AD DS - User Account

What is a user account?

User accounts give access to domain resources

In AD DS, all users who require access to network resources must have a user account. A user account is an AD DS object that contains all the information that's required to authenticate and authorize the user during the sign‑in process and build the user's access token.

With a user account, you can:

• Allow or deny users permission to sign in to a computer based on their user account identity.
• Authenticate users to the AD DS domain and give access to network resources.
• Grant users access to processes and services for a specific security context.
• Manage users’ access to resources such as properties, shared folders, files, directories, and printer queues.

How to create user accounts

Creating user accounts is easy

When you create a new user account, you must provide the Full Name, User Logon Name, and Password options.

1. Full Name. The First name and Last name attributes combine to create the Full name attribute. Full name is used as the Common Name (CN) and it must be unique within the container or OU.
2. User Logon Name. The User Logon follow the format user logon name@domain suffix.  The Domain Name System name of your domain is always available as a suffix. However, you can add other suffixes if they are needed.
3. Password. Several password options are available. As a best practice, you should always select User must change password at next logon.  This property enables you to force users to reset their password the next time that they log on. This is typically something that you might enable after you reset a user’s password.

How to add user account attributes

User accounts have many additional attributes

After you create a user account, you can configure additional account attributes. There are many attributes. Therefore, you must understand what these attributes are, and how you can use them in your organization.

The attributes of a user object fall into several broad categories: Account, Organization, Member of, Password Settings, Profile, and Extensions. The Account page has most of the day to day user information that's of interest.

1. Log on hours. This property defines when the account can be used to access domain computers. You can use the weekly calendar style view to define Logon permitted hours and Logon denied hours. For example, you could limit contractor or temporary personnel to certain office hours.
2. Log on to. Use this property to define which computers a user can use to log on to the domain. Specify the computer’s name and add it to a list of allowed computers.  For example, you could restrict access to a specific workstation in a department area.
3. Account expires

• (Never). If you set this value, you must remember to periodically update the password. However, you aren't forced to do this at a predetermined interval. Therefore, the account can never be locked out because of password expiration—a feature that's specifically important for service accounts.
• (End of). This setting is useful when you want to create temporary user accounts. For example, you might want to create user accounts for interns who will be at your company for just one year. You can set the account expiration date in advance

Windows Server Infrastructure - Basics

Question: What is an Organizational Unit (OU) and why would you create additional OUs?
Show Answer
An OU is an object in a domain that you can use to store user objects, computer objects, group objects, and other AD DS objects. You typically create additional OUs when you want to delegate control to a specific group or link a Group Policy Object to the OU.


Question: What are the five flexible single master operations (FSMO) roles and where do they exist?
Show Answer
FSMO roles are special roles within a forest and domain. There are two FSMO roles at the forest level: Schema Master and Domain Naming Master. There are three FSMO roles at the domain level: RID Master, Infrastructure Master, and PDC Emulator.

Question: What is a trust relationship and which type of trust relationship is used to improve user logon times between two domains in a forest?
Show Answer
Trust relationships are authentication pipelines between different domains. Shortcut trusts can be used to improve user logon times between two domains in an Active Directory forest.


Question: Which optional AD DS feature enables you to quickly restore objects that have been deleted?
Show Answer
The Active Directory Recycle Bin, an optional feature of AD DS, provides a simplified process for restoring deleted objects.

Question: What is Server Core and what are some advantages of using it?
Show Answer
Server Core is the default Windows Server installation option. Server Core does not have a graphical user interface. Server Core installs fewer components so fewer updates are required. Server Core removes unneeded files so disk space and memory requirements are less. Lastly, fewer files and components means less opportunity for security threats.

Question: Which feature can you use to define different password policies and account lockout settings in a domain?
Show Answer
Fine-grained password policies let you specify different password policies and account lockout policies for different groups of users. For example, executives, administrators, service accounts, or regular users.

Question: Aziz has reported he is unable to sign in to the domain. The error message is, “The trust relationship between this workstation and the primary domain failed.” What is likely the problem and how should you fix it?
Show Answer
Most likely the problem is a broken secure channel. You can use Active Directory Users and Computers or PowerShell to reset the computer account and rejoin the computer to the domain.

Question: What is the global catalog and when is it used?
Show Answer
The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.

Question: What is the global catalog and when is it used?
Show Answer
The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.

Question: What is an AD DS site and when should you consider creating a site?
Show Answer
An AD DS site represents the physical structure, or topology, of your network. There are several reasons to consider creating additional sites such as: number of users at a location, slow links between locations, service localization, and AD DS database replication.


Question: When should you use an authoritative restore?
Show Answer
An authoritative restore is necessary when a known good copy of AD DS has been restored that contains objects that must override the existing state of other objects in the AD DS database.

Question: How are Group Policy settings and a Group Policy preferences different?
Show Answer
Group policy settings and group policy preferences are different. Preferences are not enforced, can reapply automatically, and can use item-level targeting.

AD DS - User Account Template

How to create user account templates

Consider creating user templates

User templates allow administrators to create a default user account and use that account to create all the other users that match it. For example, a user account template named _LondonSales could be used to create all the other sales accounts in the London office. User templates can save you a lot of time and resources especially if you have to create a large number of users or fill out many of the same attribute fields over and over again.

• Not all information gets copied from a template. For example, Name, Logon Name, Password, Email, and Phone Number do not get copied.
• Always ensure you disable the template account. You wouldn't want someone using it to access your network.

User account best practices

User accounts require planning

- Have a plan. Plan the accounts policy carefully to make sure that the plan meets the security needs of your organization. Your user accounts policy should include password length, password complexity rules, and the maximum password age for user accounts.
- Unique accounts. Create a user account for every user who has to access your forest. Don't let users share user accounts.
- Naming convention. Implement a naming convention that yields simple-to-remember, unique user names. Consider that the more users you have, the more likely there are to be duplicates within your organization.
- Special characters. User names can contain special characters, including periods, hyphens, and apostrophes. However, these special characters may not be compatible with all programs and applications. Before you use special characters, such as an apostrophe, test with other applications your organization uses.

- Temporary accounts. Create accounts for temporary or contract staff with the same naming convention that you use for other users. For example, don't use generic account names such as Temp1 or Tester2.

AD DS - Password Policies

Password Policies

Establish password policies based on organizational needs

Ensure users cannot select simple password or reuse passwords

When securing your user accounts use the Password Policy settings. You should configure the properties of the passwords that users might select. Use these settings to make sure users don’t select simple passwords, or passwords that have been recently used. You can only have one standard password policy in a domain.

Setting	Description	Values
Enforce password history	The number of unique, new passwords that must be associated with a user account before an old password can be reused.	Default setting: 24 passwords
Maximum password age	Number of days that a password can be used before the user must change it.	Recommended setting: 42 days
Minimum password age	Number of days that a password must be used before the user can change it.	Default setting: 1 day
Minimum password length	Minimum number of characters that a user’s password must contain.	Default setting: 7 characters High security: 15 characters
Complexity requirements	Required password characteristics. Don't disable.	Does not contain your name or user name. Has at least six characters. Contains characters from different charsets

Contains characters from 3 of these 4 for charsets:  Uppercase letters [A–Z]; Lowercase letters [a–z]; Numerals [0–9]; Special, non-alphanumeric characters, such as !@#)(*&^%

AD DS - Account Lockout Policies

Account lockout policies

Set your account lockout policies based on organizational needs

Account lockout policies protect again password guessing

Account lockout policies enable you to define whether accounts should be locked if there are too many logon tries with invalid passwords. Most organizations implement account lockout policies to prevent attackers from using password-guessing techniques to gain access to a network. Using this approach provides a level of security. However, it also exposes your organization to a denial of service attack because an attacker can run scripts to guess user passwords and lock out user accounts. If you decide not to implement account lockout policies, it's important that you monitor failed account logon tries in real time to prevent an attacker from taking advantage of this configuration. There are three corresponding Group Policy settings.

Account lockout policies work together

Setting	Description	Values
Account lockout duration	Defines the number of minutes that a locked account remains locked. After the specified number of minutes, the account automatically unlocks.	Normal setting:  30 minutes Administrator must unlock the account: 0 minutes
Account lockout threshold	Determines the number of failed logon tries that are allowed before a user account is locked out. Set this value high enough to allow for mistyped passwords, but low enough to make sure the failure of brute force attempts to guess a password.	Account is never locked out: 0 attempts Typical: 3 – 5 attempts
Reset account lockout counter after	How many minutes must elapse after a failed logon attempt before the bad logon counter is reset to zero. This setting applies when a user has typed in a password incorrectly, but the user has not exceeded the account lockout threshold.	Recommended value: 30 minutes

AD DS - Fine-grained Password Policies

Fine-grained Password Policies

Different groups of users may need different password policies

You can use fine-grained password policies to specify multiple password policies, and to apply different password restrictions and account lockout policies to different sets of users in a single domain. For example, Administrators may have different password requirements that are stricter than the policies for a user. If you cannot meet your organization’s security requirements with a single password policy, you should use fine-grained password policies.

AD DS - User Profile

What is a user profile?

When a user signs in to a computer, a folder is created in C:\Users for that user. The folder stores the user profile for the user. Within this folder, subfolders contain documents and settings that represent the user’s profile, including Desktop, Documents, Downloads, Pictures, and Videos.

What are the user profile settings?

User profiles keep multiple devices in sync

If a user is likely to sign in at more than one client workstation, it's better that their user profile settings and documents be available on those other client workstations. There are several ways that you can make sure that users can access their profiles from multiple workstations. One way is the user account profile settings.

Configure the Profile path and Home folder path

• Profile path. This path is either a local, or more usually, a Universal Naming Convention (UNC) path. The user’s desktop settings are stored in the profile. If a user profile has a UNC path, then the user will have access to their desktop settings regardless of the domain computer they sign in at. This is known as a roaming profile.
• Home folder. This is a storage area in which users can save their personal documents. You can specify either a local path, or more usually, a UNC path to the user’s folder. You must also specify a drive letter that's used to map a network drive to the specified UNC path. You can then configure a user’s personal documents to this redirected home folder.

Active Directory Domain Service (AD DS)

What is the AD DS database?

How is the AD DS database organized?

The AD DS database is organized into partitions

AD DS information is stored within the directory database. Each directory partition, also called a naming context, contains objects of a particular replication scope and purpose.

• Domain. The domain partition contains all the objects stored in a domain, including users, groups, computers, and Group Policy containers.
• Configuration. The configuration partition contains objects that represent the logical structure of the forest, including information about domains, in addition to the physical topology, including sites, subnets, and services.
• Schema. The schema partition defines the object classes and their attributes for the entire directory.
• Application Partitions. You can use application partitions to limit replication of application-specific data to a subset of domain controllers. AD DS Active Directory–integrated Domain Name System (DNS) is a common example of an application that takes advantage of application partitions.

Active Directory Domain Service Schema (AD DS Schema)

What is the AD DS schema?

The AD DS schema defines your infrastructure

Information about your AD DS infrastructure is stored in the AD DS schema. The schema is a collection of objects. The schema defines:

• The AD DS objects that are part of the infrastructure.
• Rules that define the structure of the objects.
• The structure and content of the directory itself.

Every time that the directory handles data, the directory queries the schema for an appropriate object definition. Based on the object definition in the schema, the directory can create or modify an object and store the data.

Windows Server - Group Nesting

What is group nesting?

Group nesting makes it easier to manage access to resources

In almost all cases, you should use groups to control access to resources instead of giving permissions to individual user objects. Placing groups within groups (also called group nesting), is an important part of designing and using groups to control access to resources.

If you nest groups, you can manage multiple objects and groups simultaneously, and you can provide a more modular and flexible group structure. Nesting creates a hierarchy of groups that support your business roles and management rules.

What is IGDLA?

IGDLA is a best practice for nesting groups

IGDLA is an acronym

1. Identities. Create user and computer accounts.
2. Global groups. Create global groups based on business roles. For example, Sales, and Auditors. Add identities to the global groups.  
3. Domain-local groups. Create domain-local groups based on management rules. For example, ACL_SalesFolders_Read to consolidate Sales and Auditors. Add global groups to the domain-local groups.
4. Access resources. Assign permissions for the domain-local group to resources. For example, add the domain-local group to the folder’s ACL.

In the forest it is IGUDLA

In a multi-domain forest, the best practice for group nesting is known as IGUDLA. The additional letter U stands for universal groups, which fit in between global and domain-local groups.

Group Nesting Example

Consider this scenario where you have three domains and in each domain there are five people who need access to a file in one of the domains.

How many file permissions do you need to create to assign permissions on this file for each user?

• Consider that you now group the users in each domain into global groups. So, you now have three global groups, one for each domain.

How many permissions on the file do you need to assign now?

• Now, suppose you create a domain local group and add the global groups.

How many permissions must you assign to the domain local group?

AD DS - Group Types and Scope

Group Types

Groups make it easier to manage users and computers

A group helps organize users or computers to make it easier to manage permissions. There are two types of groups: security groups and distributiongroups. When you create a group, you choose the group type. The default group type is the security group.

Distribution Groups vs. Security Groups

Know which type of group to use

The main difference between distribution and security groups is whether permissions and access control can be assigned.

	Distribution Groups	Security Groups
Can permissions and access control be assigned?	No	Yes

Distribution groups are primarily for email

Distribution groups are not security enabled and cannot be given permission to resources. Distribution groups are used mainly by email applications. Sending an email message to a distribution group sends the message to all group members. If you are creating a group solely for email distribution it should be this type of group.  

Security groups control resources

Security groups are security‑enabled, and are used to assign permissions and control access to various resources. You can use a security group for email distribution, but we recommend you keep distribution groups and security groups separate.

Consider that when you add a user to a group, the user’s access token—which authenticates user processes—updates only when the user signs in. Therefore, if the user is currently signed in, the user must sign out and sign back in to update their access token with any changed group memberships.

What are group scopes?

Group scopes determine permissions and abilities

When you create an AD DS group you must also select a group scope. The scope of a group determines both the range of a group’s abilities or permissions, and the group membership. Your choices are: Domain local, Global, and Universal.

Group scopes have different memberships and permissions

Here is a summary table for the three group scopes. Each scope will be explained in more detail on the next pages.

Group scope	Group Membership	Abilities and Permissions
Domain-local	Any user in the forest	Anything in the domain
Global	Any user in the domain	Anything in the forest
Universal	Any user in the forest	Anything in the forest