Добавил:

Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.

Вуз:

Алматинский университет энергетики и связи

Предмет:

[НЕСОРТИРОВАННОЕ]

Файл:

20411B-ENU-TrainerHandbook

.pdf

Скачиваний:

237

Добавлен:

01.05.2015

Размер:

16.48 Mб

Скачать

☆

<<< < Предыдущая 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 4546 / 5346 47 48 49 50 51 52 53 > Следующая >>>

Administering Windows Server® 2012

 Task 2: Create and delete test users

1.In Active Directory Administrative Center, double-click the Research OU.

2.In the Task pane, click New, and then click User.

3.Enter the following information under Account, and then click OK: o Full name: Test1

o User UPN logon: Test1 o Password: Pa$$w0rd

o Confirm password: Pa$$w0rd

4.Repeat the previous steps to create a second user, Test2.

5.Select both Test1 and Test2. Right-click the selection, and then click Delete.

6.Click Yes at the confirmation prompt.

 Task 3: Restore the deleted users

L3-MCT19

ONLY USE .

5.	Confirm that Test1 is now located in the Research OU and that Test2 is in the IT OU.	STUDENT
1.	In Active Directory Administrative Center, click Adatum (Local), and then double-click Deleted
	Objects.
2.	Right-click Test1, and then click Restore.
3.	Right-click Test2, and then click Restore To.
4.	In the Restore To window, click the IT OU, and then click OK.

 To prepare for the next module

When you finish the lab, revert the virtual machines to their initial state by completing the following steps:

1.On the host computer, start Hyper-V Manager.

2.In the Virtual Machines list, right-click 20411B-LON-DC1, and then click Revert.

3.In the Revert Virtual Machine dialog box, click Revert.

4.Repeat steps 2 and 3 for 20411B-LON-SVR1.

Results: After completing this exercise, you will have configured the Active Directory Recycle Bin.

PROHIBITED USE

MCT USE ONLY. STUDENT USE PROHIBITED

L4-21

Module 4: Managing User and Service Accounts		MCT
Lab: Managing User and Service Accounts		MCT
Lab: Managing User and Service Accounts		USE
Exercise 1: Configuring Password-Policy and Account-Lockout Settings
 Task 1: Configure a domain-based password policy
1.	On LON-DC1, in Server Manager, click Tools, and then click Group Policy Management.
1.
2.	In Group Policy Management, expand Forest: Adatum.com. expand Domains, expand
	Adatum.com, expand Group Policy Objects, right-click Default Domain Policy, and then click Edit.
3.	In the Group Policy Management Editor, in the navigation pane, under Computer Configuration,	ONLY.
	expand Policies, expand Windows Settings, expand Security Settings, expand Account Policies,
	and then click Password Policy.
4.	Double-click Enforce password history.

5.	In the Enforce password history Properties window, type 20 in the Keep password history for field,
	and then click OK.
6.	Double-click Maximum password age.
7.	In the Maximum password age Properties window, type 45 in the Password will expire in field, and
	then click OK.
8.	Double-click Minimum password age.
9.	In the Minimum password age Properties window, ensure that the Password can be changed after
	field is 1, and then click OK.
10.	Double-click Minimum password length.
11.	In the Minimum password length Properties window, type 10 in the Password must be at least field,
	and then click OK.	STUDENT
	and then click OK.	USE
12. Double-click Password must meet complexity requirements.
13.	In the Password must meet complexity requirements Properties window, click Enabled, and then
	click OK.
14. Do not close the Group Policy Management Editor.
14. Do not close the Group Policy Management Editor.

1.In the Group Policy Management Editor, in the navigation pane, click Account Lockout Policy. PROHIBITED

2.Double-click Account lockout duration.

3.In the Account lockout duration Properties window, click Define this policy setting, type 30 in the minutes field, and then click OK.

4.In the Suggested Value Changes window, note the suggested values, including the automatic configuration of Account lockout threshold, and then click OK.

5.Double-click Reset account lockout counter after.

6.In the Reset account lockout counter after Properties window, type 15 in the Reset account lockout counter after field, and then click OK.

7.Close Group Policy Management Editor.

8.Close Group Policy Management.

L4-22 Managing User and Service Accounts

 Task 3: Configure and apply a fine-grained password policy

1.On LON-DC1, in Server Manager, click Tools, and then click Active Directory Administrative Center.

2.In Active Directory Administrative Center, in the navigation pane, click Adatum (local).

3.In the details pane, double-click the Managers OU.

4.In the details pane, right-click the Managers group, and then click Properties.

USE MCT

5.In Active Directory Administrative Center, in the navigation pane, click Adatum (local). ONLY

6.In the details pane, double-click the System container.

7.In the details pane, right-click the Password Settings Container, click New, and then click Password.

Settings.

8.In the Create Password Settings window, complete the following steps: STUDENT

a.Type ManagersPSO in the Name field.

b.Type 10 in the precedence field.

c.Type 15 in the Minimum password length field.

d.Type 20 in the Number of passwords remembered field.

e.Type 30 in the Enforce maximum password age field.

f.Click Enforce account lockout policy.

g.Type 3 in the Number of failed logon attempts field.

h.Type 30 in the Reset failed logon attempts count field.

i.Click the Until an administrator manually unlocks the account option. USE

9.In the Directly Applies to section, click Add.

10.In the Enter the object names to select field, type Adatum\Managers, click Check Names, and then click OK.

11.In the Create Password Settings window, click OK. PROHIBITED

12.Close Active Directory Administrative Center.

Administering Windows Server® 2012	MCT
	L4-23
Exercise 2: Creating and Associating a Managed Service Account
 Task 1: Create and associate a Managed Service Account

1.On LON-DC1, in Server Manager, click Tools, and then click Active Directory Module for WindowsUSE

Powershell.

2.Type the following In the Windows PowerShell® command window, and then press Enter:

3.		Type the following In the Windows PowerShell command window, and then press Enter:	.ONLY
3.

		New-ADServiceAccount –Name Webservice –DNSHostName LON-DC1 –
		PrincipalsAllowedToRetrieveManagedPassword LON-DC1$

4.		Type the following In the Windows PowerShell command window, and then press Enter:

		Add-ADComputerServiceAccount –identity LON-DC1 –ServiceAccount Webservice

5.		Type the following In the Windows PowerShell command window, and then press Enter:


7.			STUDENT
7.
1.		On LON-DC1, type the following In the Windows PowerShell command window, and then press Enter:


2.		In Server Manager click the Tools menu, and then click Internet Information Services (IIS)
		Manager.	USE
3.		In the Internet Information Services (IIS) Manager console, expand LON-DC1
		(Adatum\Administrator), and then click Application Pools. When the Internet Information
		Services (IIS) Manager window appears, click No.
4.		In the details pane, right-click the DefaultAppPool, and then click Advanced Settings.
5.		In the Advanced Settings dialog box, click Identity and then click the ellipses.	PROHIBITED
6.		In the Application Pool Identity dialog box, click Custom Account and then click Set.	PROHIBITED
6.
7.		In the Set Credentials dialog box, type Adatum\Webservice$ in the User name: field, and then
	click OK three times.
8.	In the Actions pane, click Stop to stop the application pool.
9.	Click Start to start the application pool.

10. Close the Internet Information Services (IIS) Manager.

L4-24 Managing User and Service Accounts

 To prepare for the next module

1.On the host computer, start Hyper-V Manager.

2.In the Virtual Machines list, right-click 20411B-LON-DC1, and then click Revert.

3.In the Revert Virtual Machine dialog box, click Revert.

Results: After completing this exercise, you will have created and associated a Managed Service Account.

USE MCT

PROHIBITED USE STUDENT .ONLY

			MCT
		L5-25
Module 5: Implementing a Group Policy Infrastructure
Lab: Implementing a Group Policy			USE
Infrastructure			USE
Infrastructure
Exercise 1: Creating and Configuring GPOs
 Task 1: Create and edit a Group Policy Object (GPO)			.ONLY
1.	On LON-DC1, from Server Manager, click Tools, and then click Group Policy Management.		.ONLY
1.
2.	In the console tree, expand Forest: Adatum.com, Domains, and Adatum.com, and then click the
	Group Policy Objects container.
3.	In the console tree, right-click the Group Policy Objects container, and then click New.
4.	In the Name box, type ADATUM Standards, and then click OK.
5.	In the details pane of the Group Policy Management console, right-click the ADATUM Standards
	GPO, and then click Edit.
6.	In the console tree, expand User Configuration, Policies, and Administrative Templates, and then
	click System.
7.	Double-click the Don’t run specified Windows applications policy setting.
8.	In the Don’t run specified Windows applications window, click Enabled.
9.	Click Show.
10.	In the Show Contents dialog box, in the Value list, type notepad.exe, and then click OK.
11.	In the Don’t run specified Windows applications dialog box, click OK.
12.	In the console tree, expand User Configuration, Policies, Administrative Templates, and ControlSTUDENT
	Panel, and then click Personalization.		USE
13.	In the details pane, click the	Screen saver timeout policy setting.	USE
13.	In the details pane, click the	Screen saver timeout policy setting.
14.	Double-click the Screen Saver timeout policy setting.
15.	Click Enabled.
16.	In the Seconds box, type 600, and then click OK.
17.	Double-click the Password protect the screen saver policy setting.
18.	Click Enabled, and click OK.
19.	Close the Group Policy Management Editor.

 Task 2: Link the GPO

1.In the Group Policy Management console tree, right-click the Adatum.com domain, and then click

Link an Existing GPO.

2.In the Select GPO dialog box, click ADATUM Standards, and then click OK.

 Task 3: View the effects of the GPO’s settings

1.Switch to LON-CL1, and sign in as Adatum\Pat with the password Pa$$w0rd.

2.On the Start screen, click the Desktop tile.

3.Right-click the desktop, and then click Personalize.

PROHIBITED

L5-26 Implementing			MCT
L5-26 Implementing

4.		Click Screen Saver. Notice that the Wait control is disabled—you cannot change the timeout. Notice
		that the On resume, display logon screen option is selected and disabled, and that you cannot
		disable password protection.	USE
5.		Click OK to close the Screen Saver Settings dialog box.	USE
5.		Click OK to close the Screen Saver Settings dialog box.
6.		Pause the mouse pointer in the lower-right corner of the display, and then click Start.
7.		Right-click the Start screen, and then click All apps.
8.		In the Apps list, click Notepad. Notepad does not open.

	Results: After this exercise, you should have successfully created, edited, and linked the required GPOs.			.ONLY


	Exercise 2: Managing GPO Scope
	 Task 1: Create and link the required GPOs		STUDENT
1.		On LON-DC1, switch to Server Manager, click Tools and then click Active Directory Users and	STUDENT
1.
		Computers.
2.		In the console tree, expand the Adatum.com domain and click the Research organizational
		unit (OU).
3.		Right-click the Research OU, point to New, and then click Organizational Unit.
4.		Type Engineers, and then click OK.
5.		Close Active Directory® Users and Computers.
6.		Switch to the Group Policy Management console.
7.		In the console tree, expand Forest: Adatum.com, Domains, Adatum.com, Research, and then click
		the Engineers OU.	USE
8.		Right-click the Engineers OU, and then click Create a GPO in this domain and Link it here.	USE
8.
9.		Type Engineering Application Override, and then click OK.
10.		Right-click the Engineering Application Override GPO, and then click Edit.
11.		In the console tree, expand User Configuration, Policies, Administrative Templates, and Control	PROHIBITED
		Panel, and then click Personalization.	PROHIBITED
		Panel, and then click Personalization.
12.		Double-click the Screen saver timeout policy setting.
13.		Click Disabled, and click OK.
14.		Close the Group Policy Management Editor.
1.		In the Group Policy Management console tree, click the Engineers OU.
2.		Click the Group Policy Inheritance tab. Notice that the Engineering Application Override GPO has
		higher precedence than the ADATUM Standards GPO. The screen saver timeout policy setting you
		just configured in the Engineering Application Override GPO is applied after the setting in the

ADATUM Standards GPO. Therefore, the new setting will overwrite the standards setting, and will win. Screen saver timeout will be disabled for users within the scope of the Engineering Application Override GPO.

1.On LON-DC1, from Server Manager, click Tools, and then click Active Directory Users and MCT

Computers.

2.In the console tree, if necessary, expand the Adatum.com domain and the Research OU, and then USE click the Engineers OU.

3.Right-click the Engineers OU, point to New, and then click Group.

4.Type GPO_Engineering Application Override_Apply, and then press Enter.

5.Switch to the Group Policy Management console. ONLY

6.In the console tree, if required, expand the Engineers OU, and then double-click the link of the

Engineering Application Override GPO under the Engineers OU. A message appears.

7.Read the message, select the Do not show this message again check box, and then click OK. In the Security Filtering section, you will see that the GPO applies by default to all authenticated users.

8.In the Security Filtering section, click Authenticated Users. .

9.Click the Remove button. A confirmation prompt appears.

10.Click OK. STUDENT

11.In the details pane, click the Add button.

12.In the Select User, Computer, or Group dialog box, in the Enter the object name to select (examples): box, type GPO_Engineering Application Override_Apply, and then press Enter.

13.Switch to Active Directory Users and Computers.

14.In the console tree, expand the Adatum.com domain, and then click the Users folder.

15.Right-click Users, point to New, and then click Group.

16.Type GPO_ADATUM Standards_Exempt, and then press Enter.

17.Switch to the Group Policy Management console.

18.In the console tree, click the Adatum.com domain object, and then double-click the Adatum USE Standards GPO. In the Security Filtering section, notice that the GPO applies by default to all authenticated users.

19.Click the Delegation tab.

20.Click the Advanced button. The ADATUM Standards Security Settings dialog box appears. PROHIBITED

21.Click the Add button. The Select Users, Computers, Service Accounts, or Groups dialog box appears.

22.In the Enter the object names to select (examples): box, type GPO_ADATUM Standards_Exempt, and press Enter.

23.Select the Deny check box next to Apply group policy.

24.Click OK. A warning message appears to remind you that deny permissions override allow permissions. Click Yes. Notice that the permission appears on the Delegation tab as Custom.

L5-28 Implementing a Group Policy Infrastructure

4.In the New Object – Organizational Unit dialog box, type Kiosks, and then click OK.

5.Right-click Kiosks, point to New, and then click Organizational Unit.

6.In the New Object – Organizational Unit dialog box, type Conference Rooms, and then click OK.

7.Switch to the Group Policy Management console. Refresh the console if necessary.

8.In the tree, expand the Kiosks OU, and then click the Conference Rooms OU.

9.Right-click the Conference Rooms OU, and then click Create a GPO in this domain, and Link it here.

10.In the New GPO box, in the Name box, type Conference Room Policies, and then press Enter.

11.In the console tree, expand Conference Rooms, and then click the Conference Room Policies GPO.

12.Click the Scope tab. Confirm that the GPO is scoped to apply to Authenticated Users.

13.Right-click the Conference Room Policies GPO in the console tree, and then click Edit.

14.In the Group Policy Management Editor console tree, expand User Configuration, Policies,

Administrative Templates, and Control Panel, and then click Personalization.

15.Double-click the Screen saver timeout policy setting.

16.Click Enabled.

17.In the Seconds box, type 2700, and then click OK.

18.In the console tree, expand Computer Configuration, Policies, Administrative Templates, and System, and then click Group Policy.

19.Double-click the Configure user Group Policy loopback processing mode policy setting.

20.Click Enabled.

21.In the Mode drop-down list, select Merge, and then click OK.

22.Close the Group Policy Management Editor.

Results: After this exercise, you should have successfully configured the required scope of the GPOs.

Exercise 3: Verifying GPO Application

 Task 1: Perform Resultant Set of Policy (RSoP) analysis

1.Switch to LON-CL1.

2.Verify that you are logged on as Adatum\Pat. If necessary, provide the password of Pa$$w0rd.

3.Pause your mouse pointer in the lower-right corner of the display, and then click Start.

4.Right-click the Start screen, and then click All apps.

5.In the Apps list, right-click Command Prompt, and then click Run as administrator.

6.In the User Account Control dialog box, in the User name box, type Administrator. In the Password box, type Pa$$w0rd. Click Yes.

7.At the command prompt, type the following command, and then press Enter:

gpupdate.exe /force

PROHIBITED USE STUDENT .ONLY USE MCT

<<< < Предыдущая 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 4546 / 5346 47 48 49 50 51 52 53 > Следующая >>>

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]

#
01.05.201559.39 Кб101_Diplom_Trebovania_Tekhnika_bezopasnosti.doc
#
01.05.201548.15 Кб272 д-ріс.docx
#
01.05.2015110.08 Кб152 лаба.doc
#
01.05.2015224.26 Кб52-РГР техника жне технология негіздері.doc
#
01.05.2015624.64 Кб542012215.pdf
#
01.05.201516.48 Mб23720411B-ENU-TrainerHandbook.pdf
#
01.05.2015134.66 Кб182192_srs2_politology.doc
#
10.03.2016475.65 Кб52222.doc
#
01.05.201569.93 Кб1924 билет ЗИ в ТКС.docx
#
01.05.201518.89 Кб133 д-ріс.docx
#
01.05.2015675.84 Кб123 лаба метод указ.doc