Lab securing AIDS.
Scenario.
The security team at a Dayton corporation has been examining possible security issues in the organization,
focusing on ads.
The security team is particularly concerned with ads, authentication and security of branch office
domain controllers.
You must help improve security and monitoring of authentication against the Enterprise's ads domain.
Additionally, management at a datum has instituted a password policy, and you must enforce it for
all user accounts and develop a more stringent password policy for security sensitive administrative
accounts.
It also is important that you implement an appropriate audit trail to help monitor authentication attempts
within ads.
The second part of your assignment includes deploying and configuring runs to support ADSL authentication
within a branch office.
Lastly, you should evaluate the usage of a group MSA by deploying it to the test server.
Objectives.
After completing this lab, you will be able to implement security policies for accounts, passwords
and administrative groups.
Deploy and configure in ROTC.
Create and associate a group MSA.
Exercise one.
Implementing security policies for accounts, passwords and administrative groups.
A data management has indicated that it is important that all management processes are as secure as
possible to help prevent a security breach.
The company's security and management teams have identified its business requirements with respect to
account log ons and password security.
In this exercise, you will define and implement the group policy settings to meet the company's requirements.
Supporting Documentation A Data and GPO Strategy Proposal Requirements Overview.
A datum has identified the following requirements regarding account log on and password policies.
All users must use a password that is at least eight characters long.
For IT administrators, the minimum length must be ten characters.
Passwords for all users must be complex and stored securely.
All users except IT administrators must change their password every 60 days or less.
It.
Administrators must change their password every 30 days or less.
If users enter the wrong password more than five times within 20 minutes, their accounts must be locked.
For normal users, accounts are unlocked automatically after one hour.
For it, administrators, accounts must be locked after three incorrect password attempts.
It.
Administrator accounts are never unlocked.
Automatically, an administrator must unlock the account.
IT administrator accounts include all members of the IT group and the Domain Admins group.
No users should be able to use at least ten of their previous passwords.
The membership list for the local administrators group on all member servers must be limited to only
the local administrator account, the domain admins group and the group.
The Domain Admins group must include only the administrator account.
The enterprise admins and schema admins groups must be empty during normal operations.
Users must be added explicitly to these groups only when they need to perform tasks that require this
level of administrative rights.
Other built in groups such as account operators and server operators should contain no members.
If users are added to one of these groups, they should be removed from the group automatically.
All changes made to user objects and security groups in ads must be audited.
Proposals.
List the settings that you must configure to meet a Dayton's requirements regarding password policies
and account lockout.
Setting configuration for all users, configuration for it administrators.
Enforce password.
History.
Maximum password.
Age.
Minimum.
Password.
Age.
Minimum password length.
Passwords must meet.
Complexity requirements.
Store password using reversible encryption.
Account Lockout.
Duration.
Account.
Lockout threshold.
Reset account lockout counter after one.
How can you configure that?
IT administrators have different password and account lockout settings than regular users.
Two How can you identify it administrators in terms of more restricted password and account lockout
settings?
Three.
How can you meet the requirement to limit the membership list for the local administrators groups on
all member servers to only the local administrator account, the domain admins group and the group?
Four.
How can you meet the requirement that the domain admins group must include only the administrator account
and that the enterprise admins and schema admins groups must be empty during normal operations.
Five.
How can you meet the requirement that other built in groups such as account operators and server operators
must not contain members?
Six.
How can you meet the requirement that you must audit all changes to ads?
Task one identify the required settings.
One Read the documentation provided to fill in the table of settings according to the requirements of
a datum corporation.
Three Answer the additional questions from the proposals document test to configure password settings
for all users.
One on ELO and DC one from server manager open the group policy management console to navigate to the
default domain policy and then click edit three in the group policy management editor window.
Navigate to computer configuration backslash policies backslash window settings.
Backslash Security settings, backslash account policies and then select password policy.
Four Configure the following policy settings enforce password history ten passwords remembered maximum
password age 60 days minimum password age one days password must meet complexity requirements enabled.
Password length.
Eight characters.
Store passwords.
Using reversible encryption.
Disabled.
Five Select Account Lockout Policy and then define and configure the following policy settings.
Account Lockout duration 60 Minutes.
Accept the suggested value change.
Account lockout threshold five invalid log on attempts to reset account lockout counter after 20 minutes
six closed the group policy management editor window and the group policy management console.
Task three Configure a PSL for IT Administrators one on ELO and DC, one from server manager open Active
Directory Administrative Center.
To navigate to a datum local backslash system.
Backslash password settings container.
Three.
Create a new PSL with the following parameters.
Name a datum.
Administrators Password Settings precedence ten.
Enforce minimum password length selected ten.
Characters minimum password length.
Enforced Password History selected ten.
Passwords remembered password must meet.
Complexity Requirements selected.
Store password using reversible encryption not selected.
Password age options enforced.
Minimum password age selected user cannot change the password within days.
One Enforce maximum password age.
Selected user must change the password after days 30.
Account Lockout Options enforce account lockout policy selected number of failed log on attempts allowed
three reset failed log on attempts count after mince 20.
Account will be locked out until an administrator manually unlocks the account.
Four in the directly applies to section configure the so to apply to the IT group.
Five.
It will not work because it is not a global group.
Open Windows PowerShell and then verified the IT group scope with the following command get aid group
86.
Modify the group scope by using the following command set aid group IT Group Scope Global seven in the
directly applies to section, configure the PSU to apply to the following groups.
I.t.
Domain admins.
Eight.
Create the PSA nine.
An Active Directory administrative center.
Switch to the overview page and in the global search box.
Search for Abbie Skinner.
Use the view, result and password settings to verify that the ID datum administrative password settings
PSA applies to A-B.
He is in the IT group.
Ten.
Repeat Step nine to verify the user Adam Harms.
He is not in an IT group and the default domain policy settings apply to him.
11 Close Active Directory Administrative Center and Windows PowerShell task for implement administrative
security policies one on low and DC one open Active Directory Administrative Center and create a top
level.
You name two datum servers to move L1 SDR one and L1 SDR two to the datum servers.
Oh you three open the group policy management console and then create and link a policy named restricted
administrators on member servers to the A datum servers.
Oh you.
Four.
Edit the GPO to restrict the local administrators group to the administrator account, the domain admins
group and the group.
Five Switch to L0 and SVR one and refresh group policy six.
Verify that the policy has applied to ELO and SVR one and has restricted the local administrators group.
Seven.
Switch back to low end DC one.
Eight.
Edit the default domain controllers policy.
Nine.
Configure the GPO with restricted groups.
And the group's account operators and server operators and configure both to contain no members.
Ten closed the group policy management console.
Task five Implement administrative auditing one on ELO and DC one from server manager.
Start the group policy management console to navigate to and edit the default domain controllers policy.
Three.
Configure the default domain controllers policy to enable success auditing of audit directory service
changes under computer configuration backslash policies backslash.
Windows Settings backslash.
Security Settings backslash.
Advanced Audit Policy configuration.
Backslash audit policies.
Backslash.
RDS Access.
For in the default domain controllers policy enables success auditing of audit security group membership
under computer configuration backslash policies backslash windows settings backslash security settings
backslash advanced audit policy configuration backslash audit policies backslash account management
five In the default domain controllers policy enable the policy audit force audit policy subcategory
settings Windows Vista or later to override audit policy category settings under computer configuration
backslash policies backslash.
Windows Settings backslash security settings.
Backslash local policies.
Backslash Security Options.
Six at a command prompt to repudiate slash force and then press enter.
Seven Open Active Directory users and computers and enable the advanced features view in the a date
and icon properties dialog box under advanced security settings in auditing.
Locate the success auditing entry for everyone with special access which applies to this object only.
Eight.
Open and change the auditing entry to apply to this object and all descendant objects.
Nine Inactive Directory users in computers.
Add the user Abbie Skinner to the Domain Admins group.
Ten Locate the user Ada Russell in the marketing o you and then change her city from London to Birmingham.
11 Open Event Viewer Go into the security log and then open the most recent event ID 4728 in the properties.
Note that a date and backslash administrator has added a date and backslash Abbi to the domain admins
groups.
12.
In event viewer open the most recent event ID 5136 and note that a date and backslash administrator
has modified the user object C and equals ADA Russell and deleted the value London 13 move and opened
the next event in the event property's details page and notice that a date and backslash administrator
has modified Ada Russell and added the value.
Birmingham 14 closed all open windows except for server manager results.
After this exercise, you should have identified and configured the security policies for a datum.
Exercise two scenario.
In this exercise, you will configure the server l1 SDR one as an arrow DC in the distant branch office.
To avoid travel costs, you decide to do the conversion remotely, working with a desktop support technician
and the branches only one staff member.
This user already has installed a Windows Server 2016 computer named L1 SVR one.
You will stage a delegated installation of an arrow DC so that this administrative user can complete
the installation.
After the deployment is complete, you will configure a domain wide password replication policy and
the password replication policy specific to L1 SVR one.
The main tasks for this exercise are as follows one stage a delegated installation of an arrow DC to
run the Active Directory Domain Services installation wizard on an arrow DC to complete the deployment
process.
Three.
Configure the domain wide password replication policy.
Four.
Create a group to manage password replication to the branch office RDC.
Five Evaluate the result and password replication policy.
Task one stage, a delegated installation of an RDC preparation to Prestwich in RDC account.
The computer name must not be in use in the domain.
Therefore, you first need to remove L0 and SVR one from the domain by performing the following steps.
One Remove L0 and SVR.
One from the domain added to the Munich Work Group and then restart the server.
To sign in as a username administrator.
Password.
Three.
Switch to low and DC one four from server manager start active directory users and computers navigate
to the added datum servers oyu and then delete L1 SVR one confirm the deletion stage a delegated installation
of an arrow DC one Inactive directory sites and services create a new site named Munich and then assign
it to default.
Website link to start Active Directory Administrative Center and then navigate to the domain controllers.
0u3 pre create an arrow DC account with the name l0 SVR one, which also should be a DNS server and
a global catalog.
For Delegate Nestor Fiore to install and administer the RDC.
Five finished the recreation of the ROTC account tasked to run the Active Directory Domain Services
installation wizard on an odyssey to complete the deployment process.
One.
Switch to l0 in SVR one from server manager.
Start the ad rolls and features wizard to use the wizard to install Active Directory domain services
on loan SVR one.
Accept the installation of features and management tools.
Three.
When the installation is finished, click in the notification area of server manager to promote this
server to a domain controller.
Four Configure to add the server as a domain controller to an existing domain.
Click Change and provide the following credentials.
Username a date and backslash Nestor.
Password.
Five selected data CNN.com as the domain and then proceed.
Six.
Notice that the Active Directory Domain Services installation wizard finds the pre created account.
Accept all further defaults in the wizard to use that account and then configure ads.
Task three Configure the domain wide password replication policy one.
Switch to ELO and DC one from server manager.
Start Active Directory Administrative Center to make the IT group found in the ITU.
A member of the denied ARO DC Password Replication Group.
Note the members of the IT group have elevated permissions, so storing their password on an arrow DC
would be a security risk.
Therefore you add the IT group to the global deny list, which applies to every RDC in the domain.
Task four Create a group to manage password replication to the branch office.
RDC one Switch to server manager and from the tools menu.
Start Active Directory users and computers to navigate to the users container and then create a new
group named Unique Allowed RDC Password Replication Group.
Three.
Add on Cantrell to the new group.
For an inactive directory administrative centre from the domain controllers.
You view the properties for l0 and SVR one five in the extension section on the password replication
policy tab.
Configure the Munich allowed RDC password replication group to allow password replication.
Close the properties for L0 and SVR one.
Task five Evaluate the result and password replication policy.
One Inactive Directory Administrative Center.
Open the properties of L0 and SVR.
One And then in the extension section on the password replication policy tab.
Click Advanced.
Note that this dialog box shows all accounts whose passwords are stored in the RDC to select accounts
that have been authenticated to this read only domain controller.
And then note that this only shows accounts that have the permissions and already have been authenticated
by this RDC.
Three.
Click the resultant policy tab and then add on a Cantrell.
Notice that on a Cantrell has a resultant policy of allow for close all open dialogue boxes results.
After this exercise, you should have deployed and configured an RDC.
Exercise three scenario you need to configure a group MSA to support a new web based application that
is being deployed.
Using a group MSA will help maintain the password security requirements for the account.
The main tasks for this exercise are as follows.
One.
Create an associate in MSA to install a group MSA.
Task one.
Create an associate in MSA one.
On L0 and DC one.
Open the Active Directory module for Windows PowerShell console to create the CDS root key by using
the ADD CDs root key complete.
Make the effective time minus 10 hours.
So the key will be effective immediately.
Three.
Create the new service account named web service for the host ELO and DC one.
For associate the web service MSA with Ello and DC one five verified the group MSA was created by using
the get add service account complete task to install a group MSA one on Ello and DC one.
Install the web service service account by using the following command install add service account identity
web service two from the tools menu and Server Manager Open Internet Information Services IRS Manager.
Three.
Expand low and DC one a data backslash administrator and then click application pools.
Four in the default app pool actions pane in the advanced settings dialog box.
Configure the default app pool to use the web service dollar account as the identity.
Note that you can click the ellipsis by the identity name to add the web service dollar account as a
custom account.
Five.
Stop and then start the application pool.
Exercise three scenario.