Dynamic Host Configuration Protocol (DHCP)

Dynamic Host Configuration Protocol (DHCP)

• DHCP serves as a common infrastructure role, providing IP addresses which act as numeric "mailboxes" for networked devices
• DHCP automatically leases IP addresses, eliminating the need for manual configuration by administrators
• DHCP includes its own database, service, and administrative console

Benefits of DHCP

• Automatically ensures that every computer has a network IP address
• Allows administrators to specify a "pool" of addresses for assignment
• Computers without an IP address request one from the DHCP server
• Leased addresses are automatically renewed at specified intervals

DHCP Server Role

• DHCP clients request IP addresses from the DHCP server
• DHCP server supplies IP address leases
• An optional standby DHCP server can be used for high availability

DHCP Role Installation Components

• Database: Includes IP address scopes and scope options
• Service: Listens for requests and responds accordingly
• Administrative console: A GUI tool for setup

DHCP Administrative Console

• Before a DHCP server can issue IP addresses, a scope must be created and the server authorized
• A scope is a range of IP addresses assigned to computers requesting a dynamic IP address
• Authorization is a security measure to ensure that only authorized DHCP servers run on the network
• To add a new scope, click New Scope in the Action menu
• To authorize the DCHP server, navigate to the server node and click Authorize in the Action menu

User Accounts

• A user account enables authentication via login name and password
• A user account is a security principal with a security identifier (SID) that can be assigned permissions

User Account Storage

• Active Directory: Enables logon to the domain and assignment of permissions to resources anywhere in the domain, administered via Active Directory snap-ins and commands
• Local SAM database: Enables logon to the local computer and assignment of permissions to local resources, administered via the Local Users and Groups snap-in

Creating Users with PowerShell

• New-ADUser -Name [Parameters]: command for creating a user
• -Name: Specifies the name of the user to create, which also becomes the SAM Account name if no other parameters are provided
• [Parameters]: Various parameters to customize user creation
• -SAMAccountName: Specifies the name with which the user logs on
• -AccountPassword: Sets the account password
• -Enabled: Enables the account; disabled by default if not provided
• -Path: Specifies the location where the object should be created; defaults to the Users container
• Get-Help New-ADUser –detailed: Command to get explanations of the parameters that can be used

Name Attributes

• User logon name (pre-Windows 2000): sAMAccountName
• Should be unique in the domain
• Limited to 20 characters
• User logon name userPrincipalName (UPN)
• Consists of Name + @ + UPN suffix
• Must be unique in the forest
• Name or Full Name cn (common name)
• Unique in OU so that the relative distinguished name (RDN) is unique in OU, ensuring the object's distinguished name is unique in the forest
• Display name displayName
• Exchange global address list (GAL): Best if unique, but not technically required

Account Attributes

• Common parameters for user accounts include
• Logon Hours
• Log On To
• User must change password at next logon
• User cannot change password
• Password never expires
• Account is disabled
• Store password by using reversible encryption
• Smart Card is required for interactive logon
• Account is trusted for delegation
• Account expires

User Account Management Tasks

• Renaming user accounts
• Resetting user passwords
• Unlocking user accounts
• Disabling or enabling user accounts
• Moving user accounts
• Deleting user accounts

Viewing User Attributes

• The Attribute Editor tab can be utilzed for viewing
• In Active Directory Users and Computers, click the View menu, and then select Advanced Features to view

Procedure for Modifying Attributes For Multiple Users

• Select multiple users by holding CTRL and clicking
• Right-click any of the selected users
• Click Properties to access parameters

Attributes That Can Be Modified

• General: Description, Office, Telephone Number, Fax, Web page, E-mail
• Account: UPN suffix, Logon hours, Computer restrictions (logon workstations), all Account options, Account expires
• Address: Street, P.O. Box, City, State/province, ZIP/Postal Code, Country/region
• Profile: Profile path, Logon script, Home folder
• Organization: Job Title, Department, Company, Manager

Modifying With Powershell

• Get-AdUser retrieves attributes of objects
• Command line: Get-ADUser UserDN... [-parameter value]
• UserDN distinguishedName of the user
• Parameter for attributes: Name of attribute
• Value: Value for attribute or use * for all attributes
• Set-ADUser modifies specified attributes
• Command line: Set-ADUser UserDN [-parameter value]
• UserDN distinguishedName of the user
• Parameter value for specific attributes: Attribute and value to be modified
• Example using both together:
• Get-ADUser Tony.Krijnen | Set-ADUser -office "Stockholm"

User Creation Via Templates

• General tab with no properties copied
• Address tab to copy P.O. box, city, state or province, ZIP or postal code, and country or region. -The street address itself will not be coped
• Account tab with logon hours, logon workstations, account options, and account expiration copied over.
• Profile tab copies profile path, logon script, home drive, and home folder path
• Organization tab that copies department, company, and the user's manager
• Member Of

Exporting and Importing Users

CSV (Comma-Separated Value Text Files)

• Can be edited with simple text editors such as Notepad, or more advanced programs such as Microsoft Office or Excel
• Has an export application know as CSVDE.exe
• csvde -f filename -d RootDN -p SearchScope -r Filter -1 ListOfAttributes
• RootDN: The domain in which to start the export. (default = domain)
• SearchScope: Scope of export (Base, OneLevel, Subtree)
• Filter: Filter of which users need to be exported (LDAP query language)
• ListOfAttributes: Use the LDAP name

Importing Users with CSVDE

• csvde -i -f filename [-k]
• -I import-default mode is export
• -K Continue past errors (such as Object Already Exists)
• It cannot import passwords, so users are created as disabled
• Cannot modify existing users

LDIFDE

• LDAP Data Interchange Format File
• Has an export program LDIFDE.exe
• ldifde [-i] [-f filename] [-k]
• -I import-default mode is export
• -K Continue past errors (such as Object Already Exists)
• Cannot import passwords, so users are created as disabled
• Can modify or remove existing users

Importing and Exporting Users with Powershell

• To import you must use Import-CSV and New-ADUser command lines
• Import-CSV Users.csv | foreach {New-ADUser -SamAccountName $.SamAccountName -Name $.Name -Surname $.Surname -GivenName $.GivenName -Path "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM" -AccountPassword (ConvertTo-SecureString -AsPlainText $_.SamAccountName -Force) -Enabled $true}

Challenges of Standard User Accounts for Services

• Extra administration to manage the service account password

Managed Service Account

• Automates password and SPN management for service accounts used by services and applications

Steps to Configuring and Administering These Accounts

• Create a managed service account:
• New-ADServiceAccount [-SAMAccountName <String>] [-Path <String>]
• Install a managed service account on the host server:
• Install-ADServiceAccount -Identity <ADServiceAccount>
• Associate the service account with the intended service