岁月如歌99课件

MicrosoftServer2008R2ActiveDirectoryandGroupPoliciesActiveDirectoryReview/UpdatesNowcalledActiveDirectoryDomainServicesinthe2008/R2worldBigdatabaseofobjectsandisusedtocentrallymanageallobjectsofanorganization.DNSisrequiredorADDSDNSSRVrecordsareusedtolocatedomaincontrollersrunningspecificservices70%ofADproblemsaredirectlyrelatedtoDNSActiveDirectoryReview/Updates2008R2supportsfine-grainedpasswordpolicies2008R2FunctionlevelisrequiredtosupporttheActiveDirectoryRecycleBinADwithPowerShellCreatingusersCommand:new-aduser“JoeSmith”GettinghelpCommand:helpnew-aduserCommand:get-helpnew-aduser–examplesCommand:get-helpnew-aduser-detailedADwithPowerShellCreatingmanyusersADUC?ADAC?PowerShellatatime?CSVDE?(sorta)Command:import-csvc:\users.csv|foreach{new-aduser–Name$_.Name–SamAccountName$_.SamAccountName…etc…etc}

ADwithPowerShellUnlockinguseraccountsCommand:unlock-adaccount–identityjsmithResettingpasswordsCommand:set-adaccountpassword–identityjsmith–reset–newpassword(read-host“Pleaseenterthenewpassword”–assecurestring)DisplayuserattributesCommand:get-aduser“joesmith”-properties*|moreCommand:get-aduser“joesmith”–propertieshomedirectoryBenefitsPublishorassignsoftwareAssignstartup,shutdown,logon,logoffscriptsDefinepassword,lockoutandauditpoliciesStandardizeusersettingsDefineandenforceInternetExplorerSettingsDefineandenforcerestrictionsondesktopsRedirectfoldersConfigureandstandardizesettingssuchasofflinefolders,quotas,etc.GPOConceptsPoliciesareappliedfromthebottomup.Rulesthatapply.ListentothelastpolicyyouheardfromExecutepoliciesfromthebottomupastheyappearintheGUIAccountPoliciescannotbeappliedattheOU’s,theycanonlybeappliedonthedomains.GPOPlanning

OUDesignCreateseparateOUsforcomputersandusersSegmentmachines/usersintorolesbyOU;ExamplesServers:ExchangeServers,TerminalServers,WebServers,Print,etcWorkstations:Desktops;Laptops,taskstationsetc.DomainControllers:LeaveinDomainControllersOU(withDefaultDomainControllersPolicyGPOlinked)Users:ITStaff,Engineers,ShopFloor,LaptopUsers,etc.Bydefault,allnewaccountsarecreatedincn=Usersorcn=Computers(cannotlinkthesetoGPO’s).However,ifyouhaveaWindowsServer2003domain:Run“RedirUsr.exe”and“RedirCmp.exe”inyourdomaintospecifythenewdefaultOU’sinwhichallnewuser/computeraccountswillbecreatedAllowsyoutomanagenewaccountsthroughGroupPolicywhenyoudon’tspecifyanOUataccountcreation1Limitwhocancreate/update/linkGPOs(delegation)Planning:Deployment

Test,Stage,AndProductionIt’sa“goodthing”ifyou:Test->Stage->Test->

Deploy->ValidateGroupPolicyModeling(moreelegantfaceonRSoPPlanning)Backup/Copy/Import(includingmigrationtables)Documentation:HTMLorXMLReportsPlanning

DisasterRecoveryGPMCBackup/RestorehandlesGPOasalogicalentityAutomateGPObackupusingGPMCscripts-BackupAllGPOsorBackupGPORegularlytestGPOrestoreinyourenvironment–RestoreAllGPOsorRestoreGPOThinkaboutbuilding/rebuildingyourstagingenvironmentPlanning

DisasterRecoveryBeawareofwhatisNOTincludedinabackupofaGPOandplanaccordinglyIPSecSettings,whichliveinCN=IPSecurity,CN=System,DC=xxxx(ADbackuphandlesthis);TheGPOincludesjustthelinktothisdataWMIFilter(onlythefilterlinkisbackedup);ThefilteritselfisstoredinADsoyourADbackupcoversthisGPOlinksfromsites,domainsorOUs,sincetheyarenotanattributeoftheGPO(again,ADbackupcoversthis)Don’trelyonDCGPOFix(lastresorttool!)DCGPOFixreturnsdefaultGPOstothecleaninstallstate(notanupgrade)andtheyareunlinked;UseyourownbackupinsteadPlanning

GroupPolicyDependenciesICMP,atnetworkroutersorinTCP/IPconfiguration

(clientsorDCs)UsedtovalidateconnectivitytoaDCandforslowlinkdetection(usesPing)PolicynotappliedifclientcannotreachDCIfyouabsolutelymustdisableICMP,disableslowlinkdetection;Butthena“fastlink”isassumed–considerimpactonsoftwareinstallationandfolderredirectionWithnoconnectivitytoaDCatlogon(i.e.aremotemachine)policywillnotprocess,unlessyoucheckthe“Logonusingdial-upconnection”checkboxatthelogonpromptSoManyPolicySettings

WhereDoIStart?KnowthePolicySettingsReferenceSpreadsheetanduseitsfiltersPolicySettings.xlsConsidertheGroupPolicyCommonScenariosIterativedeployment.Startsmallandbuild…SecurityOperatingSystem/ApplicationConfigurationIEMaintenanceSoftwareInstallationGroupPolicies

AdministrativeTemplatesKnowthebenefitsofa“truepolicy”(ascomparedtopreferences)Security–onlylocaladministratorscanedittruepolicysettingsNotattooing–iftheGPOgoesoutofscopeitssettingsareremovedRespectforuserpreferences–afterapolicysettingisremoved/unlinked,theoriginaluserpreferenceremainsGroupPolicies

FolderRedirectionDonotpre-createfolders(ACLissues)IfserverisWindows2000,donotredirectfolderstosamemachineusedforRoamingUserProfiles(fixedinWindowsServer2003)DonotredirectApplicationDatafolder

(particularlyifloggedonfrommultiplecomputers)ExclusivelocksAbsolutepathsNetworklatencyYoucannotredirecttoamappeddrive

(folderredirectionoccursbeforemappingofdrives)GroupPolicies

RSoPNoGroupPolicyResultsdataavailableforIPSec,Wireless,andDiskQuotaWindows2000

(butyoucansimulateusingGroupPolicyModeling)GroupPolicyModelingcanonlysimulatethefollowingSlowlinksstatusLoopbackAlso,Modelingdoesn’tknowabouttheLGPOGroupPolicies

SoftwareInstallationFormachineassignmentarebootisnecessary(toinitiatetheinstall);AnapplicationthatshouldbeinstalledthroughmachineassignmentisGPMC(sinceit’sanMMCsnap-in)Whenassigningapps,keepasyncpolicyprocessinginmind.Insomecases,twologonsorrebootsmaybenecessary;Considerthe“WaitForNetworkAtComputerStartupandLogon”policysetting(thisextendsbootandlogontimes)LimituseofsecurityfilteringwithsoftwaredistributionGPO’s;FilteredoutusersmayincludeuserswhoneedtohaveapplicationadminrightsTroubleshootingUsingtheLocalGPO(LGPO)Agoodoptionifyoudon’thaveaccesstochangeGPOsinadomain(notallsettingswillb