Complete Windows Server 2008 Step By Step v2

8/10/2019 Complete Windows Server 2008 Step By Step v2

1/582

1


2/582

2

To my loving wife of more than 10 years, who continues to provide me love and encouragement even when I dont deserve it.

http://zcomby-server2008.blogspot.com/


3/582

3

AcknowledgmentsNo book is written alone. Instead, there is a wealth of people working behind the scenesto help make a book the best possible. I m grateful for the hard work put in behind the

scenes by several people. Kamal Harmoni, Kharizan, Hj. Shukri, Fadhlina, Ruslan, Azzahari, Alanto, and Nor Izwan, all provided a significant amount of work that helpedproduce this book. I m grateful to each of them.

About the AuthorZulfadli Mohd Saad has been teaching Microsoft networking concepts since the DOSdays and has been teaching a myriad of other topics since many years before then. He sbeen a Malaysia Skills Competition Coach for trade IT PC/Network Support since 2003and holds many other certifications, including Certified Ethical Hacker, NationalIndustrial Specialist (IT02-00 Information & Communication Technology), NationalIndustrial Specialist Instructor (IT02-00 Information & Communication Technology),Certificate of Excellent MySkills-ASEAN 2009 (IT PC/Network Support), Diploma ofExcellent MySkills 2008 (IT PC/Network Support) and Bronze Medal MySkills 2010 (ITPC/Network Support)

Zulfadli has developed several video training courses for People Trust Council (Majlis Amanah Rakyat) and has written and co-authored several other technical books. He has

a passion for teaching and enjoys sharing knowledge in the classroom as much as hedoes through books.

He currently works full-time on a government contract providing a wide array of technicaltraining to government personnel in support of a network operations support center. Hemoonlights as an adjunct instructor at a local college (MARA Vocational Institute)teaching Network System Administration courses.

Zulfadli lives with his wife and four children in Ipoh, Perak, but on most weekends theycan t be found because they always travel . He s found that configuring networks is apiece of cake compared to building a good house and happy family , but he hasn t givenup yet.


4/582

4

Notes For Users

This section explains how the lab network of computers is arranged, the IPaddresses and computer names used, and other details. Users should use thisinformation to alter the examples in the labs and notes to match their own

network configurations.

`

Each Computer is configure as

Static IP : 192.168.2. SN Subnet Mask : 255.255.255.0Gateway : 192.168.2.25DNS : 192.168.2. S e r v er N u m b e r

Client

Name : clientxp SN Static IP : 192.168.2. SN

Server

Network Printer 192.168.2.254

Name : server SN Static IP : 192.168.2. SN

All computers use static IP addresses and are on the same subnet. All PCsshould have the following configuration:

Server : Minimum Intel Dual Core 2.6GHz, 2GB RAM, 80GB Disk. Partition 1: C Drive, formatted as NTFS, 40GB, installed with Windows

Server 2008.

Partition 2: D Drive, formatted as NTFS, 40GB, free space.

Client : Minimum Pentium D 2.6GHz, 1GB RAM, 80GB Disk. Partition 1: C Drive, formatted as NTFS, 40GB, installed with Windows XP

Pro SP2. Partition 2: D Drive, formatted as NTFS, 40GB, free space.


5/582

5

Table Of Contents

Title Page

Exercise 1 Installing Windows Server 2008 7

Exercise 2 Initial Configuration 18

Exercise 3 Installing And Configuring DNS 30

Exercise 4 Installing Active Directory 56

Exercise 5 Creating Organization Units And Users 75

Exercise 6 Configuring Client Computer 97

Exercise 7 Viewing Computers In Active Directory 107

Exercise 8 Delegating Management Of Users 125

Exercise 9 Exploring Group Scopes and Types 142

Exercise 10 Creating And Applying Group Policies 156

Exercise 11 Creating And Sharing Resources 175

Exercise 12 Logon Scripts 209


6/582

6

Table Of Contents

Title Page

Exercise 13 Home Directories 227

Exercise 14 Disk Quotas 248

Exercise 15 Managing Software Applications 262

Exercise 16 Viewing Events 320

Exercise 17 Auditing 328

Exercise 18 Installing And Configuring Printer 368

Exercise 19 Other Administrative Tools 400

Exercise 20 Installing And Configuring DHCP Server 454

Exercise 21 Installing And Configuring Web Server 482

Exercise 22 Installing And Configuring FTP Server 520


7/582

7

Exercise 1

Installing WindowsServer 2008

Zulfadli Bin Mohd SaadComputer Engineering Technology,

Department of ElectronicMARA Vocational Institute, Lumut, Perak.



8/582

8

Exercise 1 : Installing Windows Server 2008

In this section, you should be able to :

Describe the different editions of Server 2008

Describe the requirements for a full installation G et a free evaluation copy of Windows Server 2008 (if you don t already hav eone) and how to install it.

Perform Full Installation of Server 2008

Hardware Requirements

Table 1.1 lists the basic system requirements for Windows Server 2008 editions.

Standard Enterprise Datacenter

Processor (min) 1 GHz (x86)1.4 GHz (x64) 1 GHz (x86)1.4 GHz (x64) 1 GHz (x86)1.4 GHz (x64)Processor (recommended) 2 GHz or faster 2 GHz or faster 2 GHz or faster

Memory (min) 512 MB 512 MB 512 MB

Memory (recommended) 2 GB or more 2 GB or more 2 GB or more

Memory (max) 4 GB (32 bit)32 GB (64 bit)

64 GB (32 bit)2 TB (64 bit)

64 GB (32 bit)2 TB (64 bit)

Disk space (min) 10 GB 10 GB 10 GB

Disk space (recommended) 40 GB 40 GB 40 GB

TABLE 1.1 Hardware requirements for Windows Server 2008 editions.

Hardware resources would need to be increased for any systems using Hyper-Vtechnology and running virtual machines. For example, if you re running three virtualservers within a Windows Server 2008 Enterprise edition, you would need additionalprocessing power, more memory, and more disk space.

How to Obtain a Copy of Windows Server 2008? It s common for Microsoft to provide free evaluation copies of Server operating systemsfor use. Currently, you can download Windows Server 2008 30-day and 60-dayevaluation editions free of charges at :

http://www.micosoft.com/windowsserver2008/en/us/trial-software.aspx


9/582

9

Beware, though. These files are quite large. If you re using a slower dial -up link, youmight want to see whether Microsoft is currently offering an evaluation DVD via regularmail. There s a nominal cost involved with this option, but it s better than trying todownload more than 2GB at 56KB.

The download is an .iso image of the actual DVD. Search with your favorite searchengine for Download Windows Server 2008 , and you ll find the link.

Once you download the .iso image, you can burn it to a DVD. If you don t have thesoftware needed to burn it to DVD, you can use one of many freeware utilities (such asImgBurn) to burn the .iso image to your DVD.

EXERCISE 1.1

Installing Windows Server 2008

1. Insert the Windows Server 2008 DVD into your DVD drive. Boot your PC usingWindows Server 2008 DVD.

2. Language and Keyboard Options .

This allows you to specify your language and your keyboard layout. By default,text input language and method is : US Keyboard layout (Figure 0001).

Figure 0001 : Language and Keyboard Options

2.1. Click Next to continue.


10/582

10

3. Windows Server 2008 Setup

You are presented with options to Install, brief information about Server 2008 orrepair (Figure 0002).

Figure 0002 : Windows Server 2008 Setup

3.1 Click Install now to start setup Windows Server 2008 on this computer.

4. Product Key and Activation

Figure 0003 : Product Key and Activation

4.1 Enter your " Product Key " for activation now or you can enter it later (Figure0003).


11/582

11

4.2. Click Next to continue.

Figure 0004 : Product Key Warning

4.3. If you leave the product key box blank, the warning window will appear (Figure

0004); just click No to continue.

5. Windows Server Version

5.1. Select Windows Server 2008 Enterprise (Full Installation) , (as shown in theFigure 0005).

Figure 0005 : Windows Version

5.2. Tick the box of I have selected the edition of Windows that I purchased.

5.3. Click Next .


12/582


13/582

13

7. Installation Options.

You are presented with options to Upgrade or Custom (advanced).

Click Custom (advanced) , (Figure 0007).

Figure 0007 : Installation Options

8. Partition Options

8.1. Click Drive options (advanced) , (Figure 0008).

Figure 0008 : Drive options


14/582

14

8.2. Click New , (Figure 0009).

Figure 0009 : New Partition

8.3. Change the size to 40,000 MB , (Figure 0010).

Figure 0010 : Partition Size

8.4. Click Apply .


15/582

15

8.5. Select Disk 0 Partition 1 (Figure 0011).

Figure 0011 : Partition

8.6. Click Next . The partition will be formatted with NTFS as part of the installation. Atthis point, take a break. The installation will continue on its own.

Figure 0012 : Installing Windows


16/582


17/582

17

Figure 0015 : Password changed successfully

10.3 Once the password has been changed, the screen indicates success(Figure 0015). Click OK.

Congratulation! You have finish install the Windows Server 2008.

Summary

In this section you installed Windows Server 2008 on a computer. In the followingexercises you will setting time zone, install Active Directory and other services, creatinga small network for you to administer.


18/582

18

Exercise 2

Initial Configuration





19/582

19

Exercise 2 : Initial Configuration In this section, you should be able to :

Complete the Initial Configuration Tasks Setup time zone for your server.

Configure networking on your server Change your server name

Setting Time Zone

In this section, you ll learn how to setup time zone for your server.

EXERCISE 2.1

Setting Time Zone

1. In Initial Configuration Tasks , select Set time zone (Figure 0016).

Figure 0016 : Set time zone

2. Click Change time zone (Figure 0017).

Figure 0017 : Change time zone


20/582

20

3. Select time zone appropriate for your location.e.g. (GMT+08:00) Kuala Lumpur, Singapore (Figure 0018).

Figure 0018 : Time zone

4. Click OK .

5. Click OK again (Figure 0019).

Figure 0019 : Change time zone


21/582

21

Configuring Network

In this section, you ll learn how to configure networking on your server. Make sure youhave hook up your server to the network before you start.

EXERCISE 2.2Configuring Network

1. In Initial Configuration Tasks , select Configure networking (Figure 0020).

Figure 0020 : Configure networking

2. Double-click Local Area Connection (Figure 0021).

Figure 0021 : Local Area Connection


22/582

22

3. Click Properties button (Figure 0022).

Figure 0022 : Local Area Connection Properties

4. Uncheck Internet Protocol Version 6 (TCP/IPv6) , because we only useTCP/IPv4 only (Figure 0023).

Figure 0023 : TCP/IPv6


23/582


24/582

24

Figure 0025 : Static IP address

7. Click Advanced button after complete setting your IP address (Figure 0025).

8. Select the DNS tab (Figure 0026).

Figure 0026 : Advanced TCP/IP Setting

9. Specify myserver.com as the DNS suffix for this connection (Figure 0026).

10. Tick Use this connections DNS suffix in DNS registration box (Figure 0026).


25/582

25

11. Click OK (Figure 0026).

12. Click OK again.

13. Click Close button to close Local Area Connection Properties (Figure 0027).


14. Click Close button to close Local Area Connection Status.

15. Close Network Connection properties (Figure 0028).

Figure 0028 : Network Connection properties


26/582

26

Changing Computer Name

In this section, you ll learn how to change your server name.

EXERCISE 2.3

Changing Computer Name

1. In Initial Configuration Tasks , select Provide computer name and domain (Figure 0029).

Figure 0029 : Provide computer name and domain

2. Click Change... button (Figure 0030).

Figure 0030 : System Properties


27/582


28/582

28

5. Click Close button on System Properties dialog box (Figure 0033).


6. Click Restart Now to reboot your computer (Figure 0034).

Figure 0034 : Restart Computer


29/582

29

7. After restart, login your server as Administrator (Figure 0035)

Figure 0035 : Login

Summary

In this section you have configure Time Zone, Networking and Computer Name for yourServer 2008. In the following exercises you will install Active Directory and otherservices for you to administer.


30/582

30

Exercise 3

Installing andConfiguring DNS



http://n/Desktop/Server2008/Win2003/lab4_0.htmhttp://n/Desktop/Server2008/Win2003/lab4_0.htmhttp://n/Desktop/Server2008/Win2003/lab4_0.htmhttp://n/Desktop/Server2008/Win2003/lab4_0.htm


31/582

31

Exercise 3 : Installing and Configuring DNS

Installing Domain Name System (DNS) Services Role

In this section, you ll learn how to implement a domain name server for your network.Domain Name System (DNS) provides a standard method for associating names withnumeric Internet addresses. This makes it possible for users to refer to networkcomputers by using easy-to-remember names instead of a long series numbers.

Windows DNS services can be integrated with Dynamic Host Configuration Protocol(DHCP) services on Windows, eliminating the need to add DNS records as computersare added to the network.

The first step is required to ensure that you are using a static IP address and that theDNS settings on the computer have been correctly configured. Make sure your havehook up your PC to the network and you are using a static IP address before you start.

EXERCISE 3.1

Installing Domain Name System (DNS) Services Role

1. Login your server as Administrator.

2. Launch Server Manager . Click Start Administrator Tools Server Manager(Figure 0036).

Figure 0036 : Launch Server Manager


32/582

32

3. In Server Manager, select Roles (Figure 0037).

Figure 0037 : Roles

4. Select Add Roles (Figure 0038).

Figure 0038 : Add Roles

5. On the Before You Begin page, review the requirements, and click Next (Figure0039).

Figure 0039 : Add Roles Before You Begin


33/582

33

6. On the Select Server Role page, select the check box next to DNS Server , andclick Next (Figure 0040).

Figure 0040 : Server Roles DNS Server

7. On the DNS Server page, review the information, and click Next (Figure 0041).

Figure 0041 : DNS Server


34/582

34

8. On the Confirm Installation Selections page, click Install (Figure 0042).

Figure 0042 : Confirm Installation Selections

Please wait. This operation will take a few minutes.

Figure 0043 : Installation Progress


35/582


36/582

36

EXERCISE 3.2

Configuring Domain Name System (DNS)

10. Launch DNS Manager . Click Start Administrator Tools DNS (Figure 0045)

Figure 0045 : Launch DNS Manager

11. Double-click on the computer icon to expand the DNS Server (Figure 0046).

Figure 0046 : DNS Manager


37/582

37

EXERCISE 3.2.1

Configuring Forward Lookup Zones

12. Click on Forward Lookup Zones first, and then right-click on it.

13. Select New Zone (Figure 0047)

Figure 0047 : Create New Zone

14. New Zone welcome wizard appear. Click Next to continue (Figure 0048).

Figure 0048 : New Zone Welcome Wizard


38/582

38

15. Select Primary zone and click Next button (Figure 0049).

Figure 0049 : Zone Type

16. The New Zone Wizard dialog box requests the name for the zone. Enter thename that has been assigned to your domain (this example uses myserver.com).(Figure 0050).

Figure 0050 : Zone Name

17. Once you have entered the correct name for the zone name, click Next button tocontinue.


39/582

39

18. The dialog box now displays the name that will be used to the new zone file.Leave the filename as suggested, then click Next (Figure 0051).

Figure 0051 : Zone File

19. Select the option "A llow both nonsecure and secure dynamic updates ". ClickNext to continue (Figure 0052).

Figure 0052 : Dynamic Update


40/582

40

20. Click Finish to close the wizard and create the new zone (Figure 0053).

Figure 0053 : Successfully Completed the New Zone Wizard


41/582

41

EXERCISE 3.2.2

Creating Forward Lookup Zones New Host

21. Double click to expand Forward Lookup Zones.

22. Right click myserver.com and select New Host (Figure 0054).

Figure 0054 : Create New Host

23. Enter IP address for DNS server (myserver.com) and click Add Host (Figure0055).

Figure 0055 : New Host

24. Click OK button.

25. Click Done button to exit New Host Wizard.


42/582

42

26. After finish configuring Forward Lookup Zones, recheck myserver.com must haveminimum three(3) types resource record (SOA), (NS) and (A). (Figure 0056).

Figure 0056 : Forward Lookup Zones


43/582

43

EXERCISE 3.3

Configuring Reverse Lookup Zones

27. Click on Reverse Lookup Zones.

28. Right click Reverse Lookup Zones and select New Zone (Figure 0057).

Figure 0057 : Add a New Zone

29. New Zone welcome wizard appear. Click Next to continue (Figure 0058)

Figure 0058 : New Zone Welcome Wizard


44/582


45/582

45

32. A reverse zone maps IP addresses to computer names, so it has to know whatrange of IP addresses it will be responsible for.

Enter the first 3 octets of the IP address that has been allocated to your networkdomain (Figure 0061).

Figure 0061 : Network ID

33. After entering the network ID, click Next button to continue.

34. The wizard will display the name of the reverse zone file that it will create. Leavethe filename as suggested, then click Next (Figure 0062).

Figure 0062 : Zone File


46/582

46

35. Select the option "A llow both nonsecure and secure dynamic updates ". ClickNext to continue (Figure 0063)

Figure 0063 : Dynamic Updates

36. Click Finish to close the wizard and create the new zone (Figure 0064).

Figure 0064 : Successfully Completed the New Zone Wizard


47/582

47

EXERCISE 3.3.1

Creating Reverse Lookup Zones New Pointer (PTR)

37. In the DNS manager window, double-click the computer icon and expand theReverse Lookup Zone field.

38. Expand the subnet field.

39. Right-click the subnet field and select New Pointer (Figure 0065).

Figure 0065 : Create New Pointer

40. Enter the IP address of your domain server (Figure 0066).

Figure 0066 : Host IP Address

41. Click Browse button to browse for host name.


48/582

48

42. Double click your server icon (Figure 0067).

Figure 0067 : Browse Host Name - Domain

43. Double click Forward Lookup Zones (Figure 0068).

Figure 0068 : Browse Host Name - Forward Lookup Zones


49/582

49

44. Double click your domain (Figure 0069).

Figure 0069 : Browse Host Name Domain.com

45. Double click Host (A) record (Figure 0070).

Figure 0070 : Browse Host Name Host (A)


50/582

50

46. Click OK to create new pointer (Figure 0071).

Figure 0071 : New Pointer Complete Data

47. After finish configuring Reverse Lookup Zones, recheck the subnet field. Thesubnet field must have minimum three(3) types resource record (SOA), (NS)and (PTR). (Figure 0072).

Figure 0072 : Reverse Lookup Zones


51/582

51

EXERCISE 3.4

Testing The DNS Server

In this section you verify that the DNS Server is installed, running, and correctlyconfigured.

48. In the DNS manager window, right-click the computer icon and select properties(Figure 0073).

Figure 0073 : DNS Manager Server Properties

49. Click the Monitoring tab (Figure 0074).

Figure 0074 : DNS Server Properties


52/582

52

50. Enable both tests and click Test Now button (Figure 0075).

Figure 0075 : DNS Server Properties - Monitoring

Do not proceed till the test results for Simple Query indicate Pass . Yourrecursive query result will indicate Fail because we did not configure our DNS toquery to other DNS server.

51. Click OK to continue

52. Close the DNS Manager.


53/582

53

EXERCISE 3.5

Testing The DNS Server Using NSLOOKUP To Query DNS

In this exercise you will use a client tool to check the operation of the DNS server. Youwill query both a forward and reverse lookup.

53. Launch Run . Click Start Run (Figure 0076).

Figure 0076 : Launch RUN


54/582

54

54. Enter nslookup and click OK (Figure 0077).

Figure 0077 : Launch Nslookup Program

55. A command prompt DOS window will appear with the program nslookup runningin it (Figure 0078).

The default server name and IP address of the DNS server will be shown.

Figure 0078 : Running Nslookup

56. To perform a forward lookup (resolve a computer name to an IP address) enterthe name of the computer (e.g. myserver.com) (Figure 0079).

Figure 0079 : Query Forward Lookup


55/582

55

57. Press ENTER . Your query result will be same as Figure 0080 below.

Figure 0080 : Query Forward Lookup Result

58. To perform a reverse lookup (resolve an IP address to a computer name), enterthe IP address given in step 56 and press ENTER (Figure 0081).

Figure 0081 : Query Reverse Lookup

59. Close the command prompt windows (Figure 0081).

Summary

The DNS server is a database that manages computer names and their IP addresses.Zone files are used to store this information. Within a zone, a forward lookup resolvescomputer names to IP addresses. A reverse zone resolves IP addresses to computernames.

A client tool such as NSLOOKUP can be used to test the operation of a DNS server.


56/582


57/582

57

Exercise 4 : Installing Active Directory

In this exercise you will install active directory services (ADS) and change to nativemode (where the server acts purely with ADS). Once ADS is installed, you will be able totake advantage of many of the new features of Windows 2008 in managing users,

computers and sites.

Adding Active Directory Domain Services Role

In this section, you ll learn how to adding Active Directory Domain Services Role.

EXERCISE 4.1

Adding Active Directory Domain Services Role

1. Login your server as Administrator.

2. Launch Server Manager . Click Start Administrator Tools Server Manager(Figure 0082).

Figure 0082 : Launch Server Manager


58/582

58

3. In Server Manager, select Roles (Figure 0083).

Figure 0083 : Roles

4. Select Add Roles (Figure 0084).

Figure 0084 : Add Roles

5. On the Before You Begin page, review the requirements, and click Next (Figure 0085).

Figure 0085 : Add Roles Before You Begin


59/582

59

6. On the Select Server Role page, select the check box next to Active DirectoryDomain Services, and click Next (Figure 0086).

Figure 0086 : Server Roles

7. On the Active Directory Domain Services page, review the information, and clickNext (Figure 0087).

Figure 0087 : Active Directory Domain Services


60/582

60

8. On the Confirm Installation Selections page, click Install (Figure 0088).

Figure 0088 : Confirm Installation Selections

Please wait. This operation will take a few minutes.

Figure 0089 : Installation Progress


61/582

61

9. On the Installation Result page, review the information.Click Close (Figure 0090).

Figure 0090 : Installation Result

Note : You still must run the Active Directory Domain Services Installation Wizard(DCPromo) to make the server a fully functional domain controller.


62/582

62

Installing Active Directory Domain Services

In this section, you ll learn how to installing Active Directory Domain Services.

EXERCISE 4.2Installing Active Directory Domain Services

10. Logon into a Windows Server 2008 server as Administrator .

11. Click Start Run. At the Run line, enter DCPromo , and click OK (Figure 0091).

Figure 0091 : Run dcpromo

12. On the Welcome screen, click Next (Figure 0092).

Figure 0092 : Welcome Screen


63/582

63

13. On the Operating System Compatibility screen, review the information, and clickNext (Figure 0093).

Figure 0093 : Operating System Compatibility Screen

14. On the Choose a Deployment Configuration screen, select Create a NewDomain in a New Forest .

Click Next (Figure 0094).

Figure 0094 : Choose a Deployment Configuration Screen


64/582

64

If your computer were part of an existing forest, you could create a replicadomain controller within an existing domain. However, this exercise is assumingyour server will be the first domain controller in the forest.

15. On the Name the Forest Root Domain screen, enter MYServer.com as the fullyqualified domain name.


Figure 0095 : Name the Forest Root Domain Screen

16. If Domain NetBIOS Name page appears, accept the default of MYSERVER.

17. On the Set Forest Functional Level screen, select the Forest functional level ofWindows Server 2008 . This ensures that any new domains created in this forestwill automatically operate at the Windows Server 2008 domain functional level,which does provide unique features. If you had a network that has a Windows

2000 Remote Access Server, you would select the compatible option (Figure0096).

Figure 0096 : Set Forest Functional Level Screen


65/582

65

18. Click Next to continue.

19. On the Additional Domain Controller Options screen, note that both the DNSserver and the global catalog are selected as options. Active Directory DomainServices requires DNS, and if not available on the network, DCPromo will giveyou the option of installing it. Additionally, the first domain controller within adomain is a global catalog server.

Figure 0097 : Additional Domain Controller Options Screen

Note : If you have dynamically assigned IP addresses, a warning will appearindicating you must assign static IP addresses for both IPv4 and IPv6. Eitherassign static IP addresses or click Yes; the computer will use a dynamicallyassigned IP address and configure static IP addresses later. As a best practice,domain controllers should use statically assigned IP addresses.

Click Next to continue (Figure 0097).


66/582

66

20. If this server is on an isolated network without other DNS servers, a warningdialog box will appear indicating that a delegation for this DNS server can t becreated and other hosts may not be able to communicate with your domain fromoutside the domain. This is normal when installing DNS for the first domaincontroller in a forest.

Click Yes to continue (Figure 0098).

Figure 0098 : Warning Dialog Box

21. On the Location for Database, Log Files, and SYSVOL screen, accept thedefaults.


Figure 0099 : Location for Database, Log Files, and SYSVOL Screen


67/582

67

22. On the Directory Services Restore Mode Administrator Password screen, enter@xercisE in both the Password and Confirm password boxes. This password isneeded if you need to restore Active Directory Domain Services. On a productiondomain controller, a more secure password would be required.


Figure 0100 : Directory Services Restore Mode Administrator Password Screen

23. On the Summary screen, review your selections, and click Next (Figure 0101). Active Directory Domain Services will be installed.

Figure 0101 : Summary Screen


68/582

68

24. After a few minutes, the wizard will complete (Figure 0102).

Figure 0102 : AD Installation Progress

25. If a warning message appeared same as below, just click OK . This messageappeared because we already created the DNS zone before (Figure 0103).

Figure 0103 : Warning Message

26. On the Completion screen, click Finish (Figure 0104).

Figure 0104 : Completion Screen


69/582

69

27. On the Active Directory Domain Services dialog box, click Restart Now (Figure0105).

Once your system reboots, Active Directory Domain Services will be installed.

Figure 0105 : Restart Confirmation Screen

28. After restart, login your server as Administrator (Figure 0106).

Figure 0106 : Login


70/582

70

EXERCISE 4.3

Recheck Network Configuration

Now you need to recheck your network configuration because sometime afterinstalling Active Directory Domain Services, the network configurations change tolocalhost setting.

29. Launch Network and Sharing Center . Click Start Right click Network Properties (Figure 0107).

Figure 0107 : Network Properties


71/582

71

30. Under myserver.com (Domain network), click View status (Figure 0108).

Figure 0108 : View Network Status

31. Click Properties button to open Local Area Connection Properties (Figure 0109).

Figure 0109 : Local Area Connection Status


72/582

72

32. Select Internet Protocol Version 4 (TCP/IPv4) , and click Properties button(Figure 0110).


Figure 0111 : Internet Protocol Version 4 (TCP/IPv4) Properties


73/582


74/582

74

Figure 0113 : Advanced TCP/IP Setting

40. Close all remaining windows.

SummaryWindows Server 2008 brings a lot of new features and benefits that will drive a

lot of migrations to the new operating system. This chapter presented many of thesenew additions.

One of the significant benefits of Windows Server 2008 is virtualization. Threeeditions (Windows Server 2008 Standard with Hyper-V, Windows Server 2008Enterprise with Hyper-V, and Windows Server 2008 Datacenter with Hyper-V) supportvirtualization.

Each edition can be purchased with or without Hyper-V, which is the technologythat supports virtualization. The Standard edition supports one virtual server, theEnterprise edition supports as many as four virtual servers, and the Datacenter editionsupports an unlimited number of virtual servers. Virtualization is supported only on 64-bit

operating systems.

In this chapter, you learned about the new features of Windows Server 2008.These included Server Manager, Server Core, PowerShell, Windows DeploymentServices, and read-only domain controllers.

Exercises led you through the process of installing Windows Server 2008 on aPC. After reviewing many of the basics of Active Directory Domain Services, you learnedhow to promote the server to a domain controller.


75/582

75

Exercise 5

CreatingOrganization Units

And Users



http://n/Desktop/Server2008/Win2003/lab5_0.htmhttp://n/Desktop/Server2008/Win2003/lab5_0.htmhttp://n/Desktop/Server2008/Win2003/lab5_0.htmhttp://n/Desktop/Server2008/Win2003/lab5_0.htmhttp://n/Desktop/Server2008/Win2003/lab5_0.htmhttp://n/Desktop/Server2008/Win2003/lab5_0.htm


76/582


77/582

77

3. Click on the myserver.com icon to select it (Figure 0115).

Figure 0115 : Expand Domain

4. On the menu bar, click Act ion , New , Organizat ional Unit (Figure 0116).

Figure 0116 : Create New Organization Unit


78/582


79/582

79

EXERCISE 5.2

Creating Users within Organizational Units

For proper control, it is better to create users within an OU rather than the Userscontainer. In the following exercise you will create a number of users, modify theirproperties, and move them from one organizational unit to another.

9. Click the Stkm OU to highlight it (Figure 0119).

Figure 0119 : Stkm OU

Creating new user accounts for Zul

10. Right click Stkm and select New User from the menu (Figure 0120).

Figure 0120 : Stkm OU


80/582

80

11. Enter the following details for Zul (Figure 0121).

First Name Last Name Full Name User logon name

Zul Zcomby Zul Zcomby zul.zcomby

Figure 0121 : Create New User

12. Click Next .

13. Enter the password as c o m b y . Check the boxes User cannot change passwordand Password never expires, then click Next (Figure 0122).

Figure 0122 : Create Password


81/582

81

14. Click Finish to create the new user Zul (Figure 0123).

Figure 0123 : New User Account Confirmation

15. The warning below will appear. This warning appears because your passworddoes not meet the password policy requirements. Click OK to continue (Figure0124).

Figure 0124 : Password Policy Warning

16. Click Cancel to close new user account confirmation window (Figure 0125).

Figure 0125 : New User Account Confirmation


82/582

82

EXERCISE 5.2.1

Configuring Password Policy

17. To disable password policy requirements; launch Group Policy Management .Click Start Administrative Tools Group Policy Management (Figure 0126)

Figure 0126 : Launch Group Policy Management


83/582

83

18. Double click to expand Forest: myserver.com .

19. Expand Domains .

20. Expand myserver.com .

21. Click Default Domain Policy (Figure 0127).

Figure 0127 : Group Policy Management

22. If any warning box appeared; just click OK (Figure 0128).

Figure 0128 : Group Policy Management Console Warning


84/582

84

23. Right click Default Domain Policy and select Edit (Figure 0129).

Figure 0129 : Group Policy Management Default Domain Policy

24. Double click to expand Policies (Figure 0130).

25. Expand Windows Settings .

26. Expand Security Settings (Figure 0130).

Figure 0130 : Group Policy Management Security Settings


85/582

85

27. Double click to expand Account Policies (Figure 0131).

Figure 0131 : Group Policy Management Password Policy

28. Click Password Policy (Figure 0132).

29. Double click Password must meet complexity requirements under PasswordPolicy to open Password must meet complexity requirements Properties .

Figure 0132 : Group Policy Management - Password Must Meet Complexity Requirements


86/582

86

30. Select Disabled under Security Policy Setting tab (Figure 0133).

Figure 0133 : Password Must Meet Complexity Requirements Properties

31. Click OK .

32. Double click Minimum password length under Password Policy to openMinimum password length Properties (Figure 0134).

Figure 0134 : Group Policy Management - Minimum Password Length


87/582

87

33. Set No password required to 0 characters (Figure 0135).

Figure 0135 : Minimum Password Length Properties

34. Click OK .

35. Recheck your configuration. Your configuration should be same as figure below(Figure 0136).

Figure 0136 : Group Policy Management - Password Policy

36. Close all windows and RESTART your server.

After restarting server, login as Administrator and start create user Zul Zcom by again (follow step 10 to 14). There should be no problem anymore.


88/582

88

Creating Users within Organizational Units (EXERCISE 5.2 - Continue)

37. Now create the new user Ocah in the Stkm OU using the following properties(Figure 0137).

First Name Ocah

Last Name Blue

Full Name Ocah Blue

User logon name ocah.blue

Password ocah

User cannot change password

Password never expiresFigure 0137 : Ocah Blue Properties

38. Create the following user account in the Sted OU (Figure 0138).

First Name Ahmad

Last Name Akmal

Full Name Ahmad Akmal

User logon name zul.akmal

Password akmal


Password never expires

Figure 0138 : Ahmad Akmal Properties

39. Create the following user account in the Sklr OU.

First Name Ain

Last Name Syahmi

Full Name Ain Syahmi

User logon name ain.syahmi

Password ainUser cannot change password

Password never expiresFigure 0139 : Ain Syahmi Properties


89/582

89

First Name Ali

Last Name Uddin

Full Name Aliuddin

User logon name ali.zul

Password ali


Password never expiresFigure 0140 : Aliuddin Properties

First Name Wan

Last Name Saad

Full Name Md Saad

User logon name wan.saadPassword masuri

User must change password at next logon

Account is disabledFigure 0141 : Md Saad Properties

40. Note the down arrow that appears on the icon for the user Md Saad ,indicating this account has been disabled (Figure 0142).

Figure 0142 : AD Users and Computers User Disabled


90/582

90

EXERCISE 5.3

Moving Users within Organizational Units

41. It is easy to delete, rename or move a user from an organization unit. In theabove exercise the user Md Saad was inadvertently placed in the wrong OU.Right-click the user Md Saad and select move from the list (Figure 0143).

Figure 0143 : Move Users

42. Click Stkm as the destination OU (Figure 0144).

Figure 0144 : Move Users Stkm OU

43. Click OK


91/582

91

44. Expand the Stkm OU to confirm that the user Md Saad is now a member of StkmOU (Figure 0145).

Figure 0145 : Stkm OU Members

You have now created a number of users within the organizational units createdearlier. At this stage, you cannot see the benefits of doing this. However, the laterexercises will start to illustrate why this has been done, by allocating resources toorganizational units.

Thus, a user will get access to a resource based on their OU membershipproperties. If a user moves from one organizational unit to another, they willinherit all the resources associated with the new OU.


92/582

92

EXERCISE 5.4

Updating User Information

In this exercise we will look at default user properties such as logon times and how oftenthey need to change their passwords.

Active Directory allows organizations to store significantly more information than inprevious versions of Windows. For example, you can store telephone and officeinformation in the Active Directory with the user information.

45. Double click the user Md Saad in the Stkm OU (Figure 0146).

Figure 0146 : User Properties

46. Enter the following details (Figure 0147).

Office IntegrationTelephone Number 012-5740157

E-Mail [email protected]

Job Title (Organization) Senior Instructor

Department Computer Technology

Company IKMFigure 0147 : User Details


93/582

93

Figure 0148 : Md Saad Properties - General

Figure 0149 : Md Saad Properties - Organization

47. Click OK to apply the changes.


94/582


95/582


96/582


97/582

97

Exercise 6

Configuring ClientComputer



http://n/Desktop/Server2008/Win2003/lab5_0.htmhttp://n/Desktop/Server2008/Win2003/lab5_0.htm


98/582

98

Exercise 6 : Configuring a Client Computer

In this section you will configure Windows XP Professional on the other computer thatwill be part of your network. This computer will act as a client computer that users ofyour network can use to access shared resources such as files, software and printers.

Make sure that the Windows Server 2008 previously installed is running.

Please refer to the fo l low ing tab le for c l ien t config ura t ion .

Name of This Computer clientxp SN

Name of Organization IKM

Role of This Computer Client Workstation

Name of Installer Administrator

Domain Name same domain name as you did for the Server

TCP/IP Address 192.168.2. SN

TCP/IP Subnet mask 255.255.255.0

TCP/IP Gateway 192.168.2. ServerNumber

Preferred DNS server 192.168.2. ServerNumber

Note : SN = Station Number

Use the same domain name as you did for the Server.


99/582


100/582

100

4. Double click Internet Protocol (TCP/IP) (Figure 0157).


5. Now set your client (Windows XP) IP address, and ensure that you are using astatic IP address. For this exercise, I m using number 61 as my Windows XPclient station number (Figure 0159).

Use the following IP address:

IP address : 192.168.2. SN (client station number) Subnet mask : 255.255.255.0Default gateway : 192.168.2. ServerNumber (server IP address)

Use the following DNS server address:

Preferred DNS server : 192 . 168 . 2 . ServerNumber (1 st server IP address) Alternate DNS server : ___ . ___ . ___ . ___ (2 nd server IP address)


101/582

101

Figure 0159 : Internet Protocol (TCP/IP) Properties

7. Click the OK button (Figure 0159).


8. Click OK button (Figure 0160) and close all remaining windows.


102/582

102

EXERCISE 6.2

Joining Domain (Windows XP client)

9. Click Start Right-click My Computer (Figure 0161) .

Figure 0161 : My Computer

10. Select Properties . (Figure 0162).

Figure 0162 : My Computer - Properties


103/582

103

11. Click the Computer Name tab, and then click Change . (Figure 0163).


12. Click the More button. (Figure 0164).

Figure 0164 : Computer Name Changes - Workgroup


104/582

104

13. Specify yourdomain.com as the Primary DNS Suffix for This Computer (Figure0165).

Figure 0165 : DNS Suffix and NetBIOS Computer Name

14. Click the OK button.

15. Change Computer Name to clientxp SN (Figure 0166).

16. Select " Member of ....... Domain " and enter the name of your Domain (Figure 0166).

Figure 0166 : Computer Name Changes - Domain

17. Click the OK button.


105/582

105

18. Now Domain Server will prompt you for Username and Password. Enter anyusername and password you have created before. (Figure 0167).

Figure 0167 : Join Domain Verification

19. If you get this welcome message : Windows : "Computer Name Changes" -Welcome to the ....... domain "; it means you are successfully joining a domain.(Figure 0168).

Figure 0168 : Domain Welcome Message

20. Since joining a domain is a major change in the security configuration of yoursystem, you will be reminded that you have to restart your system. Click OK (Figure 0169).

Figure 0169 : Restart Reminder


106/582

106

21. You will be back in the System Properties , where you are now listed as beingpart of a domain (Figure 0170).

Figure 0170 : System Properties Computer Name

22. Click OK to close the remaining dialog boxes (Figure 0170).

23. Click YES to restart the computer. (Figure 0171).

Figure 0171 : Restart Confirmation

.

.


107/582

107

Exercise 7

Viewing ComputerIn Active Directory





108/582

108

Exercise 7 : Viewing Computer In Active Directory

In this section you will use Active Directory Users and Computers to view information forcomputers and servers.

When a client workstation is installed using Windows XP Professional or Windows 2000Professional or Windows Vista or Windows 7, it has its own accounts database andrights. When that client computer joins a domain or Windows Server 2008 network, thismeans that the domain wide accounts are available for use at the workstation. When auser logs on using the client computer, any policies are applied to the client computer.

Client workstations running Windows XP Professional have their own local accountsdatabase. This means it is possible for an administrator on the workstation to create alocal workstation account , which is not the same as the domain account, and allowusers to logon to the local computer rather than the domain.

Currently, you should have the Windows Server 2008 and a Windows XP Professionalclient workstation running.

Log on as administrator to the Windows Server 2008.

EXERCISE 7.1

Viewing Computers and Servers in Active Directory

In this exercise, you will use Active Directory Users and Computers to view theworkstations and servers in the domain.

1. Log on the Windows Server 2008 as administrator.

2. Launch Active Directory Users and Computers . Click Start AdministrativeTools Active Directory Users and Computers (Figure 0172)


109/582

109

Figure 0172 : Launch Active Directory Users and Computers

3. Expand the domain icon (Figure 0173).

Figure 0173 : AD myserver.com


110/582

110

4. Click on the Computers folder from the list (Figure 0174).

Figure 0174 : AD Computers

You can see CLIENTXP61 listed under Computer folder.

5. Double-click on the CLIENTXP61 to display its properties (Figure 0175).

Figure 0175 : CLIENTXP61 Properties

Now you can see the general information about CLIENTXP61 including it DNSname and it role.


111/582

111

6. Click on the Operating System tab (Figure 0176).

Figure 0176 : CLIENTXP61 Properties - Operating System

Here you can find information about Operating System, version and service packusing by client.

7. Click OK to close the properties box.

8. Click on the Domain Controllers folder under myserver.com (Figure 0177)

Figure 0177 : AD - Domain Controllers


112/582

112

9. Double-click on the domain controllers to display its properties (Figure 0178).

Figure 0178 : SERVER21 Properties

10. Click on the Operating System tab (Figure 0179.)

Figure 0179 : SERVER21 Properties - Operating System

Here you can find information about Operating System, version and service pack

using by server.

11. Click OK to close the properties box and close all remaining dialog box.

In this exercise you viewed properties of workstations and servers in yournetwork using Active Directory.


113/582

113

EXERCISE 7.2

Using the Local Workstation Account

In this exercise you will log on the Windows XP Professional workstation using a localadministrator account.

12. Logon the Windows XP Professional as administrator (Figure 0180).

Figure 0180 : Log on to Windows XP

13. Logoff the client computer. Click Start Shutdown and select LogoffAdministrator (Figure 0181).

Figure 0181 : Log off Windows XP


114/582

114


Figure 0182 : Log off Windows XP Administrator

EXERCISE 7.3

Using Domain wide account at the client computer

In this exercise you will log on the client computer using a domain account.

15. Press CTRL+ALT+DEL to display the logon dialog box (Figure 0183).

Figure 0183 : Windows XP Logon


115/582

115

16. Log on the Windows XP Professional as zul.zcomby and comby as password(Figure 0184).

Figure 0184 : Log on to Windows XP

17. Click OK .

18. You will receive a Logon Message . Why? (Figure 0185)

Because zul.zcomby not created on the local client account, it was created in theserver active directory account.

Just now, you were tried to logon to the client using active directory user account.

Figure 0185 : Logon Message

19. Click OK to dismiss the dialog box.


116/582


117/582


118/582

118

26.3. Enter user as zul.zcomby and password as comby (Figure 0191).

Figure 0191 : Logon to server using user account

26.4. Press ENTER .

27. What happened? Could you log on?

A error message appeared (Figure 0192).

Figure 0192 : Logon Error Message

Why?Because the user account you are using to login into server do not havepermission to login into server directly.

28. Click OK .

29. Logon to the server as administrator.


119/582

119

30. Launch Active Directory Users and Computers . Click Start AdministrativeTools Active Directory Users and Computers (Figure 0193).


31. Click on the Stkm Organizational Unit (Figure 0194).

Figure 0194 : Active Directory Users and Computers - Stkm


120/582

120

32. Double-click on the user Zul Zcomby to display the properties box (Figure 0195).

Figure 0195 : Zul Zcomby Properties

33. Click the Member Of tab (Figure 0196).

Figure 0196 : Zul Zcomby Properties - Member Of


121/582

121

34. Click Add button (Figure 0197).

Figure 0197 : Add Button

35. Click Advanced button (Figure 0198).

Figure 0198 : Select Groups

36. Click Find Now button (Figure 0199).

Figure 0199 : Select Groups - Advanced


122/582

122

37. Double-click Server Operators from the list (Figure 0200).

Figure 0200 : Select Groups Find Now

38. Click OK .


Figure 0201 : Select Groups


123/582

123


Figure 0202 : Zul Zcomby Properties - Member Of

41. Log off server. Click Start Log Off (Figure 0203).

Figure 0203 : Log Off Server

42. Attemp to log on to the server as zul.zcomby .

42.1. Press Ctrl + Alt + Del .

42.2. Click Switch User button (Figure 0204).

Figure 0204 : Switch User button


124/582

124

42.3. Click Other User button (Figure 0205).

Figure 0205 : Other User button

42.4. Enter user as zul.zcomby and password as comby (Figure0206).


42.5. Press ENTER .

What happened? Could you log on? It should be no problem.

Summary

Servers do not allow normal users to logon locally. Servers run the network and provideresources, which users connect to remotely across a network. Servers are not designedto have users physically sitting at their keyboards trying to log on and run programs.Users actually logon to a client computer in the network and access resources using anetwork connection.

Client computers running Windows XP Professional have their own accounts database.


125/582

125

Exercise 8

DelegatingManagement Of

Users





126/582

126

Exercise 8 : Delegating Management Of Users

In this exercise you will create new local groups and look at assigning managers tousers and organizational units.

EXERCISE 8.1

DelegatingControl

In this portion of the exercise you will make zul.zcomby a manager of the Stkmorganizational unit. Once he is a manager, he will be able to modify user accounts withinthe Stkm OU.

1. Log on the Windows Server 2008 as administrator.

2. Launch Active Directory Users and Computers . Click Start AdministrativeTools Active Directory Users and Computers (Figure 0207)



127/582

127


Figure 0208 : AD myserver.com

4. Right click the Stkm OU and select Delegate Control (Figure 0209).

Figure 0209 : AD Stkm

5. This starts the Delegation of Control Wizard (Figure 0210).

Figure 0210: Delegation of Control Wizard


128/582

128

6. Click Next (Figure 0210).

7. Click the Add button (Figure 0211).

Figure 0211: Delegation of Control Wizard Users or Groups

8. Click the Advanced button (Figure 0212).

Figure 0212: Select Users, Computers, or Groups


129/582

129

9. Click the Find Now button (Figure 0213).

Figure 0213: Select Users, Computers, or Groups Advanced

10. Select Zul Zcomby account (Figure 0214).

Figure 0214: Select Users, Computers, or Groups Find Now


130/582

130



Figure 0215: Select Users, Computers, or Groups User Added


Figure 0216: Delegation of Control Wizard Users Added


131/582

131

14. Delegate the following tasks as illustrated (Figure 0217).

Figure 0217: Task to Delegate


16. Click Finish (Figure 0218).

Figure 0218: Delegation of Control Wizard Finish


132/582

132

17. Log off server. Click Start Log Off (Figure 0219).

Figure 0219 : Log Off Server


133/582

133

EXERCISE 8.2

Managing Users

In this portion of the exercise you will log on to server as zul.zcomby and attempt tomanage users.

18. Attemp to log on to the server as zul.zcomby .








18.5. Press ENTER .


134/582

134


Figure 0223: Launch Active Directory Users and Computers

20. You will be asked to reenter your password for security measure. Just reenterpassword for zul.zcomby (Figure 0224).

Figure 0224: User Account Control Permission


135/582

135


Figure 0225: Active Directory Users and Computers - Domain

22. Click on the Stkm OU (Figure 0226).

Figure 0226: Active Directory Users and Computers - Stkm

23. Double-click the user Ocah Blue (Figure 0227).

Figure 0227: Active Directory Users and Computers User


136/582


137/582

137

26. Select all areas and click Logon Denied (Figure 0230).

Figure 0230 : Logon Hours for Ocah Blue Logon Denied

Change Ocahs the logon hours (under Account Tab) to Monday-Friday, 8am-5pm.

27. Select the areas Monday to Friday and 8am to 5pm (Figure 0231).

Figure 0231 : Logon Hours for Ocah Blue Select Areas


138/582

138

28. Select Logon Permitted (Figure 0232).

Figure 0232 : Logon Hours for Ocah Blue Set Logon Permitted

29. Click OK .

30. Click OK again.

31. Click the Sklr OU (Figure 0233).

Figure 0233: Active Directory Users and Computers Sklr


139/582

139

32. Double-click Ain Syahmi user account to display the properties of this user(Figure 0234).

Figure 0234: Active Directory Users and Computers User

33. Attemp to change the logon hours of this user. Click Account tab (Figure 0235).

Figure 0235: Ain Syahmi Properties


140/582

140

34. Click the Logon Hours button (Figure 0236).

Figure 0236: Logon Hours Button

35. A warning message will be displayed (Figure 0237).

Why do you think you are not able to modify this account?

Figure 0237: AD Error Message

Because Zul Zcomby only have permission to modify user under Stkm OU only.He only have read permissioin for other OU s .

36. Click OK to close the message (Figure 0237).

37. Close all remaining windows except Active Directory Users and Computers.

38. Click the Stkm OU (Figure 0238).

Figure 0238: Active Directory Users and Computers Stkm


141/582

141

39. Right-click Ocah Blue account and select Reset Password from the list(Figure 0239).

Figure 0239: AD Ocah Blue Reset Password

This display a reset password box that will allow the password to be changed.

40. Click Cancel (Figure 0240).

Figure 0240: Reset Password

41. Close all remaining windows.

42. Log off the server.

In the above exercise you delegated control of an Organizational Unit to a user. Youthen modified account details of users belonging to that OU as the designatedmanager of the OU.

Delegating control of users using the delegation control wizard is simple. Whencontrol of users and groups is delegated, administrators can be relieved of simpleadministrative tasks such as resetting passwords and modification of user accounts.


142/582

142

Exercise 9

Exploring GroupScopes and Types





143/582

143

Exercise 9 : Exploring Group Scopes and Types

EXERCISE 9.1

Exploring Group Scopes and TypesIn the following exercise you will create a number of groups. These groups will be usedto demonstrate group scope. From the notes, group scope determines who can be amember and where that group can be used in the enterprise.

GroupType

Scope

Local User accounts, Global groups and Universal groups from any domain in theforest, as well as local groups from the same domain.

Global User accounts and global groups from the same domain.

Universal User accounts, global groups and universal groups from any domain in theforest.

The recommended strategy for using groups in Windows Server 2008 is to use bothglobal and domain local groups. Place users into global groups and then place the globalgroups into domain local groups and assign permissions to the domain local groups.

Global groups have access to accounts in the local domain. Where the enterpriseconsists of more than one domain, local groups allow the use of accounts across all thedomains. Where the enterprise has combined a number of domains into a forest,Universal groups provide access to any accounts in the forest.

1. Log on server as Administrator (Figure 0241).

Figure 0241 : Administrator Login


144/582

144



3. Right-click the domain icon and select New - Group from the list (Figure 0243).

Figure 0243 : Active Directory Users and Computers New Group


145/582

145

4. Create a global group called Technical Support (Figure 0244).

4.1 Key-in Technical Support in the Group name: box4.2 Verify Group scope set to Global .4.3 Verify the Group type is set to Security .

Figure 0244 : New Object - Group


6. Add Ali Uddin as a member of Technical Support.

6.1 Double-click Technical Support (Figure 0245).

Figure 0245 : Active Directory Users and Computers Technical Support


146/582

146

6.2 Click Members tab (Figure 0246).

Figure 0246 : Technical Support Properties

6.3 Click Add button (Figure 0247).

Figure 0247 : Add button

6.4 Click Advanced button (Figure 0248).

Figure 0248 : Select Users, Contacts, Computers, or Group box


147/582

147

6.5 Click Find Now button (Figure 0249).

Figure 0249 : Select Users, Contacts, Computers, or Group - Advanced

6.6 Select Ali Uddin user account (Figure 0250).

Figure 0250 : Select Users, Contacts, Computers, or Group Find Now


148/582

148

6.7 Cick OK (Figure 0250).


Figure 0251 : Select Users, Contacts, Computers, or Group




149/582

149

7. Create a new Domain Local group called Intranet Users (Figure 0253).

7.1. Right-click the domain icon and select New - Group from the list (Figure0253).

Figure 0253 : Active Directory Users and Computers New Group

7.2. Key-in Intranet Users in the Group name: box (Figure 0254).

7.3. Verify Group scope set to Domain Local (Figure 0254).

7.4. Verify the Group type is set to Security (Figure 0254).

Figure 0254 : New Object - Group

7.5. Click OK (Figure 0254).


150/582

150

8 Double-click Intranet Users (Figure 0255).

Figure 0255: Active Directory Users and Computers

9 Add the Intranet Users group as a Member Of Technical Support .

9.1. Click Member Of tab (Figure 0256).

Figure 0256 : Intranet Users Properties

9.2. Click Add button (Figure 0257).



151/582

151

9.3. Click Advanced button (Figure 0258).

Figure 0258 : Select Groups - Add

9.4. Click Find Now button (Figure 0259).



152/582

152

9.5. Select Technical Support . What happened? (Figure 0260).

Figure 0260 : Select Groups Search Results

Can you find Technical Support ? Why do you think this happened?

9.6. Close all windows except Active Directory Users and Computers.

10 Now try adding the Technical Support group as a Member Of Intranet Users .

10.1. Double-click Technical Support group (Figure 0261).

Figure 0261 : Active Directory Users and Computers - Technical Support


153/582

153

10.2. Click Member Of tab (Figure 0262).


10.3. Click Add button (Figure 0263)


10.4. Click Advanced button (Figure 0264)

Figure 0264 : Select Groups - Add


154/582

154

10.5. Click Find Now button (Figure 0265)


10.6. Select Intranet Users and click OK button (Figure 0266).

Figure 0266 : Select Groups Search Result

What happened?


155/582

155

10.7. Click OK button (Figure 0267).

Figure 0267 : Select Groups Intranet Users Group Added

Can you add the Technical Support group as a Member Of IntranetUsers ?

Why do you think this is so?

11 Click OK button (Figure 0268).

Figure 0268 : Technical Support Properties Member Of Intranet Users

12 Log off Administrator.

Summary Windows Server 2008 running in native mode supports the use of different group types.Global groups have access to user accounts and other global groups in the samedomain. Local groups allow you to access accounts outside the current domain, anduniversal groups provide access across organizations (forests).


156/582

156

Exercise 10

Creating And Applying Group

Policies





157/582

157

Exercise 10 : Creating And Applying Group Policies

In this exercise you will create a new group policy and apply it to users within anorganizational unit.

Group Policies

Group policies are settings or configurations that can be applied to users, groups,organizational units and domains. An administrator can create a group policy thatconfigures the computer or user settings, such as menu and desktop settings, folderlocations and default password settings.

Windows NT 4 and Windows 98 introduced system policies. Windows 2000, 2003 and2008 extends these further using group policies.

EXERCISE 10.1

Creating a Group Policy




158/582


159/582

159

4. Expand the Domains (Figure 0272).

Figure 0272 : Group Policy Management Domains

5. Expand your domain.com (Figure 0273).

Figure 0273 : Group Policy Management myserver.com

Now, you will create a new group policy for the Stkm OU. This new policy will apply to allmembers of the Stkm OU though in another exercise that follows, you will override this.

6. Right-click the Stkm OU and select the Create a GPO in this domain, andLink it here (Figure 0274).

Figure 0274 : Group Policy Management Create new GPO


160/582

160

7. Rename the policy as STKM Group Policy (Figure 0275).

Figure 0275 : Create New GPO

8. Click OK to continue (Figure 0275).

9. Right-click the STKM Group Policy and select Edit (Figure 0276).

Figure 0276 : Default Domain Policy - Edit

10. The group policy editor allows you to specify user and computer settings. In thefollowing steps, you will change some of these settings (Figure 0277).

Figure 0277 : Group Policy Management Editor


161/582

161

11. Expand User Configuration (Figure 0278).

Figure 0278 : Group Policy Management Editor User Configuration

12. Expand the Policies folder (Figure 0279).

Figure 0279 : Group Policy Management Editor Policies

13. Expand the Administrative Templates folder (Figure 0280).

Figure 0280 : Group Policy Management Editor Administrative Templates

14. Click the Start Menu and Taskbar folder (Figure 0281).

Figure 0281 : Group Policy Management Editor Start Menu and Taskbar


162/582

162

15. A large list of selections is available. Double click the option Add Logoff to theStart Menu (Figure 0282).

Figure 0282 : Group Policy Management Editor Add Logoff to the Start Menu

16. The Add Logoff to the Start Menu Properties appears. Click the Disabled buttonto disable this setting (Figure 0283).

Figure 0283 : Add Logoff to the Start Menu Properties

17. Click OK to apply setting (Figure 0283).

18. The setting now displays as Disabled in the Group Policy Editor (Figure 0284).

Figure 0284 : Add Logoff to the Start Menu Disabled


163/582

163

19. Configure the following settings.

Remove Run menu from Start Menu Enabled

Remove Clock from the system notification area Enabled

Desktop\Desktop\Enable Active Desktop Enabled

Desktop Wallpaper Enabled

Wallpaper Name : C:\WINDOWS\Web\Wallpaper\Autumn.jpg

Wallpaper Style : Stretch

(This uses wallpaper from the Windows XP Pro installed on C drive of client PC)

20. Close the group policy editor.

21. Refresh the Group Policy Management. On the Menubar; click Action Refresh(Figure 0285).

Figure 0285 : Group Policy Management Refresh

22. Close the Group Policy Management windows.


164/582

164

Update Group Policy

23. Launch the Run application. Click Start Run (Figure 0286).

Figure 0286 : Launch the Run Application

24. Key-in gpupdate in the Open : box (Figure 0287).

Figure 0287 : Run Windows

25. Click OK to run the gpupdate (Figure 0288).

Figure 0288 : Updating Policy



165/582

165

EXERCISE 10.2

Test the Group Policy

The group policy has been applied to members of the Stkm Organizational Unit. Thereare two members; Zul Zcomby and Ocah Blue . You will now test this policy to see if itworks.

27. Log on the server as zul.zcomby .








27.5. Press ENTER .


166/582


167/582

167

32. Do you have the RUN command on the Start Menu?

YES / NO

33. Do you have Clock on the system notification area?

YES / NO

34. Were the wallpaper displayed on the client computer?

YES / NO

35. All the group policy setting should be applied (Figure 0294).

Figure 0294 : Client Computer Ocah Blue

36. Log off the client computer.

37. Log off the Server.


168/582

168

Log on to client computer as zul.akmal



39. Log on the Windows XP Professional as zul.akmal and akmal as password(Figure 0296).

Figure 0296 : Log On To Server Using Client Workstation

40. Were the group policy setting applied?

YES / NO

41. If not, why do you think this is so?

Because zul.akmal not a member of the Stkm OU. The group policy applied onlyto the members of the Stkm OU.



169/582


170/582

170

45. Expand the Forest (Figure 0299).

Figure 0299 : Group Policy Management - Forest

46. Expand the Domains (Figure 0300).

Figure 0300 : Group Policy Management Domains

47. Expand your domain.com (Figure 0301).

Figure 0301 : Group Policy Management myserver.com


171/582

171

You are now going to disable the policy of Stkm OU. This is a better option thanremoving the policy, as if you decide to re-implement the policy at a later date, it will stillbe there.

48. Expand the Stkm OU (Figure 0302).

Figure 0302 : Group Policy Management Stkm

49. Click the Stkm Group Policy (Figure 0303).

Figure 0303 : Group Policy Management STKM Group Policy

50. A warning box appears. The Group Policy Management remind you that youhave selected a link to a GPO and changes you make will impact all otherlocations linked with the GPO (Figure 0304).

Figure 0304 : Group Policy Management Console Warning

51. Click OK to continue (Figure 0304).


172/582

172

52. Right-click the Stkm Group Policy and select Link Enabled (Figure 0305).

Figure 0305 : STKM Group Policy Details

53. Now you can see under Link Enabled ; the status Yes have changed to No(Figure 0306).

Figure 0306 : STKM Group Policy GPO Status

54. Close the Group Policy Management windows.


173/582

173

Update Group Policy

55. Launch the Run application. Click Start Run (Figure 0307).

Figure 0307 : Launch the Run Application

56. Key-in gpupdate in the Open : box (Figure 0308).

Figure 0308 : Run Windows

57. Click OK to run the gpupdate (Figure 0309).

Figure 0309 : Updating Policy



174/582

174

Now verify that the group policy is disabled. Log on to the Client computer aszul.zcomby .



60. Log on the Windows XP as zul.zcomby and comby as password (Figure 0311).

Figure 0311 : Log On To Server Using Client Workstation

61. Were the policies now disabled?

YES / NO


Summary

In this exercise you created a group policy and applied it to an organizational unit.Only a fraction of the available settings were explored. Applying a group policy is away of controlling security and configuring groups of users with common settings.This can help reduce the cost of ownership and the level of administrator support byrestricting what users can do or change on their computers.


175/582

175

Exercise 11

Creating AndSharing Resources





176/582

176

Exercise 11 : Creating And Sharing Resources

One important aspect of a Windows Domain is the ability to share applications, files,printers and other resources on the network. Resources created on Windows Servercomputers are available to all users in the domain, and it is a simple administration task

to allocate permissions to users.

Preliminary Setup

Add zul.akmal, ocah.blue and ain.syahmi to the Intranet Users group.






177/582

177

3. Click myserver.com (your domain.com) and double-click the Intranet Users group from the list (Figure 0314).

Figure 0314 : Active Directory Users and Computers Intranet Users Group

4. Click the Members tab (Figure 0315).

Figure 0315 : Active Directory Users and Computers Intranet Users Properties

5. Add Ocah Blue as a member of Intranet Users.

5.1 Click Add button (Figure 0316).

Figure 0316 : Add button


178/582

178

5.2 Click Advanced button (Figure 0317).

Figure 0317 : Select Users, Contacts, Computers, or Group box

5.3 Click Find Now button (Figure 0318).

Figure 0318 : Select Users, Contacts, Computers, or Group - Advanced


179/582

179

5.4 Select Ocah Blue user account (Figure 0319).

Figure 0319 : Select Users, Contacts, Computers, or Group Find Now



Figure 0320 : Select Users, Contacts, Computers, or Group


180/582

180

5.7 You can see Ocah Blue is added as a member of Intranet Users group(Figure 0321).

Figure 0321 : Intranet Users Properties

6. Now repeat steps 5 to add zul.akmal and ain.syahmi as a member of IntranetUsers group.

7. After finish adding the entire user to Intranet Users group, y

Documents

Complete Windows Server 2008 Step By Step v2