Assignment 14 – Exercise 7 Group Policy 10/21/2014 Preliminary: 1. This exercise requires all preliminary work and the work in the Week 8 Exercise run sheet be completed including the 3 printers and shared folders from Week 8. 2. This exercise requires that a Windows 8.1 workstation has been added to the domain. 3. Remember that when you are working in the Console Window, Ctl & Alt & Insert replaces the usual Ctl & Alt & Delete key sequence. 4. Create a MS Word document named LastnameFirstname-ict364-09 (Use your Lastname and Firstname) 5. When you see “SCREENSHOT” in the instructions, paste the required screenshots into the exercise document. When completed, you will submit this for your grade for this assignment. Objective: This Exercise involves applying Group Policy to Domain Objects. Rather than going to each computer and setting up security, network access, firewall exceptions, and printer settings it can be controlled through AD DS Group Policy. Pre-lab maintenance: 1. Your server has multiple snapshots at this time. It’s time to clean them up. Shut down the student-2012-01 server. Once it’s shut down, right click on your student-2012r2-01 VM and select Snapshot manager. One by one, click each snapshot (except for the 1st original clean one) prior to the “Pre-Groups” snapshot and click “Delete” at the bottom. This will merge the different files into a single file keeping the changes made. It may take up to 5 minutes for each snapshot delete to complete. When finished deleting the prior snapshots, Take a new snapshot of the AD server before we start any changes (see instructions from the assignment 5), call this snapshot “Pre-Group Policy”. Do not Snapshot the virtual machine’s memory. So once finished, you’ll have the original clean snapshot, the Pre-Groups and the Pre-Group Policy snapshots. Exercise Run Sheet: 1. Before we start working with Group Policy, we need to make sure the time on our server and workstation is correct. 1.1. Check the time settings on the AD DS server 1.1.1. Log in to Student-2012-01 as corpcom\domainAdmin and open a command prompt.(Windows key & R – type cmd and hit enter) 1.1.2. Type w32tm /tz 1.1.3. Is the computer’s time zone set to “Mountain” ? 1.1.4. Type “net time” into the command window. 1.1.5. Is the time correct according to your local computer or phone? 1 Assignment 14 – Exercise 7 Group Policy 10/21/2014 1.1.6. If either of these are wrong on your AD DS server. Correct them by double clicking on the time in the lower right corner or going onto the control panel and choosing “Date and Time” 1.2. Check the time settings on the Workstation 1.2.1. Log in to Student-W8.1-01 as cgarcia and open a command prompt.(Windows key & R – type cmd and hit enter) 1.2.2. Type w32tm /tz 1.2.3. Is the computer’s time zone set to “Mountain” ? 1.2.4. If not, change it per instructions in 1.1.6 above. 1.2.5. At the command prompt, type “w32tm /monitor” 1.2.6. Is the workstation synchronizing with the domain controller for its local time? 1.2.7. Look at the NTP offset. It MUST be less than 5 minutes. 1.2.8. Look at the available w32tm commands by typing “w32tm /?” 1.2.9. What message do you get when you run “w32tm /resync” 1.2.10. Open a command prompt as an administrator 1.2.11. Type the command “set computer”, then retry “w32tm /resync” followed by “w32tm /monitor” 1.2.12. SCREENSHOT the command prompt after running these two commands and paste them into your worksheet. NOTE: When a workstation is added to a domain, the “syncfromflags” are set to the domain’s AD DS server and the workstation will attempt to synchronize with the domain controller using NTP (network time protocol). Time is synchronized as UTC time so a workstation in a different time zone from the server will reflect the correct time for that time zone even though it may be an hour (or multiple hours) different from the time server. 2. Open the Group Policy Management Console (GPMC) 2 Assignment 14 – Exercise 7 Group Policy 10/21/2014 2.1. Open Server Manager > Tools > Group Policy Management > Forest: corp.com > Domains > corp.com 3. Review the current “Default Domain Policy” 3.1. Under “corp.com” select the “Default Domain Policy” 3.2. On the main panel, click the “Settings” tab on the top. 3.3. On the far right on top, click the “show all” link 3.4. What is the “Path” to the “Account Policies/Password policy”? 3.4.1. The answer is: “Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies/Password Policy” Do you see how the path is derived? 3.4.2. Copy the following table and paste it into your Worksheet. In the right column, enter the current values from the “Default Domain Policy” Max Password Age Minimum Password Length Maximum Tolerance for Computer clock synchronization NOTE: When computer clocks get more than 5 minutes out of sync with its domain AD DS server, network errors start to occur, user authentication stops working, and in general “BAD THINGS HAPPEN”. If users are not able to connect to file shares and authentication gets flakey. Check the time on the computers!!! 4. Modify the Default Domain Policy (Right-click the Default Domain Policy in the left column and select Edit) 4.1. Modify the default password policies for your domain 4.1.1. Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy 4.1.2. Change the Maximum password age to 180 days 4.1.3. Change the Minimum password age to 0 days 4.2. Modify the Interactive login: Do not display last user name = enabled 4.2.1. Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options 4.3. Modify the Interactive logon: message text [and title] for users attempting to log on 4.3.1. Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options 4.3.2. Interactive logon: Message title… = corp.com - <your name here 3 Assignment 14 – Exercise 7 Group Policy 10/21/2014 4.3.3. Interactive logon: Message text… = By logging into this machine you agree to abide by the policies set forth in Section 2.35 of the NMSU Policy Manual. Failure to abide by these policies will result in the immediate termination of your account and all associated access to NMSU resources. 4.4. Close the policy editor and log into the Win8.1 computer as cgarcia; you should not see any change in the logon message yet. Your changes shouldn’t be seen yet because a computer refreshes its group policies every 90 minutes with a random offset of 0 to 30 minutes. The random offset prevents all computers from contacting the DC at once. 4.5. Open a command prompt on The Win8.1 computer and run the “gpupdate /force” command. This will force the machine to refresh its group policies immediately. 4.6. Restart the Win8.1 computer instead of the Ctl-Alt-Delete prompt page; you should now see your new logon banner. SCREENSHOT and paste it into your exercise sheet. 4.7. Click OK on the logon banner, press the space bar to get to the Logon page. 4.7.1. You should now see a text box for Username and Password under “Other user”. 4.7.2. SCREENSHOT this screen and paste it into your exercise sheet. NOTE; the last logged in user is not displayed. This is a security setting especially useful in a public user environment. 5. Create a new group policy object called “The Basics” and link it the corp.com domain 5.1. From the GPMC, right-click corp.com and select “Create a GPO in this domain, and link it here…” 5.2. Enter “The Basics” as the name and click OK. 5.3. Select the group policy under corp.com and click the “Settings” tab in the main window. 5.3.1. Click “Show all” and observe that both the Computer and User settings are enabled 5.3.2. Notice that in each of them there are “No settings defined” 5.4. Right-click your newly created GPO “The Basics” in the left column and select Edit 5.5. Enable some basic firewall rules 5.5.1. Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Window Firewall with Advanced…\Inbound Rules 5.5.2. Right-click Inbound Rules\New Rule\Predefined\File and Printer Sharing > Next x2 > Finish 5.5.3. Right-click Inbound Rules\New Rule\Predefined\Windows Remote Management > Next x2 > Finish 5.5.4. Right-click Inbound Rules\New Rule\Predefined\Remote Desktop > Next x2 > Finish 4 Assignment 14 – Exercise 7 Group Policy 10/21/2014 5.5.5. Right-click Inbound Rules\New Rule\Port\Next\TCP\Specific local ports: 135 > Next x3 > Name: “ORA 1 of 3” > Finish 5.5.6. Right-click Inbound Rules\New Rule\Program\Next\This program path: %SystemRoot%\System32\msra.exe > Next x3 >Name: “ORA 2 of 3”\Finish 5.5.7. Right-click Inbound Rules\New Rule\Program\Next\This program path: %WINDIR%\System32\raserver.exe Next x3 >Name: “ORA 3 of 3” > Finish 5.5.8. Expand the right pane to include the Local port column and SCREENSHOT the firewall settings and paste it into your worksheet.