Chapter 7 Account Management in Active Directory

Objectives

  • Work with organizational units.
  • Manage user accounts.
  • Manage group accounts.
  • Work with computer accounts.
  • Automate account management.

Working with Organizational Units (OUs)

  • Benefits of using OUs:
    • Create familiar hierarchical structures based on an organizational chart for easy resource access.
    • Delegation of administrative authority.
    • Easy OU structure changes.
    • Group users and computers for assigning administrative and security policies.
    • Hide AD objects for confidentiality or security reasons.

OU Delegation of Control

  • Delegation of Control: A person with higher security privileges assigns authority to a person of lesser security privileges to perform certain tasks.
  • Commonly Delegated Tasks:
    • Create, delete, and manage user accounts.
    • Reset user passwords and force password change at next logon.
    • Read all user information.
    • Create, delete, and manage groups.
    • Modify the membership of a group.
    • Manage group policy links.
    • Generate Resultant Set of Policy (Planning).
    • Generate Resultant Set of Policy (Logging).
  • Custom tasks can be created for delegation, but the nature of objects, permissions, and permission inheritance must be fully understood.
  • By default, the OU's properties don't show that another user has been delegated control. To verify, you must view the OU's permissions.

Active Directory Object Permissions

  • Security Principals: Three types can be assigned permission to an object:
    • Users
    • Groups
    • Computers
  • AD Object's Security Settings (Security Descriptor):
    • Discretionary access control list (DACL)
    • Object owner
    • System access control list (SACL)
  • Each object has a list of standard permissions and a list of special permissions.
  • Each permission can be set to Allow or Deny.
  • Five Standard Permissions:
    • Read
    • Write
    • Create all child objects
    • Delete all child objects
    • Full control

Permission Inheritance in OUs

  • Permission inheritance defines how permissions are transmitted from a parent object to a child object.
  • All objects in AD are child objects of the domain.
  • By default, permissions applied to the parent OU with the Delegation of Control Wizard are inherited by all child objects of that OU.

Advanced Features Option in Active Directory Users and Computers

  • Default settings in AD Users and Computers hide some system folders and advanced features.
  • Enable the Advanced Features option from the View menu to display them.
  • New Folders Shown:
    • LostAndFound
    • Program Data
    • System
    • NTDS Quotas
    • TPM (Trusted Platform Module) Devices
  • The Properties dialog box of domain, folder, and OU objects will now have three new tabs:
    • Object
      • Used to view detailed information about a container object.
    • Security
      • Used to view and modify an object’s permissions.
    • Attribute Editor
      • Used to view and edit an object’s attributes.

Effective Permissions

  • Effective permissions for an object are a combination of the allowed and denied permissions assigned to a security principal.
  • Can come from assignments made directly to a single user account or to a group the user belongs to.
  • Explicit permissions override inherited permissions, and can create some exceptions to the rule that Deny permissions override Allow permissions.
  • Most Common Settings for Permission Inheritance:
    • This object only: The permission setting isn’t inherited by child objects.
    • This object and all descendant objects: The permission setting applies to the current object and is inherited by all child objects.
    • All descendant objects: The permission setting doesn’t apply to the selected object but is inherited by all child objects.
    • Descendant [object type] objects: The permission is inherited only by specific child object types, such as user, computer, or group objects.
  • Several permissions are added to an OU’s DACL by default when it’s created.
  • View inherited and added permissions by viewing the Advanced Security Settings dialog box.
  • Permission inheritance is enabled by default on child objects but can be disabled.
  • Use caution before changing permissions and permission inheritance as incorrect settings can cause AD access problems.

Managing User Accounts

  • Main Functions of User Accounts in AD:
    • Provide a method for user authentication to the network.
    • Provide detailed information about a user.
  • Windows machines not part of a domain store accounts in the Security Accounts Manager (SAM) database on the local computer.
  • User accounts created in AD are referred to as “domain user accounts.” These accounts can usually log on to any computer that’s in the AD forest.

Guidelines for the Built-in Administrator Account

  • Local administrator account has full access to all aspects of a computer, while domain administrator account has full access to all aspects of the domain.
  • The domain administrator account in the forest root domain has full access to all aspects of the forest.
  • The default Administrator account should be renamed and given a strong password.
  • The Administrator account should only be used while performing administrative operations.
  • The Administrator account can be renamed or disabled but not deleted.

Guidelines for the Built-in Guest Account

  • The Guest account is disabled by default after install and must be enabled before it can be used for log on.
  • The Guest account can have a blank password.
  • Should be renamed if it is to be used.
  • The Guest account has limited access to a computer or domain but does have access to any resource for which the Everyone group has permission.

Considerations When Creating User Accounts in an AD Domain

  • User accounts must be unique throughout the domain.
  • Account names aren’t case sensitive and can be from 1 to 20 characters.
    • Can use letters, numbers, and special characters (with some exceptions).
  • Develop a standard naming convention.
  • By default, complex passwords are required and passwords are case sensitive.
  • By default, only a logon name is required to create a user account.

Attributes to Enter When Adding Users Using ADUC

  • Full name
  • User logon name
  • User logon name (pre-Windows 2000)
  • Password and Confirm Password
  • Four Check Boxes:
    • User must change password at next logon
    • User cannot change password
    • Password never expires
    • Account is disabled

Disabling User Accounts

  • Reasons to Disable a User Account:
    • A user has left the company.
    • The account is not ready to use.
    • A user goes on extended leave.
  • Aside from using ADUC and ADAC to enable and disable accounts, you can use the PowerShell cmdlets:
    • Enable-ADAccount
    • Disable-ADAccount
  • As well as the dsmod user command.

Using User Templates

  • User template: A user account that’s copied to create users with common attributes.
  • Tips for Creating User Templates:
    • Create one template account for each department or OU.
    • Disable the template account to eliminate security risks.
    • Add an underscore or other special character to the beginning of a template account’s name to make it easy to recognize.
    • Fill in as many common attributes as you can so that after the account is created, less customizing is necessary.

Modifying Multiple Users

  • Selecting multiple users using ctrl + click or shift + click allows them all to be edited simultaneously.
  • Following Actions Can Be Performed:
    • Add to a group
    • Disable account
    • Enable account
    • Move
    • Send Mail
    • Cut
    • Delete
    • Properties

Understanding Account Properties

  • Common Actions That Might Be Necessary:
    • Reset a password: The Overview window has a Reset Password check box.
      • To reset a password using PowerShell, enter: Set-ADAccount Password LogonName -Reset
    • Rename an account: Right-click the account and click Rename in the ADUC.
      • To rename an account using PowerShell, enter: Rename-ADObject DistinguisedName - NewName “NewName”

Understanding Account Properties (Cont’d)

  • Common Actions That Might Be Necessary (Cont’d):
    • Move an account: Accounts / AD objects can be moved with one of the following methods:
      • Right-click the user and click Move.
      • Right-click the user and click Cut.
      • In ADUC, drag the user from one container to another.
      • Use the Move-ADObject cmdlet in PowerShell.

The General Tab

  • Contains descriptive information about the account but doesn't affect the user’s account logon, group memberships, rights, or permissions.
  • Fields Worth Mentioning:
    • Display name: Same as the CN when the account is first created.
    • E-mail: Can be used to send an E-mail to the user using the default mail application.
    • Web page: Can contain a URL and allows you to open the specified URL by right-clicking the user account.

The Account Tab

  • Contains the information that most affects a user’s logon to the domain
    • User logon name and User logon name (pre-Windows 2000)
    • Logon Hours
    • Log On To
    • Unlock account
    • Account options
      • Store password using reversible encryption
      • Smart card is required for interactive logon
      • Account is sensitive and cannot be delegated
    • Account expires

The Profile Tab

  • Used to specify the location of files that make up a user’s profile, a logon script, and the location of a home folder:
    • Profile path: Used to specify the path to a user’s profile.
    • Logon Script: Used to specify a script that runs when the user logs on.
    • Local path: Used to specify the path to a user’s home folder (Documents folder).
    • Connect: Used to map a drive letter to a network share that’s the user’s home folder.

The Member of Tab

  • Lists groups the user belongs to.
  • Can be used to change group memberships.
  • The Set Primary Group button is needed only when a user is logging on to a Mac OS, Unix, or Linux client computer.

Using Contacts and Distribution Groups

  • A contact is an Active Directory object that usually represents a person for informational purposes only.
  • Most common use of a contact is for integration into Microsoft Exchange’s address book.
  • A distribution group is created in the same way as a group.
  • A distribution group is used with Microsoft Exchange to send e-mails, but to several people at once.

Managing Group Accounts

  • Active Directory group objects are the main security principal administrators use to grant rights and permissions to users.
  • Groups are easier to manage.
    • Users with similar access requirements to resources can be made members of a group.
  • When a group is created in ADUC, aside from assigning a name, there are two other settings:
    • Group type
    • Group scope

Group Types

  • Two group types: security and distribution.
  • A distribution group is used to group users together.
    • Mainly for sending e-mails to several people at once with an AD integrated e-mail application, such as Microsoft Exchange.
  • Can Have the Following Objects as Members:
    • User accounts
    • Contacts
    • Other distribution groups
    • Security groups
    • Computers

Group Types

  • Security groups are the main AD object administrators use to manage network resource access and grant rights to users.
  • Can contain the same types of objects as distribution groups.
  • If a contact is part of a security group that is assigned permissions to a resource, the contact does not make use of the permissions because a contact is not a security principal.

Converting Group Type

  • Group type can be changed from security to distribution and vice versa.
  • Only security groups can be added to a DACL.
  • If a security group is converted to a distribution group, the entry will remain in a DACL, but it has no effect on access to the resource.
  • Converting group types is not commonly done.
    • Usually, a distribution group is converted to a security group.

Group Scope

  • Group scope determines the reach of a group’s application in a domain or a forest.
  • Three group scope options are possible in a Windows Server 2008 forest:
    • Domain local
    • Global
    • Universal
  • A fourth scope called “local” applies only to groups created in the SAM database of a member computer or stand-alone computer.

Domain Local Groups

  • A domain local group is the main security principal recommended for assigning rights and permissions to domain resources.
  • In a single domain environment, or when users from only one domain are assigned access to a resource, use AGDLP:
    • Accounts are made members of
    • Global groups, which are made members of
    • Domain Local groups, which are assigned
    • Permissions to resources

Domain Local Groups (cont.)

  • In multidomain environments where users from different domains are assigned access to a resource, use AGGUDLP:
    • Accounts are made members of
    • Global groups, which when necessary are nested in other
    • Global groups, which are made members of
    • Universal groups, which are then made members of
    • Domain Local groups, which are assigned
    • Permissions to resources

Global Groups

  • A global group is used mainly to group users from the same domain with similar access or rights requirements.
    • Considered global because it can be made a member of a domain local group in any domain in the forest or trusted domains in other forests.
  • A common use is creating a global group for each department, location, or both.
  • In a single-domain environment, global groups are added to domain local groups for assigning resource permissions.

Universal Groups

  • A universal group can contain users from any domain in the forest and be assigned permission to resources in any domain in the forest.
  • Universal groups can be a member of other universal groups or domain local groups from any domain in the forest.
  • Universal groups’ membership information is stored only on global catalog servers.

Universal Groups (cont.)

  • Universal group membership caching: A feature enabled on a domain controller that causes it to keep a local copy of universal group membership after querying a global catalog server.
  • Universal group membership changes require replication to all global catalog servers.
  • Plan your AD group design carefully so that changes to universal groups do not happen often.

Local Groups

  • A local group is created in the local SAM database on a member server or workstation or a stand-alone computer.
  • When a computer joins a domain, Windows changes the membership of two local groups automatically:
    • Administrators: Domain Admins global group is made a member.
    • Users: Domain users global group is made a member.
  • Local groups can have the following account types as members:
    • Local user accounts
    • Domain user accounts and computer accounts from any domain in the forest
    • Domain local groups from the same domain
    • Global or universal groups from any domain in the forest

Nesting Groups

  • Nesting groups: Making a group a member of another group.
  • Usually used to group users who have similar roles but work in different departments.
  • The complexity of tracking and troubleshooting permissions increases as the number of levels of nested groups increases.
    • Usually, one level of nesting groups of the same type is enough.

Converting Group Scope

  • Group scope can be converted, with some restrictions:
    • Universal to domain local, provided it’s not a member of another universal group.
    • Universal to global, provided no universal group is a member.
      • Universal groups can’t be members of global groups.
    • Global to universal, provided it’s not a member of another global group.
    • Domain local to universal, provided no domain local group is a member.

Default Groups in a Windows Domain

  • Builtin Folder: Domain local groups used for assigning rights and permissions in the local domain.
  • Users Folder: Combination of domain local, global, and, in the forest root domain, universal scope.
    • User accounts are generally added to global and universal groups in this folder for assigning permissions and rights in the domain and forest.
  • Special Identity Groups: Can be assigned permissions by adding them to resources’ DACLs.
    • Membership is controlled dynamically by Windows and cannot be changed manually.

Working with Computer Accounts

  • Computer accounts are created in Active Directory when a client computer becomes a member of a domain.
  • A computer account is a security principal with an SID and a password and must authenticate to the domain.
  • Advantages of Having Users Log On to Computers That Are Domain Members:
    • Single sign-on
    • Active Directory search
    • Group policies
    • Remote management

Creating Computer Accounts

  • Computer accounts are created in AD two ways:
    • A user changes the computer membership from Workgroup to Domain in the System Properties dialog box.
      • Joining the domain and account is created automatically.
    • An administrator creates the account manually in Active Directory.

Changing the Default Computer Account Location

  • The Computers folder can’t have a group policy linked to it.
    • You should move computer accounts to an OU you have created.
  • Change the default location by using the redircmp.exe command-line program.
  • Example: To change the location for computer accounts to the MemberComputers OU in the csmtech.local domain, type:
    • Redircmp ou=MemberComputers, dc=local

Joining a Domain

  • On the computer joining the domain:
    • Go to the Computer Name tab in the System Properties dialog box.
    • Click Change, then click the Domain option button.
    • Type the name of the domain you want to join.
    • You’ll be prompted for credentials, and the computer will restart.
  • If the computer account does not already exist, it’s created automatically as long as the domain user account has the right to “Add workstations to the domain.”

Joining a Domain (cont.)

  • To join a domain using the command-line, enter:

    Netdom join ComputerName  /Domain:DomainName /UserD:UserName  /PasswordD:Password
    • Use * instead of specifying the password so that users are prompted for a password.

  • To join a domain using PowerShell, enter:

    Add-Computer -DomainName DomainName - Restart

Performing an Offline Domain Join

  • Offline domain join: A feature that allows a running computer or offline virtual disk to join a domain without contacting a domain controller.
  • Useful for large deployments of virtual machines or for mobile device deployments
    • Where network connectivity might not be available when the VM or device is deployed.
  • Offline domain joins can be done when regular domain joins can’t be performed reliably.

Performing an Offline Domain Join (cont.)

  • To perform an offline join, use the djoin.exe command.

  • First Phase Syntax:

    djoin /provision /domain DomainName /machine ComputerName /savefile filename.txt

  • Second Phase Syntax:

    djoin /requestODJ /loadfile filename.txt /windowspath %systemroot%  /localos

Managing Computer Accounts

  • It may be necessary to reset a computer account
    • If the computer account has become unsynchronized with the domain controller.
  • To Reset:
    • Right-click the computer object in ADUC and click Reset Account.
    • The computer will leave the domain and then join again.
  • Administrators might also want to run the Computer Management MMC remotely on a member computer.
    • Right-click the computer object and click Manage.

Disabling Computer Accounts

  • When a computer leaves the domain, its computer account is disabled automatically.
  • You might need to disable a computer account manually if the computer won’t be in contact with the domain controller for an extended period.
  • To Disable:
    • Right-click the computer object in ADUC and choose Disable from the shortcut menu.

Automating Account Management

  • When many accounts require action, or certain tasks must be repeated many times:
    • A command-line program is efficient.
  • Batch files can handle lengthy and cumbersome command-line syntax.
    • A batch file is a text file with a .bat extension.
    • Batch files can take arguments to replace variables in the command.
  • Bulk import/export programs can read an input file to create several AD objects at once or produce an output file from AD objects.

Command-Line Tools for Managing Active Directory Objects

  • Most Commonly Used Command-Line Tools for Managing Accounts:
    • dsadd
    • dsget
    • dsmod
    • dsmove
    • dsquery
    • dsrm
  • Typing /? after a command will show help information and command syntax.

Command-Line Tools for Managing Active Directory Objects (cont.)

  • dsadd Syntax:

    dsadd ObjectType ObjectDN [options]
    • Where: ObjectType is the type of object you want to create; ObjectDN is the object’s distinguished name (DN).

  • Components of DN:

    • CN (Common Name)
    • CN (Common Name) (Can be repeated if the object is in a folder)
    • OU (Organizational Unit)
    • DC (Domain component)

Piping Output

  • Command-line programs allow piping of output from one command to another, via |.
  • You can use piping with the dsquery and dsmod commands.
  • A common use of piping:
    • Sending the output of any command producing more than one screen of information to the more command.
  • Example:
    • dsmod user /? | more

Managing Accounts with PowerShell

  • There are numerous PowerShell cmdlets to manage AD accounts. To see an entire list of AD PowerShell commands, type the following at a PowerShell prompt:

    Get-Command -module ActiveDirectory

  • When using PowerShell commands that might produce results you’re not sure of, add the -whatif parameter to the command.

    • PowerShell shows the results of the command without actually performing it.

Bulk Import and Export with csvde and ldifde

  • csvde and ldifde can bulk import or export AD data.
  • csvde uses comma-separated values (CSV).
  • ldifde uses LDAP Directory Interchange Format (LDIF).
  • csvde can only create objects in AD, whereas ldifde can create or modify objects.

Creating Users with csvde

  • A CSV file must have a header record listing attributes of the object to be imported, for example:

    dn,SamAccountName,userPrincipalName,objectClass

  • Data record example:

    “cn=NewUser,ou=TestOU,dc=csmtech,dc=local”,NewUser,NewUser@410Server2012,user

  • Does not set passwords, so all user accounts are disabled until you create a password for each account.

Creating Users with ldifde

  • Same idea as csvde but with a different format.

  • Example:

    dn: cn=LDF User1,ou=TestOU1,dc=410Server2012,dc=local
changetype: add
ObjectClass: user
SamAccountName: LDFUser1
UserPrincipalName: LDFUser1@410Server2012.local

  • A common use of ldifde is exporting users from one domain and importing them into another domain.

Summary

  • OUs can be designed to mirror a company’s organizational chart.
  • OU permissions and permission inheritance work much the same way as they do in the file system.
  • User accounts provide a way for users to authenticate to the network and contain user information that can be used in a company directory.
  • ADUC and ADAC are GUI tools for creating and maintaining user accounts.
  • User templates facilitate creating users who have some attributes in common, such as group memberships.
  • Account management can be automated by using command-line tools or PowerShell cmdlets.
  • Computer accounts are created automatically when a computer joins a domain or manually by an administrator.
  • Computers that are domain members have computer accounts in AD.
  • There are three group scopes in AD: domain local, global, and universal.
  • Groups are the main security principal used to grant rights and permission.
  • The General, Account, Profile, and Member Of tabs contain user account properties. This chapter covers these tabs and their usage.