You are a network administrator for Contoso Pharmaceuticals. A new assistant named Amy Rusko joins your network administration team. You assign Amy to the domain Server Operators group so she can help with server management tasks. Three days later, Amy tells you that she no longer has the right to shut down the server. Your man¬ager, Andy Ruth, thinks that he told another administrator to set up Amy's account as the new VP of Finance. Andy asks you to e-mail him a list of his group memberships as well as Amy's group memberships.

1. Log on using the Administrator name and password.

2. Insert the Supplemental CD-ROM and run the \70-294\Labs\Chapter08\Lab8.bat

batch file. This batch file creates several groups and makes Amy a member of those

groups. When the batch file runs, it will leave the commands it runs on-screen for

you to review. Press the spacebar when you are finished reviewing what happened.

3. Open a command prompt.

4. In the command prompt window, type net user amy > userstat.txt and press

Enter. This command creates the file userstat.txt and sends information, including

a list of group memberships of which Amy is a member to that file.

5. In the command prompt window, type net user andy » userstat.txt and press

Enter. This command appends Andy's user information to the userstat.txt file.

6. Type notepad c:\userstat.txt. Notepad displays Amy's user information. From

here you could attach the file to an e-mail and send it to Andy.

Exam Objectives in this Chapter:

Plan a security group hierarchy based upon delegation requirements

Plan a security group strategy

Why This Chapter Matters

As an administrator, you'll have to work with groups. Groups reduce administrative effort by allowing you to assign permissions and rights to a group of users rather than having to assign permissions to each individual user account. As a Microsoft Windows Server 2003 domain administrator, you must understand the different types of groups and which ones you can use with each domain functional level. You must certainly understand how to create and delete groups, add members to groups, and change the group scope, as these tasks are commonly performed by network administrators. You should also understand why logging on to Windows Server 2003 using an administrator account makes your system more vulnerable to Trojan horse attacks and other security risks. To address this problem, you will learn about the Run As program, which allows you to run specific tools and programs with permissions other than those provided by the account with which you are currently logged on to perform routine tasks without exposing your computer to unnecessary risk.

Lessons in this Chapter:

Lesson 1: Understanding Groups

Lesson 2: Creating and Administering Groups

Lesson 3: Administration Strategies

Before You Begin

To complete the lessons in this chapter, you must

Prepare your test environment according to the descriptions given in the "Getting

Started" section of "About This Book"

Complete the practices for installing and configuring Active Directory as discussed

in Chapter 2, "Installing and Configuring Active Directory"

Learn to use Active Directory administration tools as discussed in Chapter 3,

"Administering Active Directory"

Complete the practices for configuring sites and replication as discussed in Chapter 5, "Configuring Sites and Managing Replication"

Complete the practices for implementing an organizational unit (OU) structure as discussed in Chapter 6, "Implementing an OU Structure"

Complete the practices for creating and maintaining user accounts as discussed in Chapter 7, "Administering User Accounts"

Before you can create groups, you must understand the purpose of groups and how they are used to simplify administration tasks. This lesson introduces you to the group types and scopes you can create in Windows Server 2003 and the rules for group membership. You also learn about the various categories of default groups. At the end of the lesson, you learn how to plan a group strategy.

After this lesson, you will be able to

Explain the purpose of groups

Explain the purpose of security and distribution group types

Explain the characteristics of domain local, global, and universal group scopes

Explain the purpose of local groups

Describe the types of default groups

Plan a group strategy

The primary reason for defining an OU is to delegate administration. Delegating

administration is the assignment of IT management responsibility for a portion of

the namespace, such as an OU, to an administrator, a user, or a group of administrators or users.

You should design OUs for simplicity. It is likely that your domains will require a

number of OUs to meet administrative requirements. The best practice is to begin

with one OU and then add only those OUs that you can justify. Define OUs with

administration, not users, in mind.

By linking GPOs to OUs, GPOs can be applied to either users or computers in the

OU. Because there is only one way to delegate administration and there are multiple ways to aclininister Group Policy, you must define OU structures to delegate

administration first. After an OU structure is defined to handle delegation of

administration, you can define additional OUs to administer Group Policy.

You cannot assign access permissions based on a user's membership in an OU.

OUs are not security principals. Access control is the responsibility of global,

domain local, or universal groups.

You move objects within an OU hierarchy by using drag and drop, the Move

option on the Active Directory Users And Computers console, or the Dsmove command.