AD DS - User Account

What is a user account?

User accounts give access to domain resources

In AD DS, all users who require access to network resources must have a user account. A user account is an AD DS object that contains all the information that's required to authenticate and authorize the user during the sign‑in process and build the user's access token.

With a user account, you can:

• Allow or deny users permission to sign in to a computer based on their user account identity.
• Authenticate users to the AD DS domain and give access to network resources.
• Grant users access to processes and services for a specific security context.
• Manage users’ access to resources such as properties, shared folders, files, directories, and printer queues.

How to create user accounts

Creating user accounts is easy

When you create a new user account, you must provide the Full Name, User Logon Name, and Password options.

1. Full Name. The First name and Last name attributes combine to create the Full name attribute. Full name is used as the Common Name (CN) and it must be unique within the container or OU.
2. User Logon Name. The User Logon follow the format user logon name@domain suffix.  The Domain Name System name of your domain is always available as a suffix. However, you can add other suffixes if they are needed.
3. Password. Several password options are available. As a best practice, you should always select User must change password at next logon.  This property enables you to force users to reset their password the next time that they log on. This is typically something that you might enable after you reset a user’s password.

How to add user account attributes

User accounts have many additional attributes

After you create a user account, you can configure additional account attributes. There are many attributes. Therefore, you must understand what these attributes are, and how you can use them in your organization.

The attributes of a user object fall into several broad categories: Account, Organization, Member of, Password Settings, Profile, and Extensions. The Account page has most of the day to day user information that's of interest.

1. Log on hours. This property defines when the account can be used to access domain computers. You can use the weekly calendar style view to define Logon permitted hours and Logon denied hours. For example, you could limit contractor or temporary personnel to certain office hours.
2. Log on to. Use this property to define which computers a user can use to log on to the domain. Specify the computer’s name and add it to a list of allowed computers.  For example, you could restrict access to a specific workstation in a department area.
3. Account expires

• (Never). If you set this value, you must remember to periodically update the password. However, you aren't forced to do this at a predetermined interval. Therefore, the account can never be locked out because of password expiration—a feature that's specifically important for service accounts.
• (End of). This setting is useful when you want to create temporary user accounts. For example, you might want to create user accounts for interns who will be at your company for just one year. You can set the account expiration date in advance

Windows Server: Active Directory Servce

Active Directory
Microsoft developed a directory service for a Microsoft Domain network and this directory service is referred to as Active Directory. It is included in most Windows Server Operating Systems as a set of processes and services.
A server running Active Directory Domain Services (AD DS) is called a domain controller. It authenticates and authorizes all users and computers in a Windows Domain type network. It assigns and enforces security policies for all computers and installing or updating software.
Active Directory uses Lightweight Directory Access Protocol (LDAP) versions 2 and 3, Microsoft's version of Kerberos, and DNS.

Active Directory Services
There are 5 active directory services:

1. Active Directory Certificate Services.
   Active Directory Certificate Services (AD CS) allows to create, distribute, and manage customized public key certificates. It is an Identity and Access Control security technology that provides customizable services for creating and managing public key certificates used in software security systems that employ public key technologies.
   It establishes an on-premises public key infrastructure. It can create, validate and revoke public key certificates for internal uses of an organization. These certificates can be used to encrypt files (when used with Encrypting File System), emails (per S/MIME standard), network traffic (when used by virtual private networks, Transport Layer Security protocol or IPSec protocol).
2. Active Directory Domain Services.
   Active Directory Domain Services (AD DS) stores directory data and manages communication between users and domains, including user logon processes, authentication, and directory searches. An Active Directory domain controller is a server that is running AD DS.
   AD DS is important part of every Windows domain network. It stores information about members of the domain, including devices and users, verifies their credentials and defines their access rights. A domain controller is contacted when a user logs into a device, accesses another device across the network, or runs an app sideloaded into a device.
   
    
3. Active Directory Federation Services.
   Active Directory Federation Services (AD FS) provides Web single-sign-on (SSO) technologies to authenticate a user to multiple Web applications over the life of a single online session.
   With an AD FS infrastructure in place, users may use several web-based services (e.g. internet forum, blog, online shopping, webmail) or network resources using only one set of credentials stored at a central location, as opposed to having to be granted a dedicated set of credentials for each service. AD FS's purpose is an extension of that of AD DS: The latter enables users to authenticate with and use the devices that are part of the same network, using one set of credentials. The former enables them use this same set in a different network.
   
    
4. Active Directory Lightweight Directory Services.
   Active Directory Lightweight Directory Services (AD LDS), which is a Lightweight Directory Access Protocol (LDAP) directory service that provides flexible support for directory-enabled applications, without the restrictions of Active Directory Domain Services (AD DS).
   AD LDS shares the code base with AD DS and provides the same functionality, including an identical API, but does not require the creation of domains or domain controllers. It provides a Data Store for storage of directory data and a Directory Service with an LDAP Directory Service Interface. Unlike AD DS, however, multiple AD LDS instances can run on the same server.
   
    
5. Active Directory Rights Management Services.
   Active Directory Rights Management Services (AD RMS) protects your information and works with AD RMS-enabled applications to help safeguard digital information from unauthorized use. Content owners can define who can open, modify, print, forward, or take other actions with the information.
   It uses encryption and a form of selective functionality denial for limiting access to documents such as corporate e-mails, Microsoft Word documents, and web pages, and the operations authorized users can perform on them.

AD DS - User Account Template

How to create user account templates

Consider creating user templates

User templates allow administrators to create a default user account and use that account to create all the other users that match it. For example, a user account template named _LondonSales could be used to create all the other sales accounts in the London office. User templates can save you a lot of time and resources especially if you have to create a large number of users or fill out many of the same attribute fields over and over again.

• Not all information gets copied from a template. For example, Name, Logon Name, Password, Email, and Phone Number do not get copied.
• Always ensure you disable the template account. You wouldn't want someone using it to access your network.

User account best practices

User accounts require planning

- Have a plan. Plan the accounts policy carefully to make sure that the plan meets the security needs of your organization. Your user accounts policy should include password length, password complexity rules, and the maximum password age for user accounts.
- Unique accounts. Create a user account for every user who has to access your forest. Don't let users share user accounts.
- Naming convention. Implement a naming convention that yields simple-to-remember, unique user names. Consider that the more users you have, the more likely there are to be duplicates within your organization.
- Special characters. User names can contain special characters, including periods, hyphens, and apostrophes. However, these special characters may not be compatible with all programs and applications. Before you use special characters, such as an apostrophe, test with other applications your organization uses.

- Temporary accounts. Create accounts for temporary or contract staff with the same naming convention that you use for other users. For example, don't use generic account names such as Temp1 or Tester2.

AD DS - Password Policies

Password Policies

Establish password policies based on organizational needs

Ensure users cannot select simple password or reuse passwords

When securing your user accounts use the Password Policy settings. You should configure the properties of the passwords that users might select. Use these settings to make sure users don’t select simple passwords, or passwords that have been recently used. You can only have one standard password policy in a domain.

Setting	Description	Values
Enforce password history	The number of unique, new passwords that must be associated with a user account before an old password can be reused.	Default setting: 24 passwords
Maximum password age	Number of days that a password can be used before the user must change it.	Recommended setting: 42 days
Minimum password age	Number of days that a password must be used before the user can change it.	Default setting: 1 day
Minimum password length	Minimum number of characters that a user’s password must contain.	Default setting: 7 characters High security: 15 characters
Complexity requirements	Required password characteristics. Don't disable.	Does not contain your name or user name. Has at least six characters. Contains characters from different charsets

Contains characters from 3 of these 4 for charsets:  Uppercase letters [A–Z]; Lowercase letters [a–z]; Numerals [0–9]; Special, non-alphanumeric characters, such as !@#)(*&^%

Windows Server: Active Directory and its Fundamentals

Active Directory
Microsoft developed a directory service for a Microsoft Domain network and this directory service is referred to as Active Directory. It is included in most Windows Server Operating Systems as a set of processes and services.
Active Directory uses Lightweight Directory Access Protocol (LDAP) versions 2 and 3, Microsoft's version of Kerberos, and DNS.


To understand above sentences we need to understand what Directory Service, Microsoft Domain, Domain Controller is. Lets find out what it is.

Directory Service
To administer, manage, locate and organize everyday items and network resources we require a share information infrastructure. Everyday items and network resources can include any or all of files, folders, users, groups, printers, volumes, devices, telephone numbers and other objects. 
Directory Service is a service or infrastructure to map the names of network resources to their respective network addresses. It is a critical component of a network operating system. Such service is provided by a server and that server is known as directory server. Each network resources is called object.
What directory service does is, it defines a namespace for the network. Namespace assigns a name, called unique identifier, to each of above mentioned objects. Directories have a set of rules determining how network resources are named and identified; basic requirement is that the identifiers need to be unique and unambiguous.
When user uses a directory services there is no need for user to remember the physical address of a network resource. User can locate the resource using name. However, some directory services may include access control mechanism which could limit the accessibility and availability of directory information to authorized users.


Microsoft Domain
Microsoft domain is a computer network in which all user accounts, computers, printers and other security principals are registered with a central database located on one or more clusters of central computers known as domain controllers. Authentication takes place on domain controllers.
Each user who uses computers within a domain receives a unique user account that can be assigned access to resources within the domain. Active directory is the Windows component in charge of maintaining that central database.

Domain Controller
On Microsoft Servers, a domain controller (DC) is a server computer that responds to security authentication requests (logging in, checking permissions, etc.) within a Windows domain.
In other words, a server running Active Directory Domain Services (AD DS) is called a domain controller. It authenticates and authorizes all users and computers in a Windows Domain type network. It assigns and enforces security policies for all computers and installing or updating software.


Example: 
When a user logs into a computer that is part of windows domain, Active Directory is the one that checks thus submitted password and determines whether the user is a system administrator or normal user. Also, it allows management and storage of information at admin level and provides authentication and authorization mechanisms.

Lightweight Directory Access Protocol (LDAP)
The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

Active Directory Domain Service (AD DS)

What is the AD DS database?

How is the AD DS database organized?

The AD DS database is organized into partitions

AD DS information is stored within the directory database. Each directory partition, also called a naming context, contains objects of a particular replication scope and purpose.

• Domain. The domain partition contains all the objects stored in a domain, including users, groups, computers, and Group Policy containers.
• Configuration. The configuration partition contains objects that represent the logical structure of the forest, including information about domains, in addition to the physical topology, including sites, subnets, and services.
• Schema. The schema partition defines the object classes and their attributes for the entire directory.
• Application Partitions. You can use application partitions to limit replication of application-specific data to a subset of domain controllers. AD DS Active Directory–integrated Domain Name System (DNS) is a common example of an application that takes advantage of application partitions.

Active Directory Domain Service Schema (AD DS Schema)

What is the AD DS schema?

The AD DS schema defines your infrastructure

Information about your AD DS infrastructure is stored in the AD DS schema. The schema is a collection of objects. The schema defines:

• The AD DS objects that are part of the infrastructure.
• Rules that define the structure of the objects.
• The structure and content of the directory itself.

Every time that the directory handles data, the directory queries the schema for an appropriate object definition. Based on the object definition in the schema, the directory can create or modify an object and store the data.

Windows Server - Group Nesting

What is group nesting?

Group nesting makes it easier to manage access to resources

In almost all cases, you should use groups to control access to resources instead of giving permissions to individual user objects. Placing groups within groups (also called group nesting), is an important part of designing and using groups to control access to resources.

If you nest groups, you can manage multiple objects and groups simultaneously, and you can provide a more modular and flexible group structure. Nesting creates a hierarchy of groups that support your business roles and management rules.

What is IGDLA?

IGDLA is a best practice for nesting groups

IGDLA is an acronym

1. Identities. Create user and computer accounts.
2. Global groups. Create global groups based on business roles. For example, Sales, and Auditors. Add identities to the global groups.  
3. Domain-local groups. Create domain-local groups based on management rules. For example, ACL_SalesFolders_Read to consolidate Sales and Auditors. Add global groups to the domain-local groups.
4. Access resources. Assign permissions for the domain-local group to resources. For example, add the domain-local group to the folder’s ACL.

In the forest it is IGUDLA

In a multi-domain forest, the best practice for group nesting is known as IGUDLA. The additional letter U stands for universal groups, which fit in between global and domain-local groups.

Group Nesting Example

Consider this scenario where you have three domains and in each domain there are five people who need access to a file in one of the domains.

How many file permissions do you need to create to assign permissions on this file for each user?

• Consider that you now group the users in each domain into global groups. So, you now have three global groups, one for each domain.

How many permissions on the file do you need to assign now?

• Now, suppose you create a domain local group and add the global groups.

How many permissions must you assign to the domain local group?

AD DS Database Files

What is NTDS.dit?

AD DS Database Files

The AD DS database is stored as a file named Ntds.dit. When you promote a domain controller, you can specify the location of the file. The default location is %SystemRoot%\NTDS.

What are the NTDS files?

Within Ntds.dit are all of the partitions hosted by the domain controller: the forest schema and configuration; the domain-naming context; and, depending on the server configuration, the partial attribute set and application partitions.

In the NTDS folder are other files that support the AD DS database. The Edb*.log files are the transaction logs for AD DS. When a change must be made to the directory, it is first written to the log file. The change is committed to the directory as a transaction. If the transaction fails, it can be rolled back.

Sometimes you have to take the AD DS database offline

Certain tasks, such as an off-line defragmentation or moving the AD DS database to another drive, require you to take AD DS offline. You can use PowerShell to stop the AD DS service: Stop-Service ntds. Similarly, you can start the AD DS service: Start-Service ntds.

What is NtdsUtil.exe?

NtdsUtil has many uses

NtdsUtil.exe is a command-line tool that you can use to perform database maintenance, including the creation of snapshots, offline defragmentation, and the relocation of the database files.

You can clean up metadata

You also can use NtdsUtil.exe to clean up domain controller metadata. If a domain controller is not demoted to a member server properly, it doesn't remove important information from the directory service. However, you can use NtdsUtil.exe to clean out the remnants of the domain controller, and it is very important that you do so.

You can reset the DSRM password

NtdsUtil.exe also can reset the password used to sign in to the Directory Services Restore Mode (DSRM). This password initially is configured during the promotion of a domain controller. If you forget the password, theNtdsUtil.exe set dsrm command can reset it.

How to Add AD DS Role

Add the AD DS role

1. In the Server Manager Dashboard, click Add roles and features, and then on the Server Roles page, select the Active Directory Domain Services role.
2. Take all of the default values, and wait for the installation to complete.
3. In Server Manager, click the Notification flag, and select Promote this server to a domain controller.
4. Complete the post deployment steps using the default options except those listed below. Notice you are adding a domain controller to an existing domain. Also, you will use the pre-created RODC account.

• Domain: domain.com
• Network credentials: domain.com\Administrator
• Password: Pa$$w0rd
• Directory Services restore mode password: Pa$$w0rd
• Read the Warning message: Use existing RODC account
• Replicate from: WinServer.domain.com
• Take the defaults for the location of the AD DS database.
• Review your selections and click View Script. Notice the PowerShell commands that are being used.

5. When the installation is complete, WinServer will automatically restart.

Windows Server - Custom Group

Custom Groups

Always create your own groups

You should try to avoid adding users to the groups that do not have members by default (Account Operators, Backup Operators, Server Operators, and Print Operators). Instead, create custom groups to which you assign permissions and user rights that achieve your business and administrative requirements.

For example, if Scott Mitchell should be able to perform backup operations on a domain controller, but should not be able to perform restore operations that could lead to database rollback or corruption, and should not be able to shut down a domain controller, do not put Scott in the Backup Operators group. Instead, create a group and assign it only the Backup Files And Directories user right, and then add Scott as a member.

Local Groups

Don’t forget about the local groups

Local groups are available on stand-alone servers or workstations, on domain member servers that are not domain controllers, or on domain member workstations. Local groups are truly local, which means that they are available only on the computer where they exist. The important characteristics of a local group are:

• You can assign abilities and permissions on local resources only, meaning on the local computer.
• Members can be from anywhere in the AD DS forest.

Protected Users Group

The Protected Users group has its own ACL

There is a subset of default groups that have significant permissions and user rights related to the management of AD DS. Because of the rights that these groups have, they are protected groups. By default, the protected groups include Account Operators, Administrators, Domain Admins and Enterprise Admins. Members of a protected group receive a copy of an ACL from the protected group.

For example, if you add Jeff Ford to the Account Operators group, his account becomes protected. The Help Desk, which can reset all other user passwords in the Employees OU, cannot reset Jeff's password.

Special Identities

Special identities are groups for which membership is controlled by the operating system

• You cannot view the groups in any list (for example, in Active Directory Users and Computers).
• You cannot view or modify the membership of these special identities.
• You cannot add special identities to other groups.

Use special identities to provide access based on authentication or connection

Special identities cannot be changed. You can, however, use these groups to assign rights and permissions. This means you can use them to provide access to resources based on the type of authentication or connection, rather than the user account.

For example, you could create a folder on a system that allows users to view its contents when they are logged on locally to the system, but that does not allow the same users to view the contents from a mapped drive over the network.

• Anonymous Logon. This identity represents connections to a computer and its resources that are made without supplying a user name and password.
• Authenticated Users. This represents identities that are authenticated. This group does not include Guest, even if the Guest account has a password.
• Everyone. This identity includes Authenticated Users and the Guest account.
• Interactive. This represents users who access a resource while logged on locally to the computer that is hosting the resource, as opposed to accessing the resource over the network. When a user accesses any given resource on a computer to which the user is logged on locally, the user is added automatically to the Interactive group for that resource. Interactive also includes users who log on through a Remote Desktop connection.
• Network. This represents users who access a resource over the network, as opposed to users who are logged on locally at the computer that is hosting the resource. When a user accesses any given resource over the network, the user is added automatically to the Network group for that resource.
• Creator Owner. This represents the security principal that created an object

Best Practices

When planning and implementing groups, you now have several points to remember.

• Avoid assigning permissions and rights directly to user accounts. Use groups to make ongoing maintenance easier.
• When you can, use the built-in groups to simplify administration.
• Nest groups to more efficiently control access to resources in larger organizations.