Creating Organizational Units, Accounts, and Groups Tom Brett Active - PDF document

21/05/2013 Creating Organizational Units, Accounts, and Groups Tom Brett Active Directory Users and Computers (ADUC) Active Directory Users and Computers (ADUC) • After installing AD DS, the next task is to create your Organizational Units, Users, groups etc. – The primary tool you’ll use is Active Directory Users and Computers (ADUC). This is a GUI application with a point and click interface – You can also complete the tasks from the command line • If you’re running Server Core, you won’t have access to ADUC locally. • Anything that can be entered from the command line can be scripted. 1

21/05/2013 LAB : NAVIGATING ACTIVE DIRECTORY USERS AND COMPUTERS (ADUC) • Launch Active Directory Users and Computers by selecting Start ‐ Administrative Tools ‐ Active Directory Users and Computers. • Active Directory Users and Computers opens 2

21/05/2013 • Expand your Domain • This exposes the containers for the Different Objects • Select Builtin • This shows you the predefined security Groups within AD DS • Click Computers • You will notice that there are presently no computers setup 3

21/05/2013 • If you view ADUC you will now see that there are two domain controllers there • Click foreign Security Principal • No security principals exist (this will be explained later) • Click Managed service Accounts • Again this is currently blank 4

21/05/2013 • Select Users • This displays the prebuilt users and security groups ORGANIZATIONAL UNITS • Organizational units are used to organize objects within Active Directory. • Any objects (such as users, computers, groups, and so on) can be placed within an OU to make them easier to administer. 5

21/05/2013 • The two primary technical reasons why you’ll create an OU: – Management through Group Policy – Administrative delegation • It’s common for administrators to create OUs to match each department in their organization or to create OUs to group Users with similar responsibilities. OU Management Through Group Policy • Group Policy objects (GPOs) can be created and linked to sites, domains, and OUs. • If you want some users to have a specific Group Policy assigned to them, you can create an OU, place the accounts within the OU, and link the GPO to the OUs. OU Administrative Delegation • The second technical reason to create an OU is related to delegation. 6

21/05/2013 LAB : CREATING OUs WITH ADUC • Launch Active Directory Users and Computers by selecting Start ‐ Administrative Tools ‐ Active Directory Users and Computers. • Right ‐ click the domain, and select New ‐ Organizational Unit. 7

21/05/2013 • Enter Sales as the name of the OU in the text box. • Ensure the check box “Protect container from accidental deletion” is selected • Click OK • Note : – “Protect container from accidental deletion” is a neat feature that prevents anyone (even administrators) from accidentally deleting an object. – If you really want to delete an object, you still can. • Modify this setting by selecting View – Advanced Features in ADUC, selecting the properties of the object, selecting the Object tab, and deselecting the “Protect object from accidental deletion” option. • Then you can delete the object • The new Organizational Unit is created 8

21/05/2013 • It’s also possible to create children OUs. • Right ‐ click the Sales OU you just created, and select New ‐ Organizational Unit. • Type in Users for the name, and click OK. • The nested Organizational unit appears within Sales 9

21/05/2013 • You now have two Users objects within Active Directory. • They Are very different to each other: – The Users OU within the Sales OU is an OU and can have GPOs linked to it. – The Users container under the domain is only a container (not an OU) and cannot have GPOs linked to it. • OUs have a slightly different icon to identify them—it’s not just a folder but instead a folder with an icon embedded on the front of the folder reminding you it’s something more. ACTIVE DIRECTORY NAMING STANDARDS 10

21/05/2013 • Active Directory uses the Lightweight Directory Access Protocol (LDAP) for communication. • LDAP uses a distinguished name (DN) to uniquely identify each object within the directory. • Since the introduction of LDAP, it has become a defacto standard which enables data exchange between directory services and applications • The LDAP defines the naming of all objects in the Active Directory database • It therefore provides a directory that can be integrated with other directory services – For example Novell eDirectory and Active Directory applications like Exchange etc. 11

21/05/2013 • LDAP refers to an object using its Distinguished Name (DN) • This DN, references each object in the Active Directory Database using its entire hierarchical path starting with the object itself going up to the root of the domain. • LDAP defines the naming of attributes that identify each part of the objects name. Object Class LDAP Naming Definition of Attribute Naming Attribute User or any Leaf CN Common Name object Organizational Unit OU Organizational Unit Name Domain DC Domain Components. One for each part of the DNS name • The format of a DN uses objectType=objectName with several object types separated by commas – – it is best not to use spaces in the Distinguished Name – LDAP is not case sensitive • If we have a user Jsmith, their distinguished name could be – cn=jsmith,ou=sales,dc=ipa,dc=com 12

21/05/2013 • An account with a name of Sally.Smith located in the Sales OU would have this DN: – cn=Sally.Smith,ou=Sales,dc=bigfirm,dc=com • An account with a name of Joe.Johnson located in the Users container would have this DN: – cn=Joe.Johnson,cn=Users,dc=bigfirm,dc=com • If OUs are nested, or have OUs within them, the lowest ‐ level OU comes first in the DN name. – For example, if the Sales OU had a child OU named Users and then had a user named Maria within it, the DN would be as follows: • cn=Maria,ou=Users,ou=Sales,dc=bigfirm,dc=c om The use of spaces in LDAP Distinguished Names • If the DN includes any spaces, it needs to be enclosed with quotes to ensure it is interpreted correctly. – For example, this doesn’t require quotes because there are no spaces: • cn=Maria,ou=Users,ou=Sales,dc=bigfirm,dc=com – However, the same DN with spaces must include quotes: – “cn=Maria, ou=Users, ou=Sales, dc=bigfirm, dc=com” 13

21/05/2013 CREATING OUs WITH DSADD • You can use DSAdd to create a variety of Active Directory different objects – You need to execute the DSAdd command from the command line. – Although it’s easier to run the command from a domain controller, you can also run it from other locations by specifying the server and domain parameters. • In the command Prompt • you can enter DSAdd /? to view the help on DSAdd. 14

21/05/2013 • Imagine you had a bunch of clowns in your organization that you wanted to manage using Group Policy. • The following command can be entered from the command line to create an OU named Clowns in the Bigfirm.com domain. • Notice the DN is ou=Clowns,dc=bigfirm,dc=com. – DSAdd ou “ou=Clowns,dc=bigfirm,dc=com” LAB : USING DSADD TO CREATE A ORGANIZATION UNIT • Here we wish to add a OU called Service in Active Directory • Open the command prompt on the DC and enter the following • DSAdd ou “ou=service,dc=tombrett,dc=local” • Obviously replace the DC parameters to match your infrastructure 15

21/05/2013 • When you press enter the OU is added • If you receive an error – check the syntax and the structure • Review Active Directory Users and Computers to see if it was successful • Active directory objects can also be created using powershell and Windows Scripting Host (using VB scripts) 16

21/05/2013 USER ACCOUNTS A user account is an object that contains all of the information that defines a user in Windows Server 2008 R2 With a user account, you can:  Allow or deny users to log on based on their identity  Grant users access to processes and services  Manage users' access to resources CREATING ACCOUNTS 17

21/05/2013 • Both users and computers need accounts in order to access the domain. • Just as with OUs, you can use either Active Directory Users and Computers or DSAdd to create the accounts. • Some accounts are created automatically – For example when you join a computer to the Domain, its account (computer) is automatically created in the Active Directory system CREATING ACCOUNTS WITH ADUC • To create a user account using Active Directory Users and Computers, follow these steps 18

21/05/2013 • Launch Active Directory Users and Computers by selecting Start ‐ Administrative Tools ‐ Active Directory Users and Computers. • Right ‐ click the Users OU within the Sales OU you created earlier, and select New ‐ User. • The new user object dialog box appears 19

21/05/2013 • Enter the first name, last name, and user logon name for the user. • Click Next. • Enter a password for the user in the Password and Confirm Password text boxes. • Ensure the check box is selected for “User must change password at next logon.” • Review the information on the Summary page, and click Finish. 20