LESSON: 1D

EXPERIMENT

Maintaining the Environment and Security of Windows Server 2003

1D.1

1D.2

Maintaining the Environment and Security of Windows Server 2003

INSTRUCTOR NOTES
Exercises in this session are designed to help the students practice the important concepts and tasks taught in the previous sessions. If students are able to complete their exercises before time, you can provide additional lab exercises to them. These additional exercises are given in this session of the coordinator guide.

Setup Requirements
Ensure the following before conducting the session:

 Windows Server 2003 is installed on the student nodes.  Active Directory is installed on the student nodes.  Organizational Unit, Administration is created on the student nodes.

Maintaining the Environment and Security of Windows Server 2003

1D.3

LAB EXERCISES

Exercise 1
For maintaining the security of the organizations network, you need to apply the following group policies using the Default Domain Policy, on all the users of the Denver branch:

 Remove the Network Connections option from the Start menu, so that the users
do not change the settings for the available network connections.

 Prevent the users from making changes to the Task bar and the Start menu.  Prevent the users from adding and deleting printers.  Prevent the users from changing the history settings of the Web browser.
In addition to these group policies, you also need to create a GPO for the Administration department, named New Group Policy Object_Administration and add the following group policies in this new GPO:

 Hide the Internet Explorer icon from the desktop.  Prevent the employees from installing new programs to their computer.
In addition to applying these group policies, you want to display a Welcome message to all the users when they log on to their computers.

INSTRUCTOR NOTES
To solve the given problem, you need to perform the following tasks: 1. Configure group policies. 2. Implement GPOs. 3. Assign scripts.

1. Configure Group Policies.  Open the Active Directory Users and Computers window.  From the left pane, right-click the domain denver.connectinc.com and select
the Properties option from the pop-up menu.

1D.4

Maintaining the Environment and Security of Windows Server 2003

 The denver.connectinc.com Properties dialog box appears. Select the Group

Policy tab.

 To configure a user group policy, click the Edit button.  The Group Policy Object Editor window appears. From the left pane, under
the User Configuration setting, expand the Administrative Templates folder. Taskbar Remove Network Connections from Start Menu option.

 From the Administrative Templates folder, expand the Start Menu and  From the right pane, right-click the Remove Network Connections from  This displays the Remove Network Connections from Start Menu
Start Menu option and select the Properties option from the pop-up menu. Properties dialog box. To remove the Network Connections icon from the Start Menu, select the Enabled option to enable the settings.

 Click the Apply button to apply the newly configured group policy.  Click the OK button. The Remove Network Connections from Start Menu
policy is enabled.

 Similarly, configure the following group policies: x x x x

Prevent Changes to Taskbar and Start Menu Settings Prevent addition of printers Prevent deletion of printers Disable changing history settings

2. Implement GPOs.  Open the Active Directory Users and Computers window.  From the left pane, expand the domain, denver.connectinc.com and rightclick the Administration organizational unit.

 Select the Properties option from the pop-up menu.  The Administration Properties dialog box appears. Select the Group Policy
tab.

 To create a new GPO, click the New button. A new GPO is added in Group
Policy Object Links list.

 To assign a new name to the GPO, click in the highlighted area and type Administration after New Group Policy Object. Management window appears.

 To configure a user group policy, click the Open button. The Group Policy

Maintaining the Environment and Security of Windows Server 2003

1D.5

 From the details pane of the Group Policy Management window, right-click
the New Group Policy Object - Administration GPO, and select the Edit option from the pop-up menu. group policies in the New Group Policy Object - Administration GPO:

 The Group Policy Object Editor window appears. Configure the following x x
Hide the Internet Explorer icon on the desktop. Hide the Add New Programs page

3. Assign Scripts.  To specify the code for the script, select Start Programs Accessories
Notepad menu command.

 Type the following commands

Set objNetwork = Wscript.CreateObject("WScript.Network") objNetwork.MapNetworkDrive "z:","\\Computer Name\Shared Folder Name" msgbox "WELCOME !!!!"

 Save the file as Logon.vbs.  Open the Group Policy Management window.  From the left pane, expand the Domains folder, and then expand the domain,
denver.connectinc.com.

 From the right pane, right-click Default Domain Policy and select the Edit
option from the pop-up menu.

 The Group Policy Object Editor window appears.  From the left pane, under User Configuration expand Windows Settings
container and select Scripts.

 To execute the script when the users logon, double-click Logon setting.  The Logon Properties dialog box appears.  To add the script so that it is executed when the user logs on, click the Add
button.

 The Add a Script dialog box appears. Click the Browse button to open the
Browse dialog box.

 Locate the Logon.vbs file and then click the OK button.  The file path is displayed in Script Name text box. Click the OK button.  The file name is shown in Logon Properties.  Click the Apply button and then click the OK button. A message box appears
that displays the Welcome message when you logon to the computer.

1D.6

Maintaining the Environment and Security of Windows Server 2003

ADDITIONAL LAB EXERCISES

Exercise 1
You need to create a GPO for the Finance department, named as New Group Policy Object - Finance and add the following group policies in this new GPO:

 Hide the Internet Explorer icon from the desktop so that the employees of the
Finance department are unable to access the Internet.

 Prevent the employees from installing new programs to their computer.

INSTRUCTOR NOTES
To solve the given problem, you need to perform the following tasks: 1. Create a new GPO. 2. Configure the GPO.

1. Create a new GPO.  Open the Active Directory Users and Computers window.  From the left pane, expand the domain, denver.connectinc.com and rightclick the Finance organizational unit.

 Select the Properties option from the pop-up menu.  The Finance Properties dialog box appears. Select the Group Policy tab.  To create a new GPO, click the New button.  A new GPO is added in Group Policy Object Links list.  To assign a new name to the GPO, click in the highlighted area and type Finance after New Group Policy Object.

Maintaining the Environment and Security of Windows Server 2003

1D.7

2. Configure the GPO.  To configure a user group policy, click the Open button. The Group Policy
Management window appears.

 From the details pane of the Group Policy Management window, right-click the  The Group Policy Object Editor window appears. Configure the following
group policies in the New Group Policy Object - Finance GPO:

New Group Policy Object - Finance GPO, and select the Edit option from the pop-up menu.

x x

Hide the Internet Explorer icon on the desktop. Hide the Add New Programs page.

1D.8

Maintaining the Environment and Security of Windows Server 2003

HOME ASSIGNMENT
1. Which of the following GPOs is provided by default after the installation of Active Directory? a. b. c. d. Default GPO Default Domain Policy Domain Controllers Policy Domain GPO

2. Which of the following GPO settings enables you to set group policies that are dedicated to either computers or users? a. b. c. d. Multiple GPO Multiple-setting GPO Dedicated GPO Dedicated-setting GPO

3. Which is the correct sequence in which a GPO is associated? a. b. c. d. Site, Site, Site, Site, Organizational Unit, and Domain Domain, Tree, Organizational Unit Tree, Domain, Organizational Unit Domain, and Organizational Unit

4. Which of the following GPOs are used to manage the configuration of the users and computers in a domain? a. b. c. d. Local GPO Active Directory- based GPOs Domain GPO Domain Controller GPO

5. Which of the following options enables you to restrict the child containers from inheriting the group policy settings of the parent containers? a. b. c. d. Filtering No Override Block Policy Inheritance Deny

Maintaining the Environment and Security of Windows Server 2003

1D.9

6. Which of the following folders can be redirected? a. b. c. d. My My My My Pictures Music Files Documents

7. Which of the following commands refreshes the group policies in Windows Server 2003? a. b. c. d. Gprefresh Gpupdate Gpresult Gpmodelling

8. Which of the following represents the correct states of a group policy? a. b. c. d. Enabled, Configured, Not Configured Disabled, Configured, Not configured Enabled, Disabled, Not Configured Enabled, Disabled, Configured

9. Which filtering method is used to exclude organizational unit administrators from security groups? a. b. c. d. Explicitly deny Remove Authenticated Users Deny Administrators No Override

10. Which of the following is a tool that enables the system administrator to manage the distribution, deployment, upgradation, and removal of software from a single location? a. b. c. d. Software Distribution Point Software Installation Extension Assigning Applications Publishing Applications

1D.10

Maintaining the Environment and Security of Windows Server 2003

INSTRUCTOR NOTES

Solutions to Home Assignment

1. b. Default Domain Policy 2. d. Dedicated-setting GPO 3. d. Site, Domain, and Organizational Unit 4. b. Active Directory- based GPOs 5. c. Block Policy Inheritance 6. d. My Documents 7. b. Gpupdate 8. c. Enabled, Disabled, Not Configured 9. b. Remove Authenticated Users 10. b. Software Installation Extension

Maintaining the Environment and Security of Windows Server 2003

1D.11

1D.12

Maintaining the Environment and Security of Windows Server 2003