Differences between revisions 15 and 47 (spanning 32 versions)
⇤ ← Revision 15 as of 2014-10-07 12:16:54 →
Size: 1525
Editor: scot
Comment:
← Revision 47 as of 2022-09-29 18:26:02 → ⇥
Size: 2789
Editor: scot
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
## page was renamed from WindowsAdministration/Lab04OuGroupLab
Line 2: Line 3:
== Instructions ==
In this lab you will use the organizational units, groups and users in your AD that we created last time to delegate control to managers of their department users. Then we will setup a share for each department and for each user. In your domain controller (Using the RSAT tools or powershell):
Line 3: Line 6:
== Instructions ==  1. Delegate control over users in the OU_Sales Organizational unit to jpatterson so that he can change their password, but nothing else.
    a. Right click on the OU, select Delegate control, Add the user.
    a. On theTasks to Delegate select only the following:
       1. Reset user passwords and force password change at next logon
       1. Reset inetOrgPerson passwords and force password change at next logon
       1. Read all inetOrgPerson information
 1. Delegate control over users in the OU_Developers Organizational unit to kthompson
    a. like the first one...
 1. Delegate control over users in the OU_CSuite Organizational unit to kthompson
    a. ...
Line 5: Line 17:
In this lab you will create some organizational groups and users in Shares:
Line 7: Line 19:
In your primary domain:  1. Create a share for each group Sales, Developers and Managers and make sure the groups have read/write access to the share.
    a. On C:\ create a folder called shares, we will use this for all our shares.
    a. Create folders in c:\shares named:
       1. sales
       1. developers
       1. managers
       1. home
    a. Share and Assign permissions to the sales, developers and managers
       1. Right click on sales, select properties, sharing, Share...
       1. add the sales group and set permission level to "Read/Write" and share.
       1. Select the security tab and make sure that the sales group does not have full control. Remove if that right by clicking on edit, selecting sales and unchecking Full Control.
    a. Repeat these steps for developers and managers.
 2. Create shares for users: Follow the directions at https://www.petenetlive.com/KB/Article/0000739 to complete this.
Line 9: Line 33:
 1. Create an organizational unit named {{{OU_Contractors}}}
    a. Create a global group in the {{{OU_Contractors}}} called {{{g_contractors}}}
    a. Create a user called {{{contractor}}} and put them in {{{g_contractors}}} group.
 1. Create a user mgr in the users folder.
    a. Make mgr the Administrator for the {{{OU_Contractors}}} by using the delegation wizard.
    a. set his password as {{{Hello123Password!}}} Make sure there is no requirement to change the password.
    a. Make mgr a member of the server operators group and give the account remote desktop access.
    a. Start Group Policy - Find the Domain Controllers Folder/OU, right click on the Default Domain Controller Policy, click edit
       1. Navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assgnments
       1. Add the mgr user to the "Allow Logon through remote desktop services" list.
    a. I will test mgr's ability by changing the password for "contractor"
Line 21: Line 34:
In your subdomain:

 1. Create a domain local group called {{{dl_temporary}}} in the users folder.
    a. Add {{{g_contractors}}} group to the {{{dl_temporary}}} group.
    
Line 28: Line 36:
 1. Document the OU structures added and Groups added to each domain.
 2. Do this in a new page called Lab04 and Create new pages called "Organizational Units" and "Groups" 		 1. Document the delegations for control that you made in the "Organizational Units" section.
 1. Document the Share created and its purpose in a new section called "Shared Resources"

== Video Grade Guide ==
||'''Topics''' ||'''Points''' ||
||Video Shows: Login as one of the manager users using remote desktop and change a user's password for which they have been delegated control || 40 ||
||Video Shows: Login as the user you changed the password for and show that it worked.
||Video Shows: Shares by going to \\cptr230a and showing shares. Access shares that the manager should have access too, and show that they are denied access to shares they shouldn't have access to. || 40 ||
||Video talks through the required documentation. ||20 ||

Lab 04

Instructions

In this lab you will use the organizational units, groups and users in your AD that we created last time to delegate control to managers of their department users. Then we will setup a share for each department and for each user. In your domain controller (Using the RSAT tools or powershell):

  1. Delegate control over users in the OU_Sales Organizational unit to jpatterson so that he can change their password, but nothing else.
    1. Right click on the OU, select Delegate control, Add the user.
    2. On theTasks to Delegate select only the following:
      1. Reset user passwords and force password change at next logon
      2. Reset inetOrgPerson passwords and force password change at next logon
      3. Read all inetOrgPerson information
  2. Delegate control over users in the OU_Developers Organizational unit to kthompson
    1. like the first one...
  3. Delegate control over users in the OU_CSuite Organizational unit to kthompson
    1. ...

Shares:

  1. Create a share for each group Sales, Developers and Managers and make sure the groups have read/write access to the share.
    1. On C:\ create a folder called shares, we will use this for all our shares.
    2. Create folders in c:\shares named:
      1. sales
      2. developers
      3. managers
      4. home
    3. Share and Assign permissions to the sales, developers and managers
      1. Right click on sales, select properties, sharing, Share...
      2. add the sales group and set permission level to "Read/Write" and share.
      3. Select the security tab and make sure that the sales group does not have full control. Remove if that right by clicking on edit, selecting sales and unchecking Full Control.
    4. Repeat these steps for developers and managers.

  2. Create shares for users: Follow the directions at https://www.petenetlive.com/KB/Article/0000739 to complete this.

Documentation

  1. Document the delegations for control that you made in the "Organizational Units" section.
  2. Document the Share created and its purpose in a new section called "Shared Resources"

Video Grade Guide

Topics

Points

Video Shows: Login as one of the manager users using remote desktop and change a user's password for which they have been delegated control

40

||Video Shows: Login as the user you changed the password for and show that it worked.

Video Shows: Shares by going to \\cptr230a and showing shares. Access shares that the manager should have access too, and show that they are denied access to shares they shouldn't have access to.

40

Video talks through the required documentation.

20

WindowsAdministration/Lab04DelegationAndShares (last edited 2024-10-03 19:39:01 by scot)