Domain Controller

“Information Technology”
2016
PASSEWRELLES NUMERIQUES CAMBODIA
Songkat Tek thla, Khan Sen Sok, Phnom Penh, Cambodia

Passerelles Numériques Cambodia
P a g e 1 | 52
By SamNang (SNA_B_2017) 2016

P a g e 2 | 52
Contents:
I. Install Active Directory and DNS Windows Server 2008 R2: .................................................... 1
A. Assign IP address on server 192.168.ID.1 and subnet mask /24 (My ID is 42):....................... 1
B. Assign hostname’s DomainID (Domain42):..........................................................................2
C. Install Active Directory: Domain’s name samnang42.lan (nameID.lan): .................................3
II. Create Organizational Unit (OU) of each department:............................................................ 9
III. Create group account and users account of each department withoutrequiredstrong
password:.................................................................................................................................. 10
A. Add membership to group in their department: ................................................................... 19
IV. ComputerCreate Account: Rightclickon OU (Computers) >New >Computer> Put the name
of Computer Account > OK.......................................................................................................... 21
V. Create users account template on each department: We just dothe same followingof creating
user account and put the name as Template................................................................................ 22
A. Department (Department Finance):..................................................................................... 22
B. Add useraccount template intogroup(Finance Group):Double clickongroupthatwe want to
add member> SelecttabMembers> add userwiththe same to the followingof adding
membership as the................................................................................................................. 23
VI. Enable and Disable Account User:.................................................................................... 23
A. Enable Account User: Right click on user thatwe want to enable > Enable Account. ............... 23
B. Disable Account User: Right click on user that we want toenable > Disable Account............... 24
VII. Unlock User Account:...................................................................................................... 24
A. From Monday to Friday period 8:00 AM to 5:00 PM allow, other deny:.................................. 25
B. Only User name “samnang.leap” can loin only computer name “Win-Client”:......................... 27
VIII. How to reset password of user:....................................................................................... 27
IX. Create multiple users with introduction below: ............................................................... 28
A. Create Organizational Unit name “SNA-B”:........................................................................... 28
B. Create Multiple User Account(Do on Excel):......................................................................... 28
X. Take windows clientjoinsdomain: “Before take windowsclientjoinsdomainwe mustinstall
DNS service and AD and take them (Server & Client) in the same network..................................... 32
A. Take one user to logon your computer client thatjoined to domain: ..................................... 40
XI. Make sure that manager can do the followingtaskin each OU departmentby delegate
control:...................................................................................................................................... 42
XII. Make sure manger can access from his/her computer to domain service (AD):................. 45
 To make sure manager can accessto domainservice inwindowsclientwe mustdowiththe
following below:..................................................................................................................... 45
 Make sure that manager (samnang.leap) can access to domain service (AD):...................... 49

P a g e 1 | 52
I. Install Active Directory andDNS Windows Server 2008R2:
A. Assign IP address on server 192.168.ID.1 and subnet mask /24
(My ID is 42):
 Run > type: ncpa.cpl > double click on Local Area Connection > …>
input IP > OK.
 Run > cmd > ipconfig > see the IP and Subnet Mask.

P a g e 2 | 52
B. Assign hostname’s DomainID (Domain42):
 Run > type: sysdm.cpl > Click on Change > Input the computer’s name
> Click on OK.
 Run > cmd > type: hostname > see the host name.

P a g e 3 | 52
C. InstallActive Directory: Domain’s namesamnang42.lan
(nameID.lan):
 Click on Server Manager > Click on Roles > Click on Add Roles.

P a g e 4 | 52
 Tick on Active Directory Domain Services > Next > Next > Install.

P a g e 5 | 52
 Click on Active Directory Domain Services >
 Click on Run the Active Directory Domain Services Installation Wizard.

P a g e 6 | 52
 Select Create a new domain in a new forest.
 Assign Domain’s name (samnang42.lan) > Next.

P a g e 7 | 52
 Tick o DNS server (If you want to install it) > Next.
 Assign password > Next > Computer will restart machine.

P a g e 8 | 52
 Check systemproperties > See Domain’s name.

P a g e 9 | 52
II. Create Organizational Unit (OU) of each department:
 Click on Start > Click on Active Directory.
 Select domain’s name (samnang42.lan) > Click on OU icon (2) > Type
the name (IT_Admin) > OK.

P a g e 10 | 52
 Create OU of each department’s name such as IT_Admin, Finance and
Sale (Just do with the following above).
III. Create groupaccount and users account of each department without
requiredstrong password:
 To create users account without required strong password we must
change group policy. Please, do with the following below:
o Clickon Start > Clickon Group PolicyManagement> Double clickonDomains> Double click
on samnang42.lan> Rightclick onDefault domainPolicy>ClickonEdit…

P a g e 11 | 52
o Double clickonPolicies>Double clickonWindowsSettings >Double clickonSecurityPolicy
> Double clickonPasswordmustmeetcomplexityrequirements…
o Clickon Disabled>OK.

P a g e 12 | 52
 After changed group policy we must update group policy by use
command line (gpupdate):
o Run > cmd > type:gpupdate.

P a g e 13 | 52
 Create users in department’s name IT_Admin:
o Go to Active Directory Usersand Computers >SelectOU that we wantto create users
(IT_Admin) >Clickon usericon> Putfirstname,lastname > Put user logonname > Next>
Put password> Next> ClickonFinish.

P a g e 14 | 52
o Do the same followingabove (These are usersindepartment’sname IT_Admin).
 Create users in department’s name Finance:
o Go to Active DirectoryUsersand Computers>SelectOU that we wantto create user
(Finance) >Clickonuser icon> Putfirstname,lastname > Put user logonname > Next…

P a g e 15 | 52
o Put password> Next> ClickonFinish.
o Do the same followingabove (These are usersindepartment’sname Finance).

P a g e 16 | 52
 Create users in department’s name Sale:
o Go to Active DirectoryUsersand Computers>SelectOU that we wantto create user(Sale)
> Clickonusericon > Put firstname,lastname > Putuserlogonname > Next…
o Put password> Next> ClickonFinish.

P a g e 17 | 52
o Do the same followingabove (These are usersin department’sname Sale).
 Create Group Account for each department:
o Go to Active DirectoryUsersand Computers>SelectOU that we wantto create user
(IT_Admin) >Clickon groupicon> Putthe name of group(Group_A > OK

P a g e 18 | 52
o Do the same followingabove (These are groupsineachdepartmentssuchasIT_Admin,
Finance,andSale).

P a g e 19 | 52
A. Add membership to group in their department:
 Double click on group that we want to add memberships (Group_A) >
Select tap Members > Click on Add… (3) > Type user name > OK (5).

P a g e 20 | 52
 Do the same following above. These are memberships in Group_A
(IT_Admin Group).
 These are memberships in Group_B (Finance Group)

P a g e 21 | 52
 These are memberships in Group_C (Sale Group)
IV. Computer Create Account: Rightclickon OU (Computers) >New > Computer>
Put the name of ComputerAccount> OK.

P a g e 22 | 52
V. Create users account template on each department: We justdo the
same followingof creatinguseraccountand putthe name as Template.
A. Department (Department Finance):
o Double click on account template that we created already > Click on tab
Organization > Put the name of department (Finance) > OK.

P a g e 23 | 52
B. Add user account template into group (Finance Group): Double click on group that
we want to add member > Select tab Members > add user with the same to the
following of adding membership as the
VI. Enable and Disable Account User:
A. Enable Account User: Right click on user that we want to enable > Enable Account.

P a g e 24 | 52
B. Disable Account User: Right click on user that we want to enable > Disable Account.
VII. Unlock User Account:
 Double click on a user that we want to unlock >…

P a g e 25 | 52
 Select tab Account > Tick on Unlock account > OK
A. From Monday to Friday period 8:00 AM to 5:00 PM allow, other deny:
o Double clickona user >…

P a g e 26 | 52
o SelecttabAccount> Clickon tab Logon Hours…
o Selectthe white partaroundthe blue part as the picture below andthenclickonLogon
Denied>OK (Please see the note).

P a g e 27 | 52
B. Only User name “samnang.leap” can loin only computer name “Win-Client”:
o Double clickonusername samnang.leap>SelecttabAccount > Clickon tab Log On To…>
Selectthe followingcomputers>Type:name of computer(Win-Client) >ClickAdd> OK.
VIII. How to reset password of user:
 Rightclickon a user thatwe wantto resetpassword> Inputpassword> OK.

P a g e 28 | 52
IX. Create multiple users with introduction below:
A. Create Organizational Unit name “SNA-B”:
o Clickon samnang42.lan(DomainName) >ClickonOU icon> Putthe name of OU (SNA-B) >
OK.
B. Create Multiple User Account (Do on Excel):
o Name:firstname.lastname,Office:A21,Email Address: firstname.lastname@samnang42.lan
and Description:SNA-B.
o Password:12345 and User mustchange password.

P a g e 29 | 52
o Copythe formulaof command line of creatingusersaccountintoNotepad
o Save file innotepadwithtype asAll Filesandextension“.bat”

P a g e 30 | 52
o Double clickonthisfile torun commandline of creatinguseraccount.
o Thisis the processof creatinguseraccount in cmd.

P a g e 31 | 52
o The resultof creatingmulti users.

P a g e 32 | 52
X. Take windows client joins domain: “Before take windowsclientjoins
domainwe mustinstall DNSservice andADand take them(Server&Client) inthe same
network.
 InstallingDNS:
o Clickon start > Clickon DNS
o Double clickonDOMAIN42 > Rightclickon Reverse LookupZones

P a g e 33 | 52
o Clickon Next.
o SelectIPv4ReverseLookupZone.

P a g e 34 | 52
o Put NetworkID(192.168.42) > ClickFinish.
o Rightclickon 42.168.192,in-addr.arpa > Clickon New Pointer(PTR) >ClickonBrowse
o Double clickonDOMAIN42.

P a g e 35 | 52
o Double clickonForward…
o Double clickonsamnang42.lan

P a g e 36 | 52
o Double clickondomain42 (hostname)
o CompletedNewPointer>ClickOK

P a g e 37 | 52
o AfterinstalledDNS> Run> cmd > nslookup
 Figure windows client and windows server into the same network
connection:
o AssignIPaddressandSubnetMask and IPDNS (IPof DNS server) > OK.
o Note:IPaddressof server(192.168.42.1) and IP of DNS server(192.168.42.1)

P a g e 38 | 52
o PingIPaddressof server(192.168.42.1)
o Testnslookup
o Run > sysdm.cpl > ClickonChange.

P a g e 39 | 52
 Take client windows joins domain:
o Clickon Domain> Put domainname of server(samnang42.lan) >OK.
o Requiredusernameandpasswordof windowsserver(Admin) >OK > PCwill restartmachine.

P a g e 40 | 52
A. Take one user to logon your computer client that joined to domain:
o Take a username hav.che to logoninwindowsclient.
o User mustchange password> Clickokto change password.
o Inputthe newpassword> Enter to login accountuser.

P a g e 41 | 52
o Passwordchanged> Clickok
o User name hav.che couldlogon to clientwindows.

P a g e 42 | 52
XI. Make sure that manager can do the following task in each OU
department by delegate control:
 Delegate Control by a user who is a manager in a department:
o Choose a useraccount as a managerin a department(Username’ssamnang.leapis
a managerin departmentIT_Admin.
o Rightclickon a departmentthatwe want to dodelegationcontrol (IT_Admin
departmentandusername’ssamnang.leapisamanager).

P a g e 43 | 52
o ClickAdd> Type the username thatwe wantto delegate >OK.
o ClickNext…

P a g e 44 | 52
o Tick the followingtasks:
a. Manager can modifythe membershipof agroup.
b. Manager can resetuserpasswordsandforce passwordchange at nextlogon.
c. Manager can create,delete,andmanage useraccounts.
o ClickFinish.

P a g e 45 | 52
XII. Make sure manger can access fromhis/her computer todomain
service (AD):
 To make sure manager can access to domain service in windows client
we must do with the following below:
a) Firstwe must install RSAT(Remote ServerAdministrationTools) programinwindowsclient:
o Double clickonRSAT software >Type an administratorpassword,andthenclickyes.
o It ispreparingthe installation….
o It isalreadyinstalledonthe computer.

P a g e 46 | 52
b) Afterinstalled,we mustopenservice bygoto configure windowsfeaturesonoroff incontrol
panel:
o Run > type:control panel > OK.
o Clickon programs.
o ClickonTurn Windowsfeaturesonoroff and thenitwill require usernameandpassword
of administrator(ServerAdmin).

P a g e 47 | 52
o Type an administratorusername andpassword,andthenclickYes> Please wait>…
o Double clickonRemote ServerAdministrationTools>Double clickonRole Administration
Tools> ClickonAD DS and AD LDS Tools > TickActive DirectoryModule forWindows
PowerShell >Ok.

P a g e 48 | 52
o It ismakingchangesto features.
o Afterinstalledwe canopenActive DirectoryUsersandComputersinwindowsclientas
windowsserver.

P a g e 49 | 52
 Make sure that manager (samnang.leap) can access to domain service
(AD):
o Nowwe take user name’ssamnang.leaptologonto windowsclient.
o So,he can accessto domainservice inwindowsclientaswindowsserver.

P a g e 50 | 52
o Now,he can delete userinhisdepartment(Because we diddelegatecontrol forthisuser
already)
o He can create userinhis department(Indepartment IT_Admin).

P a g e 51 | 52
o He can resetpasswordforuserin hisdepartment(He isauser indepartmentIT_Admin)
 Note: He couldn’t delete user, create user, and reset password in
another department beside his department (His department is
IT_Admin).
o He couldn’tcreate userindepartmentFinance.

P a g e 52 | 52
o He couldn’tresetpasswordforusername Template indepartmentFinance.

P a g e 53 | 52

Domain Controller

More Related Content

What's hot

Viewers also liked

Similar to Domain Controller

Recently uploaded

Domain Controller