Windows Administration Resource Kit: Productivity Solutions for IT Professionals

Windows Administration. Productivity Solutions for IT Professionals......Page 1
Copyright Page......Page 2
Dedication......Page 3
About the Author......Page 5
Acknowledgments......Page 7
Contents at a Glance......Page 9
Table of Contents......Page 11
Introduction......Page 37
Web-Based Content......Page 39
Using the Scripts......Page 40
Resource Kit Support Policy......Page 41
Solution Collection 1: Role-Based Management......Page 43
Scenarios, Pain, and Solution......Page 44
Scripts and tools on the companion media......Page 50
Microsoft and third-party tools......Page 51
The Windows Administration Resource Kit online community......Page 52
Solution overview......Page 53
Active Directory Users and Computers......Page 54
DS commands......Page 55
Creating a batch script......Page 56
Enumerating group membership with VBScript......Page 57
Next steps......Page 67
Solution overview......Page 68
HTML Applications......Page 69
Create an HTA......Page 70
Solution overview......Page 77
Arguments and HTAs......Page 78
Integrating a custom HTA with an MMC snap-in using tasks......Page 80
Integrating a custom HTA with an MMC snap-in using display specifiers......Page 84
Solution overview......Page 88
Introduction......Page 89
Role groups......Page 90
Capability management groups......Page 91
Role groups are nested into capability management groups......Page 93
Other nesting......Page 94
Data, business logic, and presentation......Page 95
Solution summary......Page 96
Role groups......Page 97
Capability management groups......Page 103
Representing business requirements......Page 106
Solution summary......Page 107
Introduction......Page 108
My Memberships......Page 109
Access Report......Page 113
Auditing internal compliance of your role-based access control......Page 115
Solution summary......Page 118
A review of role-based management......Page 119
Discussing and selling role-based management......Page 121
The road to role-based management......Page 123
Token size......Page 125
Solution summary......Page 129
Solution Collection 2: Managing Files, Folders, and Shares......Page 131
Scenarios, Pain, and Solution......Page 132
The ACL editor......Page 134
Evaluating effective permissions......Page 138
Solution overview......Page 141
Create a folder structure that is wide rather than deep......Page 142
Solution summary......Page 145
Create one or more consistent root data folders on each file server......Page 146
Use Group Policy to manage and enforce ACLs on root data folders......Page 147
Dedicate servers that perform a file server role......Page 149
Manage the delegation of administration of shared folders......Page 150
Introduction......Page 152
Determine which folders should be shared......Page 153
Introduction......Page 154
Implement a Read capability......Page 155
Implement a Browse To capability......Page 156
Implement an Edit capability......Page 158
Implement a Contribute capability......Page 159
Implementing a Support capability......Page 160
Manage folder access capabilities using role-based access control......Page 161
Solution overview......Page 162
Introduction......Page 163
Solution summary......Page 165
Customizing Share_Create.vbs......Page 166
Understanding Share_Create.vbs......Page 167
Solution overview......Page 168
Using Folder_Provision.hta......Page 169
Basic customization of Folder_Provision.hta......Page 172
Understanding the code behind Folder_Provision.hta and advanced customization......Page 173
Solution summary......Page 177
Introduction......Page 178
See the bug-like feature in action......Page 179
What in the world is going on?......Page 180
Solving the problem......Page 181
Solution summary......Page 182
Introduction......Page 183
Introduction......Page 185
A third perspective and a solution: Access-based Enumeration......Page 186
Introduction......Page 187
Solution summary......Page 188
Using Message_Notification.vbs......Page 189
Using PSExec to execute a script on a remote machine......Page 190
Using and customizing FileServer_NotifyConnectedUsers.vbs......Page 192
Using Robocopy to distribute files......Page 193
Using DFS Replication to distribute files......Page 194
Introduction......Page 196
Quota templates......Page 197
Apply a quota to a folder......Page 198
Introduction......Page 199
Enabling shadow copies......Page 200
Understanding and configuring shadow copies......Page 202
Accessing previous versions......Page 203
Solution summary......Page 204
Introduction......Page 205
Delegating DFS namespaces......Page 206
Linking DFS namespaces......Page 208
Presenting DFS namespaces to users......Page 210
Solution summary......Page 211
Solution Collection 3: Managing User Data and Settings......Page 213
Scenarios, Pain, and Solution......Page 214
Understand the business requirements definition exercise......Page 216
Define the high-level business requirements......Page 219
Determine key design decision that is derived from high-level business requirements......Page 222
Define requirements derived from key design decisions......Page 223
Solution summary......Page 226
Introduction......Page 227
Understand UDS options......Page 228
Align user data and settings options with requirements and scenarios......Page 231
Validate the outcome for desktop, roaming, relocated, and traveling users......Page 233
Solution summary......Page 234
Introduction......Page 235
Create the user data store root folder......Page 237
Align physical namespace with management requirements such as quotas......Page 242
Provision the creation of data stores......Page 250
Solution summary......Page 252
Introduction......Page 253
Create the SMB namespace for user data and settings stores......Page 254
Design the logical view of user data and settings stores with DFS Namespaces......Page 257
Build a DFS namespace to support thousands of users......Page 259
Understand the impact of data movement and namespace changes......Page 260
Consider the impact of %username% changes......Page 262
Build an abstract DFS namespace for user data and settings (no site-based namespace, preferably no human names)......Page 263
Automate and provision the creation of user data stores and DFS namespaces......Page 264
Solution summary......Page 265
Introduction......Page 266
Understand the role of folder redirection......Page 267
Configure folder redirection policies......Page 269
Configure folder redirection targets......Page 270
Configure folder redirection settings......Page 274
Support redirection for users on both Windows XP and Windows Vista......Page 278
Redirect without Group Policy: Favorites, Music, Pictures, and Videos......Page 280
Achieve a unified redirected folder environment for Windows XP and Windows Vista......Page 284
Introduction......Page 287
Understand caching......Page 288
Understand offline mode......Page 289
Leverage offline files for the UDS framework......Page 290
Put offline files to use......Page 298
Introduction......Page 299
Analyze the structure of the Windows Vista user profile......Page 300
Review the components that create the user profile......Page 302
Configure the folders that will not roam......Page 304
Recognize the “V2” of Windows Vista roaming profiles......Page 305
Work through the FOLKLORE of roaming profiles......Page 306
Manage the Application Data (AppData\\Roaming) folder......Page 308
Introduction......Page 309
Design a local-only data folder structure......Page 311
Ensure that applications will find relocated media folders......Page 313
Provide a way for users to find relocated folders......Page 314
Introduction......Page 316
Determine the name for a local files folder......Page 317
Option 2: Leverage offline files (Windows Vista only)......Page 318
Option 3: Create a local folder that is backed up to a network store......Page 320
Introduction......Page 321
Define the goals of a synchronization solution......Page 322
Utilize Robocopy as a backup engine......Page 323
Leverage Folder_Synch.vbs as a wrapper for Robocopy......Page 324
Deploy Folder_Synch.vbs and Robocopoy......Page 325
Launch Folder_Synch.vbs manually......Page 326
Enable users to right-click a folder and back it up using a shell command......Page 328
Run Folder_Synch.vbs automatically......Page 330
Run Folder_Synch.vbs as a scheduled task......Page 331
Run Folder_Synch.vbs as a logon, logoff, startup, or shutdown script......Page 332
Log and monitor synchronization......Page 333
Solution summary......Page 334
Recognize the crux of the challenge......Page 335
Analyze and classify your user data stores and data......Page 336
Solution summary......Page 339
Solution Collection 4: Implementing Document Management and Collaboration with SharePoint......Page 341
Scenarios, Pain, and Solution......Page 342
Solution overview......Page 343
Create a site......Page 344
Create a document library......Page 345
Configure document library settings......Page 346
Configure the document library title......Page 348
Change the default template for the library......Page 349
Configure security for a document library......Page 351
Solution summary......Page 353
Introduction......Page 354
Create a column......Page 355
Work with custom columns from Microsoft Office clients......Page 356
Work with document properties from the SharePoint Web interface......Page 358
Modify or delete library columns......Page 360
Create site columns......Page 361
Modify and delete site columns......Page 362
Introduction......Page 363
Create a content type......Page 364
Understand child site and list content types......Page 366
Solution summary......Page 368
Create a central library for templates......Page 369
Configure a library to support the content types......Page 370
Introduction......Page 371
Upload documents with the Upload commands......Page 372
Add documents to document libraries with Windows Explorer......Page 373
E-mail–enable a document library......Page 374
Solution summary......Page 375
Create Network Places (Windows XP)......Page 376
Create Network Locations (Vista)......Page 377
Introduction......Page 378
Solution summary......Page 379
Open a document with Office 2007 clients installed......Page 380
Introduction......Page 381
Subscribe to e-mail alerts for a library or document......Page 382
Introduction......Page 383
Check out a document......Page 384
Manage document check in......Page 385
Introduction......Page 387
Manage the creation of major and minor versions......Page 388
Introduction......Page 389
Solution summary......Page 390
Configure the choice field for the state......Page 391
Configure the three-state workflow......Page 392
Solution summary......Page 394
Use folders to scope document management......Page 395
Solution summary......Page 396
Enable indexing of PDFs......Page 397
Assign an icon to unrecognized file types......Page 400
Introduction......Page 401
Provide offline access to files using the local cache......Page 402
Use Outlook 2007 to take libraries and lists offline......Page 403
Solution summary......Page 404
Scenarios, Pain, and Solution......Page 405
Use Active Directory object ACLs and ACL editor interfaces......Page 407
Manage access control entries on Active Directory objects......Page 409
Adhere to the golden rules of delegation......Page 411
Apply permissions with a friend: The Delegation Of Control Wizard......Page 412
Manage the presentation of your delegation......Page 414
Introduction......Page 415
Locate and understand Delegwiz.inf......Page 416
Customize Delegwiz.inf......Page 419
Use Microsoft’s super-duper Delegwiz.inf......Page 420
Solution summary......Page 421
Recognize that some permissions are hidden......Page 422
Modify Dssec.dat......Page 423
Solution summary......Page 425
Use Dsacls to report Active Directory permissions......Page 426
Use ACLDiag to report Active Directory permissions......Page 427
Use ADFind to report Active Directory permissions......Page 428
Use DSRevoke to report Active Directory permissions......Page 429
Evaluate permissions assigned to a specific user or group......Page 430
Revoke Active Directory permissions with Dsacls......Page 431
Reset permissions to Schema defaults......Page 432
Introduction......Page 433
Delegate permissions to manage computer objects......Page 434
Use Dsacls to delegate other common tasks......Page 436
Solution summary......Page 442
Define the tasks that are performed......Page 443
Solution summary......Page 444
Identify the pain points of an unmanaged delegation model......Page 445
Assign permissions to capability management groups......Page 447
Create granular capability management groups......Page 448
Report permissions in a role-based delegation......Page 449
Solution overview......Page 450
Recognize the need for scripted delegation......Page 451
Solution summary......Page 452
Define scopes of computers......Page 453
Implement the delegation of local administration......Page 454
Manage the scope of delegation......Page 456
Solution overview......Page 458
Identify protected groups......Page 459
Solution summary......Page 460
Scenarios, Pain, and Solution......Page 461
Introduction......Page 463
Establish naming standards for computers......Page 464
Design Active Directory to delegate the management of computer objects......Page 465
Create a computer object in Active Directory......Page 467
Delegate permissions to join computers using existing computer objects......Page 468
Join a computer to the domain......Page 470
Ensure correct logon after joining the domain......Page 471
Solution summary......Page 472
Introduction......Page 473
Configure the default computer container......Page 474
Solution overview......Page 477
Use Computer_JoinDomain.hta......Page 478
Provision computer accounts with Computer_JoinDomain.hta......Page 480
Create an account and join the domain with Computer_JoinDomain.hta......Page 482
Distribute Computer_JoinDomain.hta......Page 483
Automate the management of desktop and laptop groups......Page 484
Identify and manage other computer roles and capabilities......Page 487
Solution summary......Page 488
Rejoin a domain without destroying a computer’s group memberships......Page 489
Replace a computer correctly by resetting and renaming the computer object......Page 490
Replace a computer by copying group memberships and attributes......Page 491
Introduction......Page 492
Use the managedBy attribute to track asset assignment of a computer to a single user or group......Page 493
Use the manager attribute to track asset assignment of computersto a user......Page 494
Solution summary......Page 495
Understand the impact of extending the schema......Page 496
Plan the ComputerAssignedTo attribute and ComputerInfo object class......Page 497
Register the Active Directory schema snap-in......Page 498
Create the ComputerAssignedTo attribute......Page 499
Create the ComputerInfo object class......Page 501
Associate the ComputerInfo object class with the Computer object class......Page 503
Allow the changes to replicate......Page 504
Integrate the Computer_AssignTo.hta tool with Active Directory Users and Computers......Page 505
Solution summary......Page 509
Determine the information you wish you had......Page 510
Understand Computer_InfoToDescription.vbs......Page 511
Delegate permissions for computer information reporting......Page 512
Automate computer information reporting with startup and logon scripts or scheduled tasks......Page 514
Solution summary......Page 515
Add a “Connect with Remote Desktop” command......Page 516
Add an “Open Command Prompt” command......Page 517
Execute any command remotely on any system......Page 518
Use Remote_Command.hta to create specific command tasks for remote administration......Page 519
Solution summary......Page 520
Scenarios, Pain, and Solution......Page 521
Establish best practice standards for user object name attributes......Page 523
Implement manageable user logon names......Page 529
Prepare to add the second “ John Doe” to your Active Directory......Page 532
Introduction......Page 533
Create a custom console that shows all domain users......Page 534
Control the scope of a saved query......Page 535
Build saved queries that target specific objects......Page 536
Understand LDAP query syntax......Page 538
Identify some useful LDAP queries......Page 539
Transfer saved queries between consoles and administrators......Page 540
Introduction......Page 541
Create a taskpad with tasks for each delegated ability......Page 542
Create an administrative home page within the console......Page 545
Save the console in User mode......Page 546
Distribute the console......Page 547
Introduction......Page 548
Leverage unused and unexposed attributes of user objects......Page 549
Extend the schema with custom attributes and object classes......Page 551
Create an attribute that exposes the computer to which a user is logged on......Page 553
Create an attribute that supports users’ software requests......Page 554
Introduction......Page 555
Display and edit the value of an unexposed attribute......Page 556
Use the Object_Attribute.vbs script to display or edit any single-valued attribute......Page 563
Use Object_Attribute.hta to view or edit single-valued or multivalued attributes......Page 564
Solution overview......Page 565
Carefully restrict the delegation to move (delete) objects......Page 566
Solution summary......Page 567
Examine a user-provisioning script......Page 568
Solution summary......Page 571
Scenarios, Pain, and Solution......Page 573
Create groups that document their purpose......Page 575
Protect groups from accidental deletion......Page 577
Consider the group type: security vs. distribution......Page 578
Consider group scope: global, domain local, and universal......Page 581
Solution summary......Page 582
Examine the member and memberOf attributes......Page 583
Delegate permission to write the member attribute......Page 585
Introduction......Page 591
Examine scenarios suited to the use of subscription groups......Page 592
Delegate the Add/Remove Self As Member validated write......Page 593
Provide tools with which to subscribe or unsubscribe......Page 594
Solution summary......Page 596
Use Group_Subscription.hta......Page 597
Understand Group_Subscription.hta......Page 598
Take away lessons in the value of group standards......Page 599
Solution summary......Page 600
Shadow groups and fine-grained password and account lockout policies......Page 601
Define the group membership query......Page 602
Develop a script to manage the group’s member attribute based on the query, while minimizing the impact on replication......Page 603
Trigger the script based on changes to an OU......Page 605
Introduction......Page 606
Report direct, indirect, and primary group memberships......Page 607
List a user’s membership by group type......Page 608
Display all members of a group......Page 609
Add or remove group members with Group_ChangeMember.hta......Page 610
Identify notes and next steps for group management tools......Page 611
Solution overview......Page 612
Introduction......Page 613
Understand proxying......Page 614
Explore the components of the Proxy Framework......Page 615
Imagine what proxying can do for you......Page 623
Delegate group management to users with increased confidence and security......Page 624
Scenarios, Pain, and Solution......Page 625
Introduction......Page 627
Rationalize your software folder namespace......Page 628
Manage access to software distribution folders......Page 630
Share the Software folder, and abstract its location with a DFS namespace......Page 631
Replicate software distribution folders to remote sites and branch offices......Page 633
Solution summary......Page 635
Introduction......Page 636
Determine how to automate the installation of an application......Page 637
Use Software_Setup.vbs to install almost any application......Page 639
Separate the configuration from the application installation......Page 641
Install the current version of an application......Page 643
Solution summary......Page 644
Configure a GPO to deploy an application......Page 645
Scope the deployment of an application using application groups......Page 647
Filter the software deployment GPO with the application group......Page 648
Link the GPO as high as necessary to support its scope......Page 649
GPSI and Microsoft Office 2007......Page 650
Introduction......Page 651
Deploy files with Group Policy Files preferences......Page 652
Push registry changes using Registry preferences......Page 654
Solution overview......Page 657
Identify the challenges of deploying applications such as Microsoft Office 2007......Page 658
Prepare a software distribution folder for Microsoft Office 2007......Page 659
Create a setup customization file......Page 660
Identify the requirements for a build-it-yourself software management framework......Page 661
Customize Software_Deploy.vbs to enable application deployment......Page 662
Manage change using group membership......Page 667
Give users control over the timing of installation......Page 670
Use SendKeys to automate an action sequence......Page 672
Understand and customize Config_QuickLaunch_Toggle.vbs......Page 675
Solution summary......Page 676
Solution Collection 10: Implementing Change, Configuration, and Policies......Page 677
Scenarios, Pain, and Solution......Page 678
Introduction......Page 679
Translate the change to Group Policy settings......Page 680
Implement more GPOs with fewer settings......Page 681
Establish a GPO naming convention......Page 682
Ensure a new GPO is not being applied while you are configuring its settings......Page 683
Understand the behavior of client-side Group Policy application......Page 684
Solution overview......Page 686
Scope GPOs to security groups......Page 687
Link group-filtered GPOs high in the structure......Page 691
Maximize group management techniques to control GPO scoping......Page 692
Solution overview......Page 693
Determine the password policies that are appropriate for your organization......Page 694
Customize the default GPOs to align with your enterprise policies......Page 697
Implement your password, lockout, and Kerberos policies......Page 698
Implement fine-grained password policies to protect sensitive and privileged accounts......Page 699
Understand PSO precedence......Page 701
Solution summary......Page 703
Implement your auditing policies by modifying the Default Domain Controllers Policy GPO......Page 704
Audit changes to Active Directory objects......Page 707
Leverage Directory Service Changes auditing......Page 709
Solution overview......Page 711
Scope GPOs to the domain......Page 712
Enforce corporate security and configuration policies......Page 713
Provide a managed migration path to policy implementation......Page 714
Solution summary......Page 715
Delegate permissions to link existing GPOs to an OU......Page 716
Delegate the ability to manage an existing GPO......Page 718
Delegate permission to create GPOs......Page 719
Understand the business and technical concerns of Group Policy delegation......Page 720
Introduction......Page 721
Prepare for and model the effects of the pilot test......Page 722
Create a rollback mechanism......Page 723
Migrate objects to the scope of the new GPO......Page 724
Deploy registry changes with templates or registry preferences......Page 725
Run GPUpdate on a remote system to push changes......Page 726
Avoid WMI filters and targeting when possible: Use shadow groups instead......Page 727
No-brainer Group Policy settings......Page 728
Index......Page 731