Administration système : gestion de Administration des Services Réseaux l annuaire Active Directory sous WINDOWS

Transcription

1

2 Administration système : gestion de l annuaire Active Directory Rôles des serveurs dans une architecture domaine. Introduction à Active Directory. Gestion des comptes d utilisateur et d ordinateur. Administration des accès. Intégration d une station cliente (Windows/Linux). Gestion de l impression. Gestion d accès aux objets dans les unités d organisation. Gestion de l environnement utilisateur à l aide des stratégies de groupes. Stratégie de sécurité : audit, comptes, droits. Administration d un système de gestion de fichiers (RAID). Administration et maintenance automatisée à l aide de l Infrastructure WMI Administration des Services Réseaux sous WINDOWS Présentation des méthodes, outils et documentations pour la planification d'une infrastructure réseau. Planifier et optimiser un réseau physique et logique IP. Planifier et dépanner le routage. Planifier une stratégie DHCP. Optimiser et dépanner DHCP. Planifier une stratégie DNS. Optimiser et dépanner DNS. Planifier WINS. Planifier IPSec. Planifier l'accès réseau. Dépanner l'accès réseau. Planifier et configurer un serveur Web et FTP.

3 Windows Server 2008 Editions Edition Windows Server 2008 Standard Windows Server 2008 Enterprise Windows Server 2008 DataCenter Windows Web Server 2008 Windows Server 2008 for Itaniumbased Systems Server Core Yes Yes Yes No No

4 Windows Server 2008 Installation Requirements Component Processor Memory Available Disk Space Optical Drive Display and Peripherals Minimum: 1 Ghz Recommended: 2 Ghz Optimal: 3 Ghz or faster Requirement Minimum: 512 MB RAM Recommended: 1 GB RAM Optimal: 2 GB RAM (Full) or 1 GB RAM (Server Core) or more Maximum (32-bit): 4 GB (Standard) or 64 GB (Enterprise and Datacenter) Maximum (64-bit): 32 GB (Standard) or 2 TB (Enterprise, Datacenter, and Itanium-based systems) Minimum: 8 GB Recommended: 40 GB (Full); 10 GB (Core) Optimal: 80 GB (Full); 40 GB (Core) DVD-ROM Super VGA (800 x 600) or higher-resolution monitor Keyboard Microsoft mouse or compatible pointing device

5 What Are Server Roles? A server role describes the primary function of a server Administrators can dedicate an entire computer to one role or install multiple server roles on a single computer Each role can include one or more role services or subelement of a role Server Manager is the tool that is used to install, configure, and remove Server Roles

6 What Are Server Roles? A server role describes the primary function of a server Active Directory Certificate Services (AD CS) Active Directory Domain Services (AD DS) Active Directory Federation Services (AD FS) Active Directory Lightweight Directory Services (AD LDS) Active Directory Rights Management Services (AD RMS) Application Server Dynamic Host Configuration Protocol (DHCP) Server Domain Name System (DNS) Server Fax Server File Services Network Policy and Access Services Print Services Terminal Services Universal Description, Discovery, and Integration (UDDI) Services Web Server (IIS) Windows Deployment Services and Windows SharePoint Services Hyper-V

7 Nouveautés de Windows Server 2008 R2 Stanislas QUASTANA Microsoft 7

8 What Is a Directory Service? A directory service is both the directory information source and the service that makes the information available and usable Centralized Administration Dispersed Administration

9 What Is AD DS? Active Directory Domain Services (AD DS) is a directory service that provides the following services in a Windows Server 2008 network: User account management User authentication Computer account management Access to networked resources Domain-wide services

10 How Does AD DS Work Authenticate against domain Access network resources User and computer objects are created in the directory Groups of these objects then can be created A client can use the user account to authenticate against AD DS The user can try to access networked resources The resources will again validate the authenticated user against AD DS

11 Why Deploy AD DS? AD DS provides a centralized system for managing users, computers, and other resources on a network AD DS features include: Centralized directory Single sign-on access Integrated security Scalability Common management interface

12 What is Authentication? Authentication is the process of verifying a user s identity on a network Authentication includes two components: Interactive logon grants access to the local computer Network authentication grants access to network resources

13 What is a Domain? Domains are logical directory components used to group and manage the AD DS objects in an organization Woodgrove Bank.com Domains provide: An administrative boundary for applying policies to groups of objects A replication boundary for replicating data between domain controllers An authentication and authorization boundary that provides a way to limit the scope of access to resources

14 What are AD DS Trusts? Trusts provide a mechanism for users to gain access to resources in another domain Types of Trusts Directional Transitive Description The trust direction flows from trusted domain to the trusting domain The trust relationship is extended beyond a twodomain trust to include other trusted domains Diagram Access TRUST Trust & Access All domains in a forest trust all other domains in the forest Trusts can extend outside the forest

15 What is a Domain Tree? A domain tree is a hierarchy of domains in AD DS Woodgrove Bank.com EMEA.Wood grovebank.com NA.Woodgrove Bank.com All domains in the domain tree: Have a contiguous namespace with the parent domain Can have additional child domains added to the namespace Have a two-way transitive trust with other domains in the tree

16 What is a Forest? A forest is a collection of one or more domain trees Forests: Share a common schema Share a common configuration partition Share a common global catalog to enable searching Enable trusts between all domains in the forest Share the Enterprise Admins and Schema Admins groups

17 What is an OU? OUs are Active Directory containers that can contain users, groups, computers, and other OUs OUs are used to: Represent your organization hierarchically and logically Manage a collection of objects in a consistent way Delegate permissions to administer groups of objects Apply policies

18 What are AD DS Objects? Object User InetOrgPerson Contacts Groups Computers Printers Shared folders Description Enables network resource access for a user Similar to a user account Used for compatibility with other directory services Used primarily to assign addresses to external users Does not enable network access Used to simplify the administration of access control Enables authentication and auditing of computer access to resources Used to simplify the process of locating and connecting to printers Enables users to search for shared folders based on properties

19 What are AD DS Domain Controllers? A domain controller is a server with the AD DS server role installed Domain controllers: Host a copy of the AD DS directory store Provide authentication and authorization services Replicate updates to other domain controllers in the domain and forest Allow administrative access to manage user accounts and network resources Windows Server 2008 AD DS supports RODCs

20 Overview of DNS and AD DS AD DS requires a DNS infrastructure AD DS domain names must be DNS domain names DNS Domain Name DNS AD DS domain controller records must be registered in DNS to enable other domain controllers and client computers to locate the domain controllers DNS zones can be stored in AD DS as Active Directory integrated zones DNS Zone

21 Travaux Pratiques Réalisez des instantanés régulièrement Installer Virtual Box Installer Windows 2008 server Créer un utilisateur Admin1 (groupe Administrateurs) Créer un utilisateur Util1 (groupe Utilisateurs) Réactiver le compte invité Désactiver l exigence de complexité des mots de passe Créer un dossier TP1ADM Créer un dossier TP1UTIL Modifier les autorisation NTFS sur TP1UTIL Seul Util1 peut écrire, ainsi que les Administrateurs Ouvrir une session avec le compte Util1 Copier des fichiers dans le dossier TP1UTIL Copier des fichiers dans le dossier TP1ADM Ouvrir une session avec le compte Admin1 Copier des fichiers dans le dossier TP1UTIL Copier des fichiers dans le dossier TP1ADM Effectuer la promotion du serveur en contrôleur de domaine Ouvrir une session avec le compte Admin1 Sécuriser l accès à la VM en appropriant les droits NTFS appropriés au dossier