Shares and NTFS Permissions, Offline Files, VSS, Work Folders

Share Permissions
Network Only
1st line of defense
Read, Change, Full Control
Folders only
Effective permission with multiple group membership
Deny always wins
Combine with NTFS
Administrative shares
Configuring Access-based enumeration which displays only the files & folders that a user has permissions to access.If a user does not have Read(or equivalent)permission to a folder,windows hides the folder from the user's view.


NTFS Permissions
Primary tool for access control
Files and folders
Applies locally + Remotely
Inheritance applies
 -can block parent
 -can reapply parent
Standard Permission:Full contorl,modify,R+W,R,W,list
Advanced permissions

Order of inheritance (bottom to top)
1.Explicit Deny
2.Explicit allow
3.Inherited deny
4.Inherited allow

Effective access in Advanced security settings - provide what if scenario

Offline Files
Network Shares (offline settings)
Files available when disconnected or "Work Offline"
Very good sync mechanism
Configure with "Offline settings"(caching) or GPO (Computer Cfg-Admin Templates-Network-Offline files)

Disk Quotas
Limit Disk usage
configuration
 -windows explorer
 -templates
 -soft or hard
 -drive only in explorer
 -set quota for folders in File server resource manager(FSRM) -very useful for file servers
Data Deduplication

Volume Shadow Copy
VSS Useful for
 -VM Snapshots
 -Backup operations(VSSAdmin alone is not Backup)
 -File recovery
File Recovery
 -On the fly restore
 -Schedule shadow copies
 -Not limited to shares
 -Monitor large restore jobs
VSSAdmin query reverts /For=Volume, /All
To configure, right click on the drive->configure shadow copies->Enable

Work Folders
Access to User's own work files
 -SMB/Mapped
 -Domai joined worktation
 -Non-domain joined workstation, bring your own devices(these are advantages over offline files)
Available when connected or not
Offline changes automatically synced when reconnected
Transparent conflict resolution(files will be named <name+pc name>if there is conflict)
Hub/Spoke topology
Works with file screens, classification, quotas, clustering
Grant access in setup (best with Group + fine tune with NTFS permission)
Security policies for encryption, screen lock
Can implement with existing folder redirection,offline files,home
Must be locally attached server storage
 -No DFS
 -No VNC source
1 work folder per user per device
Not collaborative (look to sharepoint, skydrive pro)

Server Basic Configuration Steps
 -Define appropriate users-->Groups
 -Add Sync server role (under Files and Storage Services)
 -Configure Role
 -DNS (create A record), Certs, Proxy

Client Configuration
 -Control panel configuration
 -Access via "work folders"
 -Can enforce with GPO (computer cfg-administrative templates-windows componenets-work folders). (user cfg-administrative templates-windows componenets-work folders)

Configuring Local Storage

Basic Disk
 -Default Disk type, Widely compatible, Easily accessible
 -Up to 4 primary or <4 with Extended + Logical
 -No fault tolerance (apart from Raid controller)

Dynamic Disk
No Direct performance benefit
Volumes (not partitions)
Allows for Multi-Disk configurations
 -Simple
 -Spanned (2 disks or more; data faill over to 2nd disk after 1st one is full)
 -Striped (RAID-0) (data is written across all available disks; if one disk fails,remaining disk has no meaningful data on them; no failover,redudancy)
 -Mirrored (RAID-1) (
 -Stripe set with parity (RAID-5) (3 or more diks;data is written to 2 disks with parity data written to 3rd disk.If one of the first 2 disks fail,data can still be retrieved using paritial data from remaining disk and parity data on 3rd disk)
Most Admin don't use
RAID-10 not available

File Systems
FAT/FAT32/exFAT
 -No security, widely compatible
NTFS
 -Security permission,encryption or compression,auditing,quotas,file tagging,large files+Vols
ReFS (Resilient File System)
 -Even larger files,directories, volumes
 -High resiliency: error correction, verification
 -Backward compatible

Partition Types
MBR Disks
 -Traditional partition table, 2TB max
GPT Disks
 -128 partitions;
 -partition up to 8ZB
 -HD up to 18GB
Create+mount VHD, VHDX (can create VHD in Disk management,attach,online and use as a drive)

Storage Spaces (Poor Man's SAN)
SANs are very expensive + require high expertise
Win12 + Win8
Virtual Disks
 -Not VHD, VHDX (virtual hard disks)
 -Formed from storage pooll
Storage Pools
 -1 or more disks (Internal, external, various interfaces)
 -Easily extended with more unformatted disks
 -Can  be fault tolerant
 -Can be thin provisioned (starts with minimum amount needed and still can grow as necessary)

Virtual Disk (Configuration)
Storage layout
 -Simple (no redundancy)
 -2 or 3 way mirror
 -Parity
Provisioning
 -Fixed
 -Thin
Allocation
 -Data Store
 -Manual
 -Hot Spare (in the event of one hard dik failure, hot spare disk is automatically used)
Replacement + Hot spare automatically sync

Steps-> Take physical disks and create storage pool. Then create virtual disk using that storage pool

Storage Tier (hot files<frequently accessed> and cold files)

Virtualization - Hyper V

Virtualization (Hyper-V)
Application virtualization
Service + Application isolation
Easy Deployment
 -VMM (virtual machine manager) templates
 -Self-service portals
Legacy Apps + OS
 -Client Hyper-V
 -MED-V

Server consolidation 
Current hardware is under-utilized
Benefits
 -Higher density
 -Less or centralized management
 -Optimized resources + very high ROI
 -Sand boxing labs
 -Efficient virus scan, Backup
 -Greener
 -Can replicate, migrate

Hyper-V Requirements
Win-12 Full/Core/Hyper-V server
X64 with Second level address translation (SLAT) + Data Execution Prevention (DEP)
Processing - Up to Host + Guest Requirements
Memory - Up to Host + Guest Requirements
Storage - Up to Host + Guest Requirements
 -I/O is Critical
 -Conisder VMs on different Disks+SAN,RAID,SSD,Hybrid SSD
 -Multiple NICs
GUEST MAX
 -1TB RAM, 32 CPU

Hyper-V Client Configuration:Settings
Dynamic Memory
Smart Paging
Resource metering (for billing purpose, etc)
Guest integration services

Hyper-V Settings:Storage
VHD-Original Recipe 2TB Max
VHDX
 -64TB MAX,more resilient,better aligned to large sectors,larger block size(Dynamic/Diff)
Modify VHD (using powershell, we could add/remove features offline without starting OS)
Edit virtual disk wizard (VHD <--> VHDx)
Differencing drives (keeping tomorrow' data/image on different disk/drive)
Pass through disks (add external disk/drive in local OS without the need to go through Hyper-V adapter? performance increase; disk must be offine on host machine first)
Snapshots (point in time instance of the OS)
Fibre Channel Adapter

Hyper-V Settings:Network
Network Virtualization with Vlans
Configure switches (same as VM host only adapter,bridge mode, etc.)
COnfigure available MAC addresses
Synthetic + Legacy virtural network adapters

Group Policy - GPO

Group Policy Objects
A Group of registry settings (not security groups)
Components
 -Templates (more can be added to default)
 -GPO files in Sysvol(C:\windows\PolicyDefinitions\admx file)
 -Linked to AD OUs, sites, domains
 -Special settings
Interfaces (how/where to view/edit)
 -Local Group policy
 -Group policy management console (GPMC)
 -Group policy management editor (GPME)
 -Group policy object editor from mmc for user/group specific (Multiple local group policy - making exception to local GPO)

Local Group Policy
Applies only locally (can export/import)
Computer configuration - Applies to all users/everyone
User configuration - Applies to all unless ..
 -Administrator/non-administrators policy
 -User-specific policy (not groups)
Can use on any Domain or Non-domain except DC
Local processing of local GPO can be disabled via a GPO
Usefulness
 -Servers with specific exceptions (Eg.diable control panel except for Admins)
 -Non-Domain System


Applying Policy
Link enabled
Block Inheritance
Enforce
Refresh
 -Startup (computer config policy)
 -Logon (user config policy)
 -90 min+random 30min, DCs 5 min
 -Gpupdate
 -PS invoke-gpupdate
 -Right-click OU

Templates + Central Store
Template
 -Acutal GPO settings
 -Can get additional (e.g, office)
 -Each OS releases adds new template settings

Central Store
 -Previous windows clould have mismatch templates
 -Already configured
 -..But might have to copy most current templates from C:\windows\policyDefinitions (local) to DC@C:\windows\sysvol\domain\policies


Scope of Management
Very important
User config -link to-> User OU
Computer config -link to-> Computer OU
Multiple group policies often apply
 -Settings are cumulative
 -Conflicts: last policy wins
Processing Order
 Local Default
  |-> Site
      |-> Domain
          |-> OU
              |-> OU
Security Filtering (to make exceptions)

Policies and Preferences
Both are mostly Registry punches

Policies (managed)
 -Setting is permanent(eg. Grayed out UI)
 -Applied at startup, logon, refresh
 -Removing policy reverts to default
 -Takes precedence over preference

Preferences (unmanaged)
 -User can reverse setting(UI not grayed out)
 -Applied+Refreshed or do not reapply
 -Setting tattoos registry
 -Not available for local GPO
 -Often useful for desktop icons,shortcuts,URL on desktop,send to,mapped drive,

Starter GPOs
Commonly desired(not required) settings
Administrative templates only
To start, create folder
 -includes canned starters
Often used for roles
 -Various types of servers
 -laptops
 -desktops
 -security sensitive
Exportable to CAB (cabinet files->compressed file)

Default GPO Permissions
Full Access
 -Domain admin, Enterprise admin, Creator owner, Local system
Read/Apply: Authenticated users
Gran Additional permissions
 -Create:Add to GP creator/owner
 -Edit: R/W via Group policy management console(GPMC)
 -Link mgmt: Delegation in GPM or Delegation of Control Wizard(DoCW)
 -Modeling/Results: Delegation in GPM or Delegation of Control Wizard(DoCW)

GPO Security Settings
User Rights
Security Options
User Account Control
Audit Policy

Security Templates
Pre-configured settings for "security settings" (.inf)
Apply to single or multiple
Apply locally or GPO
Settings
 -Account policies,local policies,event log,restricted group,system services,registry,file system
Configuration
 -GPO, secedit.exe,security config and analysis(launch using mmc)+security template consoles, security compliance manager(download)

Locking down software
Software restriction policy
 -Designed for legacy windows, fairly easy to bypass, all apps allowed by default

AppLocker
 -Designed for win7/8,2008 r2,2012, less easy to bypass, all apps denied by default(GPO-Computer config-Windows settings-Security settings-Application control policies). Note: need to start "Application identity" service and this can be done via (Security settings-System services)in same policy.

Active Directory notes

From powershell - adsiedit

more group memberships for a user makes longer time for user when loggin in.
_Template user account for easy copying in AD users and groups.

Offline domain join (clients)

Forest root is the first doamin in your forest.


The Global Catalog
--
What is it?
-Full copy of host domain objects
-Partial read-only of other domains in same forest

What benefit does it provide?
-Simpler searches across domains
-No need to contact source DCs
-User principle name authentication
-Validates forest objects
-Universal Group membership WFO

Single Domain - No burden
Multi-Domain - Consider added replication

To make a DC a GC server, go to AD sites and services.
  under servers - DC name - NTDS settings - Properties

Four types of Trust
-External (one way forest trust, etc)
-Shortcut (within forest to avoid walking down the trees)
-Realm (between AD and kerberos realm)
-Forest
Federation (trust created for external domain user to access specific application)

SRV records - DNS "SRV" Entries - critical to proper function of AD
If deleted accidentally, in command prompt "nltest /dsregdns"

other useful commands - dcdiag /fix
http://cbt.gg/M6vHml
http://cbt.gg/MfofRw
--------------------

Active Directory Automating User accounts

Methods
LDIFDE - LDAP interchange format directory exchange
CSVDE -
DSADD (more common in future)
 -DSMOD
 -DSQUEM/DSGET
 -DSMOVE
 -DSRM
Powershell (more common in future)

AD Group types

Organizational Units

AD Object
 -contain users, groups, computers
 -mostly for simplifying administration
 -not for permission
 -very powerful with GPO
Users + COmputers containers: Not OUs
Redirusr + Redircmp

Delegation

Configure OU permission to allow user/group
some level of administration
Useful to narrow management
Prevents over permissions
Usefulness
 -interns, smaller offices, limt admin scope

DNS and DHCP

DNS Zones
Storage unit of Domain names + IPs
Mostly forward but also reverse
Stored in File or AD
 File (C:\windows\system32\Domain.Dns)
  -Primary + 1 or more secondary
  -Only Primary is R/W
  -Secondary updated by Primary or other secondary
 AD-Integrated
  -Stored in AD
  -Replicated with other AD data incrementally
  -Secure dynamic Updates

Forwarders+Stubs
Forwarders
Root hints:Internet top-level servers
Conditional:Commonly accessed domain DNS server

Stub Zones
 -Contains Authoritative DNS server resource records
  *SOA, *NS, *A(Glue)
 -Receives updates

Cache Management+Resource Records
DNS Server cache
 -Prevents redundant lookups
 -Usually valid for 1 day
 -Clear

Common RR
 -A (host record for IPv4), AAAA(host record for IPv6)
 -PTR (pointer record for reverse lookup)
 -CNAME (alias)
 -MX
To display DNS cache on client machine - ipconfig /displaydns


Namespace  This is the name of a domain, not specifi cally an Active Directory domain though. It’s a logical set of hosts signifi ed by a name controlled by a set of name servers. This is
equivalent to a computer’s last name; they’re all part of the same family. For example, Bigfirm.com is the namespace for hosts in the Bigfi rm.com domain.

Recursion  This is a server-directed process to resolve an FQDN. If the server cannot resolve the FQDN with its own information, it will send the query to other name servers. The recursion process comprises root servers and domain name servers. Root servers are the top of the hierarchical naming structure. The root servers list the name servers that control the top-level domain names such as .com, .gov, and .edu. The top-level domain servers control the registry of subdomains beneath the top-level domain.

Delegation  This means allowing another name server to control a subdomain of a given namespace. For example, the Bigfirm.com name servers can delegate control of the Ecoast.Bigfi rm.com namespace to another server.

Forwarding  This is an alternative to the recursion process. Forwarding is a lateral request to another name server within the network. The forwarding server obtains a response and relays it to the originating name server.

Iteration  This is a client-directed process to resolve an FQDN. If the client receives a negative request from a name server, it will query another name server.
NetBIOS Naming System  This legacy naming system was used primarily within old Microsoft NT 4.0 networks. Its processes are still part of modern-day Windows operating systems, however, particularly when using non-domain (workgroup)–based computers.

Service Records  Service records (SRVs) are records within a DNS namespace to resolve a service to a hostname. This is an essential part of DNS supporting Active Directory.

Dynamic DNS Update  Dynamic DNS (DDNS) update is a process that allows DNS clients to register their hostnames in an assigned namespace such as DHCP. This reduces the need of admins to manually enter records in the name server databases. This is another essential part of DNS supporting Active Directory.

----------------------------------------------------------------

DHCP Process (DORA) - Discovery,Offer,Request,Acknowledge

DHCP Database

 -Backup

 -Restore

 -Reconcile

DHCP Failover

 -Load sharing

 -Hot standby