Whats new in active directory window 2008 R2 server

2,306 views

Published on

Published in: Education
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
2,306
On SlideShare
0
From Embeds
0
Number of Embeds
5
Actions
Shares
0
Downloads
26
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Whats new in active directory window 2008 R2 server

  1. 1. Windows Server 2008 R2:Whats New in Active Directory
  2. 2. Windows Server 2008 R2: What’s New in Active DirectoryTable of ContentsWindows Server 2008 R2: Whats New in Active Directory ..................................................... 1Exercise 1 Using the Active Directory Administration Center .......................................................................................2Exercise 2 Working with Active Directory using the Active Directory PowerShell Module ...........................................5Exercise 3 Recovering Deleted Objects using Active Directory Recycle Bin ..................................................................8Exercise 4 Pre-Deploying Computer Accounts using Offline Domain Join ..................................................................11
  3. 3. Windows Server 2008 R2: What’s New in Active DirectoryWindows Server 2008 R2: Whats New inActive Directory After completing this lab, you will be better able to:Objectives  Use the Active Directory Administration Center to perform administrative tasks  Locate and manage objects using the Active Directory PowerShell provider  Recover deleted Active Directory objects using the Active Directory Recycle Bin  Perform an offline domain join for a not yet deployed computer Woodgrove Bank is an investment bank located in Baltimore, USA. WoodgroveScenario Bank has a main office and many regional and local branch offices. Many of the branch offices are small offices and do not have local IT support, and are connected to the main office by low-bandwidth WAN connections. In addition, many users at Woodgrove Bank travel between offices, as well as to customers’ offices and homes for meetings regarding client accounts. Woodgrove Bank is faced with the following global challenges:  Management of many servers in many offices.  The need to reduce the operational cost of each branch office.  The need for roaming and remote users to access company resources.  Management of a large and complex Active Directory infrastructure. Before working on this lab, you must have:Prerequisites  The ability to work in a command line environment  An understanding of Active Directory administration tasks  An understanding of Windows PowerShell concepts and tasksEstimated Time to 60 MinutesComplete This LabComputers used in thisLab BAL-DC-01 The password for the Administrator account on all computers in this lab is: Passw0rd! Page 1 of 12
  4. 4. Windows Server 2008 R2: What’s New in Active DirectoryExercise 1Using the Active Directory Administration CenterScenarioIn this exercise you will use the new Active Directory Administration Center to perform some common ActiveDirectory management tasks. By performing these tasks, you will learn how basic administration and navigation oflarge Active Directory structures is made easier using the new tools.Tasks Detailed StepsComplete the following Note: In this task you will use the new Active Directory Administrative Center totask on: perform some common administrative tasks. The purpose of this exercise is to become familiar with the navigation and use of the new interface. a. On the Start menu, point to Administrative Tools and then click Active Directory BAL-DC-01 Administrative Center.1. Explore the b. In Active Directory Administrative Center, in the Reset Password tile, in User Administrative name, type WoodgrovebankBobSmith and then press TAB. Center Interface Note: The user name is checked and a warning is displayed that the username is invalid. c. In Active Directory Administrative Center, in the Reset Password tile, in User name, type WoodgrovebankDonHall and then press TAB. Note: Notice that the user account was validated by the tool. d. In Password and in Confirm Password type Passw0rd!2 and then click Apply. Note: The reset password tile is one of many tiles that can be added to the Overview page. Each tile allows common tasks to be completed quickly and without navigation to the actual object. e. In the upper right of the Administrative Center Overview pane, click Add Content. Note: The Add Content menu allows you to add additional task-based tiles to the Overview page. You can add the tiles that allow you to complete your most common tasks. f. In the Active Directory pane, click the fly-out menu next to Woodgrovebank (local). The fly-out menu is shown below. g. Using the fly-out menu, navigate to AmericaWashingtonKing and double-click Redmond. Note: You can use the Find in this column text box to type the first few letters of the item you are looking for to speed navigation. h. Under Redmond, click Abigail Heiford and then in the Tasks pane, click Enable.2. Creating and Note: In this task you will use the Active Directory Administrative Center to create and Page 2 of 12
  5. 5. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps Modifying User and modify both user and group accounts. Group Accounts In Active Directory Administrative Center, ensure you are in the AmericaWashingtonKingRedmond organizational unit. a. In the Tasks pane, click New and then click User. b. In the Create User dialog box, create a new user account with the properties defined in the following table and then click OK. Note: If a property is not listed in the table, you may omit it in the dialog box. Property Value First Name Alice Last Name Ciccu User UPN logon AliceCiccu Password Options Select Other password options and then check Password never expires. Password and Confirm Password Passw0rd! Note: Note the large number of user properties you can modify in the create user dialog box. c. In the Tasks pane, click New and then click Group. d. In the Create Group dialog box, create a new group account with the properties defined in the following table and then click OK. Note: If a property is not listed in the table, you may omit it in the dialog box. Property Value Name RedmondSupport Protect from Accidental Deletion Checked Managed By Anna Keyes Click Edit to modify the managed by value. Use the Advanced button to search for her. Members Alice Ciccu Click Add to modify group membership. e. In the Contents pane, click Alice Ciccu and then in the Tasks pane, under Alice Ciccu, click Properties. Note: You may need to refresh your view by pressing F5 if do you not see Alice Ciccu. f. In the Alice Ciccu dialog box, next to Organization, click the Collapse button. g. Next to Profile, click the Close button. Note: The properties dialog box allows you to customize the available administration panes. You can add closed sections by clicking the Add Sections menu and checking the sections you want to add back in. h. Under Extensions, on the Dial-in tab, click Allow access. Note: Many properties are accessible through the new property panels; however any additional extensions are available via the extensions panel. This ensures that any Page 3 of 12
  6. 6. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps third party add-ins for Active Directory Users and Computers still function without modification. i. Click OK to close the Alice Ciccu dialog box. j. Close the Active Directory Administrative Center. Page 4 of 12
  7. 7. Windows Server 2008 R2: What’s New in Active DirectoryExercise 2Working with Active Directory using the Active DirectoryPowerShell ModuleScenarioIn this exercise you will use the Windows PowerShell Integrated Scripting Environment (ISE) to administer ActiveDirectory. As a reference, the major components of the ISE are labeled below.Tasks Detailed StepsComplete the following Note: This exercise makes extensive use of Windows PowerShell. To assist you, youtask on: can use the up arrow key to recall previous commands and use tab completion to help quickly type commands. In this task you will use the PowerShell V2 Graphical Console to perform basic user BAL-DC-01 and group administrative tasks. You will begin by loading the Active Directory1. Using the Windows module, exposing over 75 Active Directory Cmdlets. You will then use these Cmdlets to PowerShell Graphical administer Active Directory. Console to Work with a. On the Start menu, navigate to All ProgramsAccessoriesWindows PowerShell User and Group and then click Windows PowerShell ISE. Accounts b. To load the Active Directory module and list the available Cmdlets, in the Command Pane, type the following commands, pressing ENTER after each command: Import-Module ActiveDirectory Get-Module Get-Command *ad* c. To browse your Active Directory domain using Windows PowerShell, in the Command Pane, type the following commands, pressing ENTER after each Page 5 of 12
  8. 8. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps command: Note: You can press the TAB key to auto complete many of these commands and save a great deal of typing. Cd AD: PWD DIR | Format-Table -Auto CD "DC=Woodgrovebank,DC=com" DIR | ft –a Note: This series of commands shows you how you can navigate Active Directory like a file system and format output using standard Windows PowerShell commands. d. To list the content of the users container and then enable the Guest account, in the Command Pane, type the following commands, pressing ENTER after each command: Note: If you see a repeated command, such as the third command in this series, you can use the up arrow to retrieve the previous instance of the command instead of retyping it. CD CN=Users Dir | ft –a Get-ADObject –Filter {name -like “*”} Get-ADUser –Filter {name -like “*”} Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto Enable-ADAccount –Identity Guest Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto e. To display information about the user Don Hall in the Managed Objects OU, in the Command Pane, type the following commands, pressing ENTER after each one. CD .. cd ‘OU=Managed Objects Get-ADuser -Filter {Name -eq "Don Hall"} Get-ADuser -Filter {Name -eq "Don Hall"} –Properties * f. To query information on the Domain Administrators group, in the Command Pane, type the following command and then press ENTER: Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree - Filter {Name -Like "*Domain Admins*"} -Properties * g. To add Don Hall to the Domain Administrators group, in the Command Pane, type the following command and then press ENTER: Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree - Filter {Name -Like "*Domain Admins*"}| Add-ADGroupMember -Member DonHall2. Using the Windows Note: In this task you will use Cmdlets that relate to the domain and to domain PowerShell Graphical controllers to display information about items such as password policies and FSMO Console to Work with roles. Domains and Domain a. To query information on the Woodgrovebank.com domain, in the Command Controllers Pane, type the following command and then press ENTER: Get-ADDomain Woodgrovebank.com Note: The output of this command allows you to easily determine things such as FSMO roles. b. To query information on the domain controllers in the Woodgrovebank.com domain, in the Command Pane, type the following command and then press ENTER: Get-ADDomainController –Discover Page 6 of 12
  9. 9. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps c. To query information on the domain password policy in the Woodgrovebank.com domain, in the Command Pane, type the following command and then press ENTER: Get-ADDefaultDomainPasswordPolicy Woodgrovebank.com3. Using Windows Note: In this task you will use Cmdlets that relate to organizational units to create PowerShell Graphical and delete an organizational unit. You will also use a Set Cmdlet to set properties on Console to Create an organizational unit. and Delete a. To create a new organizational unit and display its properties, in the Command Organizational Units Pane, type the following commands, pressing ENTER after each one: New-ADOrganizationalUnit –Name “Europe” –Path “DC=Woodgrovebank,DC=com” Get-ADOrganizationalUnit “OU=Europe,DC=Woodgrovebank,DC=com” –Properties * b. To delete the new organizational unit, in the Command Pane, type the following commands, pressing ENTER after each one and clicking Yes to confirm deletion. Note: Note that the first command will result in an expected failure due to insufficient permissions, which the second command will resolve. Remove-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com” Set-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com” –ProtectedFromAccidentalDeletion $False Remove-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com” Note: The ProtectedFromAccidentalDeletion property is used to add or remove an access control list to the OU which explicitly denies the delete permission for all users. This property is true by default for all container objects. c. Close Windows PowerShell ISE. Page 7 of 12
  10. 10. Windows Server 2008 R2: What’s New in Active DirectoryExercise 3Recovering Deleted Objects using Active DirectoryRecycle BinScenarioIn this exercise you will explore the new Active Directory Recycle Bin feature. The Active Directory Recycle Binstores all deleted objects in a special container which allows easy recovery at a later time, preserving all objectproperties.Tasks Detailed StepsComplete the following Note: In this task you will enable the Active Directory Recycle Bin feature. Windowstask on: Server 2008 R2 does not automatically enable features as forest and domain functional levels are increased. Each feature must now be explicitly enabled. Features are enabled using the Enable-ADOptionalFeature PowerShell Cmdlet. BAL-DC-01 a. On the Start menu, point to Administrative Tools and then click Active Directory1. Enable the Active Module for Windows PowerShell. Directory Recycle Bin b. To check the state of the Recycle Bin Feature, in Windows PowerShell, type the Feature following command and then press ENTER: Get-ADOptionalFeature –Filter {Name –Like “*”} Note: The EnabledScopes property is currently empty, which indicates that this feature is not enabled. The RequiredForestMode property indicates the prerequisites for enabling this feature. c. To enable the Recycle Bin feature, in Windows PowerShell, type the following command and then press ENTER: Enable-ADOptionalFeature -Identity CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=woodgrovebank,DC=com -Scope ForestOrConfigurationSet -Target woodgrovebank.com Note: This command will enable the Recycle Bin feature, which is disabled by default. d. To confirm the command, type Y and press ENTER. Note: You must confirm this action, as once enabled, you cannot disable the Recycle Bin. e. To verify the Recycle Bin feature has been enabled, in Windows PowerShell, type the following command and then press ENTER: Get-ADOptionalFeature –Filter {Name –Like “*”} Note: You can review the value of EnabledScopes to ensure that the Recycle Bin is enabled.2. Move Objects to the Note: In this task you will move objects to the Recycle Bin by deleting them. All Recycle Bin deleted objects are automatically moved to the Recycle Bin once the feature is enabled. a. On the Start Menu, point to Administrative Tools and then click Active Directory Administrative Center. b. Navigate to the AmericaWashingtonKingRedmond organizational unit. Page 8 of 12
  11. 11. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps c. Delete the user account Alice Ciccu. d. Delete the group account RedmondSupport. Note: You can use the search feature at the top of the window to find the group. You will also need to uncheck Protect from accidental deletion from within the group properties. e. Delete the Redmond organizational unit. f. In the Confirm Subtree Deletion dialog box, check Use delete subtree server control and then click Yes.3. Verify Objects are Note: In this task you will use Windows PowerShell to query the contents of the Active Now in the Recycle Directory Recycle Bin. Objects that have been deleted are moved to this location and Bin have their distinguished name adjusted to reflect the fact that they are a deleted object, and also to avoid conflicts when multiple objects of the same common name are deleted. a. On the Start menu, point to Administrative Tools and then click Active Directory Module for Windows PowerShell. b. To display the contents of the Recycle Bin, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject –SearchBase “CN=Deleted Objects,DC=Woodgrovebank,DC=Com” – ldapFilter “(objectClass=*)” -includeDeletedObjects Note: This command displays the entire contents of the Recycle Bin. Leave the output of this command on the screen as you will use it in the next task. c. To verify the Alice Ciccu user object is in the Recycle Bin, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject –Filter {Name –Like “*Alice Ciccu*”} –SearchScope Subtree – includeDeletedObjects | Format-List Note: The output of this command will show the details for the Alice Ciccu user object. Note the distinguished name indicates this object is in the AD Recycle Bin. d. In Windows PowerShell, type the following command and then press ENTER: Get-ADObject –Filter {Name –Like “*Redmond*”} –SearchScope Subtree –IncludeDeletedObjects | Format-List Note: The output of this command will show the details for the RedmondSupport user group as well as the Redmond OU. Note the distinguished name indicates this object is in the AD Recycle Bin.4. Recover Deleted Note: In this task you will use the Recover-ADObject PowerShell Cmdlet to recover Objects objects that have been deleted from Active Directory. Ensure Active Directory Module for Windows PowerShell is open. a. In Windows PowerShell, copy the objectGUID value for the object Alice Ciccu to the clipboard. Note: To copy text from a command prompt, right click and then select Mark. Highlight the text to copy and then press ENTER. To paste, right click and then click Paste. b. To attempt to restore the Alice Ciccu user account, in Windows PowerShell, type the following command and then press ENTER: Note: To complete the following command, copy the value of the objectGUID property from the Alice Ciccu object. Restore-ADObject –Identity <objectGUID> Page 9 of 12
  12. 12. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps Note: The command fails with an error message indicating that the object’s parent object does not exist. You can then query for the last known parent of the object and restore that object. c. To identify the last known parent of Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER: Note: To save typing, use the up arrow key to locate the previous search command and append the additional parameters to it. Get-ADObject –Filter ‘Name –Like “*Alice Ciccu*”’ –SearchScope Subtree – includeDeletedObjects –properties lastKnownParent | Format-List Note: This command displays the last known parent object, which, you can tell, is also in the Recycle Bin. d. To restore the OU which contains Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER: Note: To complete the following command, copy the value of the objectGUID property from the Redmond object which can be found from the output of the last command in Step 3 in the Verify Objects are Now in the Recycle Bin exercise. Restore-ADObject –Identity <objectGUID> e. To restore the Redmond OU Objects, including Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject –ldapFilter “(lastKnownParent=OU=Redmond,OU=King,OU=Washington,OU=America,DC=Woodgr ovebank,DC=com)” –includeDeletedObjects | Restore-ADObject Note: This command lists all objects that have the last known parent attribute as the Redmond OU and pipes them into the Restore-ADObject Cmdlet.5. Verify that Deleted Note: In this task you will review Active Directory to ensure that the deleted objects Objects have been have been recovered. Recovered a. If not open, on the Start Menu, point to Administrative Tools and then click Active Directory Administrative Center. Note: Ensure you refresh your view in Active Directory Administrative Center after you make changes to ensure you see those changes. b. Navigate to the AmericaWashingtonKing OU. c. Verify that the Redmond OU is present. d. Navigate to the Redmond OU. e. Verify that the user accounts, including Alice Ciccu, are present. f. Verify the group RedmondSupport is present. Page 10 of 12
  13. 13. Windows Server 2008 R2: What’s New in Active DirectoryExercise 4Pre-Deploying Computer Accounts using Offline DomainJoinScenarioIn this exercise you will complete the tasks required to provision an account for offline domain join. Offline domainjoin involves two steps. In the first step you will provision a computer account in Active Directory and save theaccount information in a file. In the second step you will use that file in a command that inserts the domain joininformation into an offline version of Windows.Tasks Detailed StepsComplete the following Note: In this task you will use the DJoin command to provision a computer account intask on: Active Directory for offline domain join. The result of this task is a file that can be merged into an offline copy of Windows, ensuring that the first time the computer starts it is domain joined. BAL-DC-01 a. On the Start menu, click Command Prompt.1. Provision a Computer b. To provision a new computer account, in the Command Prompt, type the Account for Offline following command and then press ENTER: Domain Join DJOIN /Provision /Domain Woodgrovebank.com /Machine BAL-SRV-10 /SaveFile BAL- SRV-10.DJoin Note: This command creates a computer account in Active Directory and stores the computer account password and related information in an encrypted file. The encrypted file can then be used to offline domain join a computer. c. To display the contents of the provisioning file, in the Command Prompt, type the following command and then press ENTER: Type BAL-SRV-10.DJoin Note: The contents of the .DJoin file are encrypted.2. Verify the Computer Note: In this task you will look at Active Directory to verify that the offline domain join Account has been has correctly created the computer account for BAL-SVR-10. Created in Active a. On the Start menu, point to Administrative Tools and then click Active Directory Directory Administrative Center. b. Navigate to Woodgrovebank (local)Computers. Note: Note that the computer account BAL-SRV-10 has been created.3. Review the Process Note: In this task you will type the command used to perform an offline domain join to Perform an Offline operation. This command will use the contents of the saved file created in the Domain Join previous task to insert domain join information into the computer’s registry without having to start the operating system. This command can be run on an offline copy of Windows such as a WIM file or VHD which has been mounted. Begin this task with a command prompt window open. a. To perform an offline domain join, use the following command: Page 11 of 12
  14. 14. Windows Server 2008 R2: What’s New in Active DirectoryTasks Detailed Steps Note: Do not execute this command. It is provided for reference purposes only. DJOIN /Requestodj /LoadFile BAL-SVR-10.DJoin /WindowsPath MountWindows Note: This command is used to perform the offline domain join. This command is intended to be run against an offline copy of Windows such as a WIM file or VHD that has been mounted as a drive or folder in the file system. Windows Server 2008 R2 with SP1 – Free Trial Download Certification: Windows Server 2008 R2, Server Virtualization Page 12 of 12

×