Exercise one.
Implementing security policies for accounts, passwords and administrative groups.
Task one Identify the required settings.
One.
Read the documentation provided to fill in the table of settings according to the requirements of a
data corporation.
Setting configuration for all users.
Configuration for IT administrators.
Enforce password history.
1010.
Maximum Password Age 60 days 30 days.
Minimum password age one day one day minimum password length eight characters.
Ten Characters.
Passwords must meet.
Complexity requirements.
True.
Store Password.
Using reversible encryption.
False.
False account lockout duration.
One hour administrator must unlock account lockout threshold five three reset account.
Lockout counter after 20 minutes.
20 minutes.
Three.
Answer the additional questions from the proposals document.
A How can you configure that?
IT administrators have different password and account lockout settings than regular users.
Answer Use the default domain policy which applies to all users and create a fine grained password policy
object that applies only to the required administrative groups.
B.
How can you identify it administrators in terms of more restricted password and account lockout settings?
Answer.
The administrative password and account lockout settings should apply to the IT group and the domain
admins group.
See how can you meet the requirement to limit the membership list for the local administrators groups
on all member servers to only the local administrator account, the domain admins group and the group.
Answer ensure that you have domain member servers in the same or you hierarchy.
Assign a policy to it and then use the restricted groups feature to restrict the local administrators
group forcefully to contain only administrators, the domain admins group and the group.
D How can you meet the requirement that the domain admins group must include only the administrator
account and that the enterprise admins and schema admins groups must be empty during normal operations.
Answer.
You cannot configure groups other than local groups with the restricted groups feature.
For domain admins, enterprise admins and schema admins.
You must configure the group membership manually and audit their changes.
E How can you meet the requirement that other built in groups such as account operators and server operators
must not contain members?
Answer.
Use the restricted groups feature.
F How can you meet the requirement that you must audit all changes to users or groups in Active Directory
Domain Services ads?
Answer.
Configure advanced auditing policies to audit directory services changes.
Test to configure password settings for all users.
One on ELO and DC, one from Server Manager Click Tools and then click group policy management.
Two In the Group Policy Management console in the navigation pane expand forest a datum icon backslash
domains backslash a data incom backslash group policy objects and then select the default domain policy.
Three.
Right click default domain policy and then click edit.
Forward in the group policy management editor window in the navigation pane expand computer configuration
backslash policies backslash window settings backslash security settings backslash account policies
and then double click password policy.
Five.
In the details pane double click enforce password history six in the enforced password history properties
dialog box ensure that defined this policy setting is selected.
Seven Configure Keep Password History for 210 passwords remembered click okay and then double click
maximum password age.
Eight in the maximum password age properties dialog box ensure the defined this policy setting is selected
nine configure password will expire into 60 days.
Click okay and then double click minimum password age ten in the minimum password age properties dialog
box ensure that defined this policy setting is selected 11 Configure password can be changed after two
one days click okay and then double click minimum password length 12 in the minimum password length
properties dialog box ensure the defined this policy setting is selected.
13.
Configure password must be at least two eight characters click.
Okay and then double click password.
Must meet complexity requirements.
14 in the password must meet complexity requirements properties dialog box ensure that defined this
policy setting is selected 15 select enabled click okay and then double click store passwords using
reversible encryption 16 in the store passwords using reversible encryption properties dialog box ensure
that defined this policy setting is selected 17 select disabled and then click okay.
18 In the navigation pane click to select account lockout policy 19 in the details pane double click
account lockout duration 20 in the account lockout duration properties dialog box click to find this
policy setting 21 Configure account is locked out for to 60 minutes and then click okay.
22 in the suggested value changes dialog box.
Click okay.
And then double click account lockout threshold 23 in the account lockout threshold properties dialog
box configure account will lockout after defined invalid log on attempts click okay and then double
click reset account lockout counter after 24 in the reset account lockout counter after properties dialog
box configure reset account lockout counter after 220 minutes and then click okay 25 closed the group
policy management editor window and the group policy management console task three Configure a PSL for
IT Administrators one on ELO and DC one from server manager Click Tools and then click Active Directory
Administrative Center to Inactive Directory Administrative Center in the navigation pane click a datum
local.
Three in the details pane scroll to and double click system and then double click password settings
container.
In the tasks pain in the password settings, container section, click new and then click password settings.
Five.
In the create password settings dialog box in the password settings section, in the name field type
of data administrators password settings six in the precedence field type ten and then ensure that enforced
minimum password length is selected seven in the minimum password length characters textbox type ten
and then ensure that enforced password history is selected eight in the number of passwords remembered
text box type ten ensure that password must need complexity requirements is selected and then ensure
that store password using reversible encryption is not selected.
Nine Under Password Age Options Ensure that enforced minimum password age is selected.
Ten In the user cannot change the password within days text box type one and then ensure that the enforced
maximum password age checkbox is selected.
11 in the user must change the password after days textbox type 30 and then select the in-force account
lockout policy checkbox.
12.
In the number of failed log on attempts allowed text box type three.
13 in the reset failed log on attempts count after mince text box take 20 and then select account will
be locked out until an administrator manually unlocks the account.
14 In the directly applies to section click add 15 in the select users or groups dialog box under Enter
the object names to select type it and then click check names 16.
The name not found dialog box appears because it is not a global group but a universal group.
Click Cancel 17.
Switch to server manager, click Tools and then click Windows PowerShell.
18.
At the Windows PowerShell command prompt typed the following command and then press enter get aid group.
19 verify that the IT group has a group scope of universal 20 at the command prompt.
Type the following command and then press enter said add.
Group it.
Group Scope.
Global 21.
Switch back to the create password settings a datum administrative password settings dialog box 22 in
the select users or groups dialog box under enter the object names to select type i.t domain admins
and then click check names.
The names are both resolved.
Click.
Okay.
23.
Click okay to close the create password settings a daytime administrative password settings dialog box
and create the password settings object.
PSL 24 in Active Directory Administrative Center in the Navigation Pane Click Overview 25 in the details
pane in the global search box type addy skinner and then press enter the user object of Abby Skinner
is found.
26.
In the tasks pane click view result and password settings.
Note that the a datum administrative password settings so applies.
Abby is in the IT group and then click cancel.
27 in the global search box type Adam Hobbs and then press enter 28.
In the tasks pane click view result and password settings.
Note that no resultant fine grained password settings apply.
Adam is not in the i.t group and the default domain policy settings apply to him.
And then click.
Okay.
29 Close Active Directory Administrative Center and Windows PowerShell task for implement administrative
security policies one on low and DC one from server manager click tools and then click.
Active Directory Administrative Center.
Two Inactive Directory Administrative Center in the navigation pane click a datum local.
Three in the tasks pane in the a datum local section click new and then click organizational unit for
again the create organizational unit dialog box in the name field type a datum servers and then click
okay fight inactive directory administrative center in the details pane double click computers, select
L1 SVR one and then press and hold the shift key and click L1 SVR two Both servers now are selected
six in the tasks pane in the two items selected section click move.
Seven in the movie dialog box, select a date and servers and then click okay.
Eight Close Active Directory Administrative Center, nine in server manager Click Tools and then Click
Group Policy Management.
Ten In the Group Policy Management Console under forests a datum icon backslash domains backslash a
date and icon locate and click to select a datum servers right click a datum servers and then click
create a GPO in this domain and link it here.
11 In the new GPO dialog box in the name field type restricted administrators on member servers and
then click okay 12 in the details pane right click the restricted administrators on Number Server's
GPO and then click edit 13 in the group policy management editor window expand computer configuration
backslash policies backslash window settings backslash security settings click to select restricted
groups, right click restricted groups and then click add group.
14.
In the ad group dialogue box, in the group field type administrators and then click okay 15 in the
Administrators Properties dialog box under members of this group, click add 16 in the Add Member Dialog
Box, Click Browse 17 in the Select Users Service Accounts or groups dialog box in the Enter the object
names to select text box type domain admins it click check names and then click okay.
18.
In the ad number dialog box in the members of this group section, add administrator to the string and
then click okay.
19 Verify that the Administrator Properties Dialog Box now shows the following in members of this group
and then click okay.
A date and backslash domain admins.
A date and backslash IT Administrator.
20 closed the group policy management ed window 21 on loan SVR one click start type cmd and then Click
Command Prompt 22 in the administrator command prompt window type the following command and then press
enter pop date slash force 23 Wait until the command updates the computer policy and the user policy
24 on low and SVR one click start and then click server manager 25 from Server Manager Click Tools and
then Click Computer Management 26 in Computer Management, Expand system tools, backslash local users
and groups and then click groups.
27.
Double click administrators and then verify that a datum backslash domain admits a datum backslash ID
and the local administrator are members of this group.
28.
Close all open windows except for server manager.
29.
Switch back to low and DC one and then switch to group policy management.
Throw in the group policy management console.
Expand domain controllers right.
Click the default domain controllers policy link and then click edit.
31 in the group policy management ed window expand computer configuration backslash policies backslash
window settings backslash security settings click to select restricted groups, right click restricted
groups and then click add group.
32.
In the ad group dialogue box, in the group field type server operators and then click okay.
33.
In the server operators properties dialog box, keep the default settings of this group should contain
no members and then click okay.
34.
Repeat the steps.
3233 for the account operators group.
35 closed the group Policy Management Ed window and the Group Policy Management Console Task five implement
administrative auditing one on ELO and DC one from server manager Click Tools and then click group policy
management.
Two In the Group Policy Management Console Expand Forest a datacom backslash domains a datacom backslash
group policy objects select the default domain controllers policy right click default domain controllers
policy and then click edit.
Three in the group policy management ed window expand computer configuration backslash policies backslash
windows settings backslash security settings backslash advanced added policy configuration backslash
added policies and then click to select RDS access.
Four in the details pane double click audit directory services changes five.
In the Audit Directory Services Changes Properties Dialog Box Select Configure the following audit events,
select the success checkbox and then click okay six in the navigation pane navigate to computer configuration
backslash policies backslash window settings backslash security settings backslash advanced audit policy
configuration backslash added policies and then click to select account management seven in the details
pane double click Audit Security Group Management eight In the Audit Security Group Management Properties
Dialog Box Select Configure the following audit events, select the success checkbox and then click
okay nine in the navigation pane navigate to computer configuration backslash policies backslash window
settings backslash security settings backslash local policies click to select security options and then
double click the Audit Force Audit Policy, Subcategory Settings, Windows Vista or later to override
Audit Policy Category Settings.
Ten in the audit force audit policy subcategory settings, Windows Vista or later to override audit
policy category settings dialog box select defined this policy settings ensure that enabled is selected
and then click okay 11 closed the group Policy Management Editor Window and the group policy management
console 12 on low and DC one from start screen type cmd and then Click Command Prompt 13 in the administrator
command prompt window type the following command and then press enter pop date slash force.
14.
From Server Manager Click Tools and then click.
Active Directory Users and Computers.
15 In Active Directory Users and computers from the view menu enable the advanced features.
View 16 in the navigation pane, click to select a daytime icon, right click a datum icon and then
click properties.
17.
In the Daytime Icon Properties dialog box on the security tab, click advanced 18 in the advanced security
settings for a daytime dialog box on the auditing tab, double click the success auditing entry for
everyone with special access which applies to this object only.
19 in the auditing entry for a datum dialog box in the applies to dropdown list box.
Select this object and all descendant objects.
20.
Click okay.
Three times to close all open dialogue boxes.
21.
Inactive directory users and computers in the navigation pane if necessary.
Expanded data imdb.com and then click to select users.
22.
In the details pane double click domain admins 23.
In the domain admins properties dialog box, click the members tab and then click Add 24.
In the Select Users Contacts, Computers, Service Accounts or groups dialog box in the enter the object
names to select textbox type A-B Click Check Names Select Abby Skinner and then click okay three times
25 Inactive Directory users in computers in the navigation pane click to select marketing 26.
In the details pane double click eight of Russell 27.
In the ADA Russell Properties dialog box on the address tab in the city text box, select London, type
Birmingham and then click okay 28 Close Active Directory users and Computers 29 in server manager Click
Tools and then Click Event Viewer.
30.
In event viewer expand Windows Logs and then click security.
31.
In the details pane search for the most recent event ID 4728 and then double click the event.
32.
In the event properties.
Event 4728.
Microsoft Windows Security Auditing Dialog Box.
You get the message.
A member was added to a security enabled global group.
You can see that a and backslash administrator invoked the change and that a datum backslash A-D was
added to the a datum backslash domain admins group.
33.
In event viewer in the Windows Logs Backslash Security Log Node search for the two most recent event
IDs 5136 then double click the older of the two events.
34.
In the event properties event 5136.
Microsoft Windows Security Auditing Dialog Box.
You will see the following message A directory service object was modified.
You can see that a date and backslash administrator has modified the user object C and equals eight
Russell and then deleted the London value on the right side of the dialog box.
Click the up arrow to move to the next event.
Note in the event properties details page.
Notice that a date and backslash administrator modified Ada Russell and added the Birmingham value.
35 closed all open windows except for server manager.