Section 2 Flashcards
Roles vs Features
Roles perform duties and do lots of things
Features are more of a tool you can use to get something done. Or a smaller part of a role that does one thing.
What is a domain?
What is a domain controller?
Domain - territory of control
Domain Controller - controls major group services:
User Activation (AD)
DNS
Print Services
File System Replication
Windows Time Service
DHCP
One primary server (primary domain controller) Computers are controlled by one that the other computers have to register with.
Domain Controller vs Active Directory
DC is just the main server that serves AD.
Active Directory (primary service role) - allows user to authenticate logins to login to clients.
Stores info about objects on network and makes info available. AD DS uses domain controllers to give net users access to permitted resources anywhere on net through single login process.
What is a requirement for domain controller installation?
You need a role service to install.
Like DNS or something, that would be domain controller role.
What’s the point of AD DS?
If you have a network of 10 computers and need to work on them, normally you’d have to add a user one computer at a time. Need to update a password? You’d have to do it one by one. AD DS makes it to where you have a one stop shop for authentication.
What is the NetBIOS Domain Name?
This is what you’d have to type in to access the domain. At work, we use humans\USERcred
Install Active Directory Domain Services but do the prerequisites first!
Confirm AD DS is on the system
mylabdc.local < -
LAB < netbios name
Verify DNS
Check your IP so your can reserve one that’s not being used, or just ping the ip
cmd > ipconfig
Settings > Network > Change Adapter settings > right click Ethernet (or whatever the adapter is called) > properties > TCP/IPv4 > Use the following. > Use the following DNS server address:
Just use default gateway.
Server Manager > Add Roles and Features > Select Active Directory Domain Services > Also select DNS > finish
Close
Click notification
Promote server to Domain Controller > Add a new forest > mylabdc.local > next > Enter Password for Domain admin account > next > next > NetBIOS name “LAB” > next > next > next > Install
Start > Windows Administrative Tools > Active Directory Users and Computers > Click your forest > Domain Controllers folder > you will see your computer.
ipconfig > double check your ip > Windows Administrative Tools > DNS > Click your pc > forward lookup Zones > mylabdc.local > lab-windows will show your entry for your static IP.
cmd > nslookup (ip) or ping lab-windows (whatever you named your computer.
What is a forest
AD runs on LDAP, what is that?
What is SYSVOL
AD Database - where is this saved
List Logical and Physical structures
Forest - Assembly of AD Domains that share a single schema for the AD. All DC’s in the forest share this schema and is replicated in hierarchical fashion among them. So same policies and rules and stuff are applied to all servers in the Domain.
LDAP - Lightweight Directory Access Protocol - Protocol used to lookup info or devices in network.
SYSVOL - Folder keeps server’s copy of the domain’s public files. Users, group policy, etc, of the sysvol folder are replicated to all domain controllers in the domain.
C:\Windows\ntds
Logical - Tree, forest, domain, OU
Physical - Domain Controller, Site
Define:
Organization Unit (OU)
Object
Attributes
OU - Subdivision of an Active Directory into which you can place users, group, computers, and other organizational units. Place where objects go.
Objects - User, Group, Contact, Computer, Shared Folder, Printer, etc.
Attributes - Objects have them and they describe them.
Example - a user object might have the name, e-mail and phone number attributes.
Go to users and computers and view the OUs
Where would you add a secondary domain controller
How do you create an object?
Navigate to your user and look at his properties
Server Manager > Tools > Active Directory Users and Computers
OR
start > windows admin tools > Active Directory users and computers > these are the folders under mylabdc.local that show a little notepad inside of them (Domain Controllers) <- you can add more DC here.
Right Click Domain Controllers or whatever OU you’re wanting to go into > new > whatever.
Users > right click user
What is an OU?
What is a sub-OU?
What is a group
These all fall under one domain
Defined by function. So like, we would be in IT for our OU, then our sub-ou might be systems, then our group would be like Linux
All the way down to our user in the Linux group.
Example - Seinfeld TV Show
OU - Seinfeld
sub-OU - Main cast, Parents, Friends, etc
group = parents > Jerry parents, George Parents
Users = Mory, Helen, etc
Check if you’re on the domain.
Go into Active Directory and create an OU for the IT team with sub OUs Systems and Network
Create Windows and Linux as groups in Systems
Create a user in Systems named James Paul
Add James Paul to the windows group
Confirm what groups James is a part of Do all the same for Sean Peters (speters) but for Linux
start > system and security > system > Check domain (or right click this pc and go to properties)
Start > Windows Admin tools > active directory users and computers > right click mylabdc.local > new > Organizational Unit > “IT” > uncheck protect container
Right click IT OU > New > Organizational Unit > Systems > do again for Network
Right Click Systems > New > Group > Name it Linux Do the same for Windows.
Right click systems > new > users > add user name > user login name (jpaul) > next > enter password > password never expires > next > finish
Right click Windows > properties > members (add) > type jpaul (login name)
Right click James Paul > properties > member of (this will show domain users and window)
Group scopes
Close enough for now:
Domain local - Only exposed to the domain locally
Global - Accounts from same domain as parent global group
Universal - Any domain in forest
What are the prerequisites for joining AD?
AD server should be up and running with a static IP
Client can reach AD
A user account should exist on AD that you will use once you’re registered.
How would you resolve your DNS’s hostname so we can ping it by name
Network and sharing > change adapter > Right click > properties > tcp/ipv4 properties > Use your Domain controller as the DNS server
ping mylabdc.local
Create a user and add them to domain admins
Add your pc to the domain
Take your pc off the domain
Users > adam1993 is fine or even one of your Windows or Linux guys
Right click users > new > users > Jerry Seinfeld > jseinfeld > next > passwd
Users > Right click domain admins > properties > members > add > jseinfeld > apply > ok
Go to system change settings > Select domain not workgroup > domain will be mylabdc.local > administrator and passwd
Don’t restart because the domain controller will go down too.
To login as local user: ./joshc
select workgroup and re-type “WORKGROUP”
What is ADAC?
Go into it and reset a password
Search for Jerry Seinfeld and add to group
Where would you go to create an object?
Active Directory Administrative Center
Windows Administrative Tools > Active Directory Administrative Center
Search name > look at right hand side
On left hand side click the domain name > click new on and it will show your opitons
Go to Domain and Trust, what is this for?
Start > Windows admin tools > active directory domain and trust >
Left pane shows domain list
Right pane shows objects and trusts
Multiple domains in the domain that the domain trusts.
List all AD Commands on powershell
Get-command -Module ActiveDirectory
Go to AD powershell
Start > Windows Administrator Tools > Active Directory module for windows powershell
Where do you go for AD Sites and Services
Start > Windows Administrator Tools > Active Directory Sites and Services
What is group policy?
What are the two types of group policies?
Access Group Policy via the DC
Allows network administrator to implement specific configurations for users and computers. You can also define user, security and networking policies at the machine level.
Local Group Policy
gpedit.msc
Domain Group Policy
gpedit.msc
Start > Windows Admin Tools > Group Policy Mgmt > Forest mylabdc.local > domains > mylabdc.local > Default Domain Controllers Policy
OR group policy object > and you’ll see default gp here as well
You can edit multiple layers of GP. If you want to edit the policy for everyone on the domain right click and edit under default domain policy. If you want to Edit just one OU do it from that section.
Different types of DNS records
A - host ipv4 (host to ip)
AAA - host ipv6
PTR - reverse (ip to host)
CNAME - (alias) for complicated host names
MX - Mail Exchange
Look at DNS forward entries for mylabdc.local
Create an A record
Create a C record
Delete record
Start > Windows Administrative Tools > DNS > Forward Lookup Zones > mylabdc.local > You’ll see one of our clients in there.
Right click > new host > name WindowsClientB > 192.168.1.245 > Create associated PTR record as well > add host
Right click > new host > alias = testcomputer > click browse by the FQDN section > click on WindowsClientA.mylabdc.local or type it in in the previous screen
Alias here will show the actual name
Right click record > delete
Find your DNS for your DC
In DNS Manager > right click LAB-WINDOWS > properties > Forwarders
What does non-authoritative answer mean?
That means the answer isn’t coming from your server as the DNS, but from the DC’s DNS server. This would exist outside of our network.
What is IIS
Internet Information Services -
It’s like apache, so it’s a webserver
It supports http https ftp ftps smtp nntp
Install IIS
Confirm you have the web server
Create your website
Server Manager > Add Roles and Features > Next > Next > Next > Roles = Web Server IIS > Next until done.
http://localhost/
Go to C:\ > New > Folder named “web” and go into > new txt index.htm > right click and open with notepad > Create whatever
Go to IIS from Server Manager under tools > Click on your server drop down > sites > right click default web site and remove > Right click > add website
Name: Anything
Physical path > locate your page
If you don’t see the .txt extension
click view > options > change folder options > view > unclick hide extensions