Active Directory Basics
Assume you want to manage a large number of computers in one company. It is so difficult to reach one by one station and try to solve its problems. Definitely, it is impossible to manage and maintain this network. Microsoft has a solution for this kind of enterprise and it is Active Directory (AD). The name of its service is Domain Controller (DC) that has two main advantages:
1. Centralised identity management
2. Managing security policies
Domain Controller can run in any network where the users and computers are too much. The base of control of this network is the user credential that according to that each user can have access to resources and facilities in the network. Active Directory Domain Service (AD DS) is the core of any domain in windows and has information on any object in the network such as users, groups, machines, printers, shares and etc.
Users:
The most common object in AD is users. Giving authenticity and assigning privilege over resources is done by Active Directory and it consists of People and Services.
Machines
As object for each computer that joins the AD network is called Machine. Identifying machines followed by a specific naming scheme. After the computer name there is a dollar sign ($) like “Desktop08” as the computer name and add ($) for the machine account “Desktop08$”
Security Groups
This is another object that is the group for defining a security level for all members of the group. By default, some Security Groups are created in a domain such as Domain Admins, Server Operators, Backup Operators, Account Operators, Domain Users, Domain Computers, and Domain Controllers.
Active Directory Users and Computers
To configure users, groups or machines in Active Directory, we need to log in to the Domain Controller and run “Active Directory Users and Computers” from the start menu:
Below Window are the AD User and Computers that we can manage all Organizational Units (OUs) and Users.
Users in Sales OU
Windows created some OU by default:
· Builtin: Contains default groups available to any Windows host.
· Computers: Any machine joining the network will be put here by default. You can move them if needed.
· Domain Controllers: Default OU that contains the DCs in your network.
· Users: Default users and groups that apply to a domain-wide context.
· Managed Service Accounts: Holds accounts used by services in your Windows domain.
Some time is needed to modify the OUs. For example, we want to delete one extra OU from THM OU’s list but to prevent deleting accidentally we can not do it directly. To do it go to Advanced Features
The advanced view is shown below
Select the OU → Right Click → Properties → Object, then you can see a checkbox to disable the protection.
To delete the Research and Development, uncheck the protection and now you can delete this OU. After confirming to delete one message shown that for some of the departments, the users in the AD don’t match the ones in our organizational chart. Create and delete users as needed to match them.
Delegation
Delegation allows you to grant users specific privileges to perform advanced tasks on OUs without needing a Domain Administrator to step in. For example, we want to give delegation to Philip for resetting passwords over other OUs.
Select Reset user Passwords
Now Phillip should be able to reset passwords for any user in the sales department.
Sign out and enter with Phillip’s account. This user has no privilege to open Active Directory Users and Computers. So try to work with PowerShell to change Sophie’s password.
Now we know Sophie’s password so with the below command on PowerShell, force Sophie to change the password.
Managing Computers in AD
Get Ehsanj’s stories in your inbox
Join Medium for free to get updates from this writer.
In AD all computers joined with the domain will be put in Computer Container
Some of those computers are servers, laptops and PCs. To manage them it is better to have a different policy for every group of computers. So we can put them in a specific container like Workstations, Servers, and Doman Controller.
All Laptops and PCs moved to the Workstation container
And all servers moved to the Servers' Container
Windows manages such policies through Group Policy Objects (GPO). GPOs are simply a collection of settings that can be applied to OUs. GPOs can contain policies aimed at either users or computers, allowing you to set a baseline on specific machines and identities. In the Start menu, type Group Policy Management to open this tool
Windows have some default policy in 3 part: 1) THM.local has Default Domain Policy and RDP policy 2) Domain Controller has Default Domain Controller Policy and 3) Group Policy Object has Default Domain Controllers Policy, Default Domain Policy, and RDP Policy.
Each policy has its own scope that shows the links to the domains and OUs. In this tab, Security Filtering is for Authenticated Users.
Each policy has its own setting which is divided into 3 parts: General, Computer Configuration and User Configuration.
GPO distribution
After any changes in GPO, it should be affected those objects that are related to them. In windows, there is one path called “sysvol” that all network clients have access to this path for any updates from GPO. Normally it takes 2 hours to effect on destination. To force one client to update run the below command in its PowerShell.
Creating some GPOs for THM Inc.
Restrict Access to Control Panel
We want to restrict access to the Control Panel across all machines to only the users that are part of the IT department. Users of other departments shouldn’t be able to change the system’s preferences.
Create on GPO and name it “Restrict Control Panel Access”. After that enable “Prohibit access to Control Panel and PC setting”
Then go to each UO that you want to apply this new GPO on that. Right Click → ”Link an Existing GPO”
Select “Restrict Control Panel Access”
Apply for 3 UOs, Management, Marketing, and Sales
Auto Lock Screen GPO
Make workstations and servers lock their screen automatically after 5 minutes of user inactivity to avoid people leaving their sessions exposed.
Let’s create a new GPO, call it “Auto Lock Screen”, and edit it. Go to the below root to change “Interactive logon: Machine inactivity limit” to 300 seconds.
Authentication Methods
When using Windows domains, all credentials are stored in the Domain Controllers. Whenever a user tries to authenticate to a service using domain credentials, the service will need to ask the Domain Controller to verify if they are correct. Two protocols can be used for network authentication in windows domains:
· Kerberos: Used by any recent version of Windows. This is the default protocol in any recent domain.
· NetNTLM: Legacy authentication protocol kept for compatibility purposes.
Trees, Forests and Trusts
By growth in the number of branches of businesses, just the use of one domain is not enough. And need to have a tree of networks and domains to cover all computers in one collection. For example, our original domain is “THM.local”. If we want to extend our network to another location, we will need sub-domains like “UK.THM.local” and “US.THM.local”. These two sub-domains are a tree of the root “THM.local”.
Forests
Suppose your company continues growing and eventually acquires another company. When both companies merge, you will probably have different domain trees for each company, each managed by its own IT department. The union of several trees with different namespaces into the same network is known as a forest.
Trust Relationships
In simple terms, having a trust relationship between domains allows you to authorize a user from domain A to access resources from domain B.
