Domain Controller and

Active Directory
Overview

Domain Controller
Active Directory
Creating User Accounts
Creating Computer Accounts
Modifying User and Computer Account Properties
Creating a User Account Template
Enabling and Unlocking User and Computer Accounts
Resetting User and Computer Accounts
Locating User and Computer Accounts in Active Directory
CSVDE & LDIFDE
Domain Controller

 Domain controllers store data and manage user and domain interactions,
including user logon processes, authentication, and directory searches.
 If you plan to use this server to provide the Active Directory service to
network users and computers, configure this server as a domain
controller

 After configuring the domain controller role, you can:

 Store directory data and make this data available to

network users and administrators
 Improve network performance between sites by placing a
domain controller in each site
 With a domain controller in each site, you can handle
client logon processes within the site
Active Directory

Active Directory is a directory service that stores information about objects

on a network and makes this information available to users and network
administrators
Active Directory stores information about user accounts
Authenticates and authorizes users, groups, and computers to access
objects on the network
Once the identity of a user has been confirmed in Active Directory, the
LSA (Local Security Authority) on the authenticating domain controller
generates a user access token and associates a security ID with the user
 Access token: When a user is authenticated, LSA creates a security access
token for that user. An access token contains the user's name, the groups to
which that user belongs, a SID for the user, and SID for the group to which
the user belongs
 Security ID (SID): Active Directory automatically assigns SIDs to security
principal objects at the time they are created
Creating User Accounts

What Is a User Account?

Names Associated with Domain User Accounts
Guidelines for Creating a User Account Naming Convention
User Account Placement in a Hierarchy
User Account Password Options
When to Require Password Changes
How to Create User Accounts
Best Practices for Creating User Accounts
What Is a User Account?

Local user accounts

(stored on local computer)

Domain user accounts

(stored in Active Directory)

Windows Server 2003 Domain

Names Associated with Domain User Accounts

Name Example
User logon name Jayadams

Pre-Windows 2000
Nwtraders\jayadams
logon name

User principal logon

Jayadams@[Link]
name

LDAP relative
CN=jayadams,CN=users,dc=nwtraders,dc=msft
distinguished name
Guidelines for Creating a User Account Naming Convention

A convention for naming user accounts should

accommodate:

Employees with duplicate names

Different types of employees, such as temporary or contract

employees
User Account Placement in a Hierarchy

Geopolitical Design Business Design

North America Accounting

Users Users

South America Sales

Users Users
User Account Password Options

Account options Description

User must change
Users must change their passwords the next time
password at next they log on to the network
logon
User cannot change A user does not have the permissions to
password change their own password

Password never
A user password is prevented from expiring
expires

A user cannot log on by using the selected

Account is disabled
account
When to Require or Restrict Password Changes

Option Use this option when you:

Require Create new domain accounts
password
Reset passwords
changes

Restrict Create local and domain service accounts

password Create new local accounts that will not log on
changes locally
How to Create User Accounts

Your instructor will demonstrate how to:

Create a domain user account

Create a local user account
Practice: Creating User Accounts

In this practice, you will:

 Create a local user account by using
Computer Management
 Create a domain account by using
Active Directory Users and Computers
 Create a domain user account by using
dsadd
Best Practices for Creating User Accounts

Best practices for creating local user accounts

Do not enable the Guest account

Limit the number of people who can log on locally

Best practices for creating domain user accounts

Disable an account that will not be used immediately

Require users to change their passwords the first time that

they log on
Creating Computer Accounts

What Is a Computer Account?

Why Create a Computer Account?
Where Computer Accounts Are Created in a Domain
Computer Account Options
How to Create a Computer Account
What Is a Computer Account?

Identifies a computer in a domain

Provides a means for authenticating and auditing computer
access to the network and to domain resources
Is required for every computer running:
 Windows Server 2003
 Windows XP Professional
 Windows 2000
 Windows NT
Why Create a Computer Account?

Security
Authentication
Auditing
Management
Active Directory features:
Software deployment
Desktop management
Where Computer Accounts Are Created in a Domain

Computers that join a domain are created

in the Computers container

Computer accounts can be moved to

or created in other organizational units
Computer Account Options
Modifying User and Computer Account Properties

When to Modify User and Computer Account Properties

Properties Associated with User Accounts
Properties Associated with Computer Accounts
How to Modify User and Computer Account Properties
When to Modify User and Computer Account Properties

Modify user account properties to:

Make it easier to use search capabilities to
find users
Match a company’s organizational hierarchy
Determine the group membership of a user account

Modify computer account properties to:

Assist in asset tracking (Location property)

Properties Associated with User Accounts

The Properties dialog box for a user account contains:

Properties Associated with Computer Accounts

The Properties dialog box for a computer account contains:

How to Modify User and Computer Account Properties

Your instructor will demonstrate how to modify user and

computer accounts
Practice: Modifying User and Computer Account Properties

In this practice, you will modify user and

computer account properties
Lesson: Creating a User Account Template

What Is a User Account Template?

What Properties Are in a Template?
Guidelines for Creating User Account Templates
What Is a User Account Template?

A user account template is a user account that contains the

properties that apply to users with common requirements
User account templates make creating user accounts with
standardized configurations more efficient

User Account
Template
What Properties Are in a Template?

Tab Properties copied

Address All properties except Street Address

Account All properties except Logon Name

All properties, except Profile path and Home folder,
Profile reflect new user’s logon name
Organization All properties except Title
Member Of All properties
Enabling and Unlocking User and Computer Accounts

Why Enable and Disable User and Computer Accounts?

How to Enable and Disable User and Computer Accounts
What Are Locked-out User Accounts?
How to Unlock User Accounts
Why Enable or Disable User and Computer Accounts?
How to Enable and Disable User and Computer Accounts

Your instructor will demonstrate how to enable and disable

user and computer accounts
What Are Locked-out User Accounts?

The account lockout threshold:

 Defines the number of failed
logon attempts
 Prevents hackers from
guessing user passwords
An account can exceed the
account lockout threshold by too
many failed logon attempts:
 At the logon screen
 At a screen saver protected
by a password
 When accessing network
resources
How to Unlock User Accounts

Your instructor will demonstrate how to unlock user

accounts
Practice: Enabling and Disabling User and Computer
Accounts

In this practice, you will enable and disable a

user account and computer account
Lesson: Resetting User and Computer Accounts

When to Reset Passwords

How to Reset Passwords
When to Reset Computer Accounts
How to Reset Computer Accounts
When to Reset User Passwords

Reset a password when a user forgets his or her password

After resetting a password, a user can no longer access
some types of information, including:
 E-mail that is encrypted with the user’s public key
 Internet passwords that are saved on the computer
 Files that the user has encrypted
How to Reset User Passwords

Your instructor will demonstrate how to reset user

passwords
When to Reset Computer Accounts

Reset computer accounts when:

 Computers fail to authenticate to the domain
 Passwords need to be synchronized
How to Reset Computer Accounts

Your instructor will demonstrate how to reset computer

accounts
Practice: Resetting a User Account Password

In this practice, you will reset the password for

a user account
Locating User and Computer Accounts in Active Directory

Introduction to Locating User and Computer Accounts in

Active Directory
Search Types
How to Search Using Common Queries
Using a Custom Query
Introduction to Locating User and Computer Accounts in
Active Directory

This presentation will explain how to locate

objects in Active Directory
Search Types

Basic query criteria include:

 Object type
 Location
 General values associated with the object, such as name
and description
CSVDE (Comma Separated Value Data Exchange )

Imports and exports data from Active Directory Domain Services

(AD DS) using files that store data in the comma-separated value (CSV)
format
CSV format consists of one or more lines of data with each value
separated by a comma and no spaces between the comma and the next
entry
To use csvde, you must run the csvde command from a command
prompt
Parameters of csvde command:
 -i: Specifies import mode. If not specified, the default mode is
export
 -f <FileName>: Identifies the import or export file name
 -k: Ignores errors during an import operation and continues
processing
 /?: Displays Help at the command prompt
 CSVDE example

File [Link] (or [Link])

objectClass,dn,SAMAccountName,userPrincipalName,userAccountControl
user,"CN=KMyer,CN=Users,DC=cpandl,DC=com",KenM,KenM@[Link],514
user,"CN=WYu,OU=SWDev,DC=cpandl,DC=com",WeiY,WeiY@[Link],514
user,"CN=JMorris,OU=Acct,DC=cpandl,DC=com",JonM,JonM@[Link],514
user,"CN=YXu,OU=AP,OU=Acct,DC=cpandl,DC=com",YeX,YeX@[Link],514

CSVDE command to import all users from [Link]:

csvde –i –f [Link]
CSVDE command to export all objects to [Link]
csvde –f [Link]
LDIFDE (LDAP Data Interchange Format, Data Exchange)

Creates, modifies, and deletes directory objects

export Active Directory user and group information
To use ldifde, you must run the ldifde command from a command prompt
Parameters of LDIFDE command:
 -i: Specifies to use the import mode. The default mode is export
 -f <FileName>: Identifies the import or export file name
 -k: Ignores errors during an import operation and continues processing
 /? Displays help
changeType value to define the type of changes that the import file will contain:
 add: Specifies that new content is contained in the import file
 modify: Specifies that existing content has been modified in the import file
 delete: Specifies that content has been deleted in the import file
LDIFDE example

File [Link] (or [Link])

DN: CN=April Stewart,OU=People,DC=contoso,DC=com
changeType: add
CN: April Stewart
objectClass: user
sAMAccountName: [Link]
userPrincipalName: [Link]@[Link]
mail: [Link]@[Link]
description: Sales Representative in the USA

LDIFDE command to import all users from [Link]:

ldifde –i –f [Link]
LDIFDE command to export all objects to [Link]
ldifde –f [Link]
Lab A: Managing User and Computer Accounts

In this lab, you will:

Create user and computer accounts
Move user and computer accounts
Enable user accounts