FORMULACIÓN DE PROPUESTAS SOBRE POSIBLES LÍNEAS DE RE- RE-FORMA A PARTIR DE LA EXPERIENCIA PREVIA DEL PAÍS ORIENTADAS

Woodgrove Bank is opening a new Houston branch. The HR department has provided you with a file that includes all of the new users that are being hired for the Houston location. You need to import the user accounts into AD DS, and then activate and assign passwords to all of the accounts.

You also need to modify the user properties for the Houston users by updating the city information.

Woodgrove Bank is also planning on starting a Research and Development department in the NYC location. You need to create a new OU for the research and development (R&D) department in the Woodgrove Bank domain, and import and configure new user accounts into AD DS.

The main tasks are as follows:

1. Modify and use the Importusers.csv file to import a group of users into AD DS.

2. Modify and run the ActivateUser.vbs script to enable the imported user accounts and assign a password to each account.

3. Modify and use the Modifyusers.ldf file to prepare for modifying the properties for a group of users in AD DS.

4. Run the CreateUser.ps1 script to add new users to AD DS.

f

1. On NYC-DC1, browse to E:\Mod02\Labfiles and open ImportUsers.csv with Notepad. Examine the header information required to create OUs and user accounts.

2. Copy and paste the contents of the ImportUsers.txt file into the ImportUsers.csv file, starting with the second line. Save the file as C:\import.csv.

3. At the command prompt, type CSVDE –I –F C:\import.csv and then press ENTER.

4. In Active Directory Users and Computers, verify that the Houston OU and five child OUs were created, and that several user accounts were created in each OU.

M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED

Creating Active Directory Domain Services User and Computer Objects 2-47

f

2. Modify the container value in the second line to:

OU=BranchManagers,OU=Houston,DC=WoodgroveBank,DC=com.

3. Modify the container values in the additional lines at the end of the script to include the following OUs, and then save the file:

• OU=CustomerService,OU=Houston,DC=WoodgroveBank,DC=com

• OU=Executives,OU=Houston,DC=WoodgroveBank,DC=com

• OU=Investments,OU=Houston,DC=WoodgroveBank,DC=com

• OU=ITAdmins,OU=Houston,DC=WoodgroveBank,DC=com 4. Save the file as c:\Activateusers.vbs, and then run using Cscript

c:\Activateusers.vbs.

5. In Active Directory Users and Computers, browse to the Houston OU, and then confirm that user accounts in all child OUs are activated.

f

1. On NYC-DC1, export all of the user accounts in the Houston child OUs by using the following command:

LDIFDE –f c:\Modifyusers.ldf –d

"OU=Houston,DC=WoodgroveBank,DC=com" –r "objectClass=user" –l physicalDeliveryOfficeName.

2. Edit the C:\Modifyusers.ldf file.

3. On the Edit menu, use the Replace option to replace all instances of changetype: add, with changetype: modify.

4. After each changetype line, add the following lines:

replace: physicalDeliveryOfficeName physicalDeliveryOfficeName: Houston

5. At the end of the entry for each user, add a dash (–) on its own line followed by a blank line.

M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED

2-48 Configuring, Managing and Maintaining Windows Server 2008 Servers

6. Save the file as C:\Modifyusers.

7. At the command prompt, type ldifde –I –f c:\Modifyusers.ldf and then press ENTER.

8. In Active Directory Users and Computers, verify that the Office attribute for the user accounts in Houston has been updated with the Houston location.

f

1. On NYC-DC1, in E:\Mod02\LabFiles, open CreateUser.ps1.

2. Under #Assign the location where the user account will be created, note the entry $objADSI =

[ADSI]"LDAP://ou=ITAdmins,DC=WoodgroveBank,DC=com".

3. Enable execution in PowerShell by typing the following at a command prompt:

Set-ExecutionPolicy AllSigned, and then press ENTER.

4. Run the script: E:\Mod02\Labfiles\CreateUser.ps1

Note: You will be prompted to authenticate. Authenticate as Administrator with a password of Pa$$w0rd. In Active Directory Users and Computers, in the ITAdmins OU, verify that the user Jesper has been created.

f

1. For each virtual machine that is running, close the Virtual Machine Remote Control window.

2. In the Close box, select Turn off machine and discard changes. Click OK.

3. Close the 6419A Lab Launcher.

Result: At the end of this exercise, you will have examined several options for automating the management of user objects.

M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED

Creating Active Directory Domain Services User and Computer Objects 2-49

Module Review and Takeaways

Review Questions

1. You are responsible for managing accounts and access to resources for members of your group. A user in your group leaves the company, and you expect a replacement for that employee in a few days. What should you do with the previous user’s account?

2. A user in your group must create a test lab with 24 computers that will be joined to the domain but the account must be created in a separate OU. What is the best way to do this?

3. You are responsible for maintaining the servers in your organization. You want to enable other administrators in the organization to determine the physical location of each server without adding any additional administrative tasks or creating any additional documents. How can you do this?

M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED

2-50 Configuring, Managing and Maintaining Windows Server 2008 Servers

4. To accelerate the process of creating new accounts when new employees enter your group, you create a series of account templates that you use to create new user accounts and groups. You are notified that a user with an account that was created by using one of the non-manager account templates has been accessing files that are restricted to the Managers group. What should you do?

5. You are responsible for managing computer accounts for your group. A user reports that they cannot log on to the domain from a specific computer but can log on from other computers. What should you do?

6. You have determined the best ways to search for Active Directory objects and documented your recommended search criteria. However, the administrators tell you that it is taking too long to create and then run the search. After further research, you determine that most of the systems administrators are searching for the same information. What can you do to accelerate the search process?

Considerations for Managing AD DS User and Computer Accounts When managing AD DS user and computer accounts, consider the following:

• If your organization typically creates large numbers of user accounts at the same time, explore using of LDIFDE, CSVDE or Windows PowerShell scripts to automate the process of creating the accounts. These tools can save a great deal of time when adding or modifying multiple accounts.

• Consider delegating permissions to create and manage user accounts in your AD DS domain. You can delegate permissions at the domain or OU level.

• At a minimum, you should retain the password complexity requirements in a Windows Server 2008 domain. Complex passwords are more difficult for users to remember, but they are also the most important first step in maintaining AD DS security.

M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED