Profiles

Profiles

Profiles are used for providing basic user environment needs
Environment needs can be

Desktop settings Startup applications N/w connectivity.

Profile is responsible for providing the initial desktop environment needs with the help of desktop folder, favorites, cookies, my documents, start menu, and Internet settings, n/w connections and etc.

When a user logs in for the first time the user will be loaded with a default user profile. Default user profile is located under
C:\documents and settings\default user

Types of profiles:

 Local profile

Roaming profile
Mandatory profile

Local profile: It is a profile loaded for the user and saved in the local hard drive where the user works.
And profile will be saved when a user logs off
Local profiles are limited only to the machine where they are saved.
A user with a local profile will not be loaded with a network profile when he logs on from another machine.

Verifying the type of the profile: My computer
Properties
Advanced
User profile – settings

Roaming Profile: It is a profile, which is saved in the shared folder on the server. Hence available in the entire network.
Roaming profile is a n/w profile which is available in the entire network. As a result when a user logs in from any machine in the n/e he will be loaded with a roaming.

Creating a roaming profile: On DC
Create a user A/C
Create a folder
And share it and give full control permission for everyone
Start >P>ADUC Double click the user Profile
Profile path ex: \\sys1\profile\username
Apply – ok

Move on to member server
Log in as user
My computer
Properties
Advanced-profile settings-you should notice “roaming profile”.

Mandatory Profile: Mandatory Profile is a profile used for controlling desktop environment setting especially used for  restricting user from saving user  data,  setting, and configuration on  the desktop.
It is a type of roaming profile but settings are not saved when a user logs off.
Changes will be available only for the session where user is active. (Active session)

Creating a mandatory profile:
Open the profiles folder you’ve created for roaming
There will be a user folder
Take the ownership of the folder of the user
Right click on the folder properties
Security – ok – advanced
Owner – administrators
Replace owner on sub >apply – ok

Open the folder

Rename the file Ntuser.dat to ntuser.man Back
Give back the permission (ownership) Folder
Properties
Security – advanced
Check the box Allow inheritable
Check - Replace permission entries on all
Apply – ok

Verifying:
Move on to client machine
Login as user
Make some desktop changes
Create a folder or delete a folder

For removing mandatory profile just rename ntuser.man to ntuser.dat

Home folders:
Home folders are separate folders where users save their data and protect their data from other users every user can have one home folder either on the server on the local machine.
If the home folder is in the server an administrator can secure it and back-up.
If the home folders are created in the local machine backing up is not that easy.

Creating a user home folder in a server
On member server
Create a home folder for user1
Share it Permissions Remove everyone
Add administrator and user1
Give full control for both
Apply ok
Open ADUC Create a user a/c
Go to user properties
Profile
Connect home folder Select the drive letter To mention the path Ex: sys1\u1\home\u1
Apply ok

Verifying:
On client machine
Log in as user
Open my computer
We should notice an extra drive letter
Go to cmd prompt
We should not get the drive letter we have assigned.

Creating a local home folder: On Member server

Login as administrator Create a folder in any drive Share it
Permissions
Remove everyone
Add administrator &u2
Give full access
Apply – ok

Move on to server or DC Open ADUC
create a user
Go to user properties
Profile
Home folder Give local path Ex: E:\u2home Apply-ok

Verifying:
Move on to client machine
Login as user
Go to command prompt.
We should notice the local folder

Offline folders:
It is a feature of 2000&03-network resources in spite of no network connections (offline)

Implementing offline folders
On server client
Open my computer
Tools
Folder options
Offline files
Check the box enable offline files
Apply – ok
Repeat same process on the client also
On server
Create a folder
Share it
Everyone full access

On the client machine
Access the share resources through the n/w places
Right click on the share resources
Make available offline
Next
Check the box automatically
Next – finish

On the client machine
Access the n/w share

SHARING

SHARING

In order to make a resource to be available over the network and to be accessed by network users we need to implement sharing.

The moment we create a share on a server, server acts like a file server. Sharing a resource:

On DC

Open my computer

Select any drive

Create a new folder Give name of the folder Right click on the folder Select sharing and security Share this folder

Apply > ok

Accessing share resources from a client machine: On client machine

Open my network places

Entire network

Microsoft windows n/w Domain name (ex. Zoom) Computer name

Creating a share through command line

:

On DC

Go to command prompt md sharename

net share sharename=c: \share name

Connecting to a share resource through a command prompt: On member server

Go to command prompt

net use z:\\computername\sharename

Mapping a drive (connecting to the share from GUI):

On member server

Right click on my computer

Map network drive

Select the drive letter

Uncheck or check reconnect logon

Browse the share folder

Computer name>share name>ok>finish.

Permissions

Using permissions an administrator can either allow or deny access to a resource. Resource can be a network resource or local resource

Permissions are of two types

1. Share level

2. File system or NTFS

Share level permissions

Share level permissions are applied over the network.

Share level permissions are not applied on the local machine where the resource is existing. There are three types of share level permissions

Full control   RWXDO (Read/Write/Execute/Delete/Ownership) Change        RWXD

Read            R

Practice: On DC

Create a share

Create three users

Set permissions

Setting permissions:

Create folder> share> right click on folder> properties> permission

> Remove everyone

>Add all the users whom you want to allow or deny.

>Apply>ok.

Verification:

Move on to client machine

Login as different users

Try to access the n/w resources.

2. NTFS permissions:

NTFS permissions are powerful permissions and they offer file and folder level security. NTFS

permissions are useful for securing locally available resources.

NTFS Features:

File/folder level security

Compress

Encryption

Quotas

Reduced fragmentation

Hot fixing

Volume shadow copy services

Mounting

Separate recycle bin for each user

NTFS permissions

Full control              RWXDO Modify                     RWXD Read & Execute      RX

List folder contents L Read                       R

Write                       RWX

Implementing NTFS permissions

:

On member server-Create a folder

On DC-Create 3 users. On member server Right click on the folder Properties

Security

Add the users we have created on DC Ok

Select the user and set the permission

U1-full control

U2-modify

U3-read

Apply-ok.

Experiment2:

Login as administrator on member server

Create a folder Folder properties Security

Advanced-uncheck the box allow inheritable permissions.. Remove

Apply – ok.

Add the users we have created along with the administrator

Administrator -full control

U1 – full control

U2 – modify

U3 – read – apply – ok

Full control permissions

This permission offers complete control i.e., taking ownership and setting permissions on files and folders.

Users who have full control permission can take ownership of a resource

The moment a user creates a folder he becomes an owner of a folder. Owners will have full control access

Taking ownership of a folder: On member server

Login as administrator

Create a folder

Go to properties of the folder

Security

Add the user to whom we want to give permission

Ex: u1-full control

Apply – ok

Step2: login as a user1 (u1) Go to the folder properties Security

Advanced Owner Select user

Check the box replace owner on

Apply – ok

Share level     NTFS level     N/W         Local

Read	read	read	read
Change Read	read modify	change read	read modify
Read	write	read	write

ACTIVE DIRECTORY

ACTIVE DIRECTORY

AD: Is a centralized database where it contains the information about the objects like users, groups, computers, printers etc.
AD is a centralized hierarchical Directory Database. AD is a searchable Database.

2003 O/S. when installed (gets installed as a stand alone server) to promoting to    D.C. We have to install A.D.

Domain Controller (D.C.)

A server where A.D. is installed is called D.C.

Functionality of A.D.:

Using A.D. we can organize, manage and control resources. It provides single point of administration.

Purpose of A.D.:

1.  Provides user logon authentication services.
2.  To organize and manage user A/Cs, computers, groups and n/w resources.
3.  Enables authorized users to easily locate n/w resources.

Features of A.D.:

1.  Fully integrated security system with the help of Kerberos.
2.  Easy administration using group policy.
3.  Scalable to any size n/w
4.  Flexible (install/uninstall)
5.  Extensible (modify the schema) New features in 2003
6.  Rename computer name & Domain names.
7.  Cross –forest trust relationship.
8.  Site-to-Site replication is faster.




Evolution of LDAP:

Earlier we had no database standard; hence TTU & ISO introduced X-500

LDAP  (Light Weight  Directory Access Protocol): It  is  an industry standard directory access protocol used for querying and providing communication among the objects in A.D.
It is directory access protocol.
It runs on the port no. 389.

DAP: It is based on OSI model. LDAP: Is based on TCP/IP model

Installing A.D: Requirements:
Windows 2003 O.S. A static IP
NTFS partition with 250 MB of free HDD space
DNS (Domain Naming System)

Step1: on 2003 machine
Start > Run> dcpromo>next>next
>Select domain controller for a new domain
>Domain in a new forest >next
>Specify the domain name (Ex: zoom.com)
>Net bios name (do nothing)>Next
>database>next
>Sysvol>next
>Select middle one>next
>Provide pwd>next
>Restart - when it prompts

After installing A.D. Go to
Start>programs> administration tools
We should notice 5 options like ADUC, ADDT, ADSS, DCSP, and DSP

Safe removal of A.D.

>Start >run >dcpromo

Forceful removal of A.D
.
>Start >run > dcpromo / forceremoval

Tools used for:

Active Directory Domains and Trusts:

    Implementing trusts
    Raising domain/forest functional levels
    Adding user logon suffixes

Active Directory Sites and Services:

    Configuring intrasite/intersite replication
    Configuring global catalog
    Creation of sites, site links, subnets.
    Scheduling replication



Active Directory Users and Computers:

    Managing users/groups
    Managing computers.


    Managing OUs
    Managing Group Policy (Domain Level)
    Managing Operations masters.
    Raising domain functional level.

Domain controller security policy:

    Set account, audit and password policies
    Set user rights
    Permissions or policies Pertains only to the DC where you set.

Domain security policy:

    Set account, audit and password policies
    Set user rights
    Permissions or policies pertain to the DC as well as to all the domains within.

Installing ADC (Additional Domain Controller):
Requirement: D.C.
Static .P. DNS
Stand-alone or Member Server.

Step1: on Stand alone machine or member server
    Specify I.P.
    Specify prefer DNS as servers IP.
    Start > run >ping server’s IP.

Step2: >start >run >dcpromo>next>next>select ADC for an existing domain
    Specify administrator’s name & pwd.
    Domain name of DC (eg.zoom.com)
    Browse the domain
    Next>next> restore pwd.



ADC is a back up for DC

    ADC maintains a back up copy of A.D., which will be in read only format.
    ADCs provide fault tolerance & load balancing
    There can be any no. of ADCs for a DC.
    ADCs should be placed and maintained offsite away from the DC.
    ADC maintains same domain name.

Verifying whether the server is configured as DC or ADC.

    Start>run>cmd>net accounts
    For DC we will find “primary”
    For ADC we will find “Backup”

ACTIVE DIRECTORY COMPONENTS

LOGICAL STRUCTURE	PHYSICAL STRUCTURE
Domains Trees Forest Organizational units	Sites Domain controllers

A.D. Components:
•   Logical structure is useful for organizing the network.
•   Logical components cannot be seen
• Physical   structure  is   useful   for   representing  our   organization  for   developing  the organizational structure.
•   It reflects the organization (mirrors)
•   Physical structure can be seen. Ex. Site – India, US, UK etc.

TREE:

A tree is a group of domains which share contiguous name space.
If  more  than  one  domain exits  we  can  combine the  multiple domains into  hierarchical tree structures.
The first domain created is the root domain of the first tree. Additional domains in the same domain tree are child domains.
A domain immediately above another domain in the same domain tree is its parent.

FOREST:

Multiple domain trees within a single forest do not form a contiguous namespace. I.e. they have non-contiguous DNS domain names
Although trees in a forest do not share a name space, a forest does have a single root domain, called the forest root domain
The forest root domain is, by definition, the first domain created in the forest. The two forest wide predefined groups – Enterprise.
Administrators and schema administrators reside in this domain.

Physical structure

SITES:

Site is a combination of TCP/IP, subnets, connected with high-speed links. Sites provide replication



There are 2 types of replications

1.  Intrasite replication
2.  Intersite replication

Intrasite Replication: It is a replication with in the same site. It offers full time replication between
DC & ADC when they are within the same site.

Intersite Replication: It is a replication between two different sites.
Intersite replication is implemented when the sites are away from each other.

-It requires a site link
-Site link is a logical connection between sites, which can be created &   scheduled.
-Site link offers communication only at scheduled intervals.

Implementing sites:

Forceful replication:

On DC
Start >programs> admin tools > ADSS > expand sites > default first site>servers
>Expand DC server > NTDS settings >right click on automatically generated>replicate now>ok. Repeat the same for DC & ADC

Creating a site:

Open ADSS>Right click on sites>New site>Site name (e.g. UK, US) Select default site link>Ok

Moving ADC into another site:

Select ADC>Right click on ADC>Select move>Select site. Creating a Site link:
Expand inter site transports>Right click on IP>Select new site link
Link name (ex. Link US –UK)

Scheduling a site link:

Expand inter site transport>IP>Double click on site link>Change schedule
Click on replication not available>set the timings>click on replication available.

KCC: (Knowledge Consistency Checker): It is a service of A.D., which is responsible for intimating, or updating the changes made either in DC or ADC.

Active Directory is saved in a file called NTDS.DIT C:\windows\ntds\ntds.dit
NTDS.DIT - New Technology Directory Services. Directory Information Tree

It is a file logically divided into four partitions.
1.  Schema partition
2.  Configuration partition
3.  Domain partition
4.  Application partition

It is a set of rules schema defines AD, it is of 2 parts classes & attributes. Ad is constructed with the help of classes and attributes.

1.  Schema: Logical partition in AD database “template” for AD database.
•   Forms the database structures in which data is stored.
•   Extensible
•   Dynamic


•   Protect  by  ACL  (Access  Control  Lists)  DACL’s  and  SACL’s  (Directory&System
ACL’s)
•   One schema for AD forest.

Collection of objects is called class.
Piece of information about the object is called attribute.

2. Configuration Partition: Logical partition in AD database.
•   “map” of AD implementation
•   Contains information used for replication logon searches.
•   Domains
•   Trust relationships
•   Sites& site links
•   Subnets
•   Domain controller locations.

3. Domain Partition:
•   Logical partition in AD database.
•   Collections of users, computers, groups etc.
•   Units of replication.
• Domain controllers in a domain replicate with each other and contain a full copy of the domain partition for their domain.
•   DCs do not replicate domain partition information for other domains

4. Application Partition:
•   It is a newly added partition in win2003. It can be added or removed
•   It can be replicated only to the specified DCs.
•   Useful when we are using AD integrated services like DNS, TAPI  services etc..



FSMO roles: (Flexible Single Master Operations): Forest wide Master Operation
1. Schema master        2.Domain Naming master

Domain wide master operation

3. PDC emulator
4. RID master
5. Infrastructure master

Schema Master:

Responsible for overall management of the entire schema in a forest. The first DC installed acts as a schema master in the entire forest. There can be only one schema master in the entire forest

Domain Naming Master:

Responsible for addition /removal of domains. It maintains the uniqueness of domain names. There can be only one DNM in the entire forest.

3. PDC emulator:

PDC provides backward compatibility for existing NT BDCs and workstations. (If it is running in mixed mode)
PDC updates the password changes made by the users.
It is also responsible for synchronizing the time. There can be only one PDC emulator per domain.

4. RID master:

Responsible for assigning unique IDs to the objects created in the domain. There can be only one RID master per domain
SID – Security Identifier it maintains a access control list. It is divided into two     parts.
1.  DID (Domain Identifier)
2.  RID (Relative Identifier)

For knowing the SID of the user
>Start>run>cmd> who am I /user

5. Infrastructure master:

Responsible for maintaining the updates made to the user & group membership. It also maintains universal group membership.
There can be only one infrastructure master per domain

The term flexibility means we can transfer any of the 5 roles from DC to ADC.

Transfer of Roles
:
We can transfer the roles for some temporary maintenance issues on to ADC and again we can transfer back the roles onto DC.

We can transfer the roles in two ways
1.  Command mode
2.  Graphical mode
Transfer of roles through command

On DC
Go to command prompt and type ntdsutil
Type: roles
Connections
Connect to server (name of ADC ex.sys2) Q
Transfer schema master
Transfer RID master
Transfer infrastructure master
Transfer                                                                                                                                        PDC Q
Q
Exit

Transferring roles using GUI
On DC
Register the schema
For registering schema
Start > run > regsvr32 schmmgmt.dll

Transferring schema master
On Dc
Start>Run>mmc>click on file> select add/remove snap in
Select A.D.Schema>add>close>ok
From console root Expand console root Right click AD Schema
Change domain controller
Specify name
Ok
Right click AD schema Select operations master Click on change
Yes> ok> file> exit (need not to save)

Transferring Domain naming master: On DC
Start>p>admin tools> ADDT>right click on ADDT
Connect to domain controller
Select ADC Ok
Right click on ADDT
Operations master
Click on change>yes>ok> close
Transferring Domain wide master operations: Start >p>admin tools> ADUC
Right click on ADUC Connect to DC Select ADC > ok
Right click on Domain name
Select operations master
Change>yes
Select PDC> change>yes>select infrastructure>change>close>close.



GLOBAL CATALOG

It is a service responsible for maintaining information about the objects and serving the requests made by the users by providing the location of the object.
Global Catalog runs on the port number 3268.
All types of queries are first heard on this port number and forward the query to port no.389 (LDAP’s).Maintains the complete information about the objects within the same domain and partial
information about other domains.
GC communicates to infrastructure master.
If DC & ADC are located in the same location only one GC is enough.
If the DC&ADC are located remotely to avoid network traffic we need to configure ADC as GC

Infrastructure  master  contacts global  catalog  for  obtaining  the  updates about  user  &  group membership and universal group membership.

The primary functions of GC
To maintain universal group membership information, to easily locate the objects with in the AD.:
Configuring a Global catalog server. Either on ADC or on Child DC
>Start >program>admin tools> ADSS> expand sites >default first site>server>
On NTDS right click> properties>check the box Global Catalog.
Installing Child DC: Requirements:
Parent DC
Member server or stand alone server
Static IP DNS
NTFS volume with 250 MB of free HDD space

On Member Server or stand alone machine specify the server’s DNS.
>Start >run>dcpromo>next>next>next>domain controller for a new domain>next>
Child  Domain in  an  existing  tree>specify  the  parent  domain’s  administrator’s name  &  pwd.
>Specify the child name>next>netbios name> next> database folder> next>Sysvol>next>restart.
Installing New Domain tree in an existing forest: Requirements:
Forest (initial domain controller or root domain controller) On member server or stand-alone machine.
Specify the server’s DNS.
Start>run>dcpromo>next>next>next>Domain Controller for a new domain. Select Domain tree in an existing forest.
Specify the root domain’s admin’s name & pwd
Next>     specify     the     new     domain     name>next>net     bios     name>next>database     >
next>sysvol>next>DNS next>permission compatible >next>restore mode pwd>next

Trust Relationship: Trust is a process of enabling resources of one domain to be accessed by another domain.

Functional Levels:
1. Domain Functional Level:
A) Windows 2000 mixed
B) Windows 2000 native
C) Interim
D) Windows 2003 server

2. Forest Functional Level:

a) Windows 2000 mixed b) Interim
c) Windows 2003 server.

Windows 2000 mixed:

By default when we install 2000 or 2003 o/s it gets installed in win 2000 mixed mode.
This mode supports older versions of win2003. We can add NT, 2000 flavors in 2003 networks.

 Windows 2000 native:

It supports only 2000 and 2003; Native mode can have 2000&2003 flavors only. Interim:
This mode can have NT and 2003. Useful when we upgrade NT to 2003

Windows 2003 server:

This mode supports only 2003 server family. We can’t join NT/2000 domains

Types of Trusts:

Trust relationships in Windows server2003:
Default two way transitive Kerberos trusts (intra forest)
Shortcut – one or two away transitive Kerberos trusts (intraforest) Reduce authentication requests
Forest-one or two way- transitive Kerberos trusts.
WS2003 forests WIN 2000 does not support forest trusts
> Only between forest roots
>Creates transitive domain relationships. External – one way non-transitive NTLM trusts.
Used to connect to /from win NT or external 2000 domains.- manually created. Realm – one or two way non-transitive Kerberos trusts.
Connect to /from UNIX MT Kerberos realms.

Establishing Trusts:

The Domain where we have user accounts is called trusted domain. The domain where we have resource is called trusting domain.
Trust between parent and child is two way transitive trusts. Ex; A trusts B, automatically B trusts A this is a two way trust.
Trust between parent and Grandchild domain is called implicit trust. One-way trust or Non-transitive Trust: A trusts B, but B doesn’t trust A Transitive trust (2 ways):
If A trusts B, B automatically trusts A

One way incoming trust:
It means A is getting the resources from B and B is offering the resources.

One way out going trust:

A is offering resources to B and B is getting resources from A Benefits of Domain Functional Level:
Win 2003 server Level:

The moment we raise the functional level, form mixed mode to win 2003 mode we get the following benefits.

Universal groups
Group nesting
Domain renaming tools.
Benefits of Forest Functional Level: Win 2003 level
We get complete benefits of 2003 when we raise the level from 2000 to win 2003 server. We can implement forest trusts.
Acceleration of global catalog replication information. Domain renaming

Implimenting Forest Level:

Raising Domain Functional in both the machines:
>Start>program>admin tools>ADDT>right click on Domain>raise Domain Functional Level>select win 2003>click on raise>ok>ok
Raising Forest Functional Level:
>Start>p>ADDT>right click on ADDT>raise forest functional level>select win2003>rise>ok.