Скачать презентацию ADM 314 Delegation of Administrative Tasks in Active Скачать презентацию ADM 314 Delegation of Administrative Tasks in Active

71c2f9e0d563f54a009f3c715fac0fad.ppt

  • Количество слайдов: 86

ADM 314: Delegation of Administrative Tasks in Active Directory Paul Reiner Program Manager Active ADM 314: Delegation of Administrative Tasks in Active Directory Paul Reiner Program Manager Active Directory

Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Maintaining a delegation model

Challenges in Managing an Active Directory Deployment An Active Directory deployment can span geographic Challenges in Managing an Active Directory Deployment An Active Directory deployment can span geographic and business unit boundaries Participating business units may impose unique autonomy and isolation requirements Managing a large & dynamic AD deployment involves a large number of administrative operations Admin responsibilities may need to be distributed amongst & delegated to regional admin groups

Successfully Managing Active Directory Familiarize yourself with Active Directory management concepts Create a delegation Successfully Managing Active Directory Familiarize yourself with Active Directory management concepts Create a delegation model to distribute admin responsibilities amongst various admin groups Implement your delegation model such that: Only delegated admins can perform the assigned tasks Delegated admins can only perform the tasks they are assigned and explicitly delegated Delegated responsibilities can be easily and reliably undelegated Maintain/update your delegation model as required

Delegation of Administration Implementation Phases Planning Phase Creating a delegation model Deployment Phase Implementing Delegation of Administration Implementation Phases Planning Phase Creating a delegation model Deployment Phase Implementing a delegation model Operations Phase Maintaining your delegation model

Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Maintaining a delegation model

Delegation of Administration Delegation Ability to distribute administrative tasks amongst administrative personnel & other Delegation of Administration Delegation Ability to distribute administrative tasks amongst administrative personnel & other stakeholders Benefits Enables secure and efficient distribution of administrative responsibilities Enables de-centralized administration Provides ability to independently manage parts of an organization Decreases total cost of ownership

Attributes of a good Active Directory delegation model Provides coverage for all aspects of Attributes of a good Active Directory delegation model Provides coverage for all aspects of Active Directory management Meets unique autonomy and isolation requirements Efficiently distributes admin responsibilities Securely delegates admin responsibilities Affords easy & reliable undelegation

Delegation of Administration in Active Directory Delegation Defined Granting a controlled set of permissions Delegation of Administration in Active Directory Delegation Defined Granting a controlled set of permissions to a less privileged user to delegate an administrative task Administrative tasks involve creation, deletion, modification, or verification of Configuration data stored in Active Directory * Domain & application data stored in Active Directory Delegating an administrative task amounts to authorizing the ability to perform operations on data in Active Directory * * or in the registry and/or file-system on Domain Controllers

Active Directory Operations & Access Rights Standard Permissions – Permissions required to perform standard Active Directory Operations & Access Rights Standard Permissions – Permissions required to perform standard operations Extended Rights – Rights required for special Active Directory operations Right to move FSMOs Validated Writes – Rights for specific operations that require validation prior to modification Add Self to Group User Rights – Rights that specify the various ways in which a user can logon to a system Interactive Logon as Service Privileges – Rights to perform various system-related operations on a computer Backup / Restore

How delegation works in Active Directory? 1 Name: Mary SID: S-1 -5 -23456 -94342 How delegation works in Active Directory? 1 Name: Mary SID: S-1 -5 -23456 -94342 -34680 -1094 Department: Accounting Mary (User) 4 Password: ********** 2 DACL: 3 John (Help-Desk Operator) Allow Help-Desk Operators User change password 4. Help-desk operator has delegated reset 3. User needs password to be 1. Help-desk operator success 2. calls Help-desk ability to reset passwords fully changes the user’s password

Delegation and Inheritance Domain Root DACL: Allow; Authenticated Users; Read Permissions Allow; Help Desk Delegation and Inheritance Domain Root DACL: Allow; Authenticated Users; Read Permissions Allow; Help Desk Operators; User change password (CI) Organizational Unit DACL: Allow; Authenticated Users; Read Permissions Allow; Help Desk Operators; User change password (CI, ID) Joe DACL: Allow; Authenticated Users; Read Permissions Allow; Help Desk Operators; User change password (CI, ID) Mary CI=Container Inherit ID = Inherited ACE DACL: Allow; Authenticated Users; Read Permissions Allow; Help Desk Operators; User change password (CI, ID)

Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Maintaining a delegation model

Active Directory Management Service management Managing all aspects involved in ensuring secure & reliable Active Directory Management Service management Managing all aspects involved in ensuring secure & reliable delivery of the directory service across the enterprise Data management Managing all aspects of the content stored in and protected by the directory service across the enterprise

Active Directory Service Management LDAP Policy Schema Master Partner. com Infrastructure Master Fabrikam. com Active Directory Service Management LDAP Policy Schema Master Partner. com Infrastructure Master Fabrikam. com DNS Infrastructure Chicago. Fabrikam. com Sunnyvale. Fabrikam. com NY. Fabrikam. com

Active Directory Service Management Categories Installation management Schema management Operations Master Roles management LDAP Active Directory Service Management Categories Installation management Schema management Operations Master Roles management LDAP Policy management Trust management Replication management Backup and Restore management Directory database file management Domain Controller management Security Policy management DNS management

Active Directory Service Management Stakeholders Service Owners Responsible for ensuring reliable & secure delivery Active Directory Service Management Stakeholders Service Owners Responsible for ensuring reliable & secure delivery of the directory service Create an administration (delegation) model for managing the service aspects of their deployment Delegate service administration to service administrators based on this model Delegate data management to data owners

Active Directory Service Management Stakeholders Service Administrators Responsible for day-to-day administrative tasks involved in Active Directory Service Management Stakeholders Service Administrators Responsible for day-to-day administrative tasks involved in maintaining & delivering the directory service Includes any group that can Legitimately change directory configuration settings Install and/or remove Domain Controllers (DC) Install and/or modify software on DCs Modify the membership of a service admin group

Active Directory Data Management Printer Name Server Name Location … Name Security Identifier (SID) Active Directory Data Management Printer Name Server Name Location … Name Security Identifier (SID) Password Office Location Phone Number Email Address Email alias User Workstation Network Printer Security Identifier (SID) Location Department Machine-Role DNS Host-Name … Help-Desk Group Name Group Members Group Owner Security Identifier (SID) Location Department Machine-Role DNS Host-Name … Server

Active Directory Data Management Categories Account management Workstation management Resource management Security group management Active Directory Data Management Categories Account management Workstation management Resource management Security group management Application-specific data management

Active Directory Data Management Stakeholders Data Owners Delegated data management by service owners Responsible Active Directory Data Management Stakeholders Data Owners Delegated data management by service owners Responsible for ensuring reliable & secure management of content stored in the directory Create an administration (delegation) model for managing their data

Active Directory Data Management Stakeholders Data Administrators Responsible for day-to-day administrative tasks involved in Active Directory Data Management Stakeholders Data Administrators Responsible for day-to-day administrative tasks involved in managing the content stored in the directory or on computers joined to the directory Have no control over the configuration or delivery of the directory service Includes any group that can Control a subset of data stored in domain partitions Manage data stored on member computers joined to the Active Directory

Isolation and Autonomy Requirements Autonomy Ability of administrators of an organization to independently (but Isolation and Autonomy Requirements Autonomy Ability of administrators of an organization to independently (but not exclusively) manage: All or part of service management (service autonomy) All or part of the data management (data autonomy) Isolation Ability of administrators of an organization to independently and exclusively manage service and data Prevent other administrators from: Controlling or interfering with service management (service isolation) Controlling or viewing a subset of data in the directory or on member computers joined to the directory (data isolation)

Addressing autonomy and isolation requirements Create a separate forest for: Service isolation Data isolation Addressing autonomy and isolation requirements Create a separate forest for: Service isolation Data isolation Create a separate Organizational Unit for: Data-autonomy from non-service owners Details on design considerations Active Directory Deployment Kit (Chap 2) www. microsoft. com/downloads Search on keywords: Active Directory deployment kit Note: True service autonomy is not possible in Active Directory because the forest is the security boundary. Use separate forests for service isolation

Delegation of Administration Whitepaper Contents Recommendations on delegating Active Directory administration Administrative role definitions Delegation of Administration Whitepaper Contents Recommendations on delegating Active Directory administration Administrative role definitions for delegating Active Directory administration Administrative role to administrative task mappings Precise permissions required to delegate all Active Directory administration tasks and customize roles Release Date: August 2003 Release Site: http: //www. microsoft. com/ad

Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Maintaining a delegation model

Creating a delegation model For each category (service & data mgmt. ): 1. 2. Creating a delegation model For each category (service & data mgmt. ): 1. 2. 3. 4. Define logical roles to distribute admin tasks Ensure that every admin task is covered by a role Define the scope of admin authority for each role Document your role definitions Responsibility Service owners create a delegation model for service mgmt. Service owners delegate data mgmt. to data owners Data owners create a delegation model for data mgmt.

Delegating Service Management Motivation: Make service management more tractable Distribute administrative responsibilities Minimize use Delegating Service Management Motivation: Make service management more tractable Distribute administrative responsibilities Minimize use of Enterprise & Domain Admin accounts Minimize risk of inadvertent damage resulting from a mistake on part of an admin logged on as Enterprise Admin or Domain Admin All service administrators should be highly and equally trusted

Active Directory Service Management Roles Service Administrator Managers Forest Configuration Operators Domain Controller Administrators Active Directory Service Management Roles Service Administrator Managers Forest Configuration Operators Domain Controller Administrators Schema Administrators Backup Operators Restore Operators Site and Subnet Administrators Replication Administrators Security Policy Administrators DNS Administrators

Active Directory Data Management Roles Business Unit Admins Organizational Unit Admins Account Admins Workstation Active Directory Data Management Roles Business Unit Admins Organizational Unit Admins Account Admins Workstation Admins Resource Admins Helpdesk Operators Security Group Admins Application-specific service accounts Roles for other stakeholders

Implementing & Maintaining Microsoft Recommended Roles Refer to the upcoming whitepaper “Delegation of Administration Implementing & Maintaining Microsoft Recommended Roles Refer to the upcoming whitepaper “Delegation of Administration in Active Directory” for more information Preview of role definitions can be found in Appendix

Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Maintaining a delegation model

Implementing the delegation model For each role (in each category): 1. 2. 3. 4. Implementing the delegation model For each role (in each category): 1. 2. 3. 4. 5. Identify the minimum set of permissions required to delegate set of admin tasks mapped to the role Identify the scope of administrative authority Create one security group* to represent every instance of a specific role Enable the role by granting appropriate permissions to the corresponding security group Delegate the role by adding delegated users to the security groups representing the role * In some cases, an existing security group may be used

Implementing delegation Two Cardinal Rules 1. 2. Use security groups representing the roles solely Implementing delegation Two Cardinal Rules 1. 2. Use security groups representing the roles solely for the purpose of delegating the role Delegate permissions only on Organizational Units

The ACL Editor Graphical tool – can be used to modify permissions on Active The ACL Editor Graphical tool – can be used to modify permissions on Active Directory objects

Using the ACL Editor Specifying permissions for specific properties Ø Displaying filtered properties – Using the ACL Editor Specifying permissions for specific properties Ø Displaying filtered properties – Microsoft KB Article - Q 296490

The Delegation Wizard Graphical tool – can be used to delegate administrative tasks The Delegation Wizard Graphical tool – can be used to delegate administrative tasks

Delegation Wizard (contd. ) Driven by a customizable inf file: delegwiz. inf Can be Delegation Wizard (contd. ) Driven by a customizable inf file: delegwiz. inf Can be customized to create and delegate custom roles Microsoft Knowledge Base Article - Q 308404

Delegation Wizard (contd. ) Benefits Can be used to delegate custom roles & tasks Delegation Wizard (contd. ) Benefits Can be used to delegate custom roles & tasks Limitations Cannot be used to un-delegate a role/task Re-running wizard to delegate an updated role/task on same scope will result in duplicate ACEs The delegwiz. inf file is a local file Recommendations Use the wizard for initial deployment of delegation model by customizing it & using it to delegate roles Use the wizard to delegate an updated role Refer to Maintaining Delegation section for details

Delegating data management at Fabrikam. com Single Forest, Multiple Domain Model Redmond Domain Two Delegating data management at Fabrikam. com Single Forest, Multiple Domain Model Redmond Domain Two business units Product Development Business Management Decentralized Account management Decentralized Resource management Centralized Help Desk Central Stakeholder - Human Resources

Default OUs & Containers Domain Root Built. In Domain Controllers System Lost And Found Default OUs & Containers Domain Root Built. In Domain Controllers System Lost And Found Foreign Security Principals Program Data Users Computers

Delegating Business Units Default OUs & Containers Delegation Product Development Admins Business Management Admins Delegating Business Units Default OUs & Containers Delegation Product Development Admins Business Management Admins Joe DACL: Allow Business Management Admins writeprop to member attribute Business Units Product Development DACL: Allow Product Development Admins full-control Business Management Joe DACL: Allow Business Management Admins full-control

Implementing the Organizational Unit Structure Business Management Accounts Groups Account Groups Resources Workstations Servers Implementing the Organizational Unit Structure Business Management Accounts Groups Account Groups Resources Workstations Servers

Delegating Business-Unit Specific Administrative Roles Account Admins Creation of user accounts Require Create Child Delegating Business-Unit Specific Administrative Roles Account Admins Creation of user accounts Require Create Child (CC) on parent object Deletion of user accounts Require Delete Child (CC) on parent object Modification of all properties Require Write-Property (WP) on object Security Group Admins Creation of security groups Require Create Child (CC) on parent object Deletion of security groups Require Delete Child (CC) on parent object Modification of group memberships Require Write-Property (WP) to the member attribute on object

Delegating Business-Unit Specific Administrative Roles Business Management Delegation Account Admins Group Admins Accounts DACL: Delegating Business-Unit Specific Administrative Roles Business Management Delegation Account Admins Group Admins Accounts DACL: Allow Account Admins CC; DC; WP Groups DACL: Allow Group Admins CC; DC Allow Group Admins WP; member

Delegating Workstation Mgmt Groups Account Groups NY Wkstn Admins Resource Groups Workstation Admins Resources Delegating Workstation Mgmt Groups Account Groups NY Wkstn Admins Resource Groups Workstation Admins Resources DACL: Allow Workstation Admins WP to member attrib { NY Wkstn. Admins } DACL: Allow Workstation Admins Full-Control on Computer objects Workstations Group Policy Restricted Groups: Workstation Admins= member. Of: Built-in Admins { Workstation Admins }

Delegating Resource Mgmt Groups Resource Groups App X Resource Admins DACL: Allow App X Delegating Resource Mgmt Groups Resource Groups App X Resource Admins DACL: Allow App X Resource Admins WP member App X Users DACL: Allow App X Resource Admins WP member Resources DACL: Allow App X Resource Admins Full-Control App X Server Farm Group Policy Restricted Groups App X Resource Admins: member. Of = Built-in Admins { App X Resource Admins }

Delegating the Help-Desk Role Centralized Help-Desk Assigned Tasks Unlock a User account Reset a Delegating the Help-Desk Role Centralized Help-Desk Assigned Tasks Unlock a User account Reset a User’s password Permissions Required Unlock a User account WP to the Lockout-Time attribute on user object Reset a User’s password Reset Password extended right on user object

Delegating the help-desk role Default OUs & Containers Delegation Product Development owners Business Management Delegating the help-desk role Default OUs & Containers Delegation Product Development owners Business Management owners Help Desk Operators Business Units DACL: Allow Help. Desk Operators write-prop to Lockout-Time on User objects extended-right Reset Password on User objects Product Development Business Management

Delegating a stakeholder role Centralized Human Resources department Stakeholder Requirement: Specify a user’s Manager Delegating a stakeholder role Centralized Human Resources department Stakeholder Requirement: Specify a user’s Manager Specify a user’s Title Specify a user’s Department Permissions Required Specify a user’s Manager WP to the manager attribute on user objects Specify a user’s Title WP to the title attribute on user objects Specify a user’s Department WP to the department attribute on user objects

Delegating a stakeholder role Default OUs & Containers Delegation Product Development owners Business Management Delegating a stakeholder role Default OUs & Containers Delegation Product Development owners Business Management owners Help Desk Operators Human Resources group Business Units DACL: Allow Human Resources group write-prop to manager on User objects Allow Human Resources group write-prop to title on User objects Allow Human Resources group write-prop to department on User objects Product Development Business Management

Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Agenda Introduction Concepts Active Directory management Creating a delegation model Implementing a delegation model Maintaining a delegation model

Maintaining your delegation model For each category, you may need to: 1. 2. 3. Maintaining your delegation model For each category, you may need to: 1. 2. 3. 4. Modify and re-delegate existing roles Create and delegate customized roles Un-delegate existing roles Meet ad hoc delegation requirements

Modifying existing roles and delegating updated roles Addition of a new task to a Modifying existing roles and delegating updated roles Addition of a new task to a role Identify permissions required to delegate task Add associated permissions to corresponding template in delwiz. inf file Removal of an existing task from an existing role Identify permissions required to delegate task Revoke associated permissions from corresponding template in delwiz. inf file Temporarily revoke all permissions granted to the security group representing the role Script (preferred) or ACL Editor Use delegation wizard to re-delegate the updated role

Un-Delegating Administration Un-delegating a user from a role Remove user from the security group Un-Delegating Administration Un-delegating a user from a role Remove user from the security group representing the role E. g. : Un-delegate Sara from Account Admins role Remove Sara from the Account Admins security group Un-delegating a role Remove all permissions granted to the security group representing the role E. g. : Un-delegate the Group Admins role Revoke all permissions granted to Group Admins security group

Un-delegating Administration Product Development Delegation Account Admins Joe Sara Group Admins Groups DACL: Allow Un-delegating Administration Product Development Delegation Account Admins Joe Sara Group Admins Groups DACL: Allow Group Admins CC; DC Allow Group Admins WP; member

Removing Permissions Scenarios: Need to un-delegate a role Need to re-delegate a customized role Removing Permissions Scenarios: Need to un-delegate a role Need to re-delegate a customized role Can use ACL Editor or a script Using a script to remove permissions Takes as input a group/user Walk through DACLs of all OUs in a specified scope Report existence of permissions for the group/user Remove all permissions for group/user in the DACLs of all OU objects in specified scope New, soon to be released command-line tool Tech. Ed atendees can downlaod tool from Commnet Visit http: //www. mymsevents. com/My. MSEvents/Search. aspx Search fpr session ADM 314 – download dsrevoke. zip

Meeting Ad-Hoc Delegation Requirements Same approach as used for other roles Create a logical Meeting Ad-Hoc Delegation Requirements Same approach as used for other roles Create a logical role for ad hoc need Identify all tasks that should map to role Identify corresponding permissions Update delwiz. inf by adding template for role Create a security group to represent role Use Delegation wizard to implement the role Add users to the security group to delegate role Remove users from group when ad hoc need is met Could revoke permissions & delete security group or keep permissions & group for future re-use

Conclusion Ability to manage Active Directory directly impacts ability to accomplish business goals Creating Conclusion Ability to manage Active Directory directly impacts ability to accomplish business goals Creating and implementing a secure and efficient delegation model is key to successfully managing your Active Directory deployment Attributes of a good delegation model Provides coverage for all Active Directory mgmt aspects Meets unique autonomy & isolation requirements Efficiently distributes and delegates admin responsibilities Delegates admin responsibilities based on least privilege Enables easy & reliable un-delegation of admin authority

Suggested Reading And Resources The tools you need to put technology to work! TITLE Suggested Reading And Resources The tools you need to put technology to work! TITLE Available Price Microsoft® Windows® Server 2003 TCP/IP Protocols and Services Technical Reference Kit Today $49. 99 Active Directory® for Microsoft® Windows® Server 2003 Technical Reference Today $49. 99

© 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.

Appendix… Ø Role Definition Previews Ø Challenging Delegations Appendix… Ø Role Definition Previews Ø Challenging Delegations

Preview of Role Definitions To be covered in upcoming whitepaper on delegation of administration Preview of Role Definitions To be covered in upcoming whitepaper on delegation of administration …

Service Management Roles Service Administrator Managers Exclusively manage all service administrator groups across the Service Management Roles Service Administrator Managers Exclusively manage all service administrator groups across the forest: Creation, deletion & management of service admin groups Modification of service admin group memberships Securing service admin groups, accounts & workstations

Service Management Roles Forest Configuration Operators Exclusively manage all security-sensitive admin operations that have Service Management Roles Forest Configuration Operators Exclusively manage all security-sensitive admin operations that have forest-wide impact: Creation and demotion of child domains Creation, deletion and management of trusts Creation, deletion and management of cross-references Transfer and seizure of the forest-wide FSMO roles Modification of forest-wide LDAP settings Installation of Enterprise Certificate Authority (CA) in every domain Raising the forest functional level

Service Management Roles Domain Configuration Operators Exclusively manage all security-sensitive admin operations that have Service Management Roles Domain Configuration Operators Exclusively manage all security-sensitive admin operations that have domain-wide impact: Addition and removal of replica Domain Controllers Transfer and seizure of the domain-wide FSMO roles Granting Replication related extended-rights Protection and management of the default Domain Controllers OU & the System & Builtin containers

Service Management Roles Domain Controller Administrators Exclusively manage all security-sensitive and directory service configuration Service Management Roles Domain Controller Administrators Exclusively manage all security-sensitive and directory service configuration administrative operations on Domain Controllers: Installation and/or modification of software on DCs Installation of service packs and hot-fixes on DCs Configuration of directory service settings in registry Maintenance and backup of event logs Configuration of the Service Control Manager Management of directory service files and SYSVOL Shutting down the Domain Controller Other security-sensitive operations

Service Management Roles Schema Administrators Exclusively manage Active Directory Schema Creation of additional classes Service Management Roles Schema Administrators Exclusively manage Active Directory Schema Creation of additional classes and attributes Modification of existing schema definitions Disabling / resurrecting existing classes / attributes Specifying that an attribute be replicated to the Global Catalog

Service Management Roles Site and Subnet Administrators Exclusively manage creation, association, management and deletion Service Management Roles Site and Subnet Administrators Exclusively manage creation, association, management and deletion of: Sites Subnets Site-link bridges

Service Management Roles Replication Administrators By design, Active Directory replication requires minimal administrative intervention Service Management Roles Replication Administrators By design, Active Directory replication requires minimal administrative intervention Exclusively manage all administrative operations involved in managing replication for a given site or a given group of sites

Service Management Roles Security Policy Administrators Exclusively manage: Domain Controller Security Policy for all Service Management Roles Security Policy Administrators Exclusively manage: Domain Controller Security Policy for all domains Following parts of Domain Security Policy Password policy settings Account Lockout settings Kerberos Policy settings

Service Management Roles DNS Administrators Exclusively manage: Installation & configuration of the DNS server Service Management Roles DNS Administrators Exclusively manage: Installation & configuration of the DNS server service on Domain Controllers Creation & configuration of DNS zones

Ensuring coverage of service management categories Category Role Installation management Forest Configuration Operators & Ensuring coverage of service management categories Category Role Installation management Forest Configuration Operators & Domain Configuration Operators Schema management Schema Admins Operations Master role management Forest Configuration Operators & Domain Configuration Operators LDAP Policy management Forest Configuration Operators Trust management Forest Configuration Operators & Domain Configuration Operators Replication management Site Topology & Replication Admins Backup & Restore management Backup & Restore Admins Directory Database management Domain Controller Admins Domain Controller management Domain Controller Admins Security Policy management Security Policy Admins

Data Management Roles Business Unit Admins & OU Admins Business Unit Admins Represent the Data Management Roles Business Unit Admins & OU Admins Business Unit Admins Represent the business-unit data owners Manage the following data administration operations : Creation and deletion of business-unit OU structure Delegation of specific data administration tasks to appropriate data administrators & other stakeholders Organizational Unit Admins Optional Role Business-unit admins may choose to grant full-control of OUs within the business-unit sub-tree to OU admins Can be either delegated specific admin operations or fullcontrol of an OU within the business-unit sub-tree

Data Management Roles Security Group Admins & Account Admins Security Group Admins Create, delete Data Management Roles Security Group Admins & Account Admins Security Group Admins Create, delete and manage non-service admin security groups Account Admins Create, delete & manage user accounts

Data Management Roles Account Admins & Workstation Admins Manage domain member workstations Create, delete Data Management Roles Account Admins & Workstation Admins Manage domain member workstations Create, delete and manage computer accounts for workstations Resource Admins Create, delete and manage resources (e. g. server farm, internal web-application etc. )

Data Management Roles Help Desk Operators, Application Specific Admins & Service-accounts Help Desk Operators Data Management Roles Help Desk Operators, Application Specific Admins & Service-accounts Help Desk Operators - Provide account support for user and computer accounts Password related administrative operations Account lockout related administrative operations Other operations (depending on support model) Application-specific service admins & service accounts Responsible for creation, modification and deletion of application specific data

Challenging Delegations Challenging Delegations

Challenging Delegations Delegating User Account Operations Specify when a user account expires Grant Write-property Challenging Delegations Delegating User Account Operations Specify when a user account expires Grant Write-property (WP) to Account-Expires attribute Enable / Disable a User account Grant WP to User-Account-Control* attribute Unlock a User account Grant WP to Lockout-Time attribute Reset a User’s password Grant the Reset Password extended right Force a User to change his password Grant WP to the Pwd-Last-Set attribute

Challenging Delegations Delegating ability to move objects Aim – Delegate the ability to only Challenging Delegations Delegating ability to move objects Aim – Delegate the ability to only be able to move objects between two OUs Permissions required to delegate operation Delete Child in Source OU & Create Child in Target OU Write property permissions to the attribute that is the RDN attribute for the object class Delegating this operation safely Create an intermediate drop-off and pick-up OU Grant source and target OU Admins required permissions on the source, target & intermediate OUs

Challenging Delegations Delegating ability to move objects DACL: Allow Source OU Admin Create Child Challenging Delegations Delegating ability to move objects DACL: Allow Source OU Admin Create Child Allow Target OU Admin Delete Child DACL: Allow Source OU Admin Delete Child Source OU DACL: Allow Target OU Admin Create Child Target OU

Challenging Delegations Delegating addition of replica DCs Operational needs may necessitate delegating this operation Challenging Delegations Delegating addition of replica DCs Operational needs may necessitate delegating this operation To delegate operation, grant the following permissions: Extended rights on domain, schema & config partitions Replicating Directory Changes, Replicating Directory Changes All, Manage Replication Topology & Replication Synchronization Additional extended right on domain partition Add/Remove Replica In Domain User Rights: Enable computer and user accounts to be trusted for delegation Permissions required: Inheritable RP on CN=Servers, CN=, CN=Sites, CN=Configuration, DC= Inheritable CC on CN=Servers, CN=, CN=Sites, CN=Configuration, DC= Full Control to “Creator Owner” on CN=, CN=Sites, CN=Configuration, DC= NOTE: In all of the above, represents the site the DC will be belong to CC on OU=Domain Controllers, DC= to create Computer objects Full Control on the Computer object for the server that is being DCPROMOed User must be member of Administrators group on member server being DCPROMOed NOTE: Microsoft highly recommends that this operation not be delegated, unless absolutely required

Other ACL Modification Tools dsacls. exe View or modify ACLs on directory objects acldiag. Other ACL Modification Tools dsacls. exe View or modify ACLs on directory objects acldiag. exe Determine whether a user has been assigned or denied access to a directory object. Reset ACLs to their default state ldp. exe Perform LDAP operations against Active Directory Can be used to view ACLs on objects adsiedit. exe View all objects (and all attributes) in the directory Modify objects and set ACLs on objects NOTE: To Install the Windows 2000 Support Tools, refer to Microsoft Knowledge Base Article - Q 301423

Community Resources http: //www. microsoft. com/communities/default. mspx Most Valuable Professional (MVP) http: //www. mvp. Community Resources http: //www. microsoft. com/communities/default. mspx Most Valuable Professional (MVP) http: //www. mvp. support. microsoft. com/ Newsgroups Converse online with Microsoft Newsgroups, including Worldwide http: //www. microsoft. com/communities/newsgroups/default. mspx User Groups Meet and learn with your peers http: //www. microsoft. com/communities/usergroups/default. mspx

evaluations evaluations

© 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.