20411B-ENU-TrainerHandbook

4-22 Managing User and Service Accounts

 Task 3: Configure and apply a fine-grained password policy

1.On LON-DC1, open the Active Directory Administrative Center console.

2.Change the group scope for the Managers group to Global.

Note: Ensure you open the Properties page for the Managers group, and not the Managers OU.

3.In Active Directory Administrative Center, configure a fine-grained password policy for the Adatum\Managers group with the following settings:

o Name: ManagersPSO o Precedence: 10

o Password length: 15 characters o Password history: 20 passwords o Complexity enabled: Yes

o Minimum password age: 1 day

o Maximum password age: 30 days

o Number of failed logon attempts allowed: 3 attempts o Reset failed logon attempts count after: 30 minutes

o Until an administrator manually unlocks the account: selected

4.Close Active Directory Administrative Center.

Results: After completing this exercise, you will have configured password-policy and account-lockout settings.

Exercise 2: Creating and Associating a Managed Service Account

Scenario

You need to configure a managed service account to support a new Web-based application that is being deployed to the DefaultAppPool Web service on LON-DC1. Using a managed service account will help maintain the password security requirements for the account.

The main tasks for this exercise are as follows:

1.Create and associate a Managed Service Account.

2.Install a managed service account on a LON-DC1.

3.To prepare for the next module.

 Task 1: Create and associate a Managed Service Account

1.On LON-DC1, open the Active Directory Module for Windows PowerShell console.

2.Create the KDS root key by using the Add-KdsRootKey cmdlet. Make the effective time minus 10 hours, so the key will be effective immediately.

3.Create the new service account named Webservice for the host LON-DC1.

PROHIBITED USE STUDENT .ONLY USE MCT

4-24 Managing User and Service Accounts

Module Review and Takeaways

Common Issues and Troubleshooting Tips

User accounts contained in a .csv file fail to import when using the Comma-Separated Values Data Exchange tool.

User password settings are not applying as expected.

The New-ADServiceAccount cmdlet fails with key-related messages.

Tools

PROHIBITED USE STUDENT .ONLY USE MCT

Module 5

Implementing a Group Policy Infrastructure

Contents:

Module Overview

Group Policy provides an infrastructure within which you can define settings centrally and deploy them to users and computers in your enterprise. In an environment managed by a well-implemented Group Policy infrastructure, very little configuration takes place by an administrator directly touching a user’s computer. You can define, enforce, and update the entire configuration by using the settings in Group Policy Objects (GPOs) or GPO filtering. By using GPO settings, you can affect an entire site or domain within an enterprise, or narrow your focus to a single organizational unit (OU). This module will detail what Group Policy is, how it works, and how best to implement it in your organization.

Objectives

After completing this module, you will be able to:

•Describe the components and technologies that comprise the Group Policy framework.

•Configure and understand a variety of policy setting types.

•Scope GPOs by using links, security groups, Windows® Management Instrumentation (WMI) filters, loopback processing, and preference targeting.

•Describe how GPOs are processed.

•Locate the event logs that contain Group Policy-related events and troubleshoot the Group Policy application.

5MCT-1 USEONLY

STUDENT . PROHIBITED USE

5-2 Implementing a Group Policy Infrastructure

Lesson 1

Introducing Group Policy

A Group Policy infrastructure has several interacting components, and you need to understand what each component does, as well as how they work together and how you can assemble them into different configurations. This lesson provides a comprehensive overview of Group Policy components, procedures, and functions.

Lesson Objectives

After completing this lesson, you will be able to:

•Identify the business requirements for configuration management.

•Describe the core components and terminology of Group Policy.

•Explain the benefits of implementing GPOs.

•Describe GPOs.

•Explain the function and behavior of the client-side GPO components.

•Explain GPO refresh.

•Create and configure GPOs.

What Is Configuration Management?

If you have only one computer in your environment—at home, for example—and you need to modify the desktop background, you can achieve that in several different ways. Most people would probably open Appearance and Personalization from Control Panel, and make the change by using the Windows interface. While that works well for one computer, it may be tedious if you want to make the change across multiple computers. Implementing any change

and maintaining a consistent environment is more difficult with multiple computers.

Configuration management is a centralized approach to applying one or more changes to one or more users or computers. The key elements of configuration management are:

•Setting. A setting is also known as a centralized definition of a change. The setting brings a user or a computer to a desired state of configuration.

•Scope. The scope of the change is the ability to change users’ computers.

•Application. The application is a mechanism or process that ensures that the setting is applied to users and computers within the scope.

Group Policy is a framework within Windows—with components that reside in Active Directory® Domain Services (AD DS), on domain controllers, and on each Windows server and client—that enables you to manage configuration in an AD DS domain.

PROHIBITED USE STUDENT .ONLY USE MCT

5-4 Implementing a Group Policy Infrastructure

Benefits of Using Group Policy

Group Policies are very powerful administrative tools. You can use them to push various settings to a large number of users and computers.

Because you can apply them to various levels from local to domain, you also can focus these settings very precisely.

Primarily, you can use Group Policies to configure settings that you do not want users to configure. Additionally, you can use Group Policies to standardize desktop environments on

all computers in an OU or in an entire enterprise, to provide additional security and some advanced

system settings, and for other purposes that the following sections detail.

Apply Security Settings

In the Windows Server® 2012 operating system, GPOs include a large number of security-related settings that you can apply to both users and computers. For example, you can enforce settings for Windows Firewall, and configure auditing and other security settings. You also can configure full sets of user-rights assignments.

Manage Desktop and Application Settings

You can use a Group Policy to provide a consistent desktop and application environment to all users in your organization. By using GPOs, you can configure each setting that affects the look and feel of user environment and also configure settings for some applications that support GPOs.

Deploy Software

Group Policies enable you to deploy software to users and computers. You can use Group Policy to deploy all software that is in the .msi format. Additionally, you can enforce automatic software installation or you can let your users decide whether they want the software to deploy to their machines.

Note: Deploying large packages with GPOs may not be the most efficient way of distributing an application to your organization’s computers. In many circumstances, it may be more effective to distribute the applications as part of the desktop computer image.

Manage Folder Redirection

With folder redirection, you can manage and back up data quickly and easily. By redirecting folders, you also ensure that users have access to their data regardless of the computer on which they sign in. Additionally, you can centralize all users’ data to one place on the network server, while still providing a

user experience that is similar to storing these folders on their computers. For example, you can configure folder redirection to redirect the users’ Documents folders to a shared folder on a network server.

Configure Network Settings

Using Group Policy enables you to configure various network settings on client computers. For example, you can enforce settings for wireless networks to allow users to connect only to specific service set identifiers (SSIDs), and with predefined authentication and encryption settings. You also can deploy policies that apply to wired network settings as well as configure the client side of services, such as Network Access Protection (NAP).

PROHIBITED USE STUDENT .ONLY USE MCT