Learn Active Directory Management in a Month of Lunches

A book by Richard Siddaway

• Active Directory provides a centralized service that links all machines in an organization and allows a user to log on and access any of them they have been granted permission to do so.

• Authentication, in AD terms, is the act of proving that you are who you say you are.

• You’re logging on to the domain, not an individual computer.
• Active Directory uses the Kerberos protocol for authentication.
• Time synchronization within your Active Directory is important because the time stamp is used during the authentication process.

• Authorization is the act of granting users appropriate access to resources—such as file shares, databases, applications, and mailboxes—once they’ve authenticated themselves to Active Directory. The concept of authorization is simply one of proving you have permission to do something.

• To simplify the process, when you log on a token is created on your local machine that contains your group memberships, privileges, and rights. This is presented to resources that you’re trying to access. The system will check the token to see if your permissions allow you access to the file or other resource, and either grant or deny access based on the data presented in your token.

• Important: access tokens are never transmitted across the network from one machine to another.
• Authentication and authorization are combined into the concept of identity management.

• FOREST
  • The forest is the whole of your Active Directory. It can contain one or more domains arranged in trees (that’s why it’s called a forest). The forest is named after the first domain created in the forest (known as the root domain, which can’t be changed).
  • All domains in a forest share a common Configuration container and a common schema.
  • The domains are linked together by transitive trusts that are automatically created when the domains are created.
    • NOTE: Transitive means that if A trusts B and B trusts C, then A also trusts C.
• DOMAIN
  • A domain is a container for the objects you’ll work with—users, computers, groups, and so on.
  • The domain provides a number of boundaries within the organization:
    • It’s an administration boundary. Domain administrators don’t have permissions in other domains.
    • It’s a security administration boundary. Permissions applied within the domain can’t affect objects outside the domain.
    • It’s a policy application boundary. Best practice is to limit the application of Group Policy to a single domain. Applying policies across domains will slow processing and make administration much harder.
  • A domain has a fully qualified Domain Name System (DNS) name as its unique identifier.
  • Domains can be arranged in a hierarchy (trees) with parent-child relationships.
    • But it has no administrative connotation. (An admin in parent domain is NOT an admin in child domain)

• ORGANIZATIONAL UNIT
  • An organizational unit (OU) is a container within a domain that can be used to hold user, computer, group, and other OU objects.
  • There are two main reasons to create an OU:
    • 1 To control the delegation of administrative privileges (a certain group of administrators can only control the users, groups, and computers in a certain OU).
    • 2 To control the application of Group Policy.

• Containers
  • There are a number of these, but the ones you’re most likely to come across are
    • Built-in, which stores a number of the default groups.
    • Users, which stores other default groups, especially the Domain Admins, Enterprise Admins, and Schema Admins. It’s also the default location for the creation of new users if a specific OU isn’t given.
    • Computers, which is empty when the domain is created but is the default location for the creation of computer accounts when a new machine is joined to the domain.
  • The major differences between a container and an OU are that Group Policy cannot be applied to a container and child OUs can’t be created within a container.

• NOTE
  • Think of the AD structures outlined in this section as analogous to a Russian nesting doll. Forests contain domains, which contain OUs, which contain users, groups, and computers.

…

…

…

…

Computer accounts are a specialized form of user account. In most organizations they’re put into separate organizational units (OUs) to make the Group Policy Object (GPO) application simpler.

IDEA: - make user groups to make administration of GPOs for our OUs simpler.

• User accounts:
  • “general” user account
  • group or other specialized mail boxes
  • service accounts

• A user account can be created using GUI tools or PowerShell.
• AD management tools which can create user
  • AD Administration Center (ADAC)
  • AD Users and Computers (ADUC)
  • PowerShell

• To create a new user, follow these steps:
  • 1 Open ADAC and navigate to the Users container.
  • 2 Choose New from the Tasks pane.
  • 3 Choose User.
  • 4 Complete dialog box.

• Creating a user account with ADUC is a similar process to that experienced with ADUC:
  • 1 Open ADUC.
  • 2 Right-click the required container—I used the Users container again.
  • 3 Choose New > User from the context menus.
  • 4 A screen similar to figure 2.3 will be displayed—complete the fields.

The following code can be used to create a new user:

$secpass = Read-Host "Password" -AsSecureString
New-ADUser -Name "GREEN Dave" -SamAccountName dgreen
➥ -UserPrincipalName "dgreen@manticore.org" -AccountPassword $secpass
➥ -Path "cn=Users,dc=Manticore,dc=org" -Enabled:$true

One way to reduce the amount of work you need to perform and reduce the chance of an error occurring is to use a template. This is a fully configured account that’s copied to form a new account.

• The usual starting point is to create each new user account from scratch. This can be performed using GUI tools or PowerShell. One alternative, used in many organizations, is to use a template from which to create new user accounts. The template could be a standard user account or a specially created account that’s used only as a template.

• If you’re creating a single account from template you can use: ADUC or PowerShell. (ADAC has no possibility to copy accounts)

• Using PowerShell involves the –Instance parameter of New-ADUser, as follows:

$secpass = Read-Host "Password" -AsSecureString
$user = Get-ADUser -Identity jgreen -Properties memberof, office
New-ADUser -Name "GREEN Bill" -SamAccountName bgreen
➥ -UserPrincipalName "bgreen@manticore.org"
➥ -AccountPassword $secpass -Path "cn=Users,dc=Manticore,dc=org"
➥ -Enabled:$true -Instance $user

• BUT(!): This technique (using PowerShell to copy users from template) doesn’t copy group memberships or other multivalue attributes. I recommend using ADUC for copying accounts.

• Any administrative action that has to be repeated should be automated.

$secpass = Read-Host "Password" -AsSecureString
Import-Csv names.csv |
foreach {
$name = "$($_.LastName) $($_.FirstName)"
New-ADUser -GivenName $($_.FirstName) -Surname $($_.LastName) `
-Name $name -SamAccountName $($_.SamAccountName) `
-UserPrincipalName "$($_.SamAccountName)@manticore.org" `
-AccountPassword $secpass -Path "cn=Users,dc=Manticore,dc=org" `
-Enabled:$true
}

• Managed service accounts are used to run services such as SQL Server, Exchange, and IIS on systems within your domain.
• The recommended approach is to use the New-ADServiceAccount PowerShell cmdlet.

… (not really important for me at this time)

… (not really important for me at this time)

• Create the process documentation for account creation, or revise previously existing documentation. This should include the way the business requests an account and how the communication of information is performed.

User account management can be summed up as CRUD (create, read, update, delete).

• The AD attributes you’ll need to modify fall into two broad groups—single value and multiple value.

…

• Modifying a single value is a simple matter of replacing the value that’s currently present with a value that you supply:

Set-ADUser -Identity "CN=GREEN Bill,CN=Users,DC=Manticore,DC=org" `
-OfficePhone "01234 567895"

• Modifying a property containing multiple values:

Set-ADUser -Identity "CN=GREEN Bill,CN=Users,DC=Manticore,DC=org" -Replace @{otherTelephone="01234 567896","01234 567897"}

• Modifying the additional phone numbers uses a slightly different approach. Use Set-ADUser again, but instead of the named parameter, use one of the generic parameters:
  • Add - adds one or more values to a property
  • Clear - clears all values of a property
  • Remove - removes one or more values from a property
  • Replace - replaces the values of a property with the values you supply

• When you use the Add, Remove, Replace, and Clear parameters together, the operations will be performed in the following order:
  • 1 Remove
  • 2 Add
  • 3 Replace
  • 4 Clear

Copying attributes with GUI tools is a bit long-winded, and you’ll soon get bored if you have to do this for a number of users.

A little bit of PowerShell can make your life much easier:

$source = Get-ADUser -Identity bgreen -Properties OfficePhone, otherTelephone
Set-ADUser -Identity "CN=GREEN Dave,CN=Users,DC=Manticore,DC=org"
➥ -OfficePhone $($source.OfficePhone)
➥ -Replace @{otherTelephone = $($source.otherTelephone)}

• TIP: Notice that the samAccountName is used in Get-ADUser, but the distinguished name is used in Set-ADUser. Either can be used with the identity parameter (you’ll see both used throughout the book). Details of other attributes that can be used with the -Identity parameter are given in appendix A.

Disable with PowerShell:

Disable-ADAccount -Identity dgreen

Enable with PowerShell:

Enable-ADAccount -Identity dgreen

• With GUI Tools
  • … (usually something like: right click → Delete)
  • …

• With PowerShell:

Remove-ADUser -Identity dgreen -Confirm:$false

Leave off the -Confirm:$false if you want a message to force you to confirm the action. Not a bad idea with deletes!

…

…

• AD groups are objects that act as containers for users, computers, and other groups. Groups are used to make the management of users easier, especially when it comes to granting permissions to access resources. … For now, just remember that you should apply permissions to groups, not users.

• AD groups provide a way to make your day-to-day work more efficient. You allocate permissions to a group, and all of the users in the group get those permissions. You do the task once for the group instead of individually for the tens or hundreds of users in the group.

• Two categories of groups:
  • security groups
  • distribution lists

• These categories can span a number of scopes:
  • Domain Local
  • Global
  • Universal.

• Groups can be split into two categories:
  • Security groups
    • The subject of this chapter; primarily used to assign permissions
  • Distribution lists
    • Used in Exchange to send emails to multiple recipients

• An AD group can have one of three scopes:
  • Domain Local
    • Membership from: any domain in forest
    • Apply in: domain where it is
    • Nestable in: local domain groups from same domain
  • Global
    • Membership from: domain in which it is
    • Apply in: any domain in forest
    • Nestable in:
      • global groups from same domain
      • any domain local or universal group
  • Universal
    • Membership from: any domain in the forest
    • Apply in: any domain in the forest
    • Nestable in: any domain local or universal group

• The official Microsoft way to use groups is shown in figure 4.1.
  • User accounts (or computers or other allowed groups) are added to a Global group.
  • Global groups are added to Domain Local groups,
  • which are then added to Access Control Lists (ACLs). The ACLs control access and rights to resources such as shares, folders, files, and printers

…

• AD groups have a very simple lifecycle:
  • 1 Creation
  • 2 Use and modification of membership
  • 3 Deletion

• You can create a group using the GUI tools or with PowerShell. You need the following information to create a group:
  • 1 Container or OU where you’re creating the group
  • 2 Group name
  • 3 Group samAccountName
    • Ensure you supply the samAccountName with non-Microsoft cmdlets or scripts, because Active Directory will create one for you if you don’t. The samAccountName will be random characters of the form $K46000PFVI6U20JC9D, which isn’t easy to remember!

• CREATING A GROUP WITH ADAC
  • …

• CREATING A GROUP WITH ADUC
  • …

• CREATING A GROUP WITH POWERSHELL

New-ADGroup -Name PStest -Path "CN=Users,DC=Manticore,DC=org"
➥ -GroupCategory Security -GroupScope Global
➥ -Description "Test group for AD Lunches"

• The group cmdlets are used to manage the group lifecycle:
  • New-ADGroup — creates a group
  • Set-ADGroup — modifies group properties
  • Remove-ADgroup — deletes a group
  • Get-ADGroup — searches for groups

• A similar set of cmdlets is used to modify group membership:
  • Add-ADGroupMember — Adds a member to a group
  • Remove-ADGroupMember — Deletes a member from a group
  • Get-ADGroup — Lists the members of a group

• Changing a group’s scope is slightly more complicated because there are a number of restrictions on the possible changes, as shown in table 4.3.
  • …
• A Universal group can be changed to a Global or Domain Local group, as shown in table 4.3. A Global group can’t be changed into a Domain Local group directly — it has to first be made into a Universal group. Changing from a Domain Local to a Global group also has to be via a Universal group.

• Change group scope with PowerShell:

Set-ADGroup -Identity ADL-group1 -GroupScope Universal
Set-ADGroup -Identity ADL-group3 -GroupScope Universal
Set-ADGroup -Identity ADL-group3 -GroupScope DomainLocal

• Deleting a group is a task you need to perform when the group is no longer required. In GUI tools, right-click the group and choose Delete.
• With PowerShell, use this code:

Remove-ADGroup -Identity ADL-Test3 -Confirm:$false

• NOTE Protect from Accidental Deletion will prevent deletion if it’s enabled. Remember to remove the protection before deletion.

• In GUI tools, the group membership dialog is accessed by right-clicking the group and choosing Properties.

Get-ADGroupMember -Identity ADL-group1 | select Name, DistinguishedName
 
Add-ADGroupMember -Identity ADL-group1 -Members "CN=GREEN Bill,CN=Users,DC=Manticore,DC=org"
 
#  Remember, you can search for the user to add to the group:
Add-ADGroupMember -Identity ADL-group1 -Members (Get-ADUser -LDAPFilter "(Name=Green Bill)")
 
Remove-ADGroupMember -Identity ADL-group1 -Members bgreen -Confirm:$false

…

• In many organizations there isn’t a naming convention for groups—think about establishing one if your organization doesn’t have one.
• If your groups don’t have descriptions, think about adding them as you’re working with individual groups.
• Don’t sit and do all groups in one pass. Add them as you manage them.
• An activity that comes up from time to time is copying the group membership from one user to another. How could you do that?

• AD-related problems for users usually come down to two things:
  • They can’t log on.
  • They can’t access a resource.

• Your working assumption is that there’s a problem with his account. You need to investigate his account. You could do that in a number of ways:
  • Searches using the GUI tools (⇒ not really good)
  • Manual inspection using the GUI tools (good if you know the user name of particular user)
  • PowerShell scripts (most easier way)

• This is indicated by a small downward-pointing arrow superimposed on the bottom right of the icon representing

the user.

• Alternatively, use PowerShell:

# This code will display a list of disabled accounts.
 
Search-ADAccount -AccountDisabled | select Name, samAccountName
 
# If your user is in the list, enable the account like this:
 
Get-ADUser -Identity dgreen | Enable-ADAccount

• … (Check account status using ADAC) …
• … (Check account status using ADUC) …

• ADUC supplies a date picker popup, but ADAC expects you to type in the date.

• PowerShell can be used to search for expired accounts, as follows:

Search-ADAccount -AccountExpired | Format-Table Name, SamAccountName, DistinguishedName, AccountExpirationDate -AutoSize

• Once you’ve identified the expired account, a new date can be set like this:

Get-ADUser -Identity dgreen | Set-ADAccountExpiration -DateTime (Get-Date).AddDays(30)
 
# Alternatively, you could set a specific date using code like this:
 
Get-ADUser -Identity dgreen | Set-ADAccountExpiration -DateTime ([datetime]'11/25/2013')
 
# WARNING: If you use this technique, the date must be presented as month/day/year. 

• Remove the expiry date entirely:

Get-ADUser -Identity dgreen | Clear-ADAccountExpiration

• AD passwords need to be changed every 42 days by default.

• Neither of the GUI tools supply a direct way to see if the password has expired.

• The Search-ADAccount cmdlet can provide information on accounts with expired passwords:

Search-ADAccount -PasswordExpired

• Passwort reset with GUI tools
  • …
• Performing a password reset in PowerShell is a bit more difficult:

$password = Read-Host -Prompt "Password" -AsSecureString
$id = "dgreen"
Set-ADAccountPassword -Identity $id -NewPassword $password -Reset
Set-ADUser -Identity $id -ChangePasswordAtLogon:$true

• If you open ADAC and look at the properties of the user, you’ll see the padlock symbol. ADUC shows at “Account” Tab a check box named as “Unlock account”.
• PowerShell
  • cmdlet to find locked accounts: Search-ADAccount -LockedOut
  • to unlock: Search-ADAccount -LockedOut | Unlock-ADAccount

• Groups are used to give access to resources such as file shares and applications. You’ll get calls such as “I can’t access file share X.” That usually means the user isn’t in the right group.

$target = Get-ADUser -Identity mgreen -Properties memberof
foreach ($member in $target.memberof){
  Remove-ADGroupMember -Identity $member -Members $target -Confirm:$false
}
 
$source = Get-ADUser -Identity dgreen -Properties memberof
foreach ($member in $source.memberof){
  Add-ADGroupMember -Identity $member -Members $target -Confirm:$false
}

…

…

…

…

• check what can be made better in your organization

• …
• The computer needs to join the domain, which may happen with a preexisting account, or the account can be created as the machine joins the domain.
• …

• Computers container is the default location for computer accounts, but you can create an account in any OU.
• …

• …

• ADAC is built on top of PowerShell.
  • Note: The Windows PowerShell History window is normally minimized. You open it by clicking on the upward-pointing arrow at the bottom-right corner of the ADAC GUI.
• The code that ADAC generates can be overly verbose. A simplified version would be:

New-ADComputer -Enabled $true -Name ADLComp3 `
-Path "CN=Computers,DC=Manticore,DC=org" `
-SamAccountName ADLCOMP3

• The other way to generate a computer account is to create one as the system joins the domain.

• A number of prerequisites needs to be in place before you can join the computer to the domain:
  • The machine should be configured with the address of at least one DNS server that manages the DNS zone for your Active Directory.
  • You need local administrator permissions on the machine.
  • You need the account name and password of a user account that has permissions to join the machine to the domain.
  • Ideally, the machine should have been renamed to the name you want it to have in Active Directory.

• That can be done using Control Panel on the computer (which should join the domain). The computer account will be created in the default location, usually the Computers container.

• The following code can be used to join a machine to the domain:

$cred = Get-Credential
Add-Computer -Credential $cred -DomainName Manticore `
-OUPath "OU=Security Servers,OU=Servers,DC=Manticore,DC=org" -Force
Restart-Computer

• NOTE: this code should be executed on the machine, which should join the domain.

• All computers (Windows 2000 and later) in an AD domain communicate with a domain controller. They authenticate over that channel every time the machine is restarted.
• A password is used to authenticate the machine. This password is automatically reset every 30 days—you don’t have to do anything, it just happens. The secure channel is a robust mechanism and usually doesn’t go wrong.
• A simpler approach to test secure channel is to use the PowerShell that the secure channel is the cause of the problem is the Test-ComputerSecure-Channel cmdlet.
• You can test and fix in one go:

if (-not(Test-ComputerSecureChannel)){
  Test-ComputerSecureChannel -Repair –Verbose
}

• You can run the following PowerShell snippet to discover inactive (haven’t logged on to the domain) computer accounts:

Search-ADAccount -AccountInactive -ComputersOnly | Format-Table Name, DistinguishedName, LastLogonDate, ObjectClass -Autosize

• This script has some drawbacks:
  • …
• Better version (search for computer accounts that have been inactive for 90 days):

Search-ADAccount -AccountInactive -ComputersOnly -TimeSpan "90:00:00"|
where ObjectClass -eq "Computer" |
Format-Table Name, DistinguishedName, LastLogonDate, ObjectClass -Autosize

• …
• In a situation where you have many objects to delete, this can be achieved using a PowerShell script:

Import-Csv -Path C:\Scripts\ADLunches\computersTodelete.txt |
foreach {
Remove-ADComputer -Identity $_.Name -Confirm:$false
}

…

…

…

…

…

• Use the scripts in this chapter to create a mechanism for removing expired accounts. Hint: make it a two-stage process to find the expired accounts and examine them to determine which to delete. Then perform the deletion.
• Create a process for the bulk creation of computer accounts.
• Create a script that tests the service-pack level of your computers. You can then proactively start reporting which machines need to be service packed.

• An OU is a container within a domain that can be used to hold user, computer, group, and other OU objects.

• Two main reasons to create an OU:
  • To control the delegation of administrative privileges—that is, a certain group of administrators can only control the users, groups, and computers in a certain OU
  • To control the application of Group Policy

• OUs can’t be assigned permissions, so you can’t use them in place of groups.

• In your Active Directory you’ll also find objects called containers that are created with the domain. There are a number of these, but the ones you’re most likely to come across are:
  • Builtin, which stores a number of the default groups.
  • Users, which stores other default groups, especially the Domain Admins, Enterprise Admins, and Schema Admins. It’s also the default location for the creation of new users if a specific OU isn’t given.
  • Computers, which is empty when the domain is created, but is the default location for the creation of computer accounts when a new machine is joined to the domain.

• The major differences between a container and an OU are:
  • that Group Policy cannot be applied to a container
  • and that child OUs can’t be created within a container.

• OUs hirarchy can be “too deep”, because too many GPOs can make problems (e.g. longer log on process for users etc). So keep maximum depth under 6 or so.

Renaming an OU 84 ■ Adding a description to the OU 84 Changing the Managed By setting 85 ■ Deleting an OU 86 xii CONTENTS

Creating OUs 88 ■ Renaming OUs 88 ■ Setting descriptions and Managed By 89 ■ Moving objects between OUs 89 ■ Deleting an OU 90

• 2.2 User creation from template
  • use templates to create users can be a good idea

• 5.5 Group membership
  • it is possible to get/set groups using PowerShell script
    • Q: is it really good to do it in our case?
    • Q: if it is good in our case, maybe it will be good to define groups not directly in script, but to get them from a “template user”?