kaplan school of information systems and technology
DESCRIPTION
Kaplan School of Information Systems and Technology. Welcome to Unit 5 IT278 Network Administration. Course Name – IT278 Network Administration Instructor – Jan McDanolds, MS Contact Information: AIM – JMcDanolds Email – [email protected]. UNIT 4 REVIEW. What we learned in UNIT 4. - PowerPoint PPT PresentationTRANSCRIPT
KAPLAN SCHOOL OF INFORMATION SYSTEMS AND TECHNOLOGY
Welcome to Unit 5Welcome to Unit 5IT278 Network IT278 Network AdministrationAdministration
Course Name – IT278 Network Administration Instructor – Jan McDanolds, MSContact Information: AIM – JMcDanolds Email – [email protected]
UNIT 4 REVIEW
What we learned in UNIT 41. Understand Active Directory basic concepts
2. Install and configure Active Directory
3. Implement Active Directory containers
4. Create and manage user accounts
5. Configure and use security groups
6. Describe and implement new Active Directory features
UNIT 5
What is that term again?
Quick Check of Terms from UNIT 4…
1.What is a Local Group used for? (Local Security Group)
2.In a domain, what group provides access to resources?
3.Why would you use a Domain Global Group?
4.In a domain, where do you manage groups?
UNIT 5
Configuring, Managing and Troubleshooting Resource Access
Chapter 5 - Objectives
Set up security for folders and filesConfigure shared folders and shared folder securityInstall and set up the Distributed File System (DFS)Configure disk quotasImplement UNIX compatibility
UNIT 5
Managing Folder and File SecurityCreating accounts and groups are the initial steps for sharing resources
Next create access control lists (ACLs) to secure objects and set them up for sharing
Discretionary ACL (DACL)ACL configured by a server administrator or owner of an object
System control ACL (SACL)Information used to audit the access to an object
ACL – pronounced “ackel” like jackal or A. C. L. ACE – Access Control Element
UNIT 5
Configuring Folder and File Attributes
Attributes are stored as header information with each folder and file, along with volume label, designation as a subfolder, date of creation, and time of creation
Two basic attributes remain in NTFS that are still compatible with FAT - Read-only and hidden
The advanced attributes are: archive, index, compress, and encrypt
UNIT 5
Configuring Folder and File Attributes (cont)
Archive attribute - Indicates the folder or file needs to be backed up because it is new or changed
File server backup systems can be set to detect files with the archive attribute to ensure files are backed up
Index attribute vs. Windows Search ServiceThe NTFS index attribute is used to index the folder and file contents so files can be quickly searched in Windows Server 2008
through the Indexing ServiceWindows Server 2008 offers faster search service called: Windows Search Service – installed in the File Services role via Server Manager
UNIT 5
Configuring Folder and File Attributes (cont)Compress attribute - A folder and its contents can be stored on the disk in compressed format
Compression saves space, however, compressed files increase CPU overhead to open the files and to copy them
Encrypt attribute - Protects folders and files so that only the user who encrypts the folder or file is able to read it
An encrypted folder or file uses the Microsoft Encrypting File System (EFS)A unique, private encryption key associated with the user account that encrypted the folder or file
EFS uses both symmetric and asymmetric encryption techniques.When you move an encrypted file to another folder on the same computer, that file remains encrypted, even if you rename it
Encrypted files cannot be compressed!
UNIT 5
Configuring Folder and File PermissionsPermissions - Control access to an object, such as a folder or file
When you configure a folder so that a domain local group has access to only read the contents of that folder, you are configuring permissions
At the same time, you are configuring that folder’s discretionary access control list (DACL) of security descriptors
If you need to customize permissions, you have the option to set up special permissions for a particular group or user
UNIT 5
Folder PropertiesPermissions - Control access to an object, such as a folder or fileWhen you configure a folder so that a domain local group has access to only read the contents of that folder
You are configuring permissions
At the same time, you are configuring that folder’s discretionary access control list (DACL) of security descriptors
UNIT 5
Configuring Folder and File AuditingAuditing
Enables you to track activity on a folder or file
Windows Server 2008 NTFS folders and files Enable you to audit a combination of any or all of the activities listed as special permissions in Table 5-2
Configure auditing on a folder to monitor how it is accessed and who is making changes to the folder
UNIT 5
Configuring Folder and File OwnershipOnce permissions and auditing are set, you may want to verify the ownership of a folder.
-Folders are first owned by the account that creates them-Folder owners have the ability to change permissions for the folders they create
-Ownership can be transferred only by having the Take ownership special permission
Or Full control permission (which includes Take ownership)
UNIT 5
Configuring Shared Folders and Shared Folder Permissions
A folder can be set up as a shared folder for users to access over the network.
The first step for sharing a folder over the network is to turn on file sharing
UNIT 5
Configuring Shared Folders and Shared Folder Permissions
Share permissions - Differ from the NTFS access permissions set through the Security tab
The NTFS and share permissions are cumulative with the exception of permissions that are denied
Share permissions:ReaderContributorCo-ownerOwner
UNIT 5
Implementing a Distributed File SystemDistributed File System (DFS) - simplifies access to shared folders by setting up folders to appear as though they are accessed from only one placeIf DFS is used in a domain, then shared folder contents can be replicated to one or more DCs or member servers.DFS advantages: - Shared folders can be set up so that they appear in one hierarchy of folders enabling users to save time searching for information- NTFS access permissions fully apply to DFS on NTFS-formatted volumes- Fault tolerance is an option by replicating shared folders on multiple servers- Access to shared folders can be distributed across many servers (load balancing)- Access is improved to resources for Web-based Internet and intranet sites- Vital shared folders on multiple computers can be backed up from one set of master folders- DFS reduces the number of calls to server administrators asking where to find a particular resource- DFS in a domain enables folders to be replicated automatically or manually through Microsoft File Replication Service
UNIT 5
DFS ModelsStand-alone DFS model
No Active Directory implementation is available to help manage the shared foldersThis model provides only a single or flat level share
Domain-based DFS modelTakes full advantage of Active Directory and is available only to servers and workstations that are members of a domainEnables a deep, root-based, hierarchical arrangement of shared folders that is published in Active Directory
UNIT 5
DFS TopologyDFS topology - The hierarchical structure of DFS in the domain-based modelNamespace root - A main container (top-level folder) in Active Directory that holds links to shared folders that can be accessed from the rootNamespace server - The server that maintains the namespace root
After the namespace root is created, it is populated by shared folders for users to access. Folders are established in a level hierarchy and appear to be in one server location although they can be on many servers
Replication group - A set of shared folders that is replicated or copied to one or more servers in a domain
DFS is installed as a service within the File Services role
If the File Services role is already installed, but you don’t see the DFS Management tool on the Administrative Tools menu this means you didn’t install Distributed File System when you installed the File Services role
UNIT 5
DFS InstallationDFS is installed as a service within the File Services roleIf the File Services role is already installed, but you don’t see the DFS Management tool on the Administrative Tools menu, you didn’t install Distributed File System when you installed the File Services role
UNIT 5
Managing a Domain-Based Namespace Root System
Creating a folder in a namespace - A folder is simply a shared folder that you add to (or link to) the namespace rootFolder target - A path in the Universal Naming Convention (UNC) format, such as to a shared folder or to a different DFS pathUniversal Naming Convention (UNC) - A naming convention that designates network servers, computers, and shared resources
Clients who access the namespace can see a list of folder targets ordered in a hierarchy
Delegating ManagementDelegating management simply involves right-clicking the namespace and clicking Delegate Management Permissions
Tuning a NamespaceTuning options: Configure the order for referrals, Configure cache duration for a namespace, Configure cache duration for a folder, Configure namespace polling, Configure folder targets as enabled or disabled
UNIT 5
Configuring Disk Quotas
Disk quotas advantages:Preventing users from filling the disk capacityEncouraging users to help manage disk spaceTracking disk capacity needs on a per-user basis for future planningProviding server administrators with information about users quota limits
Disk quotas can be set on any local or shared volumeEstablish disk quotas by volume or userDisk quota management parameters:
Enable quota managementDeny disk space to users exceeding quota limit, Do not limit disk usageLimit disk space to, Set warning level toLog event when a user exceeds their quota limitLog event when the user exceeds their warning level
UNIT 5
Using UNIX Interoperability in Windows Server 2008
Subsystem for UNIX-based Applications (SUA)Provides interoperability between Windows Server 2008 and UNIX and Linux systems
SUA allows you to:Run UNIX/Linux applications with few or no changes to the program source codeRun UNIX/Linux scriptsUse popular UNIX/Linux shellsRun most UNIX/Linux commandsRun the popular vi UNIX/Linux editor
UNIT 5
Chapter 5 Quick Check
End of Session Check of Terms…
1. A(n) __________ is an ACL that is configured by a server administrator or owner of an object.
2. An encrypted folder or file uses the Microsoft _____________ , which sets up a unique, private encryption key associated with the user account that encrypted the folder or file.
3. __________________ control access to an object, such as a folder or file.
4. Accessing folders and files can be tracked by setting up ___________, which in Windows Server 2008 enables you to track activity on a folder or file, such as read or write activity.
UNIT 4
Assignments for UNIT 5Read Chapter 5Post to the Discussion BoardComplete the Unit 5 Project – download the assignment .pdf file
1. On your 2008 server, create a folder on the C: drive called “your initials_Veggie_Folder”. Within this folder, create two more folders called “your initials_Veggie_Compression” and “your initials_Veggie_Encryption”. (take screenshot)2. Assign the user Fred Flintstone Full Control NTFS permissions to “your initials_Veggie_Folder”. (take screenshot of Security tab) 3. Share the folder called “your initials_Veggie_Folder” as “mysharedveggies”. Assign the Bedrock group Change share permissions to this folder. (take screenshot)4. Enable compression on the folder called “your initials_Veggie_Compression”. (take screenshot of Advanced Attributes)Enable encryption on the folder called “your initials_Veggie_Encryption”. (take screenshot of Advanced Attributes) 5. Set a disk quota limit of 400 meg and a warning level of 100 meg on the C:drive for Fred Flintstone. (take screenshot)
6. No spelling or grammar errors7. Title and reference page