Module 9: Securing Administration
Lab A: Delegate Administration
Lab Setup
For this lab, you will use the available virtual machine environment. Before you begin the lab, you must complete the following steps:
1. On the host computer, click Start, point to Administrative Tools, and then click Hyper-V Manager.
2. In Hyper-V™ Manager, click 6425C-NYC-DC1, and in the Actions pane, click Start.
3. In the Actions pane, click Connect. Wait until the virtual machine starts.
4. Log on by using the following credentials:
• User name: Pat.Coleman
• Password: Pa$$w0rd
• Domain: Contoso
5. Open Windows Explorer and then browse to D:\Labfiles\Lab09a.
6. Run Lab09a_Setup.bat with administrative credentials. Use the account Pat.Coleman_Admin with the password Pa$$w0rd.
7. The lab setup script runs. When it is complete, press any key to continue.
8. Close the Windows Explorer window, Lab09a.
9. Repeat steps 2–4 for 6425C-NYC-DC2.
Exercise 1: Delegate Permission to Create and Support User Accounts
Task 1: Create security groups for role-based management.
1. On NYC-DC2, click Start, point to Administrative Tools, and run Active Directory Users and Computers with administrative credentials. Use the account Pat.Coleman_Admin with the password Pa$$w0rd.
2. In the console tree, expand the contoso.com domain and the Groups OU, and then click the Role OU.
3. Right-click the Role OU, then point to New, and then click Group.
4. In Group name, type Help Desk.
5. Confirm that Group scope is global and Group type is Security.
6. Click OK.
7. Repeat steps 3 through 6 to create a global security group named User Account Admins.
8. Right-click Help Desk and then click Properties.
9. Click the Members tab.
10. Click the Add button.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
L9-2 Lab A: Delegate Administration
11. Type Aaron.Painter_Admin; Elly.Nkya_Admin; Julian.Price_Admin; Holly.Dickson_Admin, and then press Enter.
12. Click OK to close the group Properties dialog box.
13. Right-click User Account Admins, and then click Properties.
14. Click the Members tab.
15. Click the Add button.
16. Type Pat.Coleman_Admin; April.Meyer_Admin; Max.Stevens_Admin, and then press Enter.
17. Click OK to close the group Properties dialog box.
Task 2: Delegate control of user support with the Delegation of Control Wizard.
1. In the console tree, right-click the User Accounts OU, and then click Delegate Control.
The Welcome to the Delegation of Control Wizard appears.
2. Click Next.
3. On the Users or Groups page, click the Add button.
The Select Users, Computers, or Groups dialog box appears.
4. Type Help Desk, and then press Enter.
5. Click Next.
6. On the Tasks to Delegate page, select the Reset user passwords and force password change at next logon check box.
7. Click Next.
8. On the Completing the Delegation of Control Wizard page, click Finish.
Task 3: Delegate permission to create and delete users with the Access Control List Editor interface.
1. Click the View menu, and then click Advanced Features so that the Advanced Features option is enabled.
2. In the console tree, right-click the User Accounts OU, and then click Properties.
The User Accounts Properties dialog box appears.
3. Click the Security tab.
4. Click the Advanced button.
The Advanced Security Settings for User Accounts dialog box appears.
5. Click the Add button.
The Select User, Computer, Service Account, or Group dialog box appears.
6. Type User Account Admins and press Enter.
The Permission Entry for User Accounts dialog box appears.
7. In the Apply to list, select This object and all descendant objects.
8. In the Permissions list, select the Allow check box next to Create User objects.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
Lab A: Delegate Administration L9-3
9. In the Permissions list, select the Allow check box next to Delete User objects.
10. Click OK.
11. Click the Add button.
The Select User, Computer, Service Account, or Group dialog box appears.
12. Type User Account Admins and press Enter.
The Permission Entry for User Accounts dialog box appears.
13. In the Apply to list, select Descendant User objects.
14. In the Permissions list, select the Allow check box next to Full control.
15. Click OK.
16. Click OK to close each remaining open dialog box.
Task 4: Validate the implementation of delegation.
1. Close Active Directory Users and Computers.
2. Run Active Directory Users and Computers with administrative credentials. Use the account Aaron.Painter_Admin with the password Pa$$w0rd.
3. In the console tree, expand the contoso.com domain and the User Accounts OU, and then click the Employees OU.
4. In the details pane, right-click Jeff Ford, and then click Reset Password.
The Reset Password dialog box appears.
5. In the New password box, type Pa$$w0rd.
6. In the Confirm password box, type Pa$$w0rd.
7. Notice that the User must change password at next logon check box is disabled.
8. Click OK.
A message appears: “The password for Jeff Ford has been changed.”
9. Click OK.
10. Right-click Jeff Ford, and then click Disable Account. A message appears: “Windows cannot disable object Jeff Ford because: insufficient access rights to perform the operation.”
11. Click OK.
12. In the console tree, expand the contoso.com domain and the Admins OU, and then click the Admin Identities OU.
13. In the details pane, right-click Pat Coleman (Administrator), and then click Reset Password.
The Reset Password dialog box appears.
14. In the New password box, type Pa$$w0rd.
15. In the Confirm password box, type Pa$$w0rd.
16. Notice that the User must change password at next logon check box is disabled.
17. Click OK.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
L9-4 Lab A: Delegate Administration
A message appears: “Windows cannot complete the password change for Pat Coleman (Administrator) because: Access is denied.”
18. Close Active Directory Users and Computers.
19. Run Active Directory Users and Computers with administrative credentials. Use the account April.Meyer_Admin with the password Pa$$w0rd.
20. In the console tree, expand the contoso.com domain and the User Accounts OU, and then click Employees.
21. Right-click Employees, point to New, and then click User. The New Object - User dialog box appears.
22. In the First name box, type your first name.
23. In the Last name box, type your last name.
24. In the User logon name box, type a user name for yourself following the naming standard FirstName.LastName.
25. Click Next.
Note that user logon names can be only 20 characters.
If you receive a message that indicates that another user account already exists with the same name, change your user logon name so that it is unique by adding _6425 to the end.
26. In the Password box, type Pa$$w0rd.
27. In the Confirm password box, type Pa$$w0rd.
28. Click Next.
29. Click Finish.
30. Close Active Directory Users and Computers.
Results: In this exercise, you delegated to the help desk the permission to unlock user accounts, reset passwords, and force users to change passwords at next logon through the help desk's membership in the Help Desk group. You have also delegated full control of user objects to User Account Admins group.
And, you tested both delegations to validate their functionality.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
Lab A: Delegate Administration L9-5
Exercise 2: View Delegated Permissions
Task 1: View permissions in the Access Control List Editor interfaces.
1. On NYC-DC2, run Active Directory Users and Computers with administrative credentials. Use the account Pat.Coleman_Admin with the password Pa$$w0rd.
2. In the console tree, expand the contoso.com domain, and then click the User Accounts OU.
3. Right-click the User Accounts OU, and then click Properties.
The User Accounts Properties dialog box appears.
4. Click the Security tab.
If you do not see the Security tab, close the dialog box. Click the View menu of the MMC console, and ensure that Advanced Features is selected. Then, open the properties of the object again.
5. Click the Advanced button.
The Advanced Security Settings for User Accounts dialog box appears.
6. Click the Name column heading so that the Name column is sorted alphabetically.
Question: How many permission entries were created for the Help Desk group by the Delegation of Control Wizard? Is it easy to tell which permissions were assigned in the Permission Entries list? List the permissions assigned to Help Desk.
Answer: Two permission entries appear in the list. It is not easy to tell exactly which
permissions were assigned in the list: one entry reports "Special" and the other entry reports nothing in the Permission column. Clicking Edit for the “Special” permission shows that it is Reset Password. Clicking Edit for the other permission shows that it is Read pwdLastSet and Write pwdLastSet.
7. Click Cancel to close all open dialog boxes.
Task 2: Report permissions by using DSACLs.
1. Click Start, click All Programs, click Accessories, and then click Command Prompt.
2. Type the command dsacls "ou=User Accounts,dc=contoso,dc=com" and then press Enter.
Question: Which permissions are reported for Help Desk by the DSACLs command?
Answer: DSACLs reports the following permissions for Hep Desk:
SPECIAL ACCESS for pwdLastSet: WRITE PROPERTY and READ PROPERTY Reset Password
Task 3: Evaluate effective permissions.
1. In the Active Directory Users and Computers console tree, expand the contoso.com domain and the User Accounts OU.
2. Right-click the User Accounts OU, and then click Properties.
The User Accounts Properties dialog box appears.
3. Click the Security tab.
4. Click the Advanced button.
The Advanced Security Settings for User Accounts dialog box appears.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
L9-6 Lab A: Delegate Administration
5. Click the Effective Permissions tab.
6. Click the Select button.
The Select Users, Computer, Service Account, or Group dialog box appears.
7. Type April.Meyer_Admin, and then press Enter.
8. Locate the permissions Create User objects and Delete User objects, approximately halfway down the Effective permissions list.
Question: Do you see the Reset Password permission in this list?
Answer: No. A Lab Review question at the end of this lab will address why the permission does not appear.
9. Click Cancel to close all open dialog boxes.
10. In the console tree, expand the contoso.com domain and the User Accounts OU, and then click the Employees OU.
11. In the details pane, right-click Aaron Lee, and then click Properties.
The Aaron Lee Properties dialog box appears.
12. Click the Security tab.
13. Click the Advanced button.
The Advanced Security Settings for Aaron Lee dialog box appears.
14. Click the Effective Permissions tab.
15. Click the Select button.
The Select User, Computer, Service Account, or Group dialog box appears.
16. Type Aaron.Painter_Admin, and then press Enter.
17. Locate the Reset Password permission in the Effective Permissions list.
18. Click Cancel to close all open dialog boxes.
Results: In this exercise, you confirmed that the permissions you assigned in the previous exercise were applied successfully.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
Lab A: Delegate Administration L9-7
Exercise 3: Remove and Reset Permissions
Task 1: Remove permissions assigned to Help Desk.
1. In the console tree, under contoso.com domain, click the User Accounts OU.
2. Right-click the User Accounts OU, and then click Properties.
The User Accounts Properties dialog box appears.
3. Click the Security tab.
4. Click the Advanced button.
The Advanced Security Settings for User Accounts dialog box appears.
5. Click the Name column heading so that the Name column is sorted alphabetically.
6. Select the first permission assigned to Help Desk, and then click Remove.
7. Select the remaining permission assigned to Help Desk, and then click Remove.
8. Click OK to close the remaining open dialog boxes.
Task 2: Reset the User Accounts OU to its default permissions.
1. In the console tree, under contoso.com domain, click the User Accounts OU.
2. Right-click the User Accounts OU, and then click Properties.
The User Accounts Properties dialog box appears.
3. Click the Security tab.
4. Click the Advanced button.
The Advanced Security Settings for User Accounts dialog box appears.
5. Click Restore defaults, and then click Apply.
6. Click OK twice and then close Active Directory Users and Computers console.
Note Do not shut down the virtual machine after you finish this lab because the settings you have configured here will be used in the subsequent lab.
Question: What do you achieve by clicking Restore defaults? Which permissions remain?
Answer: All custom, explicit permissions are removed. What remain are the default permissions explicitly assigned to any new OU object, as defined by the Active Directory Schema. In addition, permissions inherited from parent objects apply.
Results: In this exercise, you have reset the permissions on the User Accounts OU to its schema-defined defaults.
M C T U SE O N LY . S TU D EN T U SE P R O H IB IT ED
L9-8 Lab A: Delegate Administration