- Domain 3: Network Implementation
- What You Will Need
- Lab 1: Active Directory Structure and Permissions
- Lab 2: Services and nbtstat
- Lab 3: Wiring, Part II
- Lab 4: VPN and Authentication Re-visited
- Lab 5: Firewalls, Proxies, and Ports
- Lab 6: Anti-Virus Software
- Lab 7: Fault Tolerance
- Lab 8: Disaster Recovery
- Domain 3 Practice Questions
- Answers and Explanations
This chapter is from the book
This chapter is from the book
This chapter is from the book
Lab 1: Active Directory Structure and Permissions
Orientation
In this procedure you will accomplish the following:
Add users and groups as well as organizational units.
Assign permissions to user accounts.
Identify basic client support and interoperability of different platforms.
Prepare for the Network+ subdomain 3.1
Procedure
Now that you have a working domain and have practiced with some of the technologies inherent to client/server networks, it is now time to implement some of the user administration involved in today’s Microsoft domains. In the following lab you will add a new administrator account on the domain controller, create additional users and groups, configure permissions, and compartmentalize the network’s structure.
Create a second administrator account.
Go to PC2 (Windows 2000 Server).
Click the Start button, choose Programs, select Administrative Tools, and choose Active Directory Users and Computers to open the Active Directory Users and Computers console window.
In the left pane, right-click the Users entry, select New, and then select User, as shown in Figure 3.1.
In the New Object – User screen, type the following (see Figure 3.2):
First name: John
Last name: Smith
Full name: John Smith (this should be entered automatically)
User logon name: john_smith Remember to put an underscore between john and smith, as illustrated in Figure 3.2.
Click Next.
Type a password that you will remember and then type it a second time to confirm it. Notice on this screen the additional options for passwords and the ability to disable the account as you see fit.
Click Next.
View the summarized information, and then click Finish. The new user should be listed at the bottom of your objects list, as shown in Figure 3.3.
By default, users are given restricted rights, and are only known as a domain user. To make this person an administrator, add him to the administrators group.
Right-click the new user, John Smith.
Select Properties.
In John Smith's Properties dialog box, click the Member Of tab, as shown in Figure 3.4.
Click the Add button.
In the new window select the Administrators group and the Domain Administrators group, and click Add.
Both groups are listed in the bottom section of the Add dialog box. Click OK to return to John Smith's Properties dialog box; the resulting information should look like Figure 3.5.
Set the primary group.
Click the Domain Admins entry and, in the bottom of the Properties dialog box, click the Set Primary Group button.
Click OK. You now have another account with which you can administer the domain.
Press Ctrl+Alt+Del.
Verify that you can log on as the new user, john_smith. Don't forget your new password for this account. When you're finished, log off the new account and log back on as administrator.
Create additional users and groups.
Return to the Active Directory Users and Computers window.
Using the same method as with the john_smith account, create a few more users for practice, calling them User1, User2, and User3. You do not need passwords for these accounts, nor do you need to change their group membership.
Go to PC1 (Windows 2000 Professional).
Boot the computer and log on as User1 to the testlab.com domain. (Remember to always select that network in the Log on To drop-down box.) You don't really need a password for the purposes of this lab, so click OK. Keep in mind, however, that you would normally want a password to protect your accounts.
You are now logged on as a typical user with restricted rights. To prove it, right-click My Network Places and choose Properties.
Right-click the LAN card and select Properties.
Double-click Internet Protocol to open the Internet Protocol (TCP/IP) Properties dialog box. A pop-up window, shown in Figure 3.6, notifies you that you do not have sufficient privileges to access these configurations. Click OK.
You may have noticed in the LAN Card’s property box that the check boxes are grayed out, as are the buttons to install, uninstall, and so on. User1 doesn’t have rights to configure anything on this system. User1 can save data, but that is about it. This is a security feature of Windows 2000/2003 domains.
Return to PC2 and access Active Directory Users and Groups again.
After you have created users, you will usually want to group them. This time you will group your users together for purposes of assigning rights to multiple users at one time.
Right-click Users, choose New, and select Group.
Type the name testgroup. It should look like Figure 3.7.
Click OK. If you scroll down, you should now see testgroup listed at the bottom. Notice that the icon has two heads instead of one; that signifies a group.
Add two of your test accounts to the group as members. To begin, double-click the testgroup group; the Testgroup Properties dialog box opens.
Click the Members tab.
Click Add.
Select User2 and User3 and click Add. The users you selected will appear in the bottom pane, as illustrated in Figure 3.8.
Click OK. You will now see the users in the Members list.
Click OK to close the Testgroup Properties dialog box. You have made your group! You will apply rights to the group in just a little bit.
Configure permissions.
Still on PC2, open Windows Explorer.
Create a folder called Downloads and share it just as you did a while back on PC1. (Right-click it, select Sharing, select Share As in the pop-up window that appears, and click OK.)
Right-click the folder and select Properties open the Downloads folder's Properties dialog box.
Click the Security tab. The resulting dialog box should look like Figure 3.9.
Click Add. The resulting dialog box contains a list of users and groups, which you can sort by their column header. For example, if you click Name, the objects will be sorted alphabetically or anti-alphabetically, depending on how many times you click.
Scroll down until you find the Testgroup group. Click that group to select it and then click Add, as shown in Figure 3.10.
Click OK. This returns you to the Security tab of the Downloads folder's Properties dialog box. Notice that the Testgroup is highlighted and that it shows a different set of permissions than the Everyone group. The Testgroup, which includes User2 and User3, has basic access to the Downloads folder, which you can customize at will.
Add one more set of permissions.
Click Add.
Select Administrators from the list and click Add.
Click OK. The Administrators group should show up in the Security tab of the Downloads folder's Properties dialog box.
With the Administrators group selected in the top pane, click the Allow check box next to the Full Control entry in the bottom pane, as shown in Figure 3.11. Now the Administrators group has full control of the folder, and the Testgroup group has only limited control.
Deselect the Allow inheritable permissions check box at the bottom of the window.
When the pop-up window appears, click Remove. This removes the Everyone group from the list.
Click OK.
Return to Windows Explorer, open the Downloads folder, and create a new text document inside it. Call the document Test.
Switch to PC1.
Log off and log back on as User2.
Access Windows Explorer.
Open Tools menu select Map Network Drive.
In the window that appears, select drive letter F: and type the path \\192.168.1.200\downloads as shown in Figure 3.12. This will map the drive to the folder on PC2 that you just configured.
Click Finish. This opens a new window for the mapped drive and shows the test file you created in the Downloads share.
Compartmentalize the network structure.
Return to PC2.
Open the Active Directory Users and Computers window.
In the left pane, right-click the name of your domain, testlab.com, select New, and select Organizational Unit, as shown in Figure 3.13.
Name the organizational unit Marketing.
Click OK. In the left pane, you should see the Marketing organizational unit listed. This entry is accompanied by the directory icon, which contains a folder with a book on it.
Right-click the Marketing organizational unit, select New, and select User.
Create a user named User4, just as you did before, and click OK. Notice that this user shows up in the Marketing organizational unit, as opposed to the main Users folder in the domain. This allows you to compartmentalize the user accounts, computer accounts, and groups. Normally an admin would do this by department—for example, creating organization units for customer service, accounting, marketing, and so on. You can also add policies for those specific objects in each organizational unit and have a different policy for each.
)
Figure 3.1 Creating a new user.
)
Figure 3.2 Details of the new user.
)
Figure 3.3 The new user.
)
Figure 3.4 Member Of tab in the new user account’s Properties dialog box.
)
Figure 3.5 Member Of tab re-visited
)
Figure 3.6 Restricted user rights.
)
Figure 3.7 Creating a group.
)
Figure 3.8 Adding members to a group.
)
Figure 3.9 The Security tab.
)
Figure 3.10 Adding a group to the permissions of Downloads.
)
Figure 3.11 Giving full permissions to the administrators.
)
Figure 3.12 Mapping a drive to the Downloads share on PC2.
)
Figure 3.13 Creating an organizational unit.
Working with Interoperability
Great work! That is some of the basic user administration you need to know for the field and for the Network+ exam. Now let’s uncover a little bit on interoperability between the different platforms out there:
Client Services for NetWare (CSNW). This is Microsoft software that can be installed to allow a Microsoft Windows client (for example, Windows 2000 Professional) to log in to a NetWare server, access NetWare resources and data, or both! It is installed from your NIC’s Properties dialog box as an add-on component known as a client.
Gateway Services for NetWare (GSNW). This is also Microsoft software, but it is an add-on to Windows 2000 Server. It allows an entire group of Windows 2000 Professional or other clients to access NetWare resources through one access point. That way, instead of the clients logging in to the Novell server, they can simply remain logged on to the Windows Server. Also, when GSNW is used, there is no need to load CSNW on every single individual client. You just load the GSNW service on the server.
Novell Client. Novell makes software to allow Microsoft clients to connect to Novell NetWare resources. This software installs on the Windows client, and will automatically enable you to see any NetWare servers on the network upon login. It is free on Novell’s website. Many administrators believe this to be better written software than the Microsoft client, but it will depend on your situation. The latest version is 4.91 and can be downloaded from http://download.novell.com. (You may have to search a little. If so, search for "Novell Client 4.91".) Alternatively, use the direct link at http://www.technicalblog.com in the Downloads section.
Connect Windows systems to Novell NetWare.
Log off of PC1 and log back on as Administrator.
Right-click My Network Places and select Properties.
Right-click the LAN card and select Properties.
Click the Install button.
Choose Client, and click Add. The only client option that comes up is CSNW. We are not using this client right now so just cancel out of the windows for now.
On PC2, repeat steps a–c to access the LAN card's Properties dialog box.
Click the Install button.
Choose Client, and click Add.
You should see GSNW as the only option.
Cancel out of these windows.
Connect Windows systems to Linux. If you want Windows clients to access a Linux system, you must install Samba on the Linux system. This allows for the emulation of server message blocks, as with Microsoft systems. With this, Windows clients can map drives as they normally would. Linux uses the Line Printer Daemon for printing services. Of course, Windows clients can also connect via FTP, which is a common alternative without any other services needed.
Connect Windows systems to Apple and vice versa. Macintosh has developed a system known as Server Message Block/Common Internet File System (SMB/CIFS). This allows the clients on both platforms to access each other. AppleTalk Filing Protocol (AFP) can also be used on the Mac side for Mac clients to see the Windows Server resources. In addition, you can install File and Print services for Macintosh on the Windows 2000 Server.
Go to PC2.
Click the Start button, choose Settings, and select Control Panel.
Double-click Add/Remove Programs.
On the left side, click Add/Remove Windows Components.
In the window that opens, scroll down to Other Network File and Print Services and click Details to view the File Services for Macintosh and Printer Services for Macintosh options.
Connect UNIX systems to Windows. Although both platforms are written in the C language, the two use different coding for TCP/IP and services. Therefore, you need to connect the two via a sort of gateway. You can allow clients on a UNIX network to access Windows systems by installing the proper component on the Windows Server.
Go to PC2.
Click the Start button, choose Settings, and select Control Panel.
Double-click Add/Remove Programs.
On the left side, click Add/Remove Windows Components.
In the window that opens, scroll down to Other Network File and Print Services and click Details to view the Print Services for UNIX.
Cancel out of these windows for now.
That’s it for this lab. Let’s go over what you covered.
What Did I Just Learn?
In this lab you learned how to add objects, set up permissions, create a network structure, and work with interoperability. Specifically, you learned how to do the following:
Add users and groups.
Create organizational units.
Set permissions on resources.
Configure Linux, UNIX, Apple, and Microsoft to talk to each other.