Tài liệu Windows Server 2008 Inside Out- P26 ppt

granted. In practice, you will almost always use security groups, because they include distribution group functionality and are the only types of groups that have DACLs. Domain Local Groups Consider using domain local groups fi rst when you are giving groups or users access to local domain resources. For instance, if you have a domain named northwind.com and you want users or groups in that local domain to access a shared folder in the north- wind.com local domain, you could create a domain local group called SalesPersons, insert in the SalesPersons group the users and global groups you want to give access to the shared folder, and then assign the SalesPersons group permissions on the resource. Access policies for domain local groups are not stored in Active Directory. This means that they do not get replicated to the global catalog and thus queries performed on the global catalog will not return results from domain local groups. This is because domain local groups cannot be determined across domains. Global Groups Use global groups to give users or groups access to resources according to how they have been organized. For instance, users from the Marketing or Development depart- ments could be put in separate global groups in order to simplify administration of their need to access resources like printers and network shares. Global groups can be nested in order to grant access to any domain in the forest. Universal Groups Universal groups have very few fundamental restrictions. Universal groups can be a tempting shortcut for administrators to use, because they can be used across domains in the forest. Memberships in universal groups can be drawn from any domain, and permissions can be set within any domain. However, using universal groups as your main method of grouping users, groups, and computers has a signifi cant caveat. Universal groups are stored in the global catalog, and whenever changes are made to a universal group, the changed properties must be replicated to other domain controllers confi gured as global catalog servers. The replication of individual property changes rather than entire objects is an improvement for Windows Server 2008 that should allow wider use of universal groups without causing network bottlenecks or slowed performance during authentication and global catalog changes. Which Group Scope Should You Use? There is a strategy in choosing when to use a group scope and which group scope to use. A common strategy is to organize user accounts into logical groups based on the permissions they need to access specifi c resources. In a business model, this often can be determined according to the department the user belongs to. For instance, the Devel- opment department of a software business may put all their developers in a Dev group, and then assign permissions to a network share to the Dev group. On the other hand, in a Windows Server 2008 environment it becomes more complex than this, because there are different scopes for groups. Furthermore, groups may contain not only users, but also computers and even other groups, and can be nested to any scale. Managing Groups 1217 Chapter 35 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Some important constraints on group scope in Windows Server 2008 include the following:  Universal groups are stored in the global catalog and replicated across the net- work. However, Windows Server 2008 has new features that allow caching of the global catalog and replication of only the changes in it.  Global groups can be included in an object’s security data structure only if that object is in the same domain as the global group. In Windows 2000 native func- tional level or higher, global groups can be nested in order to grant access to any domain in the forest.  Domain local groups cannot be processed in other domains. Group scope functionality and limitations include member inclusion and permissions. Table 35-4 lists how the three scopes function. Table 35-4 How Group Scope Functions Using Windows Server 2003 and Higher Domain Functional Levels Group Member Inclusion Permissions Universal You can include users, computer accounts, global groups, and universal groups from any domain. Within any domain, universal groups can be added to other groups and granted permissions. Global You can put in a global group any user or computer account or other global groups from the same domain. Global groups can be added to other global groups in any domain in the forest and assigned permissions. Domain local Same as universal groups, but you can also include domain local groups from the same domain. Domain local groups can be added only to other domain local groups in the same domain and assigned permissions. In native mode, Windows Server 2008 groups have nesting limitations that are depen- dent on the group scope. Limitations for nesting are listed in Table 35-5. Table 35-5 Group Scope Nesting in Windows 2000 Native Functional Level Group Type Can Nest in Universal? Can Nest in Global? Can Nest in Domain Local? Universal No Yes Yes Global Yes Yes (only in the same domain) Yes Domain local No No No Why Use Domain Local Groups? Domain local groups are used when you want to give users, computers, or specifi c groups access to resources in a single local domain. In a domain local group, you can include other domain local groups with domain local scope, global groups, or univer- sal groups. You can also include single accounts in the domain local group. However, Chapter 35 1218 Chapter 35 Managing Users, Groups, and Computers Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. including single user accounts can increase the amount of administration for you instead of reducing it, so unless management has specifi cally requested a special per- mission, this may not be the best route. A common scenario for using domain local groups is to provide access to printers for members of a department (such as the Developers department). In this scenario, you would use Active Directory Users And Computers: 1. Create a domain local group by right-clicking an OU, and then selecting New, Group. 2. Assign permissions to use the printer by adding the new domain local group to the printer by opening Control Panel, Printers And Faxes, then right-clicking Properties, selecting the Security tab, and fi nally adding the domain local group to the printer. 3. Create a global group. 4. Add the user accounts from the Development department to the global group 5. Add the global group to the domain local group you created at the beginning. This way, if you ever add a new printer, all you have to do is add access to it in the domain local group, and the developers automatically get access because their global group is part of the domain local group. If a new domain is added, all you have to do to give the people in the new domain access to the printer is add the new global groups from the new domain to the domain local group. Why Use Global Groups? An important aspect of global groups is they are not replicated outside their own domain. They are not part of the global catalog replication. Thus, you should use global group membership for objects that need high regular maintenance or modifi ca- tions. These changes will not be replicated across your network and thus will not slow network traffi c over slow links. Therefore, a main reason to use global groups is to organize users with similar needs within a domain to give them access to resources. For instance, you have two domains, one in the United States, the other in India. In each domain you have developers. Because your business model requires that neither group of developers needs access to the other’s source code, you could create two global groups, USA\Dev and India\Dev, and give the global groups permissions to different source code shares. Why Use Universal Groups? Using universal groups extends this idea so that users in groups of different domains may be able to access resources without affecting network traffi c because of global catalog replication. By creating a universal group and adding global groups to it, you can give users from different domains in the forest access to the same resource. For instance, in the preceding scenario, a third group could be created for the developers, Managing Groups 1219 Chapter 35 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. called UniDev. This would be a universal group to which you would add both global groups, USA\Dev and India\Dev, and assign permissions to perhaps even a second network share of source code that both groups of users must access. This is a good strategy, because if you add new user accounts to the global groups, the changes are not replicated to the global catalog and little if no impact to network traffi c is incurred. However, be careful about changing memberships to universal groups, because those changes are replicated across all links to other domain controllers confi gured with global catalogs. Creating a Group You may create groups in the Users container or in a new OU that you have created in the domain. To create a group, start Active Directory Users And Computers. Right-click the Users container or the OU in which you want to place the group, point to New, and then select Group. This displays the New Object–Group dialog box shown in Figure 35-15. Type a group name, and then select the Group Scope and Group Type. Click OK to create the group. Figure 35-15 Creating a group. Windows Server 2008 has three group scopes and two group types you can select from. This allows you to create six different combinations of groups. You must be a member of the Account Operators, Domain Admins, or Enterprise Admins group to create new groups. Note The built-in accounts for Active Directory in Windows Server 2008 are located in two places. The built-in domain local groups such as Administrators, Account Operators, and Backup Operators are located in the Builtin container. Built-in global groups such as Domain Admins and Enterprise Admins are located in the Users container. Note The built-in accounts for Active Directory in Windows Server 2008 are located in two places. The built-in domain local groups such as Administrators, Account Operators, and Backup Operators are located in the Builtin container. Built-in global groups such as Domain Admins and Enterprise Admins are located in the Users container. Chapter 35 1220 Chapter 35 Managing Users, Groups, and Computers Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. At the command line, you can create groups using DSADD. For groups, AD path strings describe the group’s location in the directory from the group name to the actual contain- ers in which it is stored. You specify whether the group is a security group using -secgrp yes or that a group is a distribution group using -secgrp no. You specify the scope of the group using -scope u for universal, -scope g for global, and -scope l for domain local. For example, if you want to create a global security group called SeattleServices in the Services OU for the cpandl.com domain, the full path to this group object is CN=SeattleServices,OU=Services,DC=cpandl,DC=com. When creating the group object using DSADD, you must specify this path as follows: dsadd group "CN=SeattleServices,OU=Services,DC=cpandl,DC=com" -secgrp yes - scope g For the full syntax and usage, type dsadd group /? at a command prompt. Although quotation marks aren’t required in this example, I always use them to ensure that I don’t forget them when they actually are needed, such as when name components contain spaces. The directory services commands can also be used to perform many group management tasks. Using DSGET GROUP at a command prompt, you can:  Determine whether a group is a security group by typing dsget group GroupDN -secgrp.  Determine group scope by typing dsget group GroupDN -scope.  Determine the members of a group by typing dsget group GroupDN -members where GroupDN is the distinguished name of the group.  Determine the groups of which a group is a member by typing dsget group GroupDN -memberof. The -expand option can be added to display the recur- sively expanded list of groups of which a group is a member. Using DSMOD GROUP at a command prompt, you can:  Change group scope using dsmod group GroupDN -scope u for universal, -scope g for global, and -scope l for domain local.  Add members by typing dsmod group GroupDN -addmbr MemberDN where GroupDN is the distinguished name of the group and MemberDN is the distin- guished name of the account or group you want to add to the designated group.  Remove members by typing dsmod group GroupDN -rmmbr MemberDN.  Convert the group to a security group using dsmod group GroupDN -secgrp yes or to a distribution group using dsmod group GroupDN -secgrp no. SIDE OUT Creating group accounts at the command line At the command line, you can create groups using DSADD. For groups, AD path strings describe the group’s location in the directory from the group name to the actual contain- ers in which it is stored. You specify whether the group is a security group using -secgrp yes or that a group is a distribution group using -secgrp no. You specify the scope of the group using -scope u for universal, -scope g for global, and -scope l for domain local. For example, if you want to create a global security group called SeattleServices in the Services OU for the cpandl.com domain, the full path to this group object is CN=SeattleServices,OU=Services,DC=cpandl,DC=com. When creating the group object using DSADD, you must specify this path as follows: dsadd group "CN=SeattleServices,OU=Services,DC=cpandl,DC=com" -secgrp yes - scope g For the full syntax and usage, type dsadd group /? at a command prompt. Although quotation marks aren’t required in this example, I always use them to ensure that I don’t forget them when they actually are needed, such as when name components contain spaces. The directory services commands can also be used to perform many group management tasks. Using DSGET GROUP at a command prompt, you can:  Determine whether a group is a security group by typing dsget group GroupDN -secgrp.  Determine group scope by typing dsget group GroupDN -scopeN .  Determine the members of a group by typing dsget group GroupDN -membersN where GroupDN is the distinguished name of the group.N  Determine the groups of which a group is a member by typing dsget group GroupDN -memberofN . The -expand option can be added to display the recur- sively expanded list of groups of which a group is a member. Using DSMOD GROUP at a command prompt, you can:  Change group scope using dsmod group GroupDN -scope uN for universal, -scope g for global, and -scope l for domain local.  Add members by typing dsmod group GroupDN -addmbr N MemberDN whereN GroupDN is the distinguished name of the group andN MemberDN is the distin-N guished name of the account or group you want to add to the designated group.  Remove members by typing dsmod group GroupDN -rmmbr MemberDNN .  Convert the group to a security group using dsmod group GroupDN -secgrp yesN or to a distribution group using dsmod group GroupDN -secgrp noN . Managing Groups 1221 Chapter 35 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Adding Members to Groups The easiest way to add users to a group is to right-click the user in the details pane of Active Directory Users And Computers, and then select Add To A Group. The Select Groups dialog box appears and you can select the group of which the user is to become a member. You can also get to the same dialog box by right-clicking on the user name, selecting Properties, clicking the Member Of tab, and then clicking Add. Note To add multiple users to a group, select more than one user, using Shift+click or Ctrl+click, and follow the same steps. If you want to add both users and groups as members of a group, you can do this by performing the following steps: 1. Double-click the group entry in Active Directory Users And Computers. This opens the group’s Properties dialog box. 2. On the Members tab, click Add to add accounts to the group. 3. Use the Select Users, Contacts, Computers, Or Groups dialog box to choose users, computers, and groups that should be members of the currently selected group. Click OK. 4. Repeat steps 2 and 3 as necessary to add additional users, computers, and groups as members. 5. Click OK. Deleting a Group Deleting a group is as simple as right-clicking the group name within Active Directory Users And Computers, and then selecting Delete. You should be very careful when deleting groups because, though it does not delete the user accounts contained by the group, the permissions you may have assigned to the group are lost and cannot be recovered by merely re-creating the group with the same name. CAUTION ! The permissions on groups are internally characterized within Active Directory by unique SIDs that are allocated when the group is created. If you delete a group and then re-create it, it will have a new SID and thus new permissions. Note To add multiple users to a group, select more than one user, using Shift+click or Ctrl+click, and follow the same steps. CU O ! Chapter 35 1222 Chapter 35 Managing Users, Groups, and Computers Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Modifying Groups There are a number of modifi cations, property changes, and management procedures you may want to apply to groups. You can change the scope, the members, and other groups contained in the group; move a group; delegate management of a group; and send mail to a group. Finding a Group When you have a substantial number of groups, you can use the Find function to locate the one you need to manage. Just right-click the domain or OU, and then select Find. In the Find Users, Contacts, And Groups dialog box, you can specify what type of object to fi nd, change the starting point, or structure a search query from the available tabs. After the query has run, many administrative or management functions can be performed on the objects returned in the results window. In Active Directory Users And Computers, you can reuse and save queries. This allows you to fi nd groups quickly and repeatedly when you want to manage and modify them. You can locate the Saved Queries folder in the default position at the top of the Active Directory Users And Computers console tree (left pane). You cannot save queries using the Find menu when you right-click a group. You can only save them using the Saved Query procedure that is found in the uppermost part of the tree in Active Directory Users And Computers and creating a new query. Managing the Properties of Groups When you double-click a group name in Active Directory Users And Computers, the Group Properties dialog box appears. You can confi gure the following six areas or functions:  General You change the description or group e-mail address here. In addition, you may be able to change the type of group or the scope of the group. When in Windows Server 2003 or higher domain functional level, there are limitations on changing group scope, as shown in Table 35-6.  Members You can list, add, and remove group members.  Member Of Lists the groups the current group is a member of. These can be domain local groups or universal groups from the local domain or universal groups from other domains in the current domain tree or forest.  Managed By Add, clear, or modify the user account you want to make respon- sible for managing this group. SIDE OUT Saved queries in Active Directory In Active Directory Users And Computers, you can reuse and save queries. This allows you to fi nd groups quickly and repeatedly when you want to manage and modify them. You can locate the Saved Queries folder in the default position at the top of the Active Directory Users And Computers console tree (left pane). You cannot save queries using the Find menu when you right-click a group. You can only save them using the Saved Query procedure that is found in the uppermost part of the tree in Active Directory Users And Computers and creating a new query. Managing Groups 1223 Chapter 35 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark.  Object View the canonical name of the group object. This tab is visible only in Advanced view. To access Advanced view, select Advanced Features from the View menu in Active Directory Users And Computers.  Security Used to confi gure advanced permissions for users and groups that can access the group object in Active Directory. This tab is visible only in Advanced view. Table 35-6 Group Scope Conversions in Windows Server 2003 or Higher Domain Functional Level Scope of Group Can Be Converted to Universal Can Be Converted to Global Can Be Converted to Domain Local Universal NA Yes Yes Global Yes NA No Domain local Yes No NA Modifying Other Group Settings You can modify other group settings using Active Directory Users And Computers. You can perform the following tasks:  Move a group To move a group, right-click it, and then select Move. The Move dialog box appears, allowing you to select the container to which you want to move the group. Alternatively, you can drag the group icon into a new container. You can also select multiple groups to move by using Windows keyboard short- cuts such as Ctrl, then selecting multiple groups, or using Shift and selecting the fi rst and last group.  Rename a group Right-click the group name, and then select Rename. Type the new group name, and then press Enter. Multiple group selection is disabled for this function.  Send mail to a group Right-click the group name, and then select Send Mail. An error will occur if no e-mail address has been confi gured on the General tab of Group Properties. Otherwise, the default mail client will be used to open a new mail message addressed to the group, which you can complete and send. Note Moving or renaming groups can alter the effective permissions of users and groups in unpredictable ways. With this in mind, you might want to check the effective permissions for member users and groups to ensure that the permissions are as expected. Note Moving or renaming groups can alter the effective permissions of users and groups in unpredictable ways. With this in mind, you might want to check the effective permissions for member users and groups to ensure that the permissions are as expected. Chapter 35 1224 Chapter 35 Managing Users, Groups, and Computers Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Managing Computer Accounts Computer accounts are managed and confi gured using Active Directory Users And Computers. By default, computer accounts are stored in the Computers container and domain controller accounts are stored in the Domain Controllers container. Computer accounts can also be stored in other containers, such as the OUs you’ve created. Com- puters may be joined and removed from a domain using Computer Management or the System tool in Control Panel. Creating a Computer Account in Active Directory When you create a new computer account in your domain, you must be a member of the Account Operators, Domain Admins, or Enterprise Admins group in Active Directory. To create a new computer account, start Active Directory Users And Computers. Right- click the container in which you want to create the new computer account, point to New, and then select Computer. This starts the New Object–Computer Wizard shown in Figure 35-16. Figure 35-16 Creating a computer account. Type a computer name. By default, only members of Domain Admins can join com- puters to the domain. To allow a different user or group to join the computer to the domain, click Change, and then use the Select User Or Group dialog box to select a user or group account that is authorized to join the computer to the domain. If Windows NT systems can use this account, select the Assign This Computer Account As A Pre–Windows 2000 Computer check box. Click Next twice, and then click Finish. Managing Computer Accounts 1225 Chapter 35 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Note Creating a computer account does not join the computer to the domain. It merely cre- ates the account to simplify the process of joining a domain. You can, however, create a computer account when you join a computer to a domain. You can create computer accounts using DSADD as well. To do this, you’ll need to know the Active Directory service path string you want to use. For example, suppose you want to create a computer account called CustServicePC27 in the Computers container for the cpandl.com domain. The full path to this computer object is CN=CustServicePC27, CN=Computers,DC=cpandl,DC=com. When creating the computer object using DSADD, you must specify this path as follows: dsadd computer "CN=CustServicePC27,CN=Computers,DC=cpandl,DC=com" Here, CN= is used to specify the common name of an object and DC= is used to specify a domain component. With Active Directory path strings, you will also see OU=, which is used to specify the name of an organizational unit object. For the full syntax and usage, type dsadd computer /? at a command prompt. Although quotation marks aren’t required in this example, I always use them to ensure that I don’t forget them when they actually are needed, such as when name components contain spaces. The directory services commands can also be used to perform many computer man- agement tasks. Use DSMOD COMPUTER to set properties, disable accounts, and reset accounts. Use DSMOVE COMPUTER to move computer accounts to a new container or OU. Use DSRM COMPUTER to remove the computer account. Joining Computers to a Domain When you join a computer to a domain, you must supply the credentials for creating a new computer account in Active Directory. The new computer will be placed in the default Computers container in Active Directory. Most of the time, there is a dialog box for joining a computer to the domain when you install or set up Windows 2000 or later for the fi rst time. You must be a member of the Administrators group on the local computer to join it to the domain. Windows Server 2008 allows any authenticated user to join workstations to the domain—up to a total of 10—providing that you’ve already created the necessary computer accounts. To join a server to a domain, you must be a member of the Account Operators, Domain Admins, or Enterprise Admins group. Note Creating a computer account does not join the computer to the domain. It merely cre- ates the account to simplify the process of joining a domain. You can, however, create a computer account when you join a computer to a domain. SIDE OUT Creating computer accounts at the command line You can create computer accounts using DSADD as well. To do this, you’ll need to know the Active Directory service path string you want to use. For example, suppose you want to create a computer account called CustServicePC27 in the Computers container for the cpandl.com domain. The full path to this computer object is CN=CustServicePC27, CN=Computers,DC=cpandl,DC=com. When creating the computer object using DSADD, you must specify this path as follows: dsadd computer "CN=CustServicePC27,CN=Computers,DC=cpandl,DC=com" Here, CN= is used to specify the common name of an object and DC= is used to specify a domain component. With Active Directory path strings, you will also see OU=, which is used to specify the name of an organizational unit object. For the full syntax and usage, type dsadd computer /? at a command prompt. Although quotation marks aren’t required in this example, I always use them to ensure that I don’t forget them when they actually are needed, such as when name components contain spaces. The directory services commands can also be used to perform many computer man- agement tasks. Use DSMOD COMPUTER to set properties, disable accounts, and reset accounts. Use DSMOVE COMPUTER to move computer accounts to a new container or OU. Use DSRM COMPUTER to remove the computer account. Chapter 35 1226 Chapter 35 Managing Users, Groups, and Computers Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... compatible with a particular revision For example, some group policies are compatible with Windows 2000, Windows XP Professional, Windows Vista, Windows Server 2003 and Windows Server 2008, while others are compatible only with Windows XP Professional and Windows Server 2003 or with Windows Vista and Windows Server 2008 You can check compatibility when you are editing individual policy settings Local and... Group Policy to manage servers running Microsoft Windows 2000 Server and later as well as client workstations running Windows 2000 and later You cannot use Group Policy to manage Windows NT, Windows 95, Windows 98, or Windows Me Note Like Active Directory, Group Policy has gone through several revisions As a result of these revisions, some policies work only with a version of the Windows operating system... remove this watermark Chapter 36 Administrative Templates 1238 Chapter 36 Managing Group Policy You can edit GPOs using ADMX fi les only on computers running Windows Vista and Windows Server 2008 The reason for this is that Windows Vista and Windows Server 2008 have new versions of the standard policy editors that have been updated to work with ADMX That said, the policy editors automatically read and display... ADMX files are not stored in individual GPOs by default Languageneutral ADMX files are installed on computers running Windows Vista and Windows Server 2008 in the %SystemRoot%\PolicyDefinitions folder Language-specific ADMX files are installed on computers running Windows Vista and Windows Server 2008 in the %SystemRoot%\PolicyDefinitions\LanguageCulture folder Each subfolder is named after the appropriate International... currently connected or any available domain controller Working with Local Group Policy Windows Vista and Windows Server 2008 support multiple Local Group Policy objects (LGPOs) on a single computer (as long as the computer is not a domain controller) Previously, computers had only one LGPO Windows Vista and Windows Server 2008 allow you to: Assign a different LGPO to each general user type There are two... created in a particular domain Windows Vista and Windows Server 2008 introduce a new format for displaying the Registry-based policy settings in the Administrative Templates Registry-based policy settings are now defined using a standards-based, XML file format, called ADMX This new format replaces the ADM format previously used with Windows XP Professional and Windows Server 2003 Please purchase PDF... Policy 1239 Group Policy Management Console (GPMC) The GPMC is a feature that you can add to any installation of Windows Server 2008 by using the Add Features Wizard The GPMC is also included with Windows Vista and available as a download from the Microsoft Web site After you add the GPMC to a server, it is available on the Administrative Tools menu When you want to edit a GPO in the GPMC, the GPMC opens... storage space used as the number of GPOs increases and also reduces the amount of data being replicated throughout the enterprise As long as you edit GPOs using Windows Vista or Windows Server 2008, new GPOs will contain neither ADM nor ADMX files inside the GPO Implementing Group Policy Chapter 36 As discussed previously, there are two types of Group Policy: local group policy and Active Directory group... effect on the state of the setting from a previous policy application You can simplify domain administration by disabling processing of all Local Group Policy objects on computers running Windows Vista and Windows Server 2008 You do this by enabling the Turn Off Local Group Policy Objects Processing policy setting in a domain Group Policy object In Group Policy, this setting is located under Computer Configuration\Administrative... contains several subclasses of settings: Windows Settings Allow you to manage key Windows settings for both computers and users, including scripts and security For users, you can also manage Remote Installation Services, folder redirection, and Internet Explorer maintenance Administrative Templates Allow you to control Registry settings that configure the operating system, Windows components, and applications . Professional, Windows Vista, Windows Server 2003 and Windows Server 2008, while others are compatible only with Windows XP Pro- fessional and Windows Server 2003. Professional, Windows Vista, Windows Server 2003 and Windows Server 2008, while others are compatible only with Windows XP Pro- fessional and Windows Server 2003