Whats New Inactive Directory

Windows Server 2008 R2: What's New in Active Directory

Windows Server 2008 R2: What’s New in Active Directory

Table of Contents Windows Server 2008 R2: What's New in Active Directory ..................................................... 1 Exercise 1 Using the Active Directory Administration Center .......................................................................................2 Exercise 2 Working with Active Directory using the Active Directory PowerShell Module ...........................................5 Exercise 3 Recovering Deleted Objects using Active Directory Recycle Bin ..................................................................8 Exercise 4 Pre-Deploying Computer Accounts using Offline Domain Join ..................................................................11


Windows Server 2008 R2: What's New in Active Directory After completing this lab, you will be better able to:

Objectives









Scenario

Use the Active Directory Administration Center to perform administrative tasks Locate and manage objects using the Active D irectory PowerShell provider Recover deleted Active Directory objects using the Active Directory Recycle Bin Perform an offline domain join for a not yet deployed computer

Woodgrove Bank is an investment bank located in Baltimore, USA. Woodgrove Bank has a main office and many regional and local branch offices. Many of the branch offices are small offices and do not have local IT support, and are connected to the main office by low-bandwidth WAN connections. In addition, many users at Woodgrove Bank travel between offices, as well as to customers’

offices and homes for meetings regarding client accounts. Woodgrove Bank is faced with the following global challenges: 

Management of many servers in many offices.



The need to reduce the operational cost of each branch office.



The need for roaming and remote users to acc ess company resources.



Management of a large and complex Active Directory infrastructure.

Before working on this lab, you must have:

Prerequisites

Estimated Time to Complete This Lab Computers used in this Lab



The ability to work in a command line environment



An understanding of Active Directory administration tasks



An understanding of Windows PowerShell concepts and tasks

60 Minutes

BAL-DC-01

The password for the Administrator account on all c omputers in this lab is: Passw0rd!

Page 1 of 12


Exercise 1 Using the Active Directory Administration Center Scenario In this exercise you will use the new Active Directory Administration Center to perform some common Active Directory management tasks. By performing these tasks, you will learn how basic administration and navigation of large Active Directory structures is made easier using the new tools.

Tasks

Detailed Steps

Complete the following task on:

Note: In this task you will use the new Active Directory Administrative Center to perform some common administrative tasks. The purpose of this exercise is to become familiar with the n avigation and use of the new interface.

BAL-DC-01 1.

Explore the Administrative Center Interface

a. On the Start menu, point to Administrative Tools and then click Active Directory

Administrative Center . b. In Active Directory Administrative Center, in the Reset Password tile, in User

name, type Woodgrovebank\BobSmith and then press TAB. Note: The user name is checked and a warning is displayed that the username is invalid. c.

In Active Directory Administrative Center, in the Reset Password tile, in User name, type Woodgrovebank\DonHall and then press TAB .

Note: Notice that the user account was validated by the tool. d. In Password and in Confirm Password type Passw0rd!2 and then click Apply.

Note: The reset password tile is one of many tiles that can be added to the Overview page. Each tile allows common tasks to be completed quickly and without navigation to the actual object. e. In the upper right of the Administrative Center Overview pane, click Add Content.

Note: The Add Content menu allows you to add additional task-based tiles to the Overview page. You can add the tiles that allow you to complete your most common tasks. f.

In the Active Directory pane, click the fly -out menu next to Woodgrovebank (local). The fly-out menu is shown below.

g. Using the fly-out menu, navigate to America\Washington\King and double-click

Redmond. Note: You can use the Find in this column text box to type the first few letters of the item you are looking for to speed navigation. h. Under Redmond, click Abigail Heiford and then in the Tasks pane, click Enable.

Page 2 of 12

Windows Server 2008 R2: What’s New in Active Directory Tasks

Detailed Steps

2.

Note: In this task you will use the Active Directory Administrative Center to create and modify both user and group accounts.

Creating and Modifying User and Group Accounts

In Active Directory Administrative Center, ensure you are in the America\Washington\King\Redmond organizational unit. a. In the Tasks pane, click New and then click User. b. In the Create User dialog box, create a new user account with the properties

defined in the following table and then click OK. Note: If a property is not listed in the table, you may omit it in the dialog box. Property

Value

First Name

Alice

Last Name

Ciccu

User UPN logon

AliceCiccu

Password Options

Select Other password options and then check Password never expires.

Password and Confirm Password

Passw0rd!

Note: Note the large number of user properties you can modify in the create user dialog box. c.

In the Tasks pane, click New and then click Group.

d. In the Create Group dialog box, create a new group account with the properties

defined in the following table and then click OK. Note: If a property is not listed in the table, you may omit it in the dialog box. Property

Value

Name

RedmondSupport

Protect from Accidental Deletion

Checked

Managed By

Anna Keyes Click Edit to modify the managed by value. Use the Advanced button to search for her.

Members

Alice Ciccu Click Add to modify group membership.

e. In the Contents pane, click Alice Ciccu and then in the Tasks pane, under Alice

Ciccu, click Properties. Note: You may need to refresh your view by pressing F5 if do you not see Alice Ciccu . f.

In the Alice Ciccu dialog box, next to Organization, click the Collapse button.

g. Next to Profile, click the Close button.

Note: The properties dialog box allows you to customize the available administration panes.

You can add closed sections by clicking the Add Sections menu and checking the sections you want to add back in. h. Under Extensions, on the Dial-in tab, click Allow access.

Page 3 of 12


Detailed Steps Note: Many properties are accessible through the new property panels; however any additional extensions are available via the extensions panel. This ensures that any third party add-ins for Active Directory U sers and Computers still function without modification. i.

Click OK to close the Alice Ciccu dialog box.

j.

Close the Active Directory Administrative Center.

Page 4 of 12


Exercise 2 Working with Active Directory using the Active Directory PowerShell Module Scenario In this exercise you will use the Windows PowerShell Integrated Scripting Environment (ISE) to administer Active Directory. As a reference, the major components of the ISE a re labeled below.

Tasks

Detailed Steps


Note: This exercise makes extensive use o f Windows PowerShell. To assist you, you can use the up arrow key to recall previous commands and use tab completion to help quickly type commands.

BAL-DC-01 1.

Using the Windows PowerShell Graphical Console to Work with User and Group Accounts

In this task you will use the PowerShell V2 Graphical Console to perform b asic user and group administrative tasks. You will begin by loading the Active Directory module, exposing over 75 Active Directory Cmdlets. You will then use these Cmdlets to administer Active Directory. a. On the Start menu, navigate to All Programs\Accessories\Windows PowerShell

and then click Windows PowerShell ISE . b. To load the Active Directory module and list the available Cmdlets, in the

Command Pane, type the following commands, pressing ENTER after each command: Import-Module ActiveDirectory Get-Module Get-Command *ad* c.

To browse your Active Directory domain using Windows PowerShell, in the Command Pane, type the following commands, pressing ENTER after each

Page 5 of 12


Detailed Steps

command: Note: You can press the TAB key to auto complete many of these commands and save a great deal of typing. Cd AD: PWD DIR | Format-Table -Auto CD "DC=Woodgrovebank,DC=com" DIR | ft –a

Note: This series of commands shows you how you can navigate Active Directory like a file system and format output using standard Windows PowerShell commands. d. To list the content of the users container and then enable the Guest account, in

the Command Pane, type the following commands, pressing ENTER after each command: Note: If you see a repeated command, such as the third command in this series, you can use the up arrow to retrieve the previous instance of the command instead of retyping it. CD CN=Users Dir | ft –a Get-ADObject –Filter {name -like “*”} Get-ADUser –Filter {name -like “*”} Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto Enable-ADAccount –Identity Guest Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto e. To display information about the user Don Hall in the Managed Objects OU, in the

Command Pane, type the following commands, pressing ENTER after each one. CD .. cd ‘OU=Managed Objects'

Get-ADuser -Filter {Name -eq "Don Hall"} Get-ADuser -Filter {Name -eq "Don Hall"} –Properties * f.

To query information on the Domain Administrators group, in the Command Pane, type the following command and then press ENTER: Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree Filter {Name -Like "*Domain Admins*"} -Properties *

g. To add Don Hall to the Domain Administrators group, in the Command Pane, type

the following command and then press ENTER: Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree Filter {Name -Like "*Domain Admins*"}| Add-ADGroupMember -Member DonHall

2.

Using the Windows PowerShell Graphical Console to Work with Domains and Domain Controllers

Note: In this task you will use Cmdlets that relate to the domain and to domain controllers to display information about items such as password policies and FSMO roles. a. To query information on the Woodgrovebank.com domain, in the Command

Pane, type the following command and then press ENTER: Get-ADDomain Woodgrovebank.com

Note: The output of this command allows you to easily determine things such as FSMO roles. b. To query information on the domain controllers in the Woo dgrovebank.com

domain, in the Command Pane, type the following command and then press ENTER: Get-ADDomainController –Discover

Page 6 of 12


Detailed Steps c.

To query information on the domain password policy in the Woodgrovebank.com domain, in the Command Pane, ty pe the following command and then press ENTER: Get-ADDefaultDomainPasswordPolicy Woodgrovebank.com

3.

Using Windows PowerShell Graphical Console to Create and Delete Organizational Units

Note: In this task you will use Cmdlets that relate to organizational units to create and delete an organizational unit. You will also use a Set Cmdlet to set properties on an organizational unit. a. To create a new organizational unit and display its properties, in the Command

Pane, type the following commands, pressing ENTER after each one: New-ADOrganizationalUnit –Name “Europe” –Path “DC=Woodgrovebank,DC=com” Get-ADOrganizationalUnit “OU=Europe,DC=Woodgrovebank,DC=com” –Properties * b. To delete the new organizational unit, in the Command P ane, type the following

commands, pressing ENTER after each one and clicking Yes to confirm deletion. Note: Note that the first command will result in an expected failure due to insufficient permissions, which the second command will re solve. Remove-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com” Set-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com” –ProtectedFromAccidentalDeletion $False Remove-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com”

Note: The ProtectedFromAccidentalDeletion property is used to add or remove an access control list to the OU which explicitly denies the delete permission for all users. This property is true by de fault for all container objects. c.

Close Windows PowerShell ISE.

Page 7 of 12


Exercise 3 Recovering Deleted Objects using Active Directory Recycle Bin Scenario In this exercise you will explore the new Active Directory Recycle Bin feature. The Active Directory Rec ycle Bin stores all deleted objects in a special container which allows easy recovery at a later time, preserving all object properties.

Tasks

Detailed Steps


Note: In this task you will enable the Active Directory Recycle Bin feature. Windows Server 2008 R2 does not automatically enable features as forest and domain functional levels are increased. Each feature m ust now be explicitly enabled. Features are enabled using the Enable-ADOptionalFeature PowerShell Cmdlet.

BAL-DC-01 1.

Enable the Active Directory Recycle Bin Feature

a. On the Start menu, point to Administrative Tools and then click Active Directory

Module for Windows PowerShell . b. To check the state of the Recycle Bin Feature, in Windows PowerShell, type the

following command and then press ENTER: Get-ADOptionalFeature –Filter {Name –Like “*”}

Note: The EnabledScopes property is currently empty, which indicates that this feature is not enabled.

The RequiredForestMode property indicates the prerequisites for enabling this feature. c.

To enable the Recycle Bin feature, in Windows PowerShell, type the following command and then press ENTER: Enable-ADOptionalFeature -Identity 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=woodgrovebank,DC=com' -Scope ForestOrConfigurationSet -Target 'woodgrovebank.com'

Note: This command will enable the Recycle Bin feature, which is disabled by default. d. To confirm the command, type Y and press ENTER.

Note: You must confirm this action, as once enabled, you cannot disable the Recycle Bin. e. To verify the Recycle Bin feature has been enabled, in Windows PowerShell, type

the following command and then press ENTER: Get-ADOptionalFeature –Filter {Name –Like “*”}

Note: You can review the value of EnabledScopes to ensure that the Recycle Bin is enabled.

2.

Move Objects to the Recycle Bin

Note: In this task you will move o bjects to the Recycle Bin by deleting them. All deleted objects are automatically moved to the Recycle Bin once the feature is enabled. a. On the Start Menu, point to Administrative Tools and then click Active Directory

Administrative Center . b. Navigate to the America\Washington\King\Redmond organizational unit.

Page 8 of 12


Detailed Steps c.

Delete the user account Alice Ciccu.

d. Delete the group account RedmondSupport.

Note: You can use the search feature at the top of the window to find the group.

You will also need to uncheck Protect from accidental deletion from within the group properties. e. Delete the Redmond organizational unit. f.

3.

Verify Objects are Now in the Recycle Bin

In the Confirm Subtree Deletion dialog box, check Use delete subtree server control and then click Yes.

Note: In this task you will use Windows PowerShell to query the contents of the Active Directory Recycle Bin. Objects that have been deleted are moved to this location and have their distinguished name adjusted to reflect the fact that they are a deleted object, and also to avoid conflicts when multiple objects of the same common name are deleted. a. On the Start menu, point to Administrative Tools and then click Active Directory

Module for Windows PowerShell . b. To display the contents of the Recycle Bin, in Windows PowerShell, type the

following command and then press ENTER: Get-ADObject –SearchBase “CN=Deleted Objects,DC=Woodgrovebank,DC=Com” – ldapFilter “(objectClass=*)” -includeDeletedObjects

Note: This command displays the entire contents of the Recycle Bin.

Leave the output of this command on the screen as you will use it in the next task. c.

To verify the Alice Ciccu user object is in the Recycle Bin, in Windows PowerShell, type the following command and then press ENTER: Get-ADObject –Filter {Name –Like “*Alice Ciccu*”} –SearchScope Subtree – includeDeletedObjects | Format-List

Note: The output of this command will show the details for the Alice Ciccu user object.

Note the distinguished name indicates this object is in the AD Recycle Bin. d.

In Windows PowerShell, type the following command and then press ENTER: Get-ADObject –Filter {Name –Like “*Redmond*”} –SearchScope Subtree –IncludeDeletedObjects | Format-List

Note: The output of this command will show the details for the RedmondSupport user group as well as the Redmond OU.

Note the distinguished name indicates this object is in the AD Recycle Bin. 4.

Recover Deleted Objects

Note: In this task you will use the Recover-ADObject PowerShell Cmdlet to recover objects that have been deleted from Active Directory.

Ensure Active Directory Module for Windows PowerShell is open. a. In Windows PowerShell, copy the objectGUID value for the object Alice Ciccu to

the clipboard. Note: To copy text from a command prompt, right click and then select Mark. Highlight the text to copy and then press ENTER.

To paste, right click and then click Paste. b. To attempt to restore the Alice Ciccu user account, in Windows PowerShell, type

the following command and then press ENTER: Note: To complete the following command, copy the value of the objectGUID property from the Alice Ciccu object. Restore-ADObject –Identity

Page 9 of 12


Detailed Steps Note: The command fails with an error message indicating that the object’s parent object does not exist.

You can then query for the last known parent of the object and re store that object. c.

To identify the last known parent of Alice Ciccu, in Windows PowerShell, type the following command and then press ENTER:

Note: To save typing, use the up arrow key to locate the previous search command and append the additional parameters to it. Get-ADObject –Filter ‘Name –Like “*Alice Ciccu*”’ –SearchScope Subtree – includeDeletedObjects –properties lastKnownParent | Format-List

Note: This command displays the last known parent object, which, you can tell, is also in the Recycle Bin. d. To restore the OU which contains Alice Ciccu, in Windows PowerShell, type the

following command and then press ENTER: Note: To complete the following command, copy the value of the objectGUID property from the Redmond object which can be found from the output of the last command in Step 3 in the Verify Objects are Now in the Recycle Bin exercise. Restore-ADObject –Identity e. To restore the Redmond OU Objects, including Alice Cic cu, in Windows

PowerShell, type the following command and then press ENTER: Get-ADObject –ldapFilter “(lastKnownParent=OU=Redmond,OU=King,OU=Washington,OU=America,DC=Woodgr ovebank,DC=com)” –includeDeletedObjects | Restore-ADObject

Note: This command lists all objects that have the last known parent attribute as the Redmond OU and pipes them into the Restore-ADObject Cmdlet.

5.

Verify that Deleted Objects have been Recovered

Note: In this task you will review Active Directory to ensure that the deleted objects have been recovered. a. If not open, on the Start Menu, point to Administrative Tools and then click Active

Directory Administrative Center . Note: Ensure you refresh your view in Active Directory Administrative Center after you make changes to ensure you see those changes. b. Navigate to the America\Washington\King OU. c.

Verify that the Redmond OU is present.

d. Navigate to the Redmond OU. e. Verify that the user accounts, including Alice Ciccu , are present. f.

Verify the group RedmondSupport is present.

Page 10 of 12


Exercise 4 Pre-Deploying Computer Accounts using Offline Domain Join Scenario In this exercise you will complete the tasks required to provision a n account for offline domain join. Offline domain join involves two steps. In the first step you will provision a computer account in Active Directory and save the account information in a file. In the second step you will use that file in a command that inserts the domain join information into an offline version of Windows.

Tasks

Detailed Steps


Note: In this task you will use the DJoin command to provision a computer account in Active Directory for offline domain join. The result of this task is a file that can be merged into an offline copy of Windows, ensuring that the first time the computer starts it is domain joined.

BAL-DC-01 1.

Provision a Computer Account for Offline Domain Join

a. On the Start menu, click Command Prompt. b. To provision a new computer account, in the Command Prompt, type the

following command and then press ENTER: DJOIN /Provision /Domain Woodgrovebank.com /Machine BAL-SRV-10 /SaveFile BALSRV-10.DJoin

Note: This command creates a computer account in Active Directory and stores the computer account password and related information in a n encrypted file. The encrypted file can then be used to offline domain join a computer. c.

To display the contents of the provisioning file, in the Command Prompt, type the following command and then press ENTER: Type BAL-SRV-10.DJoin

Note: The contents of the .DJoin file are encrypted.

2.

Verify the Computer Account has been Created in Active Directory

Note: In this task you will look at Active Directory to verify that the offline domain join has correctly created the computer account for BAL -SVR-10. a. On the Start menu, point to Administrative Tools and then click Active Directory

Administrative Center . b. Navigate to Woodgrovebank (local)\Computers .

Note: Note that the computer account BAL-SRV-10 has been created.

3.

Review the Process to Perform an Offline Domain Join

Note: In this task you will type the command used to perform an offline domain join operation. This command will use the contents of the saved file created in the previous task to insert domain join information into the c omputer’s registry without having to start the operating system. This command can be run on an offline copy of Windows such as a WIM file or VHD which has been mounted.

Begin this task with a command p rompt window open. a. To perform an offline domain join, use the following command:

Page 11 of 12


Detailed Steps Note: Do not execute this command. It is provided for reference purposes only. DJOIN /Requestodj /LoadFile BAL-SVR-10.DJoin /WindowsPath \Mount\Windows

Note: This command is used to perform the offline domain join.

This command is intended to be run against an offline copy of Windows such as a WIM file or VHD that has been mounted as a drive or folder in the file system.

Page 12 of 12

Whats New Inactive Directory

Recommend Documents