Assignment # 8Assignment # 8

Q1Q1Effective permissions of Esra Ali are:

-Deny read permission.

-Allow Create all child

objects.

-Allow reset password.

-Deny modify owner.

-Allow Delete all child

objects .

Because the Deny permission overrides Allow permission and Explicit Allow override Inherited Deny.

Q2Q2IT department proprieties, security tab

Click Advanced button, select Auditing tab. Then click Add button.

Select success create user objects. Click OK.

Finally..

Log event after create new user:

What type of change was made? create object

Who made the change? Administrator

What member was added? Ahmad

When the change was made? 2:54 PM

Q3Q3

Follow the steps in the wizard to add the data for both PSOs

A snapshot of Password settings A snapshot of Password settings container where the two of the PSO container where the two of the PSO should appearshould appear

Apply HR PSO to: HR OU & Domain AdminsApply HR PSO to: HR OU & Domain AdminsNote that: you should make a shadow copy of Note that: you should make a shadow copy of HR OU using a group named HRHR OU using a group named HR

Apply Domain Admins PSO to Apply Domain Admins PSO to Domain AdminsDomain Admins

A snapshot of Admininstrator properties A snapshot of Admininstrator properties (member of Domain Admins group)(member of Domain Admins group)

QuestionQuestion

HR member will have HR PSOWhat is the resultant PSO of domain admins? Why it was chosen?

Domain Admins PSOBecause it has higher precedence.

Q4Q4Modify the Default Domain Controllers Policy GPO to enable auditing events for both successful and failed account logon

events .

Q4 .. ContQ4 .. Cont..Modify the Client Computers Policy to enable auditing events for both successful and failed logon events

In server side (Fail attempt In server side (Fail attempt to logon-- account logon to logon-- account logon event)event)

In server side (Successful In server side (Successful attempt to logon- account attempt to logon- account logon event)logon event)

QuestionsQuestions

How many log entries? Where?-2

one in DC and other one in client computer

-Account logon events created in the DC

-Logon events created in the client computer

Q5Q5A.What does an RODC do?

RODC provides a way to deploy a domain controller more securely in locations that require fast and reliable authentication services but cannot ensure physical security for a writable domain controller. Also, An RODC provides a more secure mechanism for deploying a domain controller. You can grant a no administrative domain user the right to log on to an RODC while minimizing the security risk to the Active Directory forest.

You might also deploy an RODC in other scenarios where local storage of all domain user passwords is a primary threat.

B.Are there any special considerations?

To deploy an RODC, at least one writable domain controller in the domain must be running Windows Server 2008. In addition, the functional level for the domain and forest must be Windows Server 2003 or higher.

C.What new functionality does RODC provide?

RODC addresses some of the problems that are commonly found in branch offices. These locations might not have a domain controller. Or, they might have a writable domain controller but not the physical security, network bandwidth, or local expertise to support it. The following RODC functionality mitigates these problems:

Read-only AD DS database

Unidirectional replication

Credential caching

Administrator role separation

Read-only Domain Name System (DNS)

D.What are the prerequisites for RODC?

-Ensure that the forest functional level is Windows Server 2003 or higher.

-Run Adprep.exe commands to prepare your existing forest and domains for domain controllers.

-Install Active Directory Domain Services (AD DS).

-Deploy at least one writable domain controller running Windows Server 2008 or Windows Server 2008 R2

E.What does the following print screen shows? What does Advance, Add and Remove button provide?

-The Password Replication Policy tab.

You can control how credentials caching for

users, groups or computers will take place.

Allow passwords for the account replicating to

this RODC.

-Advanced button provides more options:

resultant policy , prepopulate password and view

passwords are stored on RODC and Accounts that have been authenticated to RODC.

-Add and remove buttons to add and remove account.

F.What does the above print screen provide?

Advanced window provides more options: resultant policy ,prepopulate password and view passwords are stored on RODC and Accounts that have been authenticated to RODC.

G.What each of the following mean?

Accounts whose passwords are stored on this Read-only Domain Controller :Current credentials that are cached on an RODC

Accounts that have been authenticated to this Read-only Domain Controller : accounts have tried to authenticate to an RODC

Prepopulate passwords button: prepopulate the password cache for an RODC with the passwords of user and computer accounts before the accounts try to log on in the branch office.