Week 4 - Active Directory Flashcards
What does GPO stand for?
Group Policy Objects
What do GPO do?
ways to manage the configuration of Windows machines
(Active Directory is the central repository of GPOs)
What is the Active Directory tool ADAC stand for?
Active Directory Administrative Center
What kind of tool is ADAC?
It’s a tool that we’ll use for lots of the everyday tasks
Much like file systems, directory services are ________
hierarchical
What’s an OU?
A folder or directory for organizing objects within a centralized management system
an organizational unit is the actual folder that organizes objects
Can ordinary containers contain other containers?
No, only OUs can contain other OUs
What is a forest and what does it contain?
a forest is a level of hierarchy that is above a domain in tree view, a forest contains one or more domains
What’s the very first node in the AD tree? What are 2 things it contains? (3 total)
the domain
contains a short name, like example
, and the DNS name, like example.com
In which container are new AD computer accounts created?
In the Computers container under the domain tree
When are computer accounts created?
when a computer is joined to the AD domain
What are domain controllers?
they are servers that host the copies of the Active Directory database
Which container contains the domain controllers that are created by default?
the “Domain Controllers” container under the domain tree
What are 5 services that domain controllers provide on the network?
- host a replica of AD database and GPOs
- serve as DNS service, provides name resolution and service discovery to clients
- provides central authentication via Kerberos
- Decide when computers/users can log into the domain
- Decide whether the computers/users have access to shared resources (file systems, printers, etc.)
(this is how sys admins can create a system-wide user account that recognizes a new user on every device almost immediately)
It’s common for most domain controllers in AD network to be what 3 things?
- read
- write
- replicas
(each have a copy of the database and can make changes to it)
What does FSMO stand for?
Flexible single master operations
What does FSMO do?
Changes to the AD database that can only be safely made by 1 DC at a time are tasked to a single domain controller that’s granted FSMO (flexible single master operations)
For computers to take advantage of the central authentication service of AD, what needs to happen?
they need to be joined/bound to Active Directory
What does it mean when you join a computer to AD? (2)
- AD knows about the computer and provisions a computer account for it
- The computer knows about the AD domain and authenticates it
What does SAM stand for?
Security Account Manager
What does SAM do?
A database in Windows that stores usernames and passwords
(also a field in the create a new user window that means username)
How many categories of group are there in active directory?
2
Security Group
Distribution Group
What’s the most common category of group?
security group
What do security groups contain? (3)
user accounts, computer accounts, or other security groups
What are 2 examples of security groups?
- Domain users
- Domain admins
What is a distribution group?
Only designed to group accounts and contacts for email communication
(not used to grant permissions to resources)
What is group scope?
identifies the extent to which the group is applied in the domain tree or forest
What is domain local used for? [group scope]
used to assign permission to a resource
What’s an example of using domain local?
creating a domain local group that has read access to a network share (called Research Share Readers) and another with write access called Research Share Writers
What is Global used for? [group scope]
used to group accounts into a role
What are the 3 group scopes?
- Univeral
- Global
- Domain Local
Does AD store a user’s password?
No it stores a one way cryptographic hash of the password
What is a workgroup computer?
a Windows computer that isn’t joined to a domain
How do you join a computer to AD via CLI?
Add-Computer -DomainName ‘example.com’ -Server ‘dcl’
How do you get the AD version via CLI?
Get-AdForest
then
Get-AdDomain
What are functional levels?
The several versions of active directory
How do you join a computer to AD via GUI? Windows
This PC > Computer > System Properties > Change Settings > Change > Select Domain > Enter domain name (example.com)
What is a forest?
A forest contains one or more domains
What is tree view?
Tree view is the individual branches of the forest [domain (example (local), DAC, Authentication containers]
Who can access files encrypted by the Encrypting File System (EFS)?
Besides
Besides the user who encrypts a file, only designated recovery agent personnel can decrypt it
What makes EFS secure?
prevents
Prevents techniques that circumvent the restrictions of access control lists (ACLs) for sensitive files on computers shared by several users and on portable computers.
How do you simply define a directory service?
they are services that are used to store information about objects
What are “objects”?
things in your network that you want to be able to reference or manage
What does GPO stand for?
Group Policy Objects
What are GPOs?
a Group Policy Object is a set of policies and preferences that can be applied to a group of objects in the directory
What can a GPO contain? (3)
- computer configuration
- user configuration
- both
When is computer and user configuration applied? (2)
Computer configuration = when the computer starts and signs into AD domain
User configuration = when the user logs onto the computer
How is the GPO enforced when it’s in effect?
It’s enforced and checked every few minutes
What’s the difference between policies and group policy preferences, which are what make up GPOs? (2)
- Policies - Aren’t changed, settings are reapplied every set amount of minutes (by default every 90 minutes)
- Preferences - Settings that are meant to be a template for settings
How do domain-joined computers get the GPOs?
the domain controller gives the computer a list of group policies that it should apply
What does the special folder SYSVOL contain?
It contains the GPO policies that should be applied to the computer (the computer downloads it from this folder)
What does the Windows registry contain?
(use to store ___data)
a hierarchical database of settings that Windows and apps use for storing configuration data
