Lab Objective:
Learn how to work with Active Directory OUs at the Domain we just created.
Lab Purpose:
You will learn how to work with Active Directory at the Domain “lab.local” we just created before.
Lab Tool:
Windows Server 2012 R2 + Windows 10
Lab Topology:
Use two machines either on your home network or on the same virtual network in VMware.
Lab Walkthrough:
Task 1:
Understanding Active Directory:
Our Domain Controller is now an Active Directory server as you can see from the image below:
Active Directory is a Database where the system stores all the information about
- Built-in Accounts
- Users
- Groups
- Organizational Units
- Devices
and much more…!
To access to the Active Directory snap-in, click on ➜ Tools ➜ Active Directory Users and Computers:
The Active Directory snap-in opens and we can see the Active Directory database as shown below:
In the left pane, you can see the different folders that represent the structure of the Active Directory Users and Computers.
As the name itself says here, we store all the Users and Computers information.
If you go back to the Tools Menu, you can see that there are other Active Directory databases.
Each and every one of these Active Directory databases has a different meaning and use.
For now, we will concentrate our attention to the Active Directory Users and Computers
What is a Built-in Account?
In Microsoft Windows, Built-in user account is a type of user account that is created during installation.
For example, all computers running Windows 7 or Windows 10 have two built-in user accounts:
The Administrator account: Used to provide administrative access to all features of the operating system.
The Guest account: Intended to provide occasional users with access to network resources.
In Windows Servers, you’ll find more than 2 Built-in Accounts only, for obvious reasons:
The members of the Administrator’s Built-in account as in the example have complete and unrestricted access to the computer/domain.
You can assign these “Rights” to a user in your organization if you know what you do and then they would have full Rights over the whole Domain in your organization.
If you have a Printer Operator which has to have access only to the Printer Queue, then you could assign these Rights to this user and they would be allowed only to use the printer and nothing else.
These are just some examples.
Using the built-in accounts groups helps Domain Administrators to assign Rights to the users inside the organization without the need to create extra groups.
Sometimes, the Administrator needs to create a special group to have more control over the Rights assigned to the members (users) of this group.
Active Directory is a fantastic tool which helps organization to create their own organization structure by knowing who’s who and what they are allowed to do inside the organization.
Computers
The same concept goes for computers.
Not every computer has to be allowed to join to the Domain.
The Administrator can remove a client, delete or recreate it.
If you click on ➜ Computers you’ll see that at the moment not a single computer has joined into our Domain.
Under Domain Controllers, you can see that we can find our Domain Controller, the only one we have at the moment.
Note:
A company can have multiple Domain Controllers which are distributed world-wide and you would see all these Domain Controllers here in this window.
A Foreign Security Principal (FSP) is an object created by the system to represent a security principal in a trusted external forest.
The Users database keeps records of all the users of the Domain as shown below:
As you can see, the Administrator user account is present everywhere and there are some other user accounts like the Domain Users. Each user has to be at least a member of the Domain User group to be able to use the Domain.
Now imagine this scenario:
We have a company which has many different departments.
We want to distinguish each department.
For this reason, we need to create groups and organizational units for each department.
Inside these groups, we want to insert members and grant them different Rights.
The hierarchy at Active Directory to create this scenario is as follows:
OU – Organizational Units ➜ Group ➜ Users
We first create a new OU then inside this OU we create a Group and then inside this Group we insert New Users.
Task 2:
Create new Organizational Units
Right-click on ➜ lab.local ➜ New ➜ Organizational Unit.
Give the name of the new Organizational Unit as shown below and click ‘OK’.
Repeat these steps to create the other OU as shown below:
Task 3:
Create a new Group
Human Resources inside the USA OU.
Right-click on ➜ US ➜ New ➜ Group.
Type the name of the new group:
Human Resources ➜ click on ‘OK’.
The new Group has been created and you can find it under the USA OU now:
Proceed with the creation of the other groups by repeating the steps before:
Task 4:
Create the Users
Right-click on ➜ Users ➜ Select ➜ New ➜ Select ➜ User as shown below:
Fill in the user information as shown above ➜ click ‘Next’.
Set an initial password: Changeme! which will allow the new user to make his first login and to change their initial password.
Click on ➜ Finish.
The user has been created and you can find it under Users as shown above.
Right now, it is just a user which has no rights at all.
Task 5:
Now that we have created all the users accounts, we can proceed to Add these users to their Groups.
Right-click on ➜ Ray Charles ➜ Select ➜ Add to a group…
Type the name of the Group and then click on ➜ Check Names as shown above.
The group has been found and the user has been added. Click on ‘OK’.
You can check if the user is inside the USA OU ➜ Human Resources Group ➜ User as shown below.
When new users join the company, you will have to create the user account and then you can insert the new user into their department.
In this lab, you have learned how to work with Active Directory Users and Computers.
