Administer Active Directory Domain Services

0:00Active Directory Domain Services is the foundation

0:03of every Windows-based network.

0:05It provides us with the tools and technologies

0:07used to identify, authenticate, and manage

0:10network based resources.

0:11Let's take a closer look at what we're going

0:13to be covering in this skill.

0:15[MUSIC PLAYING]

0:22I like to think of Active Directory as one big database.

0:25It's a database that stores network objects such as users

0:29and computers.

0:30These are objects that require identity, and also will

0:33require authentication when accessing

0:36other network-based resources, such as printers, and files.

0:40Now do note that there are no new features for Active

0:43Directory in server 2019.

0:45We know that because we didn't receive a new domain or forest

0:49functional level, which dictates the feature set

0:52that Active Directory will use.

0:54Our max level, even in server 2019, server 2016.

0:57So that's a telltale sign that we have no features.

1:00So this skill is more on the essential side

1:03here of our server 2019 essentials course.

1:05So here's what we're going to be covering in this skill.

1:08We're going to start within Active Directory Domain

1:10Services overview, to get familiar with its purpose

1:12and also all the major components.

1:15Forest, domain, sites, domain controllers,

1:17and global catalogs.

1:19From there, we'll look at how to install and configure

1:21domain controllers.

1:23We'll look at how to install a second domain

1:25controller into an existing domain,

1:27and we'll look at how to configure a domain controller

1:29as a global catalog server.

1:31From there, we'll look at the many ways and tools used

1:34to create users and groups, the two primary objects in Active

1:37Directory Domain Services.

1:39From there, we will look at organizational units,

1:42or OUs for short.

1:43We'll define the purpose for them.

1:45We'll look at how to design a proper OU hierarchy.

1:47And then, we'll look at how to create and utilize them.

1:50We'll also take a good look at designing groups, and assigning

1:53permissions to them.

1:55We'll cover all of our group scopes,

1:56and implement some best practices for doing so.

1:59We'll wrap this skill up by looking at some common Active

2:02Directory Management tasks.

2:04Again, some more best practices to make your day

2:06to day life easier managing Active Directory Domain

2:09Services.

2:10Our virtual lab environment for this skill

2:12consists of four machines.

2:14We have ADMIN-NUG, our client machine and management box.

2:17We have DC-NUG, which is already a domain controller hosting

2:20the NuggetLab.Com domain.

2:22We have DC2-NUG, which right now is just a regular old server

2:26core machine.

2:26So we're going to take a look at how

2:28to add a second domain controller

2:30into our environment.

2:31That will also give us the opportunity

2:32to perform management tasks between them.

2:34And we also have a file server, with all kinds

2:37of data on it we'll be using to work with permissions.

2:40So that's our virtual lab environment,

2:42and our plan for learning all about Active Directory Domain

2:45Services.

2:46It's a critical skill for system administrators.

2:50Let's get learning all about it.

2:51I hope this has been informative for you,

2:53and I'd like to thank you for viewing.

0:00What is Active Directory Domain Services?

0:03And what are the components that make it what it is?

0:05Those are the questions will be answering in this Nugget.

0:08[MUSIC PLAYING]

0:15Fun fact, did you know that Active Directory Domain

0:17Services was initially released back in Windows Server 2000?

0:21Making it over 20 years old.

0:23And another fun fact, over 90% of Fortune 1,000 companies

0:27implement Active Directory Domain Services.

0:29The whole point of it is to provide our organizations

0:32with centralized management and authentication of network

0:35based objects, things like users, computers, printers,

0:39and files.

0:40Let's go over the many components

0:41that make up in ADDS infrastructure,

0:44starting at the top with forests.

0:46Now, a forest forms a security boundary

0:48and really just acts as a logical container for domains.

0:52So here we have the Nugget Lab forest,

0:55which consists of three domains, nuggetlab.com,

0:58west.nuggetlab.com and east.nuggetlab.com.

1:01Speaking of domains, domains are very

1:03much like forests in that they act as a container.

1:06Forest contain domains.

1:07Domains contain our Active Directory objects, namely

1:11users and computers.

1:12Think about this.

1:13When you log into your computer and onto the network,

1:16what do we typically log into?

1:17A domain, right?

1:18And that's because a domain acts as a security boundary for all

1:21the resources within it, as opposed to a forest,

1:24which, again, acts as a security boundary for all

1:27the domains within it.

1:28Now, notice in our example here that we have three domains.

1:31We have nuggetlab.com, which is our parent domain.

1:34We also have west and east.nuggetlab.com, which are

1:36acting as child, or subdomains.

1:39So we have three distinct security boundaries here.

1:42And if we wanted users in one domain

1:44to access resources in another domain, for example,

1:47maybe we wanted west and east.nuggetlab.com

1:49to access resources in nuggetlab.com,

1:52which could be acting as headquarters,

1:54then we can set up domain trusts between them.

1:57And, by the way, you can also configure

1:58forest trusts for users to access resources

2:01across forests.

2:02Another ADDS component that I want to briefly touch on

2:05are sites.

2:06Now, think of domains and forests as logical boundaries.

2:10Sites are physical boundaries and are primarily

2:13used to control replication of our AD objects

2:17across physical locations.

2:19Here's an example.

2:20Let's say that headquarters, which is hosting nuggetlab.com,

2:23is physically located in the UK.

2:26And west and east.nuggetlab.com are across the pond,

2:30hosted in the USA.

2:32So we could set up sites here for these locations, which,

2:35again, will allow us to control, schedule, and dictate how

2:39replication of our Active Directory objects

2:42flows between these sites.

2:44Sites can contain multiple domains.

2:46But a domain cannot belong to more than one site.

2:48So those are all of the top level containers

2:51within an Active Directory infrastructure--

2:53forest, domains, and sites.

2:55If we were to peer into a domain,

2:57we have what is arguably the most important object in all

3:00of Active Directory, the domain controller.

3:02The domain controller is a machine

3:04that has Active Directory Domain Services installed,

3:07was promoted to a domain controller,

3:09and hosts the Active Directory database containing all

3:13of Active Directory's objects.

3:14The primary Active Directory objects

3:16we're talking about here are users, groups,

3:18and computers, which we assign permissions

3:20to against resources on the network.

3:23Now, a domain controller can also

3:24be configured as a GC, a global catalog server.

3:29A global catalog server is responsible for authentication

3:32and handling Active Directory searches,

3:35as a GC will store a complete list of every active directory

3:39object and all their attributes within its own domain

3:42and a partial list of objects in other trusted domains.

3:47This can dramatically speed up searches

3:49for cross domain resources.

3:51But it can also have an impact on replication traffic

3:54across sites, which is why the default is a very small subset

3:58of attributes for each object.

4:01And those are the primary components

4:02that make up Active Directory Domain Services.

4:05Coming up next, we're going to get a hands

4:07on with domain controllers.

4:09I hope this has been informative for you,

4:10and I'd like to thank you for viewing.

0:00One domain controller in an Active Directory Infrastructure

0:03is never enough.

0:04It's a single point of failure.

0:06So if we were to lose that DC, our entire organization

0:09comes to a screeching halt. So that's

0:11why most organizations implement at least two domain

0:14controllers, for redundancy, but we also

0:16get the added benefit of load balancing.

0:18Let's take a look at how to install

0:20a second DC into an Active Directory Infrastructure.

0:23[MUSIC PLAYING]

0:30Let's get right to it.

0:32The first thing we need to do is install the Active Directory

0:34Domain Services role on to DC2-NUG,

0:37which right now is nothing on it and it's a Server Core machine.

0:40There's a number of ways we can do this.

0:42Of course, we can do it through Windows Admin Center,

0:44we can do it through Server Manager,

0:45or we can do it through PowerShell.

0:47We're going to go the Server Manager route here and walk

0:50through some wizards.

0:51You can see how they differ from installing your first domain

0:54controller into a brand new forest, which

0:56we did many skills ago, and I'll show you the PowerShell

0:59equivalence here along the way.

1:01So in Server Manager, we're going

1:02to head down to All Servers.

1:03There's DC2-NUG.

1:05All we need to do is give that a right-click

1:06and choose Add Roles and Features.

1:08We can accept the defaults for the first couple of screens

1:10here.

1:11And on the third screen, ensure that we're targeting DC2-NUG.

1:14We are.

1:14And on Server Roles, we're going to choose the second one here,

1:17Active Directory Domain Services.

1:19Notice here that because it's a Server Core machine,

1:21it's only going to install the PowerShell module

1:24for Active Directory, not any of the graphical tools,

1:26such as Active Directory Users and Computers,

1:29because it's a Server Core machine.

1:30So we're good here on Server Roles.

1:32We can hit Next.

1:33We'll accept the defaults here for everything else

1:35and then confirm and install.

1:37Once installation completes, we can promote this server

1:39to a domain controller, which will launch us

1:41into another wizard, the same one

1:43that we walked through many skills

1:45ago when we got DC-NUG up and running.

1:48But we're going to get some different options this time

1:50because we're not adding a new forest.

1:52We are adding a domain controller

1:53to an existing domain, and there is our nuggetlab.com domain.

1:57All we need to do here is provide credentials

1:59for doing so, so I'll just provide the domain

2:02administrator credentials here, and hit Next.

2:05For our Domain Controller Options,

2:07we're also going to turn this into a DNS server

2:09because we only have one running in our environment, which

2:12is hosted on our domain controller,

2:13so this will get rid of that single point of failure

2:15as well.

2:16We're also going to turn this into a Global Catalog Server.

2:19Now, a Global Catalog Server handles

2:20Authentication requests and Active Directory

2:23Search requests.

2:24So this will help out with the load balancing piece,

2:27but I'm going to turn this off in the wizard,

2:29so I can show you how to turn it on outside of the wizard using

2:32Active Directory tools

2:34Also notice that we could turn this into a read-only domain

2:37controller.

2:38Now, RODCs do not store passwords locally.

2:41Only writable domain controllers do that.

2:43So this is a great option when you need a domain controller

2:46in a remote location, such as a branch office,

2:49but you don't trust the physical security at that office.

2:52Because if somebody were to get into this

2:55or steal this domain controller, it

2:57would be worthless, since those passwords aren't stored.

3:00All right, we're good with this screen.

3:01Let's enter in our Directory Services Restore password.

3:04I'll just use the lab password a few times here and hit Next.

3:07We can safely ignore DNS options here,

3:09as DNS delegation doesn't apply to our environment.

3:12For Additional Options-- this is a screen

3:14you do not get when you install your first domain

3:16controller into a forest.

3:17We have a couple of them here.

3:19First up, Install for Media.

3:20This also applies to that branch office scenario.

3:23Let's say, for example, that our branch office

3:26is on the West Coast.

3:27We'll say Los Angeles.

3:29And our primary site, HQ, is in New York City.

3:33And we've got a slow WAN link here

3:35between these domain controllers,

3:37and we've got a massive Active Directory Infrastructure.

3:41Well, if we were to just install this without Install for Media,

3:44that could take months, if at all possible,

3:47to replicate your entire Active Directory Infrastructure

3:50over that WAN link.

3:52So what we do, prior to running this wizard

3:54and installing a domain controller here

3:56at a branch office location, is run the NTDS utility

4:01to essentially export our Active Directory Infrastructure, all

4:04of that data, all those objects, out to a flat file.

4:07We can then take that file, ship it over to our branch office

4:10location, where we can then check this box, browse to it,

4:15and, that way, it will load all of that data

4:17up from that flat file rather than over the slow link.

4:21So checking this box will allow you to enter in a path

4:24to that data generated by NTDSUtil.

4:27We can also choose where to replicate from,

4:31where are we going to receive all of this Active Directory

4:33data from.

4:34Any domain controller or a specific domain controller.

4:37This is also, again, useful when you

4:39have many domain controllers spread across multiple sites.

4:41You can obviously here choose one

4:43that is closest to your domain controller

4:45that you're bringing up.

4:46We're good here with the defaults,

4:47since we only have one other domain

4:49controller in our environment, so we'll hit Next.

4:51Everything else throughout this wizard

4:52is the same as the initial wizard

4:54when installing your first domain controller,

4:56so we'll hit Next.

4:57I do want to point out here, though, on Review Options,

4:59we can hit View Script, and here it is.

5:01A one-liner in PowerShell to do everything we

5:03just did in the wizard.

5:05Install ADDS Domain Controller specifying some of the options

5:08here, all the same options we just walked through,

5:11and that'll easily allow you to automate bringing up

5:14multiple domain controllers.

5:15So we're good here.

5:16We'll go and head next.

5:17This will run through a prerequisite check,

5:19and then we can hit Install, and there we are, good to go.

5:23A few minutes later, and we now have a second domain controller

5:27in our environment.

5:28Now let's configure DC2 as a Global Catalog Server

5:31and also verify that everything is properly in place.

5:35We'll do this here, again, in Server Manager.

5:37If we drop down the Tools menu, we

5:38have all kinds of Active Directory tools in here.

5:41We'll be using some of these throughout this skill.

5:43But the first one I want to go into here

5:45is Active Directory Users and Computers.

5:48What we want to do here is head down to Domain Controllers

5:50and just verify that we have two DCs.

5:52We do.

5:53But notice here the DC Type.

5:55We only have one, Global Catalog.

5:57DC2-NUG is just a regular old DC.

6:00And how we can change that is by,

6:02again, heading into Tools here and heading down

6:04to Active Directory Sites and Services, which

6:07is a tool that you generally use to manage your site's

6:10subnets and replication.

6:12But we can also configure a global catalog through here.

6:16So if we expand Sites, head down to Default-First-Name-Site,

6:19expand Servers, there are both of our domain controllers,

6:22and we want to expand DC2-NUG and then give NTDS settings

6:25here a right-click and head into Properties.

6:28There it is.

6:29All we need do is check that box and hit OK,

6:32and it's now a global catalog server.

6:34If we head back in to Active Directory Users and Computers

6:36and give this a refresh, they should now

6:38both say GC rather than DC.

6:41Another thing we should verify here is DNS.

6:44If we drop down the Tools menu here,

6:45let's fire up the DNS Management Console,

6:48and we also need to connect here to DC2-NUG.

6:54If this was properly configured, what we should see here

6:58is exactly what we saw over on DC-NUG.

7:00Look at that.

7:01There's nuggetlab.com.

7:02There's our testing.com that we created in a previous skill,

7:05and, look, all of our records made it over.

7:07And also notice here that we now have to name server records,

7:10one for DC-NUG and one for DC2-NUG.

7:13Another thing you'll want to do here

7:15is if you're utilizing DHCP, to ensure that DC2-NUG gets set up

7:19as a secondary DNS server.

7:22And if you're not using DHCP, which actually turned

7:25our management box back here to a static IP,

7:28then we can configure it manually.

7:29Lets do that.

7:30I'll head into Network Connections, Change Adapter

7:32Options.

7:34We'll head into the Properties of our network adapter,

7:36into IPv4, and down here it is 192.168.1.102.

7:43And now, we have 2 DNS servers configured.

7:46Now, one more true test here.

7:48What if we completely shut down DC-NUG?

7:50Think everything in our environment still going

7:52to work?

7:53It should, right?

7:53Let's test it out.

7:55So over on DC-NUG here, I'm just going

7:57to shut it completely down and give it a minute

8:00here to power all the way down.

8:02All right, it's all the way power down.

8:04Now let's head back to Admin-NUG.

8:06I'm going to go ahead and log off of this machine.

8:10All right, now we can sign back in,

8:13and this should work just fine.

8:16Hey, look at that, we're on.

8:18Without any domain controller, we

8:20wouldn't have been able to do that.

8:22Let's also verify here in Server Manager

8:24by bringing up Active Directory Users and Computers.

8:27And notice here that we are in Active Directory.

8:29I'm just going to push this bar to the right

8:31just to show you here.

8:32Look at the top.

8:33We are connected to DC2-NUG.

8:36That's how it's done.

8:38No more single points of failure and load

8:40balancing for Authentication and Active Directory Searches.

8:44I hope this has been informative for you,

8:45and I'd like to thank you for viewing.

0:00Users and groups-- the primary objects in Active Directory

0:03Domain Services and a data responsibility

0:06for system administrators.

0:08In this Nugget, we're going to take a look at the many ways

0:11that we can create and work with them.

0:19Here we are on the desktop of our Windows 10 management

0:21box, ADMIN-NUG.

0:22Now, I've already launched many of the tools

0:24that we'll be working with in this Nugget, including

0:26Windows Admin Center, Server Manager, and the PowerShell

0:29Integrated Scripting Environment.

0:31Let's actually start in Server Manager.

0:33There's a couple of tools that we can access through here.

0:35One of them is the old school ADUC, Active Directory Users

0:39and Computers.

0:39And the other is the newer school, ADAC, Active Directory

0:42Administrative Center.

0:44Let's actually start here in ADUC,

0:46because this tool has been around forever.

0:48It's tried and true.

0:49And it's really easy to work with.

0:51This will default us into the Users node, which

0:53will show us all the users and groups in our Active Directory

0:56infrastructure.

0:56And you can see, we only have two users.

0:58One of them is disabled, the Guest account.

1:00And the other one is what we've been using this entire course,

1:03the Administrator account.

1:04All the rest of these are groups.

1:06Now, let's say that we wanted to create a user.

1:08We can simply right click on the Users node and choose New User.

1:12This will pop open a dialogue and allow

1:14us to fill out some very basic information about our user.

1:17Let's create the user.

1:18How about John Smith?

1:20So we fill in their first and last name.

1:22Now we can provide them with a logon name, otherwise known

1:25as the sAMAccountName.

1:26You'll see where that matters here

1:27when we begin automating this with PowerShell.

1:29But this is what they will use to log into their machine with.

1:33So john.smith will be his user name.

1:36We'll hit Next, and we can provide some information here

1:38about their account.

1:39First up, we need to give them a password.

1:41So I'll just enter in the lab password a few times here.

1:44And then we have some options around their account here.

1:47We're going to force them to change their password

1:50the first time they log in.

1:51And we'll leave the rest of these at their defaults.

1:54We'll go ahead and hit Next, Finish.

1:56And that's it.

1:57We created user John Smith.

1:59Now let's give that new user a right click

2:01and head into Properties.

2:02This allows us to fill in much more detailed information

2:04about this user, general information, address

2:07information.

2:08We have more control over their account

2:10here including when they're allowed to log into our network

2:13and what they're allowed to log in to.

2:16We also have some more account options down here.

2:18We can configure their user profile,

2:20point them to a network share, their home folder,

2:22as well as connect them to a specific network drive.

2:26We can configure telephone numbers and more

2:28organizational information.

2:30Let's also take a look at how to create a group.

2:32We'll come back to users here in a little bit.

2:34If we right click on a user's node and choose New,

2:37there it is, Group.

2:38This will pop open another dialog

2:40where we can give our group a name, specify its scope,

2:42and its type.

2:43Now let's say that John is a developer in the IT department.

2:47And he's going to be a member of this group along with all

2:49the other developers.

2:51So let's give this group the name IT Developers.

2:54Now, the type 99% of the time is going to be Security.

2:59Security groups we can associate with permissions.

3:02Distribution groups you cannot associate with permissions.

3:05And they're useful for mailing lists when

3:08you're implementing something like Exchange

3:09in your environment.

3:11Scope, on the other hand, is the important one.

3:13These really determine two things, both of which

3:17relate to, well, as the name implies here, scope--

3:20number one, where these groups can

3:22be assigned permissions in, either the same domain

3:25with domain local, any domain with global, or any domain

3:29or any forest with universal; and number two,

3:32what types of members they can include it

3:35where those members exist.

3:37Members, by the way, is a term that

3:38describes both user accounts and groups, because groups

3:42can contain other groups.

3:44Now, this can all get very confusing and convoluted

3:47quickly, which is why years ago Microsoft laid out

3:49best practices for designing groups and assigning

3:52permissions to them.

3:53It's a process known as AGDLP.

3:56And we're going to get much deeper into it

3:58in our Nugget on permissions.

4:00For now, though, let's keep it simple.

4:01And we're actually covering the first two steps, the A

4:04and the G, which is create your accounts

4:07and then add your accounts into global groups,

4:09and also why this is the default selection when creating groups.

4:13So we're going to create a global group here and assign

4:16our user to it, which we can easily

4:18do here by either heading into our group

4:20or heading into our user.

4:21It's easier here if we just head into our group.

4:23We open that up.

4:24We hit Members.

4:25We add our member in.

4:26And now we can browse Active Directory.

4:28I'll just start typing in John, hit Check Names.

4:30And that'll resolve it.

4:32And look at that.

4:32John Smith is now a member of our IT Developers global group.

4:36Moving on, let's take a look at another tool

4:39that you can use to create users and groups

4:40and manage Active Directory.

4:42Back in Server Manager, if we drop down the Tools menu,

4:45it's the first entry in the list here, Active Directory

4:47Administrative Center.

4:48And this tool is really nice because it's more modern.

4:51It looks and feels exactly like Server Manager.

4:54It's highly customizable.

4:55And it's built on top of PowerShell.

4:58So everything we doing here is just

5:00executing PowerShell commandlets under the hood, which

5:03is a great way to learn all of those Active Directory

5:06PowerShell commandlets.

5:07It also wraps some very common operations here

5:10on the Overview page, such as resetting users' passwords when

5:13they forget them and performing a global search against all

5:16the objects here in Active Directory.

5:18Let's say that we wanted to create a user.

5:20We could hit nuggetlab here.

5:21And look at that-- looks familiar.

5:23These are all the nodes that we saw back

5:24in Active Directory, users and computers.

5:26And over here on the right here, we have our tasks.

5:29We can hit New, for example, and create a new user.

5:32It'll pop open our new user dialog

5:33where we can begin filling out this information.

5:37And if you use this a lot, again, you can customize this.

5:40You can drop sections down here.

5:41And we can turn off all the things

5:43that we don't use to simplify our view.

5:47Let's create another user here.

5:48How about old Joe Smith?

5:50And you'll notice here that we get

5:51some nice visuals indicating required field

5:54with that big red splat.

5:55And they dim out when those requirements have been met.

5:58We also need to provide the user logon name here,

6:00the sAMAccountName, which is going to be joe.smith.

6:03And that's it-- no more required fields here.

6:05But if we head down to Member Of, we can hit Add.

6:08And since we already have that group created,

6:10we could type in IT, hit Check Names.

6:12And there is our IT Developers group.

6:14This will create the user and add him in to that group.

6:18So we can now see our user right there.

6:20And also if we bring up our PowerShell history,

6:22we can see that it used the New-ADUser commandlet.

6:25And those are all the parameters that

6:26were supplied to create that user under the hood--

6:30so a fantastic tool here in Active Directory Administrative

6:33Center.

6:33But let's crank it up a notch and head into the Integrated

6:35Scripting Environment where I've got a script opened

6:38up and ready to go.

6:39Now, if you're following along, just hit that Open button

6:41on the toolbar.

6:42It'll plant you into the Nuggetlab directory

6:44where you can also open this script.

6:46Now, to create an individual user, as we just saw over there

6:48in ADAC, we utilize the New-ADUser commandlet.

6:52Here we're going to create the user Jane

6:54Smith by passing in some information

6:55about her-- first name, last name, her sAMAccountName, which

6:58is her logon name.

6:59And optionally you're enabling the account

7:01and also supplying a default password.

7:05And notice because we're passing this in as plain text,

7:07we need to convert it to a secure string,

7:09as that is what the account password parameter expects.

7:12So I'm going to highlight this code here and execute it,

7:15which will create Jane Smith.

7:17And we can verify using either one of our tools here.

7:19If we head back into Users and Computers

7:21and give this a refresh, there is Jane Smith.

7:24And we're actually missing Joe Smith.

7:25And that's because when we created him over here,

7:27we created him in the root of our network infrastructure,

7:31our hierarchy here.

7:32So if I give that a right click and choose Move,

7:34we're going to move it down to Users.

7:36There we go.

7:37Now we should be able to see Joe in here with Jane and John--

7:41perfect.

7:42All right, back to the Integrated Scripting

7:44Environment we go.

7:45So creating individual users, a breeze.

7:48We have lots of methods for doing so.

7:50But what if you had to create hundreds of users?

7:53Creating them individually by hand, just not something

7:56that we would want to do, because it

7:58would take a very long time.

8:00So let's say that we've got a data dump from our HR

8:02department in the form of a comma-separated file.

8:04In fact, I've got one here in the C drive in the Nuggetlab

8:08directory-- right there, ad-users.csv.

8:11Here it is.

8:11We've got close to 100 users here in this file.

8:14The very first row are column headers

8:17that describe the data below.

8:19So all we need to do is utilize a little bit of PowerShell

8:22here to import that file and then map

8:25those columns in that file to the parameters

8:27of the New-ADUser commandlet-- very simple here.

8:29We're running an import CSV referencing that file

8:32and piping that to a foreach loop,

8:35meaning for every single record row

8:38in that file minus the first one,

8:40the column headers there, it will run this commandlet.

8:43And that's all we're doing then is

8:44mapping the name of those columns in that file

8:46to the parameters inside of the New-ADUser commandlet.

8:50So I'm going to highlight all of this code and hit Execute.

8:53And that'll just take a minute to create

8:54all of those users in Active Directory.

8:57All right, that just finished up.

8:59If we head into Active Directory Users and Computers

9:01and give this a refresh, look at all those users.

9:03That is so much fun to do.

9:05Now let's drill into one of our users

9:06here by giving them a double click to open up their Property

9:08pages.

9:09And check it out.

9:09Just verify here that all that data made it over.

9:12We've got address information.

9:13We've even got information about the organization they belong

9:16to, including their department.

9:18So our users look good.

9:19Let's head back into the ISE and create some groups.

9:22We're going create six groups here using the New-ADGroup

9:25commandlet.

9:26And these groups are going to be modeled after the departments

9:29our users belong to.

9:30And these are all going to be global security groups.

9:33So I highlighted those six lines of code.

9:35We'll run them.

9:36That will create those six groups.

9:38Finally, our last step here-- because right now those groups

9:40are empty--

9:41is to assign our users to those groups.

9:43And we're going to do that again by looping

9:45through that same file and using the Add-ADGroupMember

9:49commandlet, targeting a group based

9:51on the department-- that's the identity parameter--

9:54and specifying which member we're

9:55placing into that group based on the sAMAccountName.

9:58So this will add the member into the group

10:01based on their department, which is the actual group itself.

10:05So we'll run that.

10:05It'll just take a second to complete.

10:07And when it's done, if we head back in Active Directory Users

10:09and Computers-- and I'll just give this

10:11a refresh here with F5 on the old keyboard-- and there it is.

10:14There's our group.

10:15There's the Executive group.

10:16Here's a Manufacturing group.

10:18If we open this up and look at members,

10:19we'll get all the members in that group.

10:21We could also look at, say, Research and Development.

10:24And we've got a handful of members in there

10:26as well as Sales and Marketing.

10:28We've got a handful of members in there as well.

10:30So we've got plenty of objects inside of our Active Directory

10:33infrastructure to play with for the Nuggets to come.

10:35But let's finish this Nugget up by taking a look at what

10:37we can do against Active Directory

10:39through Windows Admin Center.

10:41And the answer is, out of the box, not much.

10:43I actually did install the Active Directory extension

10:46into Windows Admin Center, which is currently in preview mode.

10:49So if we head to one of our domain controllers here--

10:51and I'll just go ahead and choose dc-nug--

10:53there is that extension right there, Active Directory.

10:57Once that loads up on the Overview tab here,

10:58we can perform a global search.

11:00So if we type in Smith here, we should see those three user

11:03accounts that we created.

11:04And we could choose them to perform some light management

11:07against them and also see some information about their account

11:10down below.

11:11You can also drop down the Create button here

11:13to create users, groups, and OUs here in Windows Admin Center.

11:16And finally, you can hit Browse here

11:18to navigate through the hierarchy of all the objects

11:21in Active Directory.

11:23So as you can see, we certainly have a lot of flexibility

11:26when it comes to creating users and groups.

11:28Which method you choose will depend on the scenario

11:30you're faced with and, of course, personal preference.

11:33I hope this has been informative for you,

11:35and I'd like to thank you for viewing.

0:00Organizational units an Active Directory

0:02serve two primary purposes--

0:05one, group policy.

0:07It's how we can distribute group policy

0:08settings to different areas within our organization.

0:11And two, delegation.

0:13It's how we can delegate administrative duties

0:16to other members of our IT staff.

0:18Let's take a look at how to design and work with OUs.

0:22[MUSIC PLAYING]

0:28Organizational units themselves are just containers.

0:31They are containers for other objects--

0:34users, computers, and groups.

0:36We design an organizational unit hierarchy

0:38and place these objects into it to, again, support group

0:41policy, delegation, and to a lesser extent,

0:44just organizing the objects in Active Directory.

0:47Now, how you design your hierarchy

0:49will depend on your organization.

0:51But the golden rule is always this--

0:53keep it simple.

0:55Keeping it simple will make it much easier

0:58to manage group policy and delegation.

1:01Here's an example using a simple functional design.

1:04At the top of the hierarchy, we have an OU

1:05for accounts and for machines.

1:08And then we can further break them down and organize them

1:10accordingly.

1:11Under Accounts, we can have one for users and admins

1:14in services.

1:15And here we could even get more granular.

1:17Under Users, we could create an OU here

1:19for each department or each job role.

1:22It's a common strategy to model your OU design

1:25after your business units.

1:27We would do the same thing on the machine side,

1:29break it down by servers and workstations.

1:31And underneath Servers, we could have

1:33an OU for each type of server, and underneath Workstations

1:35for each type of PC.

1:37And we could even get more granular here

1:39by creating OUs for each specific type of operating

1:43system.

1:43So maybe we have one underneath laptops and desktops

1:45for Windows 8 and Windows 10.

1:48Now, once your hierarchy is in place

1:49and all of your Active Directory objects

1:51are in their respective OU, then you

1:53can start harnessing the power of delegation in group policy.

1:57On the delegation side, let's say

2:00that we've got to help desk staff out there

2:01and we've got a group called IT Help Desk.

2:04And we want to give them the ability

2:06to reset passwords on all the users in the organization.

2:09Well, we can just give that group the ability

2:12to do so on this OU, which will flow down to all of our OUs,

2:17whether we have them separated by job role or department.

2:19That will give them the ability to reset passwords

2:21for all the users in that OU and beneath it.

2:25We could also delegate control to members of our IT staff

2:27on the server side to give them the ability to do things

2:30like reboot servers.

2:32The other side of the OU coin is, of course, group policy.

2:36A policy is really just a collection of settings.

2:39We have settings for both users and computers,

2:42and there's thousands and thousands of settings

2:44that we can control.

2:45So we configure a group policy and link it

2:48to an organizational unit.

2:51And whatever OU that is linked to, and every OU underneath it,

2:54will receive those settings.

2:56So for example, say that we wanted

2:57to deliver the company wallpaper to all workstations

3:00in our environment.

3:01We would configure that setting, define our wallpaper,

3:04and it will link it to our Workstations OU,

3:07and everything underneath it would then

3:09receive that wallpaper.

3:10Again, we have a skill dedicated to group policy,

3:13so we'll look at how to do that and much more

3:15when we get there.

3:16But for now, let's head into the virtual lab

3:18and take a look at how to create OUs and configure delegation.

3:22Here we are in the desktop of our Windows 10 Management Box

3:24ADMIN-NUG, and we're going to do this through Active Directory

3:27Users and Computers, which we can quickly

3:28get into by right clicking on the Start button,

3:30heading up to Run, and typing in dsa.mse.

3:34Once inside, we can create an organizational unit

3:36by right clicking on our domain nuggetlab.com,

3:39heading down to New, and choosing Organizational Unit.

3:42And all we need to do here is just simply give it a name.

3:45So I'll call this one Accounts, and let's create

3:47another top level one here.

3:48So right click on nuggetlab.com, head down

3:50to New, Organizational Unit, and this time

3:52we'll call this one Machines.

3:55Now, if we wanted to create an OU within these,

3:57you guessed it.

3:57We would right click on that OU, hit New, and Organizational

4:01Unit.

4:01And let's create one here called Users.

4:03Oh, that was wrong.

4:05Uers.

4:06Easy enough to rename.

4:08There we go.

4:09All right.

4:09So I went ahead and created the remaining OUs.

4:12Next up is to get our users, computers, and groups

4:15into them.

4:16Let's start here with users.

4:17If we head over to Users, there's

4:18our administrator account.

4:19I'm going to drag that over to Admins.

4:21We'll get a little message.

4:22I'm going to say, you know what?

4:24Don't show me that message ever again.

4:25We'll hit Yes, and now our administrator account

4:28is in there.

4:29Also let's grab all of our users, which start up here.

4:31I'll do a Control-Shift-End to grab them all,

4:34and just drag them over to Users.

4:36That will add all 95 users into them.

4:39Let's also do the same with our groups there.

4:41We'll grab all those groups that we created--

4:43there they are-- and drag them in to Users.

4:46Now let's do the same thing for our computers.

4:48Now we don't have to do this for our domain controllers.

4:50They already have an OU, as you can

4:52see by little visual notification on the icon there.

4:55So those are good.

4:56But we still have FS-NUG, our file servers.

4:59We can drag that down here to our file server.

5:01And we have an ADMIN-NUG, which is our management workstation.

5:04We'll say this is a desktop, and we'll drag that into there.

5:07One more thing I want to show you

5:09here is how to delegate control.

5:11You'll notice here that I've got a group called IT HelpDesk.

5:14Let's say that we want to give all the members of this group

5:17the ability to reset passwords for anybody in this Users OU.

5:21All you do is right click on this OU

5:23and hit Delegate Control, and this

5:24will walk us through a pretty simple wizard here.

5:26We choose Next.

5:27We specify which group or groups or users

5:30we wish to delegate control to.

5:32We're going to just start typing in IT and hit Check Names.

5:35There it is-- IT HelpDesk.

5:36Now we hit Next.

5:38And here we go.

5:38We can delegate common tasks or we

5:40can create our own custom task.

5:42Let's just choose the second one here,

5:43Reset User Passwords, and force them to change at next log on.

5:47We hit Next.

5:48That's the end of the wizard, and now

5:50all the members of this group have the ability

5:53through Active Directory to reset passwords

5:55for any user inside of this OU.

5:58Good stuff.

5:59Just remember, when it comes to organizational units,

6:01keep your hierarchy simple.

6:03The more complex it becomes, the more difficult

6:06it will become to manage both delegation and group policy.

6:11I hope this has been informative for you,

6:12and I'd like to thank you for viewing.

0:00Permissions determine what resources our users can access

0:04and what kind of actions they can perform against them.

0:06In this Nugget, we're going to take a closer look at groups

0:09and implement a best practice for assigning

0:12permissions against them.

0:13[MUSIC PLAYING]

0:19AGDLP, we talked about it a few Nuggets ago briefly.

0:24It is a best practice for designing groups and assigning

0:27permissions to them to grant users in those groups access

0:31to resources on the network.

0:33This is a really solid best practice to follow,

0:36because if we don't and we start assigning permissions

0:38like the wild, wild west to users and global groups,

0:41things can get very messy very quickly.

0:44Now, before we jump into AGDLP, let's

0:46take a quick refresher of the three group scopes

0:49available to us.

0:50The first thing to note is that all three of these group scopes

0:54can contain user and computer accounts and also

0:57groups depending on the scope.

0:59Domain Local Group, for example, can contain global groups

1:03from the same domain and universal groups.

1:06And it's best to think of these as permission groups.

1:09This is what we want to assign permissions to.

1:13Global groups can contain other global groups

1:16from the same domain.

1:17And it's best to think of these as role groups.

1:20We create these based on our business model, either job

1:24roles or departments.

1:26Finally, we have universal groups.

1:28These can contain global groups from any domain

1:30in the forest as well as other universal groups

1:33and these are best utilized in a multi-domain environment.

1:36More on universal groups in a little bit

1:38when we talk about AGUDLP.

1:41But first, let's talk about this best practice known as AGDLP.

1:45Remember, A stands for Accounts.

1:48And it represents our individual user and computer accounts.

1:52G stands for Global Groups.

1:55And again, we modeled these after job roles or departments,

1:59and we place our users directly into them.

2:02DL stands for Domain Local Group.

2:06These groups have visibility in the current domain.

2:09And this is what we place our global groups into,

2:13and the P, assign Permissions to resources against.

2:18Now, let's highlight the benefits of this model

2:20by looking at a real world example.

2:21And in order to do that, we need some context here.

2:23So let's say that we create a global group called Sales.

2:27And we add all of our sales users into that global group.

2:31Now, our goal here is to provide our sales users

2:34with the ability to print to this printer

2:36and have read/write access to the sales share on this file

2:39server.

2:40So what we would need is two domain local groups.

2:44One we'll call RW, for read-write Sales Share.

2:48And another for printing to the printer,

2:50which will just call P, printer.

2:54So what we would do then is, again, assign those permissions

2:57to these domain local groups.

2:59So we give print permission to the P printer

3:01domain local group and read-write permission

3:04to the Sales Share.

3:06Now, all we need to do is add our sales users directly

3:09into those domain local groups.

3:11Here's why this model is awesome and extremely efficient.

3:14Let's say that we're constantly hiring new sales

3:17folks into the organization.

3:18All we need to do is create their user account,

3:20add them into that Sales global group

3:22and, voila, they automatically inherit all of the permissions

3:26that we assigned to those domain local groups.

3:28Another reason this is awesome and another reason

3:30why we don't assign permissions here at the global group level

3:34is let's say that marketing, quality assurance, production,

3:37all these other departments needed access to the printer.

3:40All we would do is add those global groups into this domain

3:44local group and they would be able to access

3:46that printer, which results in one permission

3:49that we assign to this domain local group,

3:51rather than the many permissions that we would need to assign

3:54to all of those global groups.

3:55So the end result--

3:56this model results in a clean separation and less permissions

4:01to assign and manage.

4:03Now, let's add U into the mix, which, again,

4:05stands for Universal Groups.

4:07And this is useful in multi-domain environments

4:10when we need to grant users access

4:12to resources across domains.

4:14Here's the setup.

4:15On the left, let's say that we have west.nuggetlab.com.

4:20And on the right, we have east.nuggetlab.com.

4:23Let's say that we have some executive sales users that

4:27need access to all the sales resources across both

4:31of these domains.

4:32This is where universal groups come into play.

4:34So how this works is just like before, we have accounts.

4:38So let's say that we've got a western regional sales

4:40manager here and a eastern regional sales manager here.

4:43We add them into their respective global groups.

4:47But rather than add these global groups

4:48in the domain local groups, we add them into universal groups.

4:53We then add these universal groups

4:55into domain local groups, which will then give them access

4:59to all the sales resources in both domains.

5:02What's cool about this is that our sales managers will not

5:05need their own accounts in every domain,

5:07just in their source domain as they will automatically

5:10have access to those resources again

5:12through that universal group membership.

5:14What's not cool about this is universal groups

5:17are stored in the global catalog.

5:19So any changes made to them are replicated around,

5:22which can impact replication traffic across our domains

5:25and our forests.

5:26All right, with that, let's jump into the virtual lab

5:28and test out AGDLP.

5:31Here we are on our Windows 10 management box

5:33once again, ADMIN-NUG.

5:34Now, I've already launched the tools we're

5:36going to be working with here--

5:37Server Manager and Active Directory Users and Computers.

5:40Let's actually start in Server Manager

5:41because what we're going to do is

5:42create a share that we're going to provide our sales

5:45users with access to.

5:46So the exact scenario that we ran through there

5:48on the whiteboard.

5:49In Server Manager, we'll head down to File and Storage

5:51Services and into Shares.

5:54From here we'll drop down Tasks and choose

5:55to create a new share.

5:57We're going to create a quick SMB share.

5:59Our location here is going to be over on FS NUG.

6:02We'll hit Type of custom path and browse

6:04through the F drive over there, where

6:06we have all kinds of folders.

6:07And let's create a share here on top

6:09of the sales folder in the F drive, which

6:11has a little bit of data inside of it.

6:13We'll keep the defaults here.

6:15The name of the share will be sales,

6:16which maps to the F colon backslash sales folder

6:19on that local machine.

6:20And this is how we will access it

6:22remotely through the UNC name.

6:24So we'll hit Next here.

6:26We'll accept the defaults here for other settings.

6:28And for now, we're going to accept

6:30the default for permissions.

6:31We'll come back into this once we get our domain local group

6:34set up and configured.

6:36So I'll hit Create.

6:37And now, we have a share ready to go.

6:39All right, our next step is to head into Active Directory

6:41Users and Computers and create a domain local group.

6:44Remember, a few Nuggets ago, we already

6:45created our global group.

6:47In fact, if we expand our Accounts OU

6:49and head into Users, there is our Sales and Marketing

6:52global group.

6:53And if we open this up and head into Members,

6:55you can see we've got three members.

6:56And we're going to need to test all of this

6:58out with one of these members to ensure

7:00they have access to that share.

7:02So we've got our global group in place.

7:04We've got our members added to it.

7:06Now, we just need a domain local group.

7:08So we'll right click on a user's OU, head over to New

7:11and down to Group.

7:12This is going to be a domain local group.

7:14And we will call this RW Sales Share, like so.

7:18Perfect.

7:19We hit OK.

7:20And now what's the next step?

7:21You guessed it.

7:22We're going to add Sales and Marketing into this domain

7:25local group.

7:25So we'll open it up, hit Members, hit Add.

7:28And now I'll just start typing in sales.

7:30We'll hit Check Names.

7:31There it is.

7:32And now, we've added our global group

7:33into this domain local group.

7:36Now, our final step is to assign read-write permissions

7:40to this domain local group onto that share.

7:42So let's head back into Server Manager,

7:44give that share a right click and head into Properties.

7:46And look at that, we can head right back into Permissions

7:48here and hit Customized permissions.

7:51Now, there's two kinds of permissions.

7:52We have permissions on the folder itself

7:55and share permissions.

7:56The best way to go about this is just leave share permissions

7:59alone, allow everyone full control.

8:02That way we only have to manage permissions in one spot.

8:05And Windows only really checks them in one spot.

8:08Now, what we're going to do is Disable inheritance.

8:10And we're going to remove all inherited permissions.

8:12So this is a good thing to do to start from scratch,

8:15because if we didn't do this, everybody would still

8:17have permission to share through those inherited permissions.

8:21So the only people that have permissions to this right now

8:23are administrators, local administrators,

8:26on that machine.

8:27We're going to hit the Add button here

8:28and Select a principal.

8:30From here, I'll start typing in RW for our domain local group.

8:33And look at that, RW Sales Share.

8:35And we're going to give them read and write

8:37as well as list folder contents and read and execute

8:40permissions against that share.

8:42There's some other things you can do in this dialogue

8:44as well.

8:44Look at more granular permissions.

8:47You can also add conditions.

8:48And you can choose what this applies to.

8:51We'll stick with all the defaults for now.

8:53And hit OK.

8:54And now, that domain local group has read, write, and execute

8:57permissions against this folder and any other folders

9:00that will eventually be created inside of the share.

9:02And that's it.

9:03We hit OK.

9:04And now, we're ready to test.

9:05Now, there's a number of ways that we could test this out.

9:08We can log out and log in as that user.

9:10But that's somewhat timely.

9:12A much easier way of doing this is just mapping a drive

9:15using those user's credentials.

9:17So what we're going to do here is right

9:19click on this PC in File Explorer

9:21and choose to map a network drive.

9:23We're going to check this box right here

9:25to connect using different credentials.

9:26We'll map this to the Z drive.

9:28And the folder will be fs-nug backslash sales.

9:32Now, the user we're going to use here is the Kevin account.

9:35And I know his login name is kevin0

9:39and the password is the lab password.

9:41We hit OK.

9:42And if permissions are applied appropriately,

9:46we're not only going to be able to get into this folder,

9:49but we're also going to be able to create folders--

9:51look at that, we created a folder--

9:52and create files either in the root there or inside

9:56of this folder, because permissions

9:57are being applied to objects and sub-objects within this folder.

10:01We can create files.

10:02We can write to them.

10:03We can do everything that our permissions set grants us.

10:07Now, let's test this out as a user that

10:08isn't a member of this group.

10:10Let's just pick one here.

10:11How about Candy?

10:12I'm going to open up her profile.

10:13Her login name here, if we had over to Accounts,

10:15should be candy0.

10:16It is.

10:17So we'll be able to log in using candy0.

10:18And what we're going to need to do here

10:20is actually disconnect this drive entirely.

10:23So I'll give it a right click.

10:25And we'll choose to disconnect.

10:27Now, if it doesn't disappear from your left-hand nav,

10:30no worries.

10:30It has actually gone.

10:31And you can click on this PC and scroll down just

10:34to verify that it's gone.

10:35And you can also click on it to verify that it is gone.

10:38So all we need to do is right click on this PC again.

10:40And let's map another network drive.

10:43We'll map the exact same one here,

10:44connect using different credentials,

10:46and over to the fs-nug backslash sales.

10:49There we go.

10:50We'll hit Finish.

10:51And this time we'll enter in candy0.

10:54Again, same password here, lab password.

10:56We hit OK.

10:57It's going to open it up and say, oh, you

10:59do not have permission to access this folder.

11:03AGDLP, we should make a song or a chant

11:05about it, because it's awesome.

11:07And if you live by it, group and permission management

11:10will be a breeze in Active Directory.

11:12I hope this has been informative for you,

11:14and I'd like to thank you for viewing.

0:00Managing Active Directory is a big responsibility,

0:03especially for domain administrators

0:05who are responsible for, well, all of it--

0:08the health, the state, and the structure.

0:10In this Nugget, we're going to take a look

0:12at some of those common management

0:13tests you'll be performing to keep Active Directory running

0:17smoothly.

0:18[MUSIC PLAYING]

0:24Let's get right to it and begin in Active Directory Users

0:27and Computers.

0:28Then we'll move on over to the PowerShell Integrated Scripting

0:30Environment, because automation and PowerShell really

0:33is the name of the game, especially when it comes

0:35to Active Directory Management.

0:37Management task number one, and arguably the most important

0:40for a domain administrator, is delegation.

0:42And I know we've talked about delegation back

0:44in our Nugget on organizational units, but let's hammer it

0:46home with a bigger example.

0:48Let's say that we are the domain administrator

0:50for nuggetlab.com--

0:52a multi-site organization.

0:54We've got west.nuggetlab.com and east.nuggetlab.com

0:58with many sites underneath.

1:01Maybe we've got Los Angeles, and Las Vegas, and Seattle.

1:05We've got New York City, Atlanta, and Miami.

1:09And underneath these, we have branch office locations.

1:13Could you imagine being responsible for all

1:16of these objects across all of these sites?

1:18No, it would be more than a full-time job.

1:21So that's why as a domain administrator

1:22we would create organizational units to model this hierarchy.

1:26And then delegate responsibility to our site admins,

1:29who would then delegate responsibility

1:31to branch office admins, who would then delegate

1:33responsibility to help desk and desktop support,

1:36and anyone else who we could pass a chunk of Active

1:39Directory off to.

1:40The best part about it is once you have your hierarchy

1:42in place, it's really easy to delegate administrative duties

1:46to members of your IT staff.

1:47As we saw back in our OU Nugget, we

1:49just simply walk through the delegation of Control Wizard

1:52to determine which users and groups can perform which

1:55actions in Active Directory.

1:57Management task number two, keeping Active Directory clean.

2:01This is one of those areas that can snowball really quickly.

2:03So it's good to get a strategy and policy in place

2:07as soon as possible so you don't have

2:08to deal with a cluttered up Active Directory.

2:11Here's an example, I like to actually keep

2:14groups separate from users.

2:15So here's where we can use OUs for just simply

2:19organizational purposes.

2:20So I'm going to create a new OU here.

2:22And I'm going to call it Groups.

2:24And what I'm going to do then is drag these groups out

2:26of this user's OU and place it right into that group OU.

2:30And we've also got another group down here that we created,

2:32our IT Help Desk group.

2:33And I'll drag that over there as well.

2:35This, again, gives us nice, clean separation

2:39of the objects in Active Directory.

2:41Management task number three, use a naming convention

2:44for all of your objects in Active Directory,

2:46especially users and groups.

2:48This is another important one because it

2:50makes finding things, especially in large directories,

2:53much easier.

2:54And it just keeps people sane.

2:56And this is also something that you want to train or even

2:58come up with a policy for your Active Directory staff

3:00to follow when creating or renaming objects.

3:03Let me show you a couple of examples here.

3:05Let's take Candy Spoon as an example.

3:08Now notice that her user name and her email here is candy0.

3:12That's not a good naming convention.

3:14Typical ones for users are first letter of first name,

3:18dot, last name.

3:19Or just first name, dot, last name.

3:21In fact, we can head over to our account

3:22here and change this to candy.spoon.

3:25And we can do the same thing up here

3:27for the login name, candy.spoon@nuggetlab.com.

3:31And we can do the same thing over here

3:33in general, candy.spoon.

3:35There we go, that's a much better looking naming

3:37convention, and pretty standard here for users.

3:40And we can easily write just a little PowerShell script

3:43to change all of these in one fell swoop.

3:46We could implement something similar to this with groups

3:49as well.

3:49A common naming convention here is department, plus resource,

3:52plus permission, plus group scope.

3:55Here's an example, let's say this

3:57is our sales and marketing group that has read/write permission

4:00to our sales share.

4:01So we can go SalesMarketing-SalesShare-RW-DL.

4:08This will make it so much easier for us to find things

4:12in Active Directory based on this four part naming

4:14convention.

4:15Moving on, let's take this the rest

4:17of the way in the PowerShell Integrated Scripting

4:19Environment and start here with some Domain Controller

4:21Management.

4:22A common thing for domain administrators to do

4:25is, again, monitor the health and replication

4:27status of all the DCs in our environment.

4:30The first tool here is a command line utility called dcdiag.

4:33And here we're using the S Switch

4:35to target a specific domain controller, dc2nug.

4:38This will just simply run through all of the components

4:41in Active Directory and output their status.

4:44And what it will do is just run tests against them.

4:46So you'll want to see a bunch of passed in here.

4:48If you see any failures, pay attention to the error message

4:51and you can begin your troubleshooting journey

4:53by checking the Active Directory Event logs on that machine.

4:57This should always be your first stop

4:59when Active Directory begins slowing down or acting funny,

5:02just to verify that all those underlying components are

5:05working properly.

5:06Another great tool for domain administrators

5:08here is repadmin, which allows us to monitor the replication

5:11status.

5:12And you can even use this to kick off replication

5:14for the entire directory or for individual objects.

5:17But we can use repadmin / showrepl to show

5:20the last replication event.

5:23So this will show us the success or failure of that event.

5:26And you can see that we're in good shape

5:28here in our environment.

5:29We can also get a replsummary, which

5:30will show us any failures that have

5:32occurred during replication.

5:34Another good one here when you have multiple domain

5:36controllers in your environment and you

5:38need to verify if replication is or is not an issue.

5:42Now some common management tasks we can perform in PowerShell

5:44are account management and group management.

5:47Specifically here with accounts, we

5:49can use PowerShell to find disabled accounts,

5:51inactive accounts, which are accounts that have not logged

5:54in within a specific time period,

5:56as well as find accounts with password issues.

5:58Here's a good example of finding disabled accounts.

6:01We've got a couple of disabled accounts

6:02here in the guest account and Joe Smith.

6:05We can find inactive accounts, which

6:07we haven't logged in with any of those users we imported,

6:10which is why they're all going to show up as inactive.

6:12But they would fall off this list

6:14if we were to log in to a machine with them.

6:16And we can find accounts here with password issues,

6:19any passwords that are expired, or any accounts that

6:22are locked out.

6:23All common things that happen in Active Directory

6:25on a daily basis.

6:26And finally here we can use PowerShell to easily view

6:29group membership.

6:30To Get-ADGroup passing in a group

6:32and piping the results of that over to Get- ADGroupMemeber,

6:35will show us all of the members associated with the group.

6:38So there are the three members that are inside of the sales

6:41and marketing group.

6:42And we can also use this to view groups

6:45that a member belongs to.

6:46So if we want to see all the groups

6:47that the built-in administrator account belongs,

6:51this will show them.

6:52We can also see what groups Candy belongs to.

6:55And we renamed her, which is why Candy0 doesn't work.

6:58It's now Candy.spoon.

7:00And if we were to run this again,

7:02this time we can see that she's a member of both domain

7:04users and executive.

7:06There's a handful of some of the most

7:07common tasks you'll be faced with when

7:09managing Active Directory.

7:11Until next time, I hope this has been informative for you

7:13and I'd like to thank you for viewing.