Date post: | 20-Dec-2015 |
Category: |
Documents |
View: | 221 times |
Download: | 2 times |
Group Policies (the day after)
• How can we keep track of what we have done or changed?
• We can name the policy appropriately based on function or grouping of settings– Interactive_Logon_Policy– Internet_Explorer_Policy
• The GPMC allows us to make comments regarding a particular policy.
Group Policies (the day after)
• What should we comment on?– Who’s in charge of the GPO– Who to call if there is a problem?– Who is supposed to be affected by this GPO?– Detailed information about what this GPO should
do– Who will get fired if this doesn’t work
Group Policies (the day after)
• Comments…• GPMCSelect PolicyEditRight click on Policy
name (see below)Properties
Group Policies (the day after)
• Controlling how GPO’s run– Disable local GPOs from applying• CCPoliciesAdmin TemplatesSystemGroup Policy
Group Policies (the day after)
• Controlling how GPO’s run– Disable Link Enabled Status– Disable “half” of a Group Policy• Will speed up processing (not very noticeable)
Group Policies (the day after)
• Controlling how GPO’s run– The Enforced Function• Guarantees that policy settings within a GPO from a
higher level are always inherited by lower levels• Right click on Policy and choose Enforce
Group Policy Preferences
• Group Policy Preferences (GPP) are essentially an extension DLL (dynamic link library) that does a bunch of stuff.
• Can be “undone” by the user
Group Policy PreferencesComputer Configuration PreferencesWindows Settings• Environment:– Set user and system environment variables– Change the Windows system path variable
• Files– Copy files from point A to point B• Server share to %Documents% on the local system
• Folders– Create, delete or empty folders
Group Policy Preferences
• Network Shares– Create shares on workstations or servers
• Shorcuts– Place program or URL on desktops, startup folder,
Programs folders, etc etc.
Group Policy Preferences
Common Control Panel Settings• Local users and groups– Create/change local users– Modify local user passwords– Change local user group membership
• Power Options– Create power options for XP– Create power plans for Vista and later
PowerShell
• Microsoft ® shell environment• Gives administrators more power and
command in the shell environment– Hence…PowerShell?
• Active Directory Module for Windows® Powershell allows for Active Directory specific command-line and scripted operations
• Only available in Windows ® Server R2 and Windows ® 7
PowerShell
• First, we need to understand naming formats– Distinguished namecn=John Doe, OU=Sale_OU,
DC=MS1, DC=local– RDNRelative Distinguished Name• CNCommon Name• DCDomain Component• OUOrganizational Unit
– Fully Qualified Domain Name (FQDN)• SVBlue1.ms1.local
PowerShell
• Growing resources daily– http://technet.microsoft.com/en-us/scriptcenter/powershell.as
px– http://gallery.technet.microsoft.com/ScriptCenter/en-us/– http://technet.microsoft.com/en-us/library/dd378937(WS.10).a
spx
PowerShell
• Creating an Active Directory user account:– New-aduser
• How do I use it? Get HELP! No seriously get-help– Get-help new-aduser– Get-help new-aduser –examples– Get-help new-aduser –detailed
• new-aduser jdoe• New-aduser “John Doe” –samaccountname
“jdoe” –Givenname “John” –Surname ……..
PowerShell
• Setting Passwords– Set-ADAccountPassword –Identity jdoe -Reset -
NewPassword (ConvertTo-SecureString -AsPlainText "p@ssw0rd" –Force)
• Change attributes for multiple users– Get-ADUser -Filter 'Name -like "*"' -SearchBase
"OU=Sale_OU,DC=MS1, DC=Local" | Set-ADUser -Description "Member of the Sales Department"
PowerShell
• Display user attributes– Get-aduser jdoe– Get-aduser jdoe –properties * | more
• Add groups and members– Add-adgroupmember “Sale_Group”– Add-adgroupmember “Sale_Group” –member
jdoe• A great deal more online