Добавил:

Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.

Вуз:

Алматинский университет энергетики и связи

Предмет:

[НЕСОРТИРОВАННОЕ]

Файл:

20411B-ENU-TrainerHandbook

.pdf

Скачиваний:

237

Добавлен:

01.05.2015

Размер:

16.48 Mб

Скачать

☆

<<< < Предыдущая 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 4849 / 5349 50 51 52 53 > Следующая >>>

3.Configure computer certificate auto-enrollment by performing the following steps: MCT49

a.On LON-DC1, switch to Server Manager, click Tools, and then click Group Policy Management.

b.In the Group Policy Management Console, expand Forest: Adatum.com, expand Domains, andUSE then expand Adatum.com.

c.In the Adatum.com console, right-click Default Domain Policy, and then click Edit.

d.In the Group Policy Management Editor, expand Computer Configuration, expand

Policies, expand Windows Settings, expand Security Settings, and then expand Public ONLY Key Policies.

e.In the Public Key Policies details pane, right-click Automatic Certificate Request Settings, point to New, and then click Automatic Certificate Request.

f.In the Automatic Certificate Request Setup Wizard, click Next.

g.On the Certificate Template page, click Computer, click Next, and then click Finish. .

h.Close both the Group Policy Management Editor and the Group Policy Management Console.Administering Windows Server® 2012 L7-

 Task 3: Configure internal resources

1.Request a certificate for LON-SVR1 by performing the following steps:

a.On LON-SVR1, move the mouse to the lower-right corner of the screen, click Search, type cmd, and then press Enter.

b.At the command prompt, type the following command, and then press Enter:

	mmc	STUDENT
	mmc	STUDENT
	gpupdate /force

c. At the command prompt, type the following command, and then press Enter:

d.Click File, and then click Add/Remove Snap-in. USE

e.Click Certificates, click Add, click Computer account, click Next, click Local computer, click

Finish, and then click OK.

f.In the Certificates snap-in console, expand Certificates (Local Computer), expand

Personal, and then click Certificates.

g.Right-click Certificates, point to All Tasks, and then click Request New Certificate. PROHIBITED

h.Click Next twice.

i.On the Request Certificates page, click Adatum Web Server Certificate, and then click More information is required to enroll for this certificate.

j.In the Certificate Properties dialog box, on the Subject tab, under Subject name, under Type, click Common name.

k.In the Value text box, type nls.adatum.com, and then click Add.

l.Click OK, click Enroll, and then click Finish.

m.In the Certificates snap-in details pane, verify that a new certificate with the name nls.adatum.com was enrolled with Intended Purposes of Server Authentication.

n.Close the console window. When you are prompted to save settings, click No.

L7-50 Configuring and Troubleshooting Remote Access

2.To change the HTTPS bindings, perform the following steps:

a.In Server Manager, click Tools, and then click Internet Information Services (IIS) Manager. At the Internet Information Services (IIS) Manager message box, click No.

b.In the Internet Information Services (IIS) Manager console, navigate to LON-SVR1/Sites, and then click Default Web Site.

c.In the Actions pane, click Bindings, and then click Add.

d.In the Add Site Binding dialog box, click https, in the SSL Certificate dialog box, click the certificate with the name nls.adatum.com, click OK, and then click Close.

e.Close the Internet Information Services (IIS) Manager console.

 Task 4: Configure the DirectAccess server

1.Obtain required certificates for LON-RTR by performing the following steps:

a.Switch to LON-RTR.

b.Open a command prompt, type the following command, and then press Enter:

gpupdate /force

c.In the command prompt, type mmc.exe, and then press Enter.

d.Click File and then click Add/Remove Snap-in.

e.Click Certificates, click Add, click Computer account, click Next, select Local computer, click

Finish, and then click OK.

f.In the Certificates snap-in console, expand Certificates (Local Computer), expand Personal, and then click Certificates.

g.Right-click Certificates, point to All Tasks, and then click Request New Certificate.

h.Click Next twice.

i.On the Request Certificates page, click Adatum Web Server Certificate, and then click More information is required to enroll for this certificate.

j.In the Certificate Properties dialog box, on the Subject tab, under Subject name, under Type, click Common name.

k.In the Value text box, type 131.107.0.2, and then click Add.

l.Click OK, click Enroll, and then click Finish.

m.In the Certificates snap-in details pane, verify that a new certificate with the name 131.107.0.2 was issued with Intended Purposes of Server Authentication.

n.Right-click the certificate, and then click Properties.

o.In the Friendly Name text box, type IP-HTTPS Certificate, and then click OK.

p.Close the console window. If you are prompted to save settings, click No.

2.Create CRL distribution point on LON-RTR by performing the following steps:

a.Switch to Server Manager.

b.In Server Manager, click Tools, and then click Internet Information Services (IIS) Manager.

c.If the Internet Information Service Manager message box displays, click No.

PROHIBITED USE STUDENT .ONLY USE MCT

	Administering Windows Server® 2012		MCT
	Administering Windows Server® 2012	L7-51
d.	In the console tree, expand to LON-RTR, expand Sites, click Default Web Site, right-click
	Default Web Site, and then click Add Virtual Directory.
e.	In the Add Virtual Directory dialog box, in the Alias text box, type CRLD. Next to Physical		USE
	path, click the ellipsis (…) button.		USE
	path, click the ellipsis (…) button.
f.	In the Browse for Folder dialog box, click Local Disk (C:), and then click Make New Folder.
g.	Type CRLDist, and then press Enter.
h.	In the Browse for Folder dialog box, click OK.		.ONLY
i.	In the Add Virtual Directory dialog box, click OK.		.ONLY
i.	In the Add Virtual Directory dialog box, click OK.
j.	In the middle pane of the console, double-click Directory Browsing, and in the Actions pane,
	click Enable.
k.	In the console, click the CRLD folder.
l.	In the middle pane of the console, double-click the Configuration Editor icon.
m.	Click the down-arrow of the Section drop-down list, expand system.webServer, expand
	security, and then click requestFiltering.
n.	In the middle pane of the requestFiltering console, double-click allowDoubleEscaping to
	change the value from False to True.
o.	In the actions pane, click Apply.
p.	Close Internet Information Services (IIS) Manager.		STUDENT
Question: Why do you make the CRL available on the edge server?			STUDENT

Answer: You make the CRL available on the edge server so that the Internet DirectAccess clients can access the CRL.

3.Share and secure the CRL distribution point by performing the following steps:

a.On the taskbar, click the Windows Explorer icon. USE

b.In Windows Explorer, double-click Local Disk (C:).

c.In the Windows Explorer details pane, right-click the CRLDist folder, and then click Properties.

d.In the CRLDist Properties dialog box, click the Sharing tab, and then click Advanced SharingPROHIBITED.

e.In the Advanced Sharing dialog box, click Share this folder.

f.In the Share name text box, add a dollar sign ($) to the end of the name so that the share name is CRLDist$.

g.In the Advanced Sharing dialog box, click Permissions.

h.In the Permissions for CRLDist$ dialog box, click Add.

i.In the Select Users, Computers, Service Accounts, or Groups dialog box, click Object Types.

j.In the Object Types dialog box, select Computers, and then click OK.

k.In the Select Users, Computers, Service Accounts, or Groups dialog box, in the Enter the object names to select text box, type LON-DC1, click Check Names, and then click OK.

L7-52 Configuring and Troubleshooting Remote Access

l.In the Permissions for CRLDist$ dialog box, in the Group or user names list, click LON-DC1 (ADATUM\LON-DC1$). In the Permissions for LON-DC1 area, under Full control, click Allow, and then click OK.

m.In the Advanced Sharing dialog box, click OK.

n.In the CRLDist Properties dialog box, click the Security tab.

o.On the Security tab, click Edit.

p.In the Permissions for CRLDist dialog box, click Add.

q.In the Select Users, Computers, Service Accounts, or Groups dialog box, click Object Types.

r.In the Object Types dialog box, click Computers, and then click OK.

s.In the Select Users, Computers, Service Accounts, or Groups dialog box, in the Enter the object names to select text box, type LON-DC1, click Check Names, and then click OK.

t.In the Permissions for CRLDist dialog box, in the Group or user names list, click LON-DC1 (ADATUM\LON-DC1$). In the Permissions for LON-DC1 area, under Full control, click Allow, and then click OK.

u.In the CRLDist Properties dialog box, click Close.

v.Close the Windows Explorer window.

4.Publish the CRL to LON-RTR by performing the following steps:

Note: These steps make the CRL available on the edge server for Internet-based DirectAccess clients.

a.Switch to LON-DC1.

b.In Server Manager, click Tools, and then click Certification Authority.

c.In the Certification Authority console, expand Adatum-LON-DC1-CA, right-click Revoked Certificates, point to All Tasks, and then click Publish.

d.In the Publish CRL dialog box, click New CRL, and then click OK.

e.On the taskbar, click the Windows Explorer icon.

f.In the Windows Explorer address bar, type \\LON-RTR\CRLDist$, and then press Enter.

g.In the Windows Explorer window, notice the Adatum-LON-DC1-CA files.

h.Close the Windows Explorer window.

5.Complete the DirectAccess Setup Wizard on LON-RTR by performing the following steps:

Note: These steps configure LON-RTR as a DirectAccess server.

a.On LON-RTR, open Server Manager, click Tools, and then click Routing and Remote Access. If prompted, click No to launching the DirectAccess wizard.

b.In Routing and Remote Access, disable the existing configuration, and close the console.

c.In Server Manager, on the Tools menu, click Remote Access Management.

d.In the Remote Access Management console, click Configuration.

PROHIBITED USE STUDENT .ONLY USE MCT

		Administering Windows Server® 2012		MCT
		Administering Windows Server® 2012	L7-53
	e. In the results pane, click Run the Getting Started Wizard.
	Note: If you get an error at this point, restart LON-RTR, sign in as Adatum\administrator,			USE

and
and
	f.	In the Configure Remote Access Wizard, click Deploy DirectAccess only.
	g.	In the Network Topology pane, verify that Edge is selected, and verify that 131.107.0.2 is the		.ONLY
		public name used by clients to connect to the Remote Access server.
	h.	Click Next.
	h.	Click Next.
	i.	On the Configure Remote Access page, click Finish.
	j.	When the configuration completes, click Close.
	k.	In the Remote Access Management console, under Step 1, click Edit, and then click Next.
	l.	Under Select Groups, in the details pane, click Add.		STUDENT
	m.	In the Select Group dialog box, type DA_Clients, click OK.		STUDENT
	m.	In the Select Group dialog box, type DA_Clients, click OK.
	n.	Clear the Enable DirectAccess for mobile computers only check box.
	o.	Remove the Domain Computers group, and then click Next. Click Finish.
	p.	In the Remote Access Management console, under Step 2, click Edit.
	q.	On the Network Topology page, verify that Edge is selected, type 131.107.0.2, and then click
		Next.
	r.	On the Network Adapters page, verify that CN=131.107.0.2 is used as a certificate to
		authenticate IP-HTTPS connections, and then click Next.
	s.	On the Authentication page, click Use computer certificates, click Browse, click Adatum-
		LON-DC1-CA, click OK, and then click Finish.		USE
	t.	In the Remote Access Setup pane, under Step 3, click Edit.		USE
	t.	In the Remote Access Setup pane, under Step 3, click Edit.
	u.	On the Network Location Server page, click the The network location server is deployed on
		a remote web server (recommended). In the URL field of the network location server (NLS),
		type https://nls.adatum.com, and then click Validate.
	v.	Ensure that URL is validated.		PROHIBITED
				PROHIBITED

w. Click Next, on the DNS page, examine the values, and then click Next. x. In the DNS Suffix Search List, click Next.

y. On the Management page, click Finish. z. Under Step 4, click Edit.

aa. On the DirectAccess Application Server Setup page, click Finish. bb. Click Finish to apply the changes.

cc. In Remote Access Review, click Apply.

dd. Under Applying Remote Access Setup Wizard Settings, click Close.

L7-54 Configuring

6.		Update Group Policy settings on LON-RTR by performing the following steps:
		a. Move the mouse pointer on the lower-right corner, on the menu bar, click Search, type cmd, andMCT
			then press Enter.		USE
		b. At the command prompt, type the following commands, pressing Enter at the end of each line:			USE




		Note: Verify that		LON-RTR has an IPv6 address for Tunnel adapter IPHTTPSInterface	.ONLY
					.ONLY

starting with 2002.

	Results: After completing this exercise, you will have configured the DirectAccess infrastructure.

	Exercise 2: Configuring the DirectAccess Clients				STUDENT
	Exercise 2: Configuring the DirectAccess Clients
	 Task 1: Configure DirectAccess Group Policy settings
1.		Start LON-CL1 and sign in as Adatum\Administrator with the password of Pa$$w0rd. This is to
		ensure that the LON-CL1 computer connects to the domain as a member of the DA_Clients security
		group.
2.		At Start, type cmd to open a command prompt window.
3.		At the command prompt, type the following command, and then press Enter:

		gpupdate /force
						USE
4.		At the command prompt, type the following command, and then press Enter:

		gpresult /R
		gpresult /R

5.		Verify that DirectAccess Client Settings GPO displays in the list of the Applied Policy objects for the
		Computer Settings.
		Note: If the policy is not being applied, run the gpupdate /force command again. If the			PROHIBITED
					PROHIBITED

policy is still not being applied, restart the computer. After the computer restarts, sign in as
Adatum\Administrator and run the Gpresult –R command again.
	 Task 2: Verify client computer certificate distribution
1.		In the command prompt, type mmc.exe, and then press Enter.
2.		In the MMC console, click File and then click Add/Remove Snap-in.
3.		Click Certificates, click Add, select Computer account, click Next, select Local computer, click
		Finish, and then click OK.
4.		In the Certificates snap-in console, click to Certificates (Local Computer), expand
		Personal, and then click Certificates.

			Administering Windows Server® 2012		MCT
			Administering Windows Server® 2012	L7-55
5.		In the Certificates details pane, verify that a certificate with the name LON-CL1.adatum.com displays
		with Intended Purposes of Client Authentication and Server Authentication.
6.		Close the console window. When you are prompted to save settings, click No.			USE
		Task 3: Verify internal connectivity to resources			USE
		Task 3: Verify internal connectivity to resources
1.		On LON-CL1, on the desktop, in the task bar, click Internet Explorer.
2.		In the Windows Internet Explorer® address bar, type http://lon-svr1.adatum.com/, and then press
		Enter. The default IIS 8 web page for LON-SVR1 displays.			.ONLY
3.		In the Internet Explorer address bar, type https://nls.adatum.com/, and then press Enter. The			.ONLY
3.
		default IIS 8 web page for LON-SVR1 displays.
4.		Leave the Internet Explorer window open.
5.		On the taskbar, click the Windows Explorer icon.
6.		In the Windows Explorer address bar, type \\Lon-SVR1\Files, and then press Enter. A window with
		the Files shared folder contents displays.			STUDENT
2.		On LON-CL1, move the mouse pointer to the lower-right end of the screen, click Settings, select			STUDENT
7.		Close all open windows.
1.		Switch to LON-CL1.
		Control Panel, and then click Network and Internet.			USE
3.		Click Network and Sharing Center.			USE
3.		Click Network and Sharing Center.
4.		Click Change Adapter Settings.
5.		Right-click Local Area Connection, and then click Properties.
6.		In the Local Area Connection Properties dialog box, double-click Internet Protocol Version 4			PROHIBITED
		(TCP/IPv4).			PROHIBITED
		(TCP/IPv4).
7.		In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, click Use the following IP
		address.
8.		Complete the following settings, and then click OK:
		o	IP address: 131.107.0.10
		o	Subnet mask: 255.255.0.0
		o	Default gateway: 131.107.0.2
9.		In the Local Area Connection Properties dialog box, click OK.
10.		In the Network Connections window, right-click Local Area Connection, and then click Disable.
11.		In the Network Connections window, right-click Local Area Connection, and then click Enable.

L7-56 Configuring and Troubleshooting Remote Access

12.On your host, in Hyper-V Manager, right-click 20411B-LON-CL1, and then click Settings.

13.Change the Legacy Network Adapter to be on the Private Network 2 network, and then click OK.

 Task 2: Verify connectivity to the DirectAccess server

1.On LON-CL1, move the mouse pointer to the lower-right corner, on the right menu, click Search, type cmd, and then press Enter.

2.At the command prompt, type the following command, and then press Enter:

ipconfig

3.Notice the returned IP address starts with 2002. This is an IP-HTTPS address.

4.At the command prompt, type the following command, and then press Enter:

Netsh name show effectivepolicy

5.At the command prompt, type the following command, and then press Enter:

powershell

6.At the Windows PowerShell® command-line interface, type the following command, and then press Enter:

Get-DAClientExperienceConfiguration

Note: Notice the DirectAccess client settings.

 Task 3: Verify connectivity to the internal network resources

1.Switch to Internet Explorer, and in the address bar, type http://lon-svr1.adatum.com, and then press Enter. The default IIS 8 web page for LON-SVR1 displays.

2.Leave the Internet Explorer window open.

3.On the taskbar, click the Windows Explorer icon.

4.In the Windows Explorer address bar, type \\LON-SVR1\Files, and then press Enter. A folder window with the contents of the Files shared folder displays.

5.Switch to the command prompt window.

6.At the command prompt, type the following command, and then press Enter:

ping lon-dc1.adatum.com

7.Verify that you are receiving replies from lon-dc1.adatum.com.

8.At the command prompt, type the following command, and then press Enter:

gpupdate /force

9.Close all open windows.

10.Switch to LON-RTR.

11.Switch to Remote Access Management.

12.In the console, click REMOTE CLIENT STATUS.

PROHIBITED USE STUDENT .ONLY USE MCT

Administering Windows Server® 2012

Note: Notice that LON-CL1 is connected via IP over HTTPS (IP-HTTPS). In the Connection Details pane, in the bottom-right of the screen, note the use of Kerberos for the Machine and the User.

13. Close all open windows.

 To prepare for the next module

1.On the host computer, start Hyper-V Manager.

2.In the Virtual Machines list, right-click 20411B-LON-CL1, and then click Revert.

3.In the Revert Virtual Machines dialog box, click Revert.

4.Repeat steps 2 to 3 for 20411B-LON-SVR1, 20411B-LON-RTR, and 20411B-LON-DC1.

Results: After completing this exercise, you will have verified the DirectAccess configuration.

L7-MCT57 USEONLY

STUDENT . PROHIBITED USE

MCT USE ONLY. STUDENT USE PROHIBITED

<<< < Предыдущая 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 4849 / 5349 50 51 52 53 > Следующая >>>

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]

#
01.05.201559.39 Кб101_Diplom_Trebovania_Tekhnika_bezopasnosti.doc
#
01.05.201548.15 Кб272 д-ріс.docx
#
01.05.2015110.08 Кб152 лаба.doc
#
01.05.2015224.26 Кб52-РГР техника жне технология негіздері.doc
#
01.05.2015624.64 Кб542012215.pdf
#
01.05.201516.48 Mб23720411B-ENU-TrainerHandbook.pdf
#
01.05.2015134.66 Кб182192_srs2_politology.doc
#
10.03.2016475.65 Кб52222.doc
#
01.05.201569.93 Кб1924 билет ЗИ в ТКС.docx
#
01.05.201518.89 Кб133 д-ріс.docx
#
01.05.2015675.84 Кб123 лаба метод указ.doc