Active Directory Basics

Active Directory: Active Directory (AD) is a centralized database that stores information about users, computers, printers, and other network resources in a domain. Active Directory is designed to provide a centralized authentication and authorization mechanism for network resources. It allows administrators to manage and control access to resources on a network by creating and managing user accounts, groups, and computer accounts. AD provides a variety of features including user and group management, access control, authentication, and single sign-on.

Windows Domain: A Windows domain is a grouping of computers, users, and other network resources that are managed as a single unit using Active Directory. In a Windows domain, a central server called a domain controller authenticates users and allows them to access network resources based on their permissions and policies defined by administrators.

In a Windows domain, credentials are stored in a centralized repository called…

Active Directory

The server in charge of running the Active Directory services is called…

Domain Controller

Active Directory Objects: Objects refer to the various entities that are stored within the directory service database. Objects represent resources such as users, groups, computers, printers, and other network devices that are managed by Active Directory.

· User: A user object represents an individual user account that has access to network resources, and it contains properties like username, password, and group membership.

· Machine: A computer object represents a network device, and it has properties like hostname, operating system, and group membership.

· Security groups: They represent collections of users and computers that share common access permissions. A security group object has properties like name, description, and group membership.

In Active Directory, objects are organized into a hierarchical structure based on their properties, which allows administrators to manage and delegate control over network resources. Objects can be placed into containers or organizational units (OUs) based on their properties, and administrators can apply policies and permissions to these containers to manage the resources within them.

Practical 1: Creating new OU named Students under THM:

Which group normally administrates all computers and resources in a domain?

Domain Admins

What would be the name of the machine account associated with a machine named TOM-PC?

TOM-PC$

Suppose our company creates a new department for Quality Assurance. What type of containers should we use to group all Quality Assurance users so that policies can be applied consistently to them?

Organizational Units

Practical 2: Deleting extra users and OUs

The additional department OU in our current AD configuration is Research and Development that doesn’t appear in the chart. We’ve been told it was closed due to budget cuts and should be removed from the domain. If we try to right-click and delete the OU, we will get the following error:

By default, OUs are protected against accidental deletion. To delete the OU, we need to enable the Advanced Features in the View menu:

Practical 3: Delegation Steps

· To delegate control over an OU, we can right-click it and select Delegate Control

· This should open a new window where we will first be asked for the users to whom you want to delegate control

· To avoid mistyping the user’s name, write “phillip” and click the Check Names button. Windows will autocomplete the user for you.

· Click OK, and on the next step, select the option, “Read user passwords and force password change at next logon”.

· Now Phillip should be able to reset passwords for any user in the sales department.

· Now let’s use Phillip’s account to try and reset Sophie’s password.

· When we may be tempted to go to Active Directory Users and Computers to try and test Phillip’s new powers, he doesn’t really have the privileges to open it, so we’ll have to use other methods to do password resets. In this case, we will be using Powershell to do so:

· Log into Sophie’s account with your new password and retrieve a flag from Sophie’s desktop.

· After changing Sophie’s account password, we can log in as Sophie using the password specified by the PowerShell command.

What was the flag found on Sophie’s desktop?

THM{thanks_for_contacting_support}

The process of granting privileges to a user over some OU or other AD Object is called…

Delegation

Managing Computers in AD: Managing computers in Active Directory involves several tasks, such as joining computers to the domain, managing computer accounts, and configuring policies and permissions for computers.

Practical 4: Tidying up our AD

Create two separate OUs for Workstations and Servers directly under the thm.local domain container.

After creations of separate OUs, we will have following number of workstations and servers.

Get Krina Patel’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Workstations OU:

Servers OUs:

Group Policy Object: A Group Policy Object (GPO) is a collection of settings that define how computers and users behave in an Active Directory domain. GPOs are used to enforce security policies, software installation and configuration, and other settings that affect computer and user behavior.

GPOs can be linked to domains, OUs, and sites in Active Directory to apply settings to specific groups of computers and users. GPOs can be used to manage both computer and user settings, and can be used to apply policies to multiple levels of the Active Directory hierarchy.

Group Policies: A Group Policy Object (GPO) is a collection of settings that define how computers and users behave in an Active Directory domain. GPOs are used to enforce security policies, software installation and configuration, and other settings that affect computer and user behavior. GPOs can be linked to domains, OUs, and sites in Active Directory to apply settings to specific groups of computers and users. GPOs can be used to manage both computer and user settings, and can be used to apply policies to multiple levels of the Active Directory hierarchy.

There are three policies defined and their scope are as shown:

1. The Default Domain Policy is a GPO that contains settings that apply to all computers and users in the domain. It can be used to configure security policies, password policies, and other domain-wide settings.

2. The Default Domain Controller Policy is a GPO that contains settings that apply specifically to domain controllers in the domain. It can be used to configure security policies, audit policies, and other settings that are specific to domain controllers.

3. The RDP policy is a GPO that contains settings that apply specifically to Remote Desktop Protocol (RDP) connections. It can be used to control access to RDP, configure authentication settings, and other settings that are specific to RDP connections.

Practical 5: Changing the length of Password

· Any modification to this GPO would have an impact on all computers because it pertains to the entire domain. Change the minimal password length policy to demand that users use passwords with at least 10 characters.

· Right-click the GPO and choose Edit to complete this.

· By doing so, a new window will appear, allowing us to browse and edit each of the configurations that are offered.

· Go to

Computer Configurations -> Policies -> Windows Setting -> Security Settings -> Account Policies -> Password Policy

· Modify the necessary policy value to change the minimum password length.

Practical 6: Create and apply Restrict Control Panel Access GPO

The restrict control panel access policy was implemented to three OUs of thm.local, including Management, Marketing, and Sales, using Group Policy Management Editor.

Practical 7: Create and use a GPO for the Auto Lock Screen.

The root domain of thm.local was subject to the auto screen lock regulation.

The linked accounts were unable to access the Control Panel after applying the GPO to particular OUs. When a user tries to carry out an illegal activity, an error message is shown.

What is the name of the network share used to distribute GPOs to domain machines?

SYSVOL

Authentication Methods: Authentication methods are used to verify a user’s identity when accessing a service or resource in a Windows domain. Two protocols that can be used for network authentication in Windows domains are Kerberos and NetNTLM.

· Kerberos is the default protocol used in recent versions of Windows and is considered more secure than NetNTLM. When a user attempts to authenticate using Kerberos, the Domain Controller verifies their identity and issues a ticket that is used to access the requested resource.

· NetNTLM is a legacy authentication protocol kept for compatibility purposes. It is less secure than Kerberos and should be considered obsolete, but it may still be enabled in many networks.

When referring to Kerberos, what type of ticket allows us to request further tickets known as TGS?

Ticket Granting Ticket

Trees, Forests and Trusts: Companies and their networks expand together. A business can get by with just one domain at first, but as time goes on, you might find that you need more than one.

Trees:

As networks grow, multiple domains may be needed.

Active Directory allows integration of multiple domains into trees.

A tree consists of domains that share the same namespace.

IT teams can manage their respective domains independently.

Forests:

Domains in a network can be configured in different namespaces.

A forest is a union of several domain trees with different namespaces.

Each domain in a forest can have its own IT department and policies.

An Enterprise Admins group controls everything in the enterprise.

Trust Relationships:

Trust relationships allow domains to authorize users from other domains.

One-way trusts and two-way trusts can be established.

One-way trusts authorize access in one direction only.

Two-way trusts authorize mutual access between domains.

What is a group of Windows domains that share the same namespace called?

Tree

What should be configured between two domains for a user in Domain A to access a resource in Domain B?

A trust relationship