04windows server2012ad及组策略应用module4管理域服务对象

OfficialManagingActiveDirectoryServicesObjectsModuleManagingUserManagingManagingComputerLesson1:ManagingUserADDSAdministrationCreatingUserConfiguringUserAccountCreatingUserDemonstration:ManagingUserDemonstration:UsingTem testoManageUserADDSAdministrationTomanageADDSobjects,youcanusethefollowinggraphicaltools:Youcanalsousethefollowingcommand-linetools:ActiveDirectorymoduleinWindowsDirectoryService

CreatingUser ，WindowsPowerS 用户用户 CreatingUserTheAccountsectionoftheActiveDirectoryAdministrativeCenterCreateUserwindowConfiguringUserAccountAttributesTheLogonhoursdialogboxCreatingUserTheProfilesectionoftheUserPropertiesDemonstration:ManagingUserInthisdemonstration,youwillseehowUsetheActiveDirectoryAdministrativeCentertomanageuseraccountsDeleteauserCreateanewuserMovetheuserViewtheWINDOWS UseWindows tomanageuserFindinactiveuserFinddisableduserDeletedisableduserDemonstration:UsingTem testoManageUserAccountsInthisdemonstration,youwillseehowCreateauser teUseWindowsPowerS tocreateauserfromtheusertem Verifythepropertiesofthenewuser Official OfficialManagingActiveDirectoryServicesObjectsLesson2:ManagingGroupGroupImplementingGroupDefaultSpecial

GroupUsedonly Notsecurity-enabled(noSID);cannotbegivenpermissionsSecurityprincipalwithaSID;canbegivenpermissionsCanalso BothsecuritygroupsanddistributiongroupscanbeconvertedtotheothertypeofgroupGroupMemberssamefrominMembersfromCanbepermissionstoU,GG,DLG,andlocalU,C,GG,UGU,C,Onthelocal-U,GG,DLG,U,C,GG,UGU,C,AnywhereinU,C,GG,UGU,C,GG,UGAnywhereinU,C,Anywhereinor Global

-local UniversalImplementingGroupIUsersorcomputers,whicharemembersofGGlobalWhichcollectmembersbasedonmembers’roles,whicharemembersof -localWhichprovidemanagementsuchasresourceaccess,whichareAAssignedaccesstoa

(Globalgroup) -localThisThisbestpracticefornestinggroupsisknownasIGDLA.ImplementingGroupIUsersorcomputers,whicharemembersofImplementingGroupUsersorcomputers,whicharemembersGGlobalWhichcollectmembersbasedonmembers’roles,whicharemembersofImplementingGroupIUsersorcomputers,whicharemembersofGGlobalWhichcollectmembersbasedonmembers’roles,whicharemembersof -localWhichprovidemanagementsuchasresourceaccess,whichare

(Globalgroup) -localImplementingGroupIUsersorcomputers,whicharemembersofGGlobalWhichcollectmembersbasedonmembers’roles,whicharemembersof -localWhichprovidemanagementsuchasresourceaccess,whichareAAssignedaccesstoa

(Globalgroup) -localImplementingGroupIUsersorcomputers,whicharemembersofGGlobalWhichcollectmembersbasedonmembers’roles,whicharemembersof -localWhichprovidemanagementsuchasresourceaccess,whichareAAssignedaccesstoa

(Globalgroup) -localThisThisbestpracticefornestinggroupsisknownasIGDLADefaultCarefullymanagethedefaultgroupsthatprovideadministrativeprivileges,becausethesegroups:TypicallyhavebroaderprivilegesthanarenecessaryformostdelegatedenvironmentsOftenapplyprotectiontotheirEnterpriseUserscontainerofrootSchemaUserscontainerofrootBuilt-incontainerofAdminsUserscontainerofServerBuilt-incontainerofAccountBuilt-incontainerofBackupBuilt-incontainerofPrintBuilt-incontainerofCertUserscontainerofSpecialSpecialAregroupsforwhichmembershipiscontrolledbytheoperatingsystemCanbeusedbytheWindowsServeroperatingsystemtoprovideaccesstoresources:BasedonthetypeofauthenticationorNotbasedontheuserImportantspecialidentitiesAnonymousAuthenticated

CreatorInthisdemonstration,youwillseehowCreateanewAddmemberstotheAddausertotheChangethegrouptypeandModifyingthegroup’sManagedBy Official 专业 优质、专业 内课程 实 答疑|online Q OfficialManagingActiveDirectoryServicesObjectsLesson3:ManagingComputerWhatIstheComputersSpecifyingtheLocationofComputerControllingPermissionstoCreateComputerPerformingan ComputerAccountsandSecureResettingtheSecureBringYourOwnWhatIstheComputersActiveDirectoryAdministrativeCenter,openedtotheAdatum(local)\ComputerscontainerDistinguishedNameisSpecifyingtheLocationofComputer通常通过区（OU）进行细划划分通过管理方便与组策略配ControllingPermissionstoCreateComputerTheDelegationofControlWizardwindowTheadministratoriscreatingacustomdelegationforcomputerobjectsdjoin.exe/Provision</Machinedjoin.exe/Provision</Machine<MachineName>/SaveFile joinisusedtojoincomputerstoawhentheycannotcontactaCreate joinfileImport joinfiledjoin.exedjoin.exe/requestODJ/LoadFile/WindowsPath<pathtotheWindowsdirectoryoftheofflineimage>ComputerAccountsandSecureComputershavesAMAccountNameandUsedtocreateasecurechannelbetweenthecomputeranda 以下情况，一个安全通道可以被打 ResettingtheSecureDonotdeleteacomputerfromthe thenrejoinitThiscreatesanewaccount,resultinginanewSIDandlostgroupmembershipsOptionsforresettingthesecureActiveDirectoryUsersandActiveDirectoryAdministrativeWindowsBringYourOwnADFShasbeenenhancedtosupportBYOD ceJoincreatesanADDSobjectforconsumerdevicesLimitcontentaccesstospecificUsingDynamicAccessControlorconditionsonpermissionsyoucanlimitcontentaccessto-joinedSupportforiOSdevicescanbe ce-joinedas Official OfficialManagingActiveDirectoryServicesObjectsLesson4:DelegatingConsiderationsforUsingOrganizationalADDSEffectiveADDSConsiderationsforUsingOrganizationalOUsallowyoutosubdivide formanagementOUsareusedDelegationofApplicationofTheOUstructurecanFlat,onetotwolevelsDeep,morethan5levelsNarrow,anythinginADDSAdvancedSecuritySettingsforEffectiveADDSPermissionsassignedtousersandgroupsaccumulate(累积Bestpracticeistoassignpermissionstogroups,nottoindividualusersIntheevent DenypermissionsoverrideAllowExplicitpermissionsoverrideInheritedExplicitAllowoverridesInheritedToevaluateeffectivepermissions,youcanTheEffectiveAccess Inthisdemonstration,youwillseehowCreateanMoveobjectsintoanDelegateastandardDelegateacustomViewADDSpermissionsresultingfromthese 专业 优质、专业 内课程 实 答疑|online Q Lab:ManagingActiveDirectory Exercise1:DelegatingAdministrationforaBranchExercise2:CreatingandConfiguringUserAccountsinADDSExercise3:ManagingComputerObjectsinADLogonVirtualUsername

20410D-LON-20410D-LON-EstimatedTime:70LabYouhavebeenworkingforA.DatumCorporationasadesktopsupportspecialistandhavevisiteddesktopcomputerstotroubleshootappandnetworkproblems.Youhaverecentlyacceptedapromotiontotheserversuppo