShell program group and Pin it the StartMenuExercise 2: Create a User with Windows PowerShell1. Open Windows PowerShell2. Type objOU [ADSI]”LDAP://OU Employees,DC FinalVision,DC Com”a. Connect to the Employees OU3. Type objUser objOU.Create(“user”,”CN Mary Star”)a. Create Mary Star object4. Type . Populates the Pre-Windows 20005. Type objUser.SetInfo()a. Writes account into Active Directory6. Type objUser.distinguishedName7. Type objuser get-membera. Lists the populated attributes Copyright 2010 - Idea Dudes LLCPage 17

Exercise 3: Create a New User with a Windows PowerShell Script1. Log on to DC1 as Administrator2. Open Notepad3. Type the following objOU *ADSI ”LDAP://OU Employees,DC FinalVision,DC Com” objUser objUser.Create(“user”,”CN Scott Milner”) �) objUser.Setinfo()4. Save the script to your Documents folder as “Newuser.ps1”, with quotes to save as a non-textdocument5. Open Windows PowerShell6. Type cd documents and press ENTER7. Type set-executionpolicy remotesigneda. This will enable script execution8. Type .\newuser.ps1 and press ENTER9. Confirm that the user was created in Active DirectoryExercise 4: Create a New User with a VBScript Script1. Open Notepad2. Type the followingSet objOU GetObject(LDAP://OU Employees,DC FinalVision,DC Com)Set objUser objUser.Create(“user”,”CN Toya a.jackson”)objUser.Setinfo()3. Save the script in your Documents folder as “Newuser.vbs”, including the quotes so that it is a nontext document4. Open the command prompt5. Type cd %userprofile%\documents and press ENTER6. Type cscript.exe newuser.vbs7. Confirm that the user was created successfully in Active Directory Copyright 2010 - Idea Dudes LLCPage 18

Module 8– Supporting User Objects and AccountsRequirementsUse the DC1 that was created in Exercise 1First Level Employees, GroupsA global security group in the Groups OU named SalesScott MilnerToya JacksonMary StarExercise 1: View All Attributes of a User1.2.3.4.5.6.7.8.9.10.11.12.13.Logon to DC1 as an AdministratorOpen ADUCOpen Employees OU and Right-Click Scott MilnerChoose PropertiesExamine the tabs of the Properties dialog boxClick the Telephone tab and enter information into the Notes field. Click OKClick View menu and select Advanced FeaturesOpen the Properties of Scott Milner and Click the Attribute Editor tabScroll to locate the info attributeLocate the division attribute, double click it, type Subsidiary and click OKLocate the employeeID attribute, type 12345678 and then click OKExamine the other attributesClick OK to close the Properties dialog boxExercise 2: Manage Attributes of Multiple n the Employees OU , select Scott MilnerHold the CTRL key and select Mary Star and Toya JacksonRight-Click any of the selected users and choose PropertiesOn the General Tab, Select the Office box and type MiamiClick the Account TabClick on the Logon Hours buttonClick Sunday and click the Logon Denied optionClick Saturday and click the Logon Denied option then click OKSelect the Computer Restrictions button and click the Log On to buttonSelect the following optionIn the Computer Name box type DESKTOP01 and click AddRepeat the process for DESKTOP02 and DESKTOP03 then click OKOn the Address tab, select the Street, City, State/Province and Zip/Postal Code boxes and Enterfictitious informationClick the Profile tab and configure the \\DC1\%username%\documents home folderClick the Organizational tab and configure the company name, Final Vision, Inc.Click OKOpen the user objects to confirm that the changes were applied Copyright 2010 - Idea Dudes LLCPage 19

Exercise 3: Manage User Attributes with DS Commands1. Open Windows PowerShell2. Type dsquery user –name “* Milner” dsmod user –office “Sydney” –disabled “Yes”a. Modifies the location and account is disabled3. Confirm the changes in ADUC4. Type dsquery user –name “* Milner” dsget user –samid –upna. This will return the Pre-Windows 2000 account and the UPN of Scott Milner5. Type the following lines in Windows PowerShell objOU *ADSI ”LDAP://CN Scott Milner,OU Employees,DC FinalVision,DC Com” objUser.psbase.InvokeSet(‘AccountDisabled’, false) objUser.Setinfo()6. Confirm changes in ADUC Copyright 2010 - Idea Dudes LLCPage 20

Module 9– Creating and Managing GroupsRequirementsUse the DC1 that was created in Exercise 1First Level Employees, GroupsA global security group in the Groups OU named SalesScott MilnerToya JacksonMary StarExercise 1: Create .19.20.21.Logon to DC1 as an AdministratorOpen ADUC and Select the Groups OURight-Click Groups OU, choose New and then Select GroupIn the Group Name type SalesSelect the Global group scope and Security group type Click OKRight-Click the Sales group and choose PropertiesClick the Members tabClick the Add buttonType: Linda,Toya and click OKClick OK to close the Properties boxCreate two global groups Marketing and ConsultantsCreate a Domain Local group named ACL Sales Folder ReadOpen the properties of the ACL Sales Folder Read groupAdd Sales, Marketing and Consultants to the ACL Sales Folder Read groupAdd LindaOpen the properties for the Marketing groupAdd the ACL Sales Folder Read groupCreate a Sales folder on the C:\Bring up the Advanced Security properties for the SalesClick Edit and click AddClick Advanced , and then click Find Nowa. Notice groups with ACL prefix to assist in finding the groups faster22. Create a new groups called Christmas List and make it a Distribution GroupExercise 2: Convert Group Type and Scope1.2.3.4.5.6.Right-Click the Christmas List and choose PropertiesChange the group type to DistributionClick ApplyChange the group scope to Universal click ApplyChange the group scope to Global click ApplyClick OK to close the Properties dialog box Copyright 2010 - Idea Dudes LLCPage 21

Module 10– Automating the Creation and Management of GroupsRequirementsUse the DC1 that was created in Exercise 1First Level Employees, GroupsA global security group in the Groups OU named SalesScott MilnerToya JacksonMary StarExercise 1: Create a Group with Dsadd1. Logon to DC1 as an Administrator2. Open a command prompt3. Type dsadd group “CN Finance,OU Groups,DC FinalVision,DC Com” –samid Finance Group secgrp yes –scope g4. Confirm that group was created by using ADUCExercise 2: Import Groups with CSVDE1. Open Notepad and type the followingobjectClass, sAMAccountName, DN, membergroup,Accounting,”CN Accounting, OU Groups,DC FinalVision,DC Com”, “CN ScottMilner,OU Employees,DC FinalVision,DC Com”; “CN Mary Star,OU Employees,DC FinalVision,DC Com”2.3.4.5.Save the file to your Documents folder with the name “Importgroups.csv”Open a command promptType csvde –I –f “%userprofile%\importgroups.csv”Confirm the changes in ADUCExercise 3: Modify Group Membership with LDIFDE1. Open Notepad and type the followingdn: CN Accounting, OU Groups, DC FinalVision, DC ComchangeType: modifyadd: membermember: CN Toya Jackson,OU Employees, DC FinalVision,Dc Commember:CN Scott Milner,OU Employees,DC FinalVision,DC Comdn: CN Accounting, OU Groups, DC FinalVision, DC ComchangeType: modifyadd: membermember: CN Mary Star,OU Employees, DC FinalVision,Dc Com Copyright 2010 - Idea Dudes LLCPage 22

2.3.4.5.Save the file to your Documents folder as “Membershipchange.ldf”Open a command promptType ldifde –I –f Confirm that membership of Accounting group has been changedExercise 4: Modify Group Membership with Dsmod1. Open a command prompt2. Type dsmod group “CN Finance, OU Groups, DC FinalVision, DC Com” –addmbr “CN ScottMilner, OU Employees, DC FinalVision, DC Com” “CN Acccounting,OU Groups,DC FinalVision, DC Com”3. Confirm the changes in ADUCExercise 5: Confirm Group Membership with Dsget1.2.3.4.5.6.7.8.9.10.Open a command promptType dsget group “CN Accounting,OU Groups,DC FinalVision,DC Com” –membersPress ENTERType dsget group “CN Finance, OU Groups, DC FinalVision,DC Com” – membersPress ENTERType dsget group “CN Finance, OU Groups, DC FinalVision,DC Com” –members –expandPress ENTERType dsget user “CN Scott Milner, OU Employees, DC FinalVision, DC Com” –memberofPress ENTERType dsget user “CN Scott Milner, OU Employees, DC FinalVision, DC Com” –memberof expand11. Press ENTER Copyright 2010 - Idea Dudes LLCPage 23

Module 11– Administering Groups in an EnterpriseRequirementsUse the DC1 that was created in Exercise 1First Level Employees, GroupsA global security group in the Groups OU named SalesScott MilnerToya JacksonMary StarExercise 1: Create a Well-Documented Group1.2.3.4.5.6.7.8.9.10.11.12.Logon to DC1 as an AdministratorSelect the Groups OU in the console treeRight-Click the Groups OU, choose New and then select GroupGroup Name Box type ACL Budget EditSelect Domain Local in the Group Scope section and Security in the Group Type section, and clickOKClick the View menu and ensure Advanced Features is selectedRight-Click the ACL Budget Edit group and choose PropertiesClick the Object TabSelect the Protect Object From Accidental Deletion check box and Click OKOpen the group’s Properties againDescription box type BUDGET (EDIT)Notes field type the following\\SRV1\data \finance\budget\\SVR2\data \finance\revenue projections13. Click OKExercise 2: Delegate Management of Group Membership1.2.3.4.5.Open the Properties dialog box of ACL Budget Edit groupClick the Manage by tabClick the Change buttonType the user name for Scott Milner and click OKSelect the Manager Can Update Membership List check box Click OK Copyright 2010 - Idea Dudes LLCPage 24

Exercise 3: Validate the Delegation of Membership Management1.2.3.4.Open a command promptType runas /user:Scott cmd.exeEnter the Password Pa w0rdType the following dsmod group “CN ACL Budget Edit, OU Groups, DC FinalVision, DC Com”–addmbr “CN Finance, OU Groups, DC FinalVision, DC Com”5. Close command prompt6. Confirm the changes in ADUC Copyright 2010 - Idea Dudes LLCPage 25

Module 11– Creating Computers and Joining the DomainRequirementsUse the DC1 that was created in Mod 1 Exercise 1First Level Admins, GroupsA global security group in the Admins\Groups OU named Server AdminsA global security group in the Admins\Groups OU named Help DeskEmployees OUScott Milner member of Domain Users and Server AdminsToya JacksonMary Star member of Domain Users and Help DeskExercise 1: Create OUs for Client and Server Computer Objects1. Logon to DC1 as an Administrator2. Open ADUC and expand the domain3. Create Desktops and Servers OUsExercise 2: Create Computers Objects1.2.3.4.5.6.7.8.9.10.Right-Click the Desktops OU and select ComputerComputer Name box DESKTOP101Click the Change button next to the User or Group boxType Help Desk in the Select User Or Group dialog box that will be allowed to join the computer tothe domainClick OKCreate a New Computer in Server OU named Server02Click Change button next to User or Group boxType Server AdminsClick OKClick OKExercise 3: Delegate the Ability to Create Computer Objects1.2.3.4.5.6.7.8.9.10.11.12.Logon to DC1 as an AdministratorOpen ADUCClick View menu and ensure Advanced Features is selectedBring up the properties of Desktops OUClick the Security tabClick AdvancedClick AddType Help DeskClick the Object tabSelect This Object and All Descendant Objects from the Drop-Down listIn the Permissions list select Allow next to Create Computer ObjectsClick OK three timesExercise 4: Redirect the Default Computer Container1. Open a command prompt2. Type redircmp “OU Desktops, DC FinalVision, DC Com” Copyright 2010 - Idea Dudes LLCPage 26

Module 12– Create and Manage a Custom MMCRequirementsUse the DC1 that was created in Mod 1 Exercise 1First Level Admins, GroupsA global security group in the Admins\Groups OU named Server AdminsA global security group in the Admins\Groups OU named Help DeskEmployees OUScott Milner member of Domain Users and Server AdminsToya JacksonMary Star member of Domain Users and Help DeskWindows PowerShell must be installedExercise 1: Create a Computer with Dsadd1.2.3.4.Logon to DC1 as an AdministratorOpen a command promptType dsadd computer “CN DESKTOP100, OU Employees, DC FinalVision, DC Com”Confirm the computer was createdExercise 2: Import Computers by Using CSVDE1. Open ccountName“CN DESKTOP153,OU Desktops,DC FinalVision,DC Com”, computer, DESKTOP153, 4096, DESKTOP153 “CN DESKTOP154,OU Desktops,DC FinalVision,DC Com”, computer, DESKTOP154, 4096, DESKTOP154 “CN SERVER03,OU Servers,DC FinalVision,DC Com”, computer, Server03, 4096, Server03 2.3.4.5.Save the file to your Documents folder as “Computers.csv”Open a command promptType csvde –I –f “%userprofile%\documents\computers.csv”Confirm changes with ADUC Copyright 2010 - Idea Dudes LLCPage 27

Exercise 3: Import Computers by Using LDIF file1. Open Notepad2. Enter the following informationdn: CN Server10, OU Servers, DC FinalVision, DC Com”changeType: addobjectClass: TopobjectClass: personobjectClass: organizationalPersonobjectClass: userobjectClass: computercn: Server10userAccountControl: 4096sAMAccountName: SERVER10 dn: CN Server11, OU Servers, DC FinalVision, DC Com”changeType: addobjectCla

Exercise 1: Install Windows Server 2008 1. Insert the Windows Server 2008 installation DVD 2. Power on the system 3. Select the language, regional settings and keyboard layout that are correct for your system and Click Next 4. Click Install Now 5. Select the Windows Server 2008 Enterprise (Full Installation) and Click Next 6.