Server in the Enterprise - Instruktion Lab 1 Implementing Directory Services Using NT 4 Server · Establishing and Testing a One-Way Trust Relationship Implementing a One-Way Trust Relationship Note: After the trust relationship has been established, you will view the domain names that appear in the Domain box of the Logon dialog box. During this lab, the trusted domain (with accounts) will be referred to as DomainX. The trusting domain (with resources) will be referred to as DomainY. To configure DomainY as a trusting domain Note: Complete this procedure from the PDC of DomainX Log on as Administrator Start User Manager for Domains On the Policies menu, click Trust Relationships. The Trust Relationships dialog box appears To the right of Trusting Domains, click Add. The Add Trusting Domain dialog box appears In the Add Trusting Domain box, type DomainY (the name of the trusting domain) Do not use a password. Leave Initial Password and Confirm Password blank Click OK. The name of DomainY, the trusting domain, appears in the Trusting Domains box. Click Close This is first stage of implementing a one-way trust between domain. You have permitted DomainY (the trusting domain) to trust DomainX (the trusted domain) · To complete the one-way trust relationship Note: Complete this procedure from the PDC of DomainY. Wait until DomainX has permitted DomainY to trust. Log on as Administrator Start User Manager for Domains On the Policies menu, click Trust Relationships. The Trust Relationships dialog box appears To the right of Trusting Domains, click Add. The Add Trusting Domain dialog box appears In the Add Trusting Domain box, type DomainX (the domain you are going to trust) Do not use a password. Leave Password blank because the trusted domain did not assign a password to your domain Click OK If you do not receive a message indicating the trust relationship was successfully established, what message did you receive? Take corrective action as indicated in the message …The User Manager for Domains information box appears, indicating the trust relationship was successfully established. Click OK. The name of DomainX appears in the Trusted Domains box. Click Close DomainY now trusts DomainX. This means that a user sitting at a computer located in DomainY can log on from DomainX using his /her DomainX user account. · Logging on Trough the trust Note: When you are requested to log on from a domain, select domain name in the Domain box of the Welcome dialog box, and then complete the logon process · To create the users Note: Complete this procedure from the PDC of DomainX (the trusted domain) Log on as Administrator Create three user accounts: AAAAA, BBBBB, CCCCC. These accounts should be: only a member of the default group Domain Users, not require the user to change the password at next logon, not exist in DomainY · To identify the domains trusted by DomainX Note: Complete this procedure from the PDC of DomainX (the trusted domain) Log off Press CTRL+Alt+Del to use the Logon Information dialog box In the Domain box, display the available domains What names appear in the Domain box of a trusted domain? Log on as Administrator · To identify the domain trusted by DomainY Note: Complete this procedure from the PDC of DomainY (the trusting domain) Log off Press CTRL+Alt+Del to use the Logon Information dialog box In the Domain box, display the available domains What names appear in the Domain box of a trusting domain? · To complete the logon process Note: Complete this procedure from the PDC of DomainY (the trusting domain) Attempt to log on from DomainY as the user named AAAAA. DomainY should by appear in the Domain box Where you able to log on? Why or why not? Attempt to log on from DomainX as the user named AAAAA. DomainX should appear in the Domain box to indicate that you want be validated by the user accounts database of DomainX Where you able to log on? Why or why not? By logging on from DomainX while your computer is a member of DomainY, you have verified that a trust relationship exists Administering Domains Across Trust Relationship · To create global groups Note: Complete this procedure from the PDC of DomainX (the trusted domain) Log on as Administrator, from DomainX Start User Manager for Domains, and then create the global group RESEARCH-ALL. Add AAAAA, BBBBB, CCCCC as members of this group Remove any other members from the group Create the global group RESEARCH-MGM. Add AAAAA as a member of this group Remove any other members from the group · To configure a trusting domain for administration across a trust relationship Note: Complete this procedure from the PDC of DomainY (the trusting domain) Log on as Administrator, from DomainY Start User Manager for Domains, click the Administrators group, and then on the User menu, click Properties Click Add In the List Names From box, click DomainX In the Names box, click Research-Mgm, and then click Add Click OK In the Members box, how is the Research-Mgm group referenced? Click OK · To administer a trusting domain Note: Complete this procedure from the PDC of DomainY (the trusting domain) Log on as AAAAA from DomainX Start User Manager for Domains. Title bar of User Manager for Domains indicates DomainX, your logon domain. You want to create a local group in DomainY On the User menu, click Select Domain Click DomainY, and then click OK. Title bar of User Manager for Domains indicates DomainY In DomainY, create the local group RESEARCHERS. Add the DomainX\Research-All group as a member of this group Remove any other members from the group Close User Manager for Domains Start My Computer, open the C: drive, and create a new folder called Soles Share the Soles folder with the share name Soles. Assign the local group RESEARCHERS Full Control permissions to the shared folder and remove permissions for Everyone. Why is user AAAAA to perform administrative tasks (sharing the directory) on DomainY, the trusting domain Accessing Resources Through the Trust · To log on and use the share from DomainX Note: Complete this procedure from the PDC of DomainX (the trusted domain) Log off and then log on as CCCCC from DomainX Connect to the Soles shared folder on the DomainY PDC Verify that you have full access to the resource by using Notepad to create and save a file in Soles · To log on and use the share from DomainY Note: Complete this procedure from the PDC of DomainY (the trusting domain) Log off and then logon as BBBBB from DomainX Connect to the Soles share on the DomainY PDC Verify that you have full access to the resource by using Notepad Why are users BBBBB and CCCCC able to use the resource? Establishing and Testing a Two-Way Trust Relationship · To permit DomainX to trust DomainY Note: Complete this step from the PDC of DomainY Log off and log on as Administrator from DomainY Using User Manager for Domains, add DomainX as a trusting domain · To complete the trust relationship from DomainX Note: Complete this step from the PDC of DomainX Log off and log on as Administrator from DomainX Using User Manager for Domains, add DomainY as a trusted domain · To create a user to test the trust Note: Complete this step from the PDC of DomainY Create a new user account, Janne. Janne should be: only a member of the default group Domain Users not have to change the password at the next logon not exist in DomainX · To assign permissions Note: Complete this step from the PDC of DomainY Add permissions for Janne to the existing Soles share on the PDC of DomainY using the following information: existing folder: Soles existing share name: Soles add Share Permissions: DomainY\ Janne with Full Control · To log on and use the share from DomainX Note: Complete this step from the PDC of DomainX Log off and then log on as Janne from DomainY Connect to the Soles shared folder on the DomainY PDC Verify you have full access to the resource by using Notepad to create and save a file in Soles Designing and Implementing the Domain Model · To implement trust relationships if you are a master/account domain Note: Complete this procedure from the PDC of each master/account domain Log on as Administrator to your domain Remove all existing trust relationships Using User Manager for Domains, permit each domain (including other master/account domains) as trusting domains. Do not use a password Using User Manager for Domains, make each of the other master/account domains a trusted domain. Do not use a password · To implement trust relationships if you are a resource domain Note: Complete this procedure from the PDC of each resource domain. In this procedure you will wait until the master/account domain have completed step 3 above, permitting your domain to trust thier domain, before you start Log on your domain as Administrator Remove all existing trust relationships Using User Manager for Domains, make each of the master/account domains a trusted domain. Do not use a password · To test the trust relationships Note: Complete this procedure from a domain controller in each domain. In this procedure you will wait until all trust relationships are established in the previous procedures Log off your computer Press CTRL+ALT+DEL to initiate the logon process What domain names should appear in the Domain box? Verify that these are the domain names you see. If not, contact your domain administrator to correct the trust relationship problem Designing and Implementing Administration of the Domain Model · Designing the Directory Service Structure For KillerApplications Company Basic Structure Design The Company has 60000 users located around the world. The corporate headquarters is in Geneva (Europe). North and South American headquarters are located in New York City. The Asia and Australia headquarters are located in Singapore. Each of the regional headquarters will maintain total control of users and equipment within thier areas. Users will require access to resources in the other regional headquarters (around the world). The three regional headquarters sites are connected by T1(possibly T3) lines. Each of the three regional headquarters has line of business applications that need to be available to all sites within thier areas as well as the other regional headquarters. These line of business applications are all running on NT based computers that will be configured as servers or workstations within the domains. The corporate databases (6 GB totally) are split to all regional headquarters. The KillApp Company working with strongly growing the share of the market. The amount of employees to be constantly, but traffic load to be an increase of 20 percent in the next 2 years. Additional groups info (all sites): corp_management (only Geneva) site_management junior_sales senior_sales development junior_officers senior_officers site_admins · Supplementary Structure Design for Asia/Australia Region You will be designing the NT Directory Services for Asia/Australia region. The design will take into account: Logon validation Pass-through authentication Additional info: The links between Singapore, Australia and Malaysia are typicaly operating at 70 percent of capacity. The Asia/Australia region has ten subsidiaries including Japan, Korea, China, Taiwan, Thailand, Singapore, Malaysia, Indonesia, Australia and New Zeland. In addition, Malaysia and Australia have major employees to which all regional subsidiaries will need access. Due to import restrictions with some of the subsidiaries, it has been decided to give control of the equipment to each subsidiary, and to have a resource domain in each subsidiary. The NT Workstations has recently been installed on most of the computers the subsidiares have purchased. The company has authorized redundant hardware where you can justify it. · Mandatory questions (use drawing(s) to show ansvers/solutions): How many domains will you need to configure? How many master domains will be configured? How many resource domains will need to be configured? How many PDCs will need to configure? How many BDCs will need to be configure? (Think about pass-throug validation and pass-through authentication) To which domain will the branch office sites belong? How many trusts will need to be configured?