Tài liệu Module 5: Administering User Accounts doc

There are two labs in this module; in them students disable and enable user accounts, reset a user’s password, search Active Directory for user accounts, reset a user’s password, define

Contents

Overview 1

Lab A: Administering User Accounts 6

Introduction to Group Policies 22

Lab B: Administering User Profiles 23

Review 30

This course is a prerelease course and is based on

Microsoft Windows 2000 Beta 3 software Content in the

final release of the course may be different than the content

included in this prerelease version All labs in the course

are to be completed using the Beta 3 version of

Microsoft Windows 2000 Advanced Server

Module 5: Administering User Accounts

with all applicable copyright laws is the responsibility of the user No part of this document may

be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Microsoft Corporation If, however, your only means of access is electronic, permission to print one copy is hereby granted

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property

 1999 Microsoft Corporation All rights reserved

Microsoft, MS-DOS, MS, Windows, Active Directory, PowerPoint, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A and/or other countries

The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted

Other product and company names mentioned herein may be the trademarks of their respective owners

Project Lead/Senior Instructional Designer: Red Johnston

Instructional Designers: Tom de Rose (S&T OnSite), Meera Krishna (NIIT (USA) Inc.) Program Manager: Jim Cochran (Volt Computer)

Lab Simulations Developers: David Carlile (ArtSource), Tammy Stockton (Write Stuff) Technical Contributor: Kim Ralls

Graphic Artist: Julie Stone (Independent Contractor)

Editing Manager: Tina Tsiakalis

Editors: Wendy Cleary (S&T OnSite), Diana George (S&T OnSite)

Online Program Manager: Nikki McCormick

Online Support: Tammy Stockton (Write Stuff)

Compact Disc Testing: ST Labs

Production Support: Rob Heiret, Ismael Marrero, Mary Gutierrez (Wasser)

Manufacturing Manager: Bo Galford

Manufacturing Support: Mimi Dukes (S&T OnSite)

Lead Project Manager, Development Services: Elaine Nuerenberg

Lead Product Manager: Sandy Alto

Group Product Manager: Robert Stewart

Introduction

This module provides students with the information that they will need to administer existing user accounts The module discusses how to use Active Directory™ directory service to find a user account with specific account properties It also covers how to change user account settings, administer desktop environments with user profiles, and create home folders The module provides an introduction to group policies and the effect they can have on user accounts At the end of this module, students will be able to perform day-to-day Microsoft® Windows® 2000 administrative tasks

There are two labs in this module; in them students disable and enable user accounts, reset a user’s password, search Active Directory for user accounts, reset a user’s password, define user profiles, define home directories, create and test a local user profile, and create and test a roaming user profile

Materials and Preparation

This section provides you with the materials and preparation needed to teach this module

Materials

To teach this module, you need the following materials:

!"Microsoft PowerPoint® file 1556A_05.ppt

!"Module 5, “Administering User Accounts”

Preparation

To prepare for this module, you should:

!"Read all the materials for this module Notice that some slides are animated and require that you click them several times as you step through the corresponding process Animated slides are indicated with an icon in the lower left corner

!"Review the Delivery Tips and Key Points for each section and topic

!"In order to demonstrate unlocking a user account that is locked out

of the network, create the account before teaching the module

!"Complete the two labs

!"Study the review questions and prepare alternative answers for discussion

!"Anticipate questions that students might ask Write out the questions and provide answers to them

Presentation:

60 Minutes

Lab:

30 Minutes

Module Strategy

Use the following strategy to present this module:

!"Finding User Accounts Describe and demonstrate the Find function of Active Directory to locate a user account

!"Administering User Accounts Provide an overview of common tasks that are involved in administering user accounts Explain to students why they might need to reset passwords and unlock user accounts Demonstrate how to perform both administrative actions Describe and demonstrate how to disable, enable, rename, and delete user accounts

The labs associated with this module are in a proposed new format Remind students to complete the lab survey on the Student Materials Web page when they have completed the course

!"Managing User Profiles Provide students with an overview of user profiles Define user profiles; explain how they are created, and how they change Describe default user profiles as a template to create new user profiles Present an overview of roaming user profiles The topic on defining roaming user profiles has an animated slide The icon on the bottom left corner of the slide identifies it

as an animated slide Use the slide to help describe the application of a roaming user profile to a computer at which the user logs on Demonstrate the steps for setting up a roaming user profile Describe customized roaming user profiles to provide users with the desktop environments that they need Describe mandatory roaming user profiles The topic on mandatory roaming user profiles also has an animated slide Use the slide to help describe the application of a mandatory roaming user profile to a computer at which the user logs on Demonstrate how to create and assign a customized profile for multiple users

!"Creating Home Folders Provide students with an overview of home folders Explain home folders as the network location where users store their files Explain and demonstrate the procedure to create a home folder on a server

!"Introduction to Group Policies Introduce group policies and explain how they can affect user access Tell students that they should be aware of group policies that might affect user accounts and should work with Group Policy administrators to resolve access conflicts

!"Troubleshooting User Accounts Provide students with solutions to user account access problems

!"Best Practices Read the Best Practices section before you start the module, and then refer

to the appropriate practice as you teach the corresponding module section Then, at the end of the module, summarize all of the best practices for the module

Customization Information

This section identifies the lab setup requirements for a module and the configuration changes that occur on the student computers during the labs This information is provided to assist you in replicating or customizing Microsoft Official Curriculum (MOC) courseware

The labs in this module are also dependent on the classroom configuration that is specified in the Customization Information section at

the end of the Classroom Setup Guide for course 1556A, Administering

of the following actions:

!"Complete module 2, 3, or 4 in course 1556A, Administering

To prepare the student computers to meet this requirement:

!"Run the script Lab051.cmd on only one of the two domain controllers in each subdomain

If you run the script on both domain controllers, the labs will not function properly

!"If you create the users manually, leave the password blank

Lab Results

Performing the labs in this module introduces the following configuration changes:

!"The assignment of the Log on locally right to the Users group

!"The addition of User51, User52, User53, User54, User55, and User56 in the Users container

Important

Caution

Overview

! Finding User Accounts

! Administering User Accounts

! Managing User Profiles

! Creating Home Folders

! Introduction to Group Policies

! Troubleshooting User Accounts

! Best Practices

You might have to find specific user accounts to administer them You use Active Directory™ directory service to find a user account by searching for specific account properties As an administrator, you might have to change user account settings and set up desktop environments Changes to a user account can involve changing a user’s password, or renaming or deleting a user account

In addition to administering user accounts, you also administer other functions that affect user accounts You set up user profiles to control what appears on a user’s desktop and the applications to which users have access Your familiarity with group policies enables you to understand the influence they have on user accounts, groups, and computers You create and manage home folders at a location where users store data files

You must be an administrator or have administrative rights to complete the tasks of modifying user accounts, creating roaming user profiles, and assigning home folders

At the end of this module, you will be able to:

!"Use Active Directory to find a user account

!"Administer user accounts

!"Manage user profiles and roaming user profiles

!"Create home folders

!"Describe group policies and their effect on user accounts, groups, and computers

!"Troubleshoot user accounts

!"Apply best practices to administer user accounts

In this module, you will learn

how to administer user

accounts This includes

modifying user accounts, as

well as setting up user

profiles and home folders

You will also learn how

group policies affect user

accounts in your network

Important

# Finding User Accounts

Find Users, Contacts, and Groups

File Edit View Help Find: Users, Contacts, and Groups nwtraders

Administrators can use the Find Users, Contacts, and Groups dialog box to

quickly find a user or group in Active Directory using account properties such

as first name, last name, e-mail alias, or office location

To find a user account, open Active Directory Users and Computers

Right-click the domain, and then click Find Type the user name or, under

Description, type a property of the user that you want to find, such as e-mail

alias Then click Find Now

Slide Objective

To describe the Find

function of Active Directory

to locate a user account

Lead-in

You can use Active directory

to find a user account

Delivery Tip

Demonstrate using Users,

Contacts, and Groups to

find an object such as a

user in Active Directory

# Administering User Accounts

! Resetting Passwords and Unlocking User Accounts

! Disabling, Enabling, Renaming, and Deleting User Accounts

After you set up a user account, you might have to make modifications to it Company business needs and personnel changes might require you to modify user accounts For example, you might need to rename an existing user account for a new employee so that the employee has the same permissions and network access as his or her predecessor You might need to make modifications to user accounts because of changes in:

Slide Objective

To introduce some common

tasks that are involved in

administering user

accounts

Lead-in

Administering user accounts

allows you to fix problems

that might arise for users

Delivery Tip

This is an overview of

administering user

accounts Prepare students

for the topic by providing the

following key points of

information

Key Points

You might need to reset

passwords and unlock user

accounts

You might also need to

disable, enable, rename,

and delete user accounts

Resetting Passwords and Unlocking User Accounts

Reset password

Reset password !The password expires

!The user forgets password

!The password expires

!The user forgets password !!Reset Password dialog box Reset Password dialog box

Unlock user account

Unlock user account !A group policy locks theaccount

!A group policy locks theaccount !Account tab of Propertiesdialog box of user

!Account tab of Properties

dialog box of user

If a user cannot log on to a domain or a local computer, you might need to reset the user’s password or unlock the user’s account To perform these tasks, you must be a member of the Administrators or account operators group

The following table describes when and where you make these modifications

Reset a password

The password expires before the user changes it or the user forgets the password

In the Reset Password dialog

box You do not need to know a user’s password in order to reset it

You should require the user to change the password the next time that he or she logs on Unlock

a user account

A Group Policy locks out a user account if the user violates the policy For example, a user is locked out if he or she exceeds the limit that a Group Policy allows for failed logon attempts

When a user account is locked out, Windows 2000 displays an error message

On the Account tab in the

Properties dialog box for

the user

When a user account is locked

out, the Account lock out

check box is selected Clear the check box

You gain access to the Reset Password and Properties dialog boxes in Active

Directory Users and Computers Right-click the appropriate user account, and

then click Reset password or Properties

Slide Objective

To present why and how to

reset a password and

unlock a user account

Lead-in

When a user cannot gain

access to the network or a

computer, you might need to

reset a password or unlock

the user account

Delivery Tip

Demonstrate the procedures

to reset a user account

password by using Active

Directory Users and

Computers

Demonstrate how to unlock

a user account on the

Account tab in the

Properties dialog box for

the user

Key Points

You do not need to know a

user’s password in order to

reset it In fact, there is no

way to determine a user’s

current password

Typically, a Group Policy

locks out a user account

Disabling, Enabling, Renaming, and Deleting User Accounts

dsa - [Active Directory Manager\nt5admin\Users]

Console Window Help

Active View

Active Directory

Users

Builtin Computers Domain Controllers

nt5admin User1

User2 User3 User4 User5 User6 User7 User8 User9 User10

User User User User User User User User User User

Open user’s home page Send mail

Task Delete Rename

!"Renaming a user account Rename a user account if you want to retain all rights, permissions, and group memberships for the user account and reassign it to a different user For example, if there is a new company accountant, rename the account by changing the first, last, and user logon names to those of the new accountant Also, you might have to change other properties for a user, such as telephone number and address

!"Deleting a user account Delete a user account when an employee leaves the company and you are not going to rename the user account By deleting these user accounts, you do not have unused accounts in Active Directory You disable, enable, rename, and delete user accounts in Active Directory

Select the appropriate user account On the Action menu, click the command

for the type of modification that you want to make As an alternative, right-click the user name and select the action

A red circle with an X across it indicates a disabled user account

Slide Objective

To show how to disable,

enable, rename, and delete

user accounts

Lead-in

Some modifications affect

the functionality of user

accounts These are

enabling, disabling,

renaming, and deleting

user accounts

Delivery Tips

Demonstrate the procedure

to disable a user account by

using Active Directory Users

and Computers

Then, with the same user

still selected, point out that

the Action menu now

contains the Enable option

Then, demonstrate the

procedures to rename a

user account

Key Points

Renaming a user account

means that all of the

permissions and user

privileges for the account

remain the same, with just a

different user name

Note

Lab A: Administering User Accounts

Objectives

After completing this lab, you will be able to:

!"Search the Active Directory™ directory service for user accounts

!"Disable and enable user accounts

!"Reset a user’s password

Prerequisites

Before working on this lab, you should have:

!"Experience logging on to and off Microsoft® Windows® 2000

Lab Setup

To complete this lab, you need the following information Your instructor will provide this, or you and your partner can decide together If you are not working with a partner, you will use “A”

Your computer (A or B) _ Your partner’s computer (A or B)

Estimated time to complete this lab: 15 minutes

We need your opinion on this proposed lab format After you complete the course and have access to the Internet, please respond to the lab format survey on the Web page on the Student Materials compact disc

Slide Objective

To prepare students for

the lab

Lead-in

In this lab, you will disable

and enable user accounts,

reset a user’s password,

and search Active Directory

for user accounts

Delivery Tip

Have students work with a

partner when they do the lab

exercises

Note

Exercise 1: Disabling and Enabling User Accounts

Scenario: You are an administrator for a company of medium size (fewer than 500 users) An employee

takes a leave of absence You expect the employee to return sometime in the future, but it is not definite You are concerned that if you leave the employee’s account active, someone could use it for unauthorized access You could delete the account, but if the employee comes back you will have to reassign all of the permissions to everything to which the user had access You have decided instead to disable the account, and if the employee returns you will just need to re-enable the account

Your Tasks: Find a user account and disable it Then test the user account and re-enable it

Log on to your domain as

Administrator Use the Find function in

Active Directory Users and Computers

to search for a user

If you are on computer A, use User51

account

If you are on computer B, use User52

account

Log on to your domain as Administrator

Start Active Directory Users and Computers

Maximize the window

Expand your domain name, and then right-click the Users folder

Select Find

If you are on computer A, type User51 in the Name box

If you are on computer B, type User52 in the Name box

Click Find Now

When would you use the Find function?

When the number of users becomes too large to scroll through or when you do not know the location of the user account

_

_

Disable the user account Right-click the user, and click Disable Account

The Active Directory Service message box appears, stating that

the account has been disabled

Click OK to return to the Find Users, Contacts, and Groups

dialog box

Close the Find Users, Contacts, and Groups dialog box to return to

Active Directory Users and Computers

Select the Users folder, and then press F5

In the details pane of Active Directory Users and Computers, find the user account that you disabled

How can you tell that the user account is disabled?

A red circle with an X appears over the icon for the user

_

_

Under what other circumstances would you disable a user account?

Answers may vary

One possible answer: You have created an account for a new employee before the employee starts work, and you do not want anyone else to be able to use the account

_ _

Important: Before you start the next step, confirm that your partner has finished the preceding step The

next step is necessary to synchronize Active Directory between domain controllers

Run Synch.cmd, which is found in the

C:\MOC\WIN1556A\Labfiles folder

Click the Start button, and then click Run

In the Run box, type C:\MOC\WIN1556A\Labfiles\synch.cmd

Test a disabled account Log off

Windows 2000 and attempt to log on as

the following user:

If you are on computer A, log on as

User51

If you are on computer B, log on as

User52

Log off Windows 2000

Attempt to log on as the following user:

If you are on computer A, log on as User51

If you are on computer B, log on as User52

Were you successful? Why or why not?

No The account is disabled

_ _ Log on as Administrator and enable the

Start Active Directory Users and Computers

Maximize the window

Expand Domain.nwtraders.msft (where Domain is your domain), and

then click Users:

If you are on computer A, in the details pane, right-click User51, and then click Enable Account

If you are on computer B, in the details pane, right-click User52, and then click Enable Account

Windows 2000 displays the Active Directory Service message

box, confirming that the account was enabled

Click OK to return to Active Directory Users and Computers

How can you tell that the user account is enabled?

The red circle with the X is gone

_ _ Close Active Directory Users and

Computers, and log off Windows 2000

Close Active Directory Users and Computers

Log off Windows 2000

Exercise 2: Resetting Passwords

Scenario: An employee has just returned from an extended leave of absence and cannot log on because

she has forgotten her password You will have to reset the password so that the user is able to log on

Your Tasks: Reset a user password, and then test the new password

Log on as Administrator, and open the

Reset Password dialog box for:

User53 if you are on computer A

User54 if you are on computer B

Log on as Administrator

Start Active Directory Users and Computers

Maximize the window

Expand Domain.nwtraders.msft (where Domain is your domain), and

then click Users:

If you are on computer A, in the details pane, right-click User53, and then click Reset Password

If you are on computer B, in the details pane, right-click User54, and then click Reset Password

Why is the old password not visible?

Passwords are not visible to anyone, including the administrator This prevents someone from seeing the password and logging on as that user

_

_

Reset the password to password and

click Users must change password at

next logon

In the New password and Confirm password boxes, type password Select the Users must change password at next logon check box

Why would you require the user to change the password the next time she logs on?

By selecting this box, you ensure that the user will change the password the first time that she logs on Then, only the user will know her new password

Windows 2000 displays the Active Directory Service message

box, confirming that the password has been changed

Click OK to return to Active Directory Users and Computers

Log off Windows 2000

Test the new password by attempting to

log on as:

User53 if you are on computer A,

User54 if you are on computer B, with

a password of password

Change the password to user when

prompted

Attempt to log on to Windows 2000 as the following user:

If you are on computer A, log on as User53 with a password of

password

If you are on computer B, log on as User54 with a password of

password

Change your password to user when prompted

Log off Windows 2000 Log off Windows 2000

# Managing User Profiles

! Defining User Profiles

! Default User Profile

! Defining Roaming User Profiles

! Setting Up a Roaming User Profile

! Customizing Roaming User Profiles

! Mandatory Roaming User Profiles

! Assigning a Customized Profile to Multiple Users

You will need to perform many functions that affect user accounts

Microsoft® Windows® 2000 automatically creates user profiles, which store the user’s desktop configuration and settings User profiles are created the first time

that a user logs on to a computer A user profile is a collection of folders and

data that stores the user’s current desktop environment and application settings and their data Every time that a user logs off, his or her user profile is updated

on the computer at which the user was logged on This update to the user profile reflects the condition of the desktop at the time when the user logged off When you want a consistent starting point for user profiles, you can create a default user profile that Windows 2000 will apply to each user account the first time that the user logs on To support users who work at multiple computers,

you can set up roaming user profiles Roaming user profiles are user profiles

that are stored on a network server When you set up roaming user profiles, a user has the same desktop environment on any computer where he or she logs

Slide Objective

To introduce user profiles

Lead-in

Managing user profiles is

the method that you will

typically use to manage a

user’s desktop

Delivery Tip

This is an overview of

managing user profiles

Prepare students for the

topic by providing the

following key points of

information

Key Points

A user profile contains a

user’s desktop environment

A default user profile

provides the same starting

profile for all new users

A roaming user profile is

used to configure the user’s

desktop in the same way at

each network computer

You set up roaming user

profiles on a file server

You customize roaming user

profiles to provide users with

the desktop environments

that they need

You can make roaming user

profiles mandatory so that

users cannot modify them

You can assign a

customized roaming user

profile to multiple users

Defining User Profiles

! Provide Desktop Settings and Network Connections

! Windows 2000 Creates a Profile the First Time a User Logs On

! Each Time a User Logs On, the User Receives His or Her Desktop Settings

! A User Changes His or Her Profile by Changing Desktop Settings

! User Profiles Contain the My Documents Folder, Where Users Store Their Files

! In Some Situations, It Is Best to Store User Files in Home Folders

A user profile contains the settings and connections that are established when a user logs on to a computer This includes desktop settings and network

connections, such as Start menu items and mapped drives to network servers

User profiles ensure desktop consistency for the user by providing the same desktop that the user had the last time that he or she logged on to the computer User profiles operate in the following manner:

!"The first time that a user logs on to a client computer, Windows 2000 uses the default user profile to create a profile for the user Windows 2000 stores

the profile in the system root folder called Documents and Settings\User

!"When a user logs on to a client computer running Windows 2000, the user always receives his or her individual profile, regardless of how many users share the same computer

!"A user changes his or her user profile by changing desktop settings For example, a user makes a new network connection or adds a file to My Documents Then, when the user logs off, Windows 2000 incorporates the changes into the user profile The next time that the user logs on, the new network connection and file are present

!"A user profile contains a folder named My Documents, which provides a place for users to store their files My Documents is the default location for

the File Open and Save As commands By default, Windows 2000 creates a

My Documents icon on the user’s desktop This makes it easier for users to

locate their documents

In most situations, users will store their documents in My Documents rather than in home folders However, some older applications might not be able to use My Documents Also, in situations where a user’s files are large, copying the documents to the server each time that the user logs on and off affects network performance In these situations, it might be best to save user files in home folders

Slide Objective

To present user profiles

Lead-in

Windows 2000 automatically

creates user profiles, which

contain users’ desktop

environments

Delivery Tip

Show the user profile path

by using Windows Explorer

Expand the profile folder for

the Administrator account

and point out the subfolders,

especially My Documents

Key Points

Windows 2000 automatically

creates a user profile the

first time a user logs on to a

computer

Included in the user profile

is the My Documents folder,

which is the default location

for saving files for many

Microsoft applications, such

as Microsoft Word

Default User Profile

Network Server

When a User Logs On the First Time, the Default User Profile Is Copied from the Server to the Client Computer

Log On

Server\netlogon

Default Profile

Log On

When you want a consistent initial desktop environment for users, you can create a default user profile that Windows 2000 will apply to each new user account the first time that the user logs on A default user profile provides the template for the initial profile for new users

When a new user logs on to a client computer running Windows 2000 and does

not have a local or server-based profile defined, Windows 2000 first looks for a

network default user profile If a network default user profile exists, it becomes

the template for the profile for the user If Windows 2000 does not find a

network default user profile, the default user profile on the local computer

becomes the template for creating the user’s profile

You can create a network default user profile by placing a profile in the

Netlogon share (systemroot\SYSVOL\sysvol\domain\scripts) of each domain

controller on a network The shared folder must be named Default User in order for the profile to be downloaded from the server

You can customize the default user profile to provide users with specific desktop settings and shortcuts that appear whenever they log on

consistent beginning profile

for all new users

Delivery Tip

The slide for this topic is

animated Explain to

students that the

administrator can provide a

consistent initial desktop

environment for users by

creating a default user

profile

Defining Roaming User Profiles

Network Server

When a User Logs On, the User Profile Is Copied from the Server to the Client Computer

When a User Logs Off, Any Changes to the User Profile Are Copied Back to the Server

Log On

Profile Ntuser.dat

User1 Profile

Log Off

A roaming user profile applies the user’s desktop environment to any computer running Windows 2000 in the network to which the user logs on Use roaming user profiles to provide users with the same desktop configuration, no matter where they log on

To set up a roaming user profile, an administrator modifies a user’s account to store the user’s profile on a server Consequently, the user always receives his

or her individual desktop settings and connections at any computer on the network where the user logs on This is in contrast to a local user profile, to which the user only has access when logged on to the computer where the profile is saved

How a Roaming User Profile Works

Roaming user profiles work in the following manner:

!"When a user logs on, Windows 2000 copies the roaming user profile from the network server to the client computer and applies the user profile settings to that computer Any documents saved in the user’s My Documents folder are copied from the server to the local computer

Thereafter, when the user logs on to the computer, Windows 2000 compares the locally stored user profile and the roaming user profile files on the network server It copies only the files that have changed since the last time that the user logged on at the computer The logon process is shorter

!"When a user logs off, Windows 2000 copies changes that the user made to the local copy of the roaming user profile back to the server where the roaming user profile is stored

A file in the profile called Ntuser.dat contains the section of Windows 2000 system settings that applies to the individual user account and contains the user environment settings, such as desktop appearance

Slide Objective

To present an overview of

roaming user profiles

Lead-in

You set up roaming user

profiles on a server so that

the profile is available to the

user no matter where the

user logs on in the domain

Delivery Tips

The slide for this topic is

animated Begin by

explaining to students that

the administrator modifies a

user account to store a

profile on a server Then

explain that the user always

obtains his or her desktop

settings and connections on

any network computer

where he or she logs on

Show students the

Ntuser.dat file in the

Administration folder

Ntuser.dat is maintained in

the Documents and

Settings\user_name folder

Make sure that you show

hidden files and folders

Key Points

A roaming user profile

follows the user to each

Windows 2000-based client

computer to which the user

logs on

When a user logs on,

Windows 2000 copies the

roaming user profile on the

server to the computer to

which the user is logging on

Note