Using WMI Event Logging Provider

Windows Management Instrumentation (WMI) is use to set up standards for creating, reading, and modifying management information. The functionality of WMI is similar to a database. The WMI database known as the repository stores information about different components, such as, devices, services, and application. The WMI providers pass the information to the WMI Object Manager that enters the information in the repository.

The WMI providers provide description about the operating system. The administrator can view the information about network configuration, processes that are running, installed services, hardware, and software. You can access the information stored in the WMI repository with the help of management tools, Application Programming Interfaces, scripting tools, or command line using Windows Management Interface Command-line (WMIC). WMIuses Common Information Model (CIM). Objects that are present in the management environment are described by the CIM.

WMIC is an easy command line interface that enables to work with WMI. Computers running on different versions of Microsoft windows can be managed with the help of WMIC. To manage and monitor remote computers with the help of WMIC, WMI needs to be on the local computer that you want to monitor and WMIC can be available remotely.

WMIC enables to perform the following task:

> Local management of a computer - Enables to manage the local computer. You can use WMIC on the local computer to manage that computer.Remote management of a computer - Enables to manage remote computer. You can use WMIC on one computer to manage another computer. > Remote management of multiple computers - Enables to manage multiple remote computers. You can use WMIC on one computer to manage multiple remote computers with a single command.

> Administrative scripting - Enables to manage local, remote, or multiple computers by writing management script with the help of WMIC.

To access the information from the WMI you need to use queries in WMIC. WMI query is known as aliases. Aliases enables to access information that administrator would require for managing and monitoring different computers.

Aliases perform certain task and these tasks can be issued using certain verbs along with the alias. The most useful verbs that can be used with the alias are:

> CALL - Executes the specified methods. For example, to start a particular service enter, service call startservice. It will execute the command to start the service.

> GET - Displays the values of a particular property.

> LIST - Displays all the values for a given alias.

> LIST BRIEF - Displays only the important information about the alias.The output of the WMIC command can be redirected to CSV file, text file, or HTML page. Redirecting the output enables you to analyze the information in much better format.

To view the information about the processes whose processlD is greater than 300 using WMIC:

1. Select Start 4 Programs 4 Accessories 4 Command Prompt. The Command Prompt window appears.

2. Enter WMIC and press enter.

3. Enter process where 'process iD>300' list brief and press enter. The list of all processes whose ID>300 appears.

The Command Prompt - wmic window displays all the processes whose ID is greater than 300.

Using Task Manager

Task Manager enables us to view the information about programs and processes that are running on your computer. If a particular program stops responding then you can view the status of the program and end that program with the help of Task Manager.

To view the Task Manager:

1. Press Ctrl + Alt + Delete. The Windows Security dialog box appears.

2. Click Task Manager. The Windows Task Manager dialog box appears

The Windows Task Manager displays the total number of processes that are running, percentage usage of CPU, and memory allocated to the programs and system. You can view the status of all the programs running on the computer. The different options available in the Windows Task Manager dialog box are:

> End Task - Enables to end the program that is running. You can also end the program that is not responding.

> Switch To - Enables to switch to another program.

> New Task - Enables to start a new program. New task opens Create New Task dialog box that enables to select a program that you want to start.

3. Click the Processes tab. The Processes tab appears.

The Processes tab displays information about all the processes that are running on your computer. It displays all user applications, services, and other system processes including executable. It also displays information about Image name of the processes that are running, user name, CPU usage, and Memory usage.

4. Select View > Select Columns. The Select Columns dialog box appears.
The Select Columns dialog box enables to select the required column names that you want to display in the Processes tab.

5. Select the required column names.

6. Click OK. The selected columns are displayed in the processes tab.

7. Click the Performance tab. The Performance tab appears.

The information displayed on the Performance tab is:

> Cpu Usage - Displays the percentage of time the processors are working in the graph format. The graph shows high percentage if your computer is running slowly.

> CPU Usage History - Displays how busy the computer is over the time in the graphical format. You can change the update speed of the graph by clicking Update Speed from the View menu.

> PF Usage - Displays the paging file used by the computer in Megabytes. Paging files are reserved disk space that backs up committed physical memory on the computer.

> Page File Usage History - Displays the paging file used over the time in the graphical format. The information displayed depends on the option you have selected from the Update speed under the View Menu.

8. Click the Networking tab. The Networking tab appears,

The Networking tab displays information about the network performance in the graphical format. The information displayed on the Networking tab is:

> Adapter Name - Displays the name of the network adapter that connects your computer to a network

> Network Utilizations - Displays the percentage of the network utilization based on the initial connection speed for the interface

> Link Speed - Displays the connection speed of the interface

> State - Displays the status of the network

9. Click the Users tab. The Users tab appears.

The Users tab displays information of all the users who are logged on. It displays the local users as well as the remote users.

The different options available on the Users tab are:

> Disconnect - Enables you to disconnect the user who is connected to your computer.

> Logoff - Enables you to logoff the user who is logged in over the network.

> Send Message- Enables to send the message to a remote user. To send a message you need to select the user and click Send Message.

10. Close the Windows Task Manager dialog box.

Using Performance Console

Monitoring system performance enables you to maintain and administer your operating system. You can monitor the system performance over the network with the help of the performance console. Monitoring the system helps you in understanding the effect of the workload on your system resources. It also helps in identifying problem areas and accordingly the administrator can make appropriate changes to improve the performance of the system.

The Window Server 2003 provides with the following tools as part of the performance console:

> System Monitor - Enables you to monitor and measure the performance of your computer or network computers. It enables you to collect and view the real time performance data of the remote computers. It also stores information about the usage of the hardware resources and activities of the system services on computers you are administering.

> Performance Logs and Alerts - Enables you to collect the performance data automatically from local or remote computers. Data collected in the Performance logs and alerts can be easily imported tospreadsheet program as they are collected in comma separated or tab separated format. Performance log is divided into as follows:

• Logs: Displays information, which the application, services or operating system generates. There are two types of logs, counter and trace. Counter logs displays the information about the hardware usage and activities of the system services of local and remote computer. Trace logs displays information about the activities, such as, disk input/output activity. This information helps to know the performance of the system.

• Alerts: Displays information about the logs when the counter value rises or falls below the specified limit.

To monitor the performance of the computer you can add a counter. You can view the required system information by adding counter.

To monitor the performance of a computer:

1. Select Start > Control Panel > Administrative Tools > Performance. The Performance console appears.

The System Monitor details pane displays the performance of the selected computer. The details of the graph are displayed below the graph. The details table displays the real-time data about memory usage in terms of pages/sec, physical disk usage in terms of average disk queue length and percentage processor time.

2. Right-click the System monitor. A shortcut menu appears.

3. Select Add Counters. The Add Counters dialog box appears.

The options available in the Add Counters dialog box are:

> Use local computer counter - Enables you to view the performance of the local computer.

> Select counter from computer - Enables you to select computer to view the performance.

> Performance object - Enables you to select performance object.Performance object represents the collection of the counters that are associated with a resources or service that can be monitored. Counter refers to data reporting item.

> All Counters - Enables you to select all the counters.

> Select Counters from the list - Enables to select the required counter.

> All instances - Displays all the instances of the counter. Instances refer to one or more occurrences of a counter.

> Select instances from the list - Enables to select the required instances. The Total displays the selected instance. It represents the combined data from the multiple instances of a counter when multiple instances are available. A '0' is displayed in the text box when there is only one instance of the counter. It will display ‘1 when there two processes on the system.

> Add - Enables you to add the counter to view the performance.

> Explain - Explains the counter that you have selected.

4. Select Select Counter from the list option and select the counter from the drop-down list.

5. Select the required object from the Performance object drop-down list.

6. Select the required counters from the Select the counters from the list drop-down list.

7. Select All instances check box to display all the counter instances that are available when system monitor is in use.

8. Click Add. The Performance console appears with the selected counter.

Using Event Viewer

Event viewer enables tj administrator to gather information about hardware and software problems. The event logs are file that contains information about the events that you want to monitor. The administrator can view and set login options for event logs.
Windows Server 2003 records three types of logs in the event viewer:

> Application log - Contains information about events logged by the application or programs. The application developer decides events that are logged in the application log. For example, if an application generates any error then that information will be stored in the application log.

> Security log - Contains information about the security related events that you have specified in the audit policy. It contains event log for valid and invalid logon attempts, creating, opening, and deleting files or folder. For example, if you configure the audit policy to monitor all unsuccessful attempts made by a user to delete a particular file, then the security log will contain information about all the unsuccessful attempts made by the user to delete that file.

> System log - Contains information about events logged by Windows Server 2003 system component. The server predetermines the events that are logged in the system log. For example, at the time of installing some software, if there is any driver failure or if there is any abnormal shutdown then the information about all these events will be stored in the system log.

A computer that is running Windows Server 2003 operating system and is configured as a domain controller records two additional events:

> Directory Service log - Contains information about the events that are logged by the Windows Active Directory directory service. For example, connection problem between the servers are recorded in the directory service log.

> File Replication Service log - Contains information about events logged by Windows File Replication Service. The events logged are related to the copying of information between Domain Controller during a replication cycle. For example, the events that occur while updating the domain controller with the information about system volume changes are stored in the file replication log.

A computer running Windows Server 2003 operating system and configured as a Domain Name System (DNS) server records one additional event, which is Domain Name System log. It contains information about error or important events reported by the DNS server.

To view the application log in the Event Viewer:

1. Select Start > Control Panel > Administrative Tools > Event Viewer. The Event Viewer console appears. The Event Viewer displays different logs. We can select the required log to view the events under that log.

2. In the console tree, click Application. The list of individual application events appears in the details pane,
The Application log displays all the events related to application. The different types of event log displayed are:

> Information - Specifies the successful operation of an application

> Error - Contains information about an event, which specifies the failure operation of an application

> Warning - Provides an alert message, which may not be important now but might indicate the future problem

3. Double-click the required event to view more details about the event from the detail pane. The Event Properties dialog box appears.

The Event Properties dialog box displays the details about the selected event.

4. Click OK.

Monitoring Performance

The administrator needs to monitor and manage the system to know the performance of the system. Periodical monitoring of the resources enables to identify the problems in the hardware and software. Accordingly, the administrator can take appropriate steps to solve the problem and improve the performance of the system. Windows Server 2003 provides you with the tools, such as, the Event Viewer, Performance Console, Task Manager, and WMI Event Logging Provider to monitor the performance of the system.

Managing Terminal Services

In a network infrastructure, the administrator may find it difficult to monitor users and session on each server of the network. For this, the administrator needs the information of the user sessions on the remote server. Windows Server 2003 provides the Terminal Services Manager for this purpose.
The Terminal Services Manager helps you in viewing the administrative information of the Remote Desktop Sessions on the server. The Terminal Services Manager can also be used to send messages to the users of all the remote computers.

To send messages to a remote computer:

1. Select Start 4 Programs 4 Administrative Tools 4 Terminal Services Manager. The Terminal Services Manager message box appears.

2. Click OK. The All Listed Servers - Terminal Services Manager console appears.

3. In the console tree, click the required Connections under All Listed Servers

4. Select Action > Connect to Computer. The Connect to Computer dialog box appears.

5. Enter the name of the computer to which you want to send the message in Type the name of the computer to connect to text box.

6. Click OK.

7. Select Action > Send Message. The Send Message dialog box appears.

8. Enter the required message in the Message text box.

9. Click OK. The message is sent to the selected computer.

Configuring Terminal Services

You can configure the properties of a particular connection. Configuring the properties of a connection enables you to set login options. For example, if you want to assign different User name, Domain, and password for the users who can connect to the terminal server, you can configure the login settings. You can also configure the ability of the administrator to view the users session remotely.

To configure the Terminal services:

1. Select Start > Control Panel > AdmInistrative Tools > Terminal Services Configuration. The Terminal Services Configuration\Connections console appears.

2.In the console tree, click Connections.

3.Select Connections from the detail pane.

4. Select Action 3 Properties. The Properties dialog box appears. The Properties dialog box enables to select the level of encryption from the Encryption level. The default encryption level is Client Compatible, which mean any user can connect to the terminal server irrespective of the encryption capability.

The different options in the Properties dialog box are:

> Comment - Enables to enter the required comment

> Encryption - Enables to select the required encryption level. The different encryption levels are:
• High - Enables to encrypt the data that is sent from the server to client and client to server using 128 bit level of encryption
• Low - Enables to encrypt the data that is sent from the client to server using 56 bit level of encryption. Data is not encrypted when it is sent from the server to the client.
• FIPS Complaint - Enables to encrypt and decrypt the data sent from the client to the server and from server to client using Federal Information Processing Standard (FIPS) encryption

> Use standard Windows authentication - Enables to use the standard windows authentication when you have install another authentication package on the server.
If the user is not capable of the encryption mode that you have selected, then the user will not be able to connect to the terminal server.

5. Select the appropriate Encryption level from the drop-down list box.

6. Click Logon Settings tab. The Logon Settings tab appears.

The Logon Settings tab enables to configure the login settings for the terminal. The different options are:

> Use client-provided logon information - Enables to use the login information provided by the user to connect to the terminal server

> Always use the following logon information - Enables to assign different User name, Domain, and password for the users who can connect to the terminal server by selecting this option

> Always prompt for password - Enables to specify to prompt a user for password, always before logging to the server.

7. Select the appropriate option to set the login settings.

8. Click Sessions tab. The Sessions tab appears. Session tab enables you to configure the settings that determine the behavior of a user session that has been active, ideal, or disconnected. The different options available are:

> Override user settings - Enables to set the time out session for a connection. You can specify when to end the disconnected session. It enables to set the time limit for active and idle session.

> Override user settings when session limit is reached or connection is broken - Enables to select to disconnect or end session when limit that you have set is reached or if the connection is broken.

> Allow reconnection - Enables to set the reconnection option. You can select to connect the user as any client or can connect as the client that was disconnected.

9. Select the appropriate options.

10. Click Environment tab. The Environment tab appears.

The Environment tab enables you to set the initial program. You can configure to start a particular program when the user logs in. The options available are:

> Override settings from user profile and Remote Desktop connection - Enables to override the settings of a user profile.

> Start the following program when the user logs on - Enables to execute a program when the user logs on. The options available are:

• Program path and file name: Enables to enter the name and path of the program that you want to execute.

• Start in: Enables to specify the mode in which you want to start the program

11. Select the appropriate option if you want to set the initial program for the server.

12. Click Remote Control tab. The Remote Control tab appears.

Remote Control tab enables to configure the server to set remote control, which means the ability of the administrator to view the user’s session remotely. Remote control allows the administrator to view and interact with the sessions of the user. You can also configure the remote control that requires the user permission to view the session.

13. Select the appropriate option to set remote control.

14. Click Client Settings tab. The Client Settings tab appears. Client settings tab enables to configure client settings and color depth. You can also disable the required mapping settings. Audio mapping is disabled by default.
15. Select the required option.

16. Click Network Adapter tab. The Network Adapter tab appears. Network Adapter tab enables to select the network adapter and the number of concurrent connections to the terminal server.

17. Select the required network adapter from the Network Adapter drop-down list box.

18. Select appropriate option to set connections.

19. Click Permissions tab. The Permissions tab appears. Permissions tab enables to assign permission for different users. You can assign or deny full control to a particular user. An error message will appear if a particular user who does not have sufficient permission to access the terminal server tries to access the terminal server.

20. Select a user from the Group or user name box and assign the appropriate access.

21. Click OK.

Installing Terminal Servers

To use the terminal services you need to install terminal servers.To install Terminal Server:

1. Select Start > Control Panel. > Add/Remove Programs. The Windows Components screen appears.

2. Select Terminal Server. The Configuration Warning dialog box appears.

3. Click Yes to return to Windows Component screen.

4. Select Terminal Server Licensing.

5. Click Next. The Terminal Server setup screen appears.

6. Click Next. The Select Default Permissions screen appears.

7. Select Full Security.

8. Click Next. The Terminal Server Licensing Setup screen appears.

9. Select the required option for which you want to make this server available.

10. Click Browse and select the location where you want to install the server database.

11. Click Next. The Configuring Components screen appears.

12. Click Next after the set up is complete. The System Settings Change dialog box appears.

13. Click Yes to restart your machine.

Terminal Services

Terminal Services in Windows Server 2003 enables to share the application over the network. It allows the Administrator to control and manage a computer from their desk. For example, in an organization there are 30 computers and the administrator needs to manage and control the working of those computers. It is not possible for the administrator to go to the desk of each computer and manage them. In such a case, it becomes easy for the administrator to manage those computers from their desk using terminal services.

Working with Security Logs

Security logs contain information about security related events that you have specified in the audit policy. For example, if you configure the audit policy to monitor all the unsuccessful attempts made by a user to delete a particular file, then the security log will contain information about all the unsuccessful attempts made by the user to delete that file.

To view security logs:

1. Select Start > Programs > Administrative Tools > Event Viewer. The Event Viewer console appears.

2. In the console tree, click Security. The list of individual security events appears in the details pane, The Security console displays the list of security events that are logged. It logs all the events that you have specif led in the audit policy.

3. Double-click a particular event to view more details about that event from the detail pane. The Event Properties dialog box appears. The Event Properties dialog box displays the details about the selected event.

4. Click OK to return to Event Viewer console.

5. Select View > Filter. The Filter tab appears, Filter tab enables you to view selected events from all the events stored in the security log based on their Event ID, User name, and Computer name. You can also enter the start and end date when the events were generated to display more selected events.

6. Select appropriate Event source and Category from the drop-down list box.

7. Enter the appropriate event id in the Event ID text box.

8. Enter the appropriate user name in the User text box.

9. Enter the appropriate computer name in the Computer text box.

10. Click OK. The selected events appear in the security detail pane.

Enabling Auditing

Auditing is not enabled when you configure the auditing entries of a file or a folder. You enable auditing through audit policy. After enabling auditing, the system looks after the audit settings.

To enable auditing:

1. Select Start > Programs > AdmInistrative Tools > ActIve Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Right-click the Domain. A shortcut menu appears.

3. Select Properties. The Properties dialog box appears.

4. Click the Group Policy tab. The Group Policy tab appears.

The different options available in the Group Policy tab are:

> New - Enables to create a new group policy

> Add - Displays the Add a Group Policy Object Link dialog box that enables to add the required group policy

> Edit- Displays the Group Policy and enables to edit the selected policyOptions - Displays the Default Domain Policy Options and enables to select the required option

> Delete - Enables to delete the selected domain policy> Properties - Displays the Properties dialog of the selected domain policy

> Block Policy inheritance - Enables to prevent the inheritance of policy to the linked domain

5. Select Default Domain Policy.

6. Click Edit. The Group Policy Object Editor window appears.

7. Expand Computer Configuration.

8. Expand Windows Settings.

9. Expand Security Settings.

10. Expand Local Policies.

11. Click Audit Policy. A list of Audit Policies appears in the detail pane.

12. Double-click Audit Object Access from the detail pane. The Audit object access Properties dialog box appears

13. Select Define these policy settings.

14. Select Success option to audit all successful attempts.

15. Select Failure option to audit all unsuccessful attempts.

16. Click OK.

Configuring Auditing

You can configure the audit settings and specify the task you want to monitor. For example, if you want to monitor the deletion of important files by unauthorized users, then you can configure the audit settings. This will keep track of the attempts made by any user to delete that file.
To configure auditing policy settings for local file or folder:

1. Select Start > Programs > AccessorIes > Windows Explorer. The My Documents window appears.

2. Right-click the file or folder you want to audit. A shortcut menu appears.

3. Select Properties. The Properties dialog box appears.

4.Click Security tab. The Security tab appears, The Security tab enables to assign the permission for the selected users. You can assign full access to a file or selected permissions to a file.

5. Click Advanced. The Advanced Security Settings dialog box appears.

6. Click Auditing tab. The Auditing tab appears.

The options available in the Auditing tab are as follows:

> Add - Enables to set up auditing for a new user or group

> Edit - Enables to view or modify auditing for an existing user or group

> Remove - Enables to remove auditing for an existing user or group

7. Click Add. The Select User, Computer, or Group dialog box appears.

The options available in the Select User, Computer, or Group dialog box are:

> Locations - Enables to select the required location.

> Object Types - Enables to select the required type of object, such as, users, Groups, and Computers.

> Enter the object name to select - Enables to enter the name of the object. The examples link displays the format in which you can enter the name of the object.

> Check Names - Specifies the correct name of the object that you have entered in the Enter the object name to select text box.

> Advanced- Enables to select the advanced options to search the object.

8. Click Object Types. The Object Types dialog box appears.

9. Select the required object type.

10. Click OK to return to Select User, Computer, or Group dialog box.

11. Enter the object name in the Enter the object name to select text box.

12. Click OK. The Auditing Entry dialog box appears.

The different options available in the Auditing Entry dialog box are:

> Change - Enables to select different username for which you want to assign access.

> Apply onto - Enables to specify where the object is audited

> Clear All - Clears all the selected access permission.

>Apply these auditing entries to objects and/or containers within this container only - Enables to specify whether to apply the auditing to the selection in the Apply onto and all applicable child object

> Access - Displays various types of access permissions. The two options for the access

permissions are:

• Successful - Audits all successful attempts for the required access type

• Failed - Audits all unsuccessful attempts for the required access type

13. Select the required Access to audit successful or unsuccessful attempts.

14. Click OK. The added auditing entry appears.

15. Click OK.

Auditing

Auditing refers to a process used by operating system to detect and record security related events, such as, an attempt made by the user to create, access, or delete files or folders. The records of such attempt are entered in a file called as Security log.

AUDITING AND TERMINAL SERVICES

Auditing helps the administrator to keep track of certain task performed by the users. You can configure the audit settings in the audit policy as per your requirement. Security related events that you have configured are stored in a separate Security logs file. Terminal Services in Windows Server 2003 enables to share the application over the network. It allows the Administrator to control and manage a computer from their desk.

Logon and Logoff Scripts

When the user logs on to the domain you can specify to run programs or open last used network drives. You can execute such tasks using scripts. You can assign log on scripts to execute tasks when the user logs on to the domain. You can also use లోగోఫ్ఫ్ scripts to execute tasks when the user logs off from the domain.

To Assign Logon Scripts:

1. Open Group Policy Object Editor console. The Group Policy Object Editor Console appears.

2. Expand Windows Settings under User Configuration.

3. Click Scripts (Logon/Logoff). Windows Server 2003 lists the Logon and Logoff Scripts.

4. Double-click Logon. The Logon Properties dialog box appears.

The different options on the Logon Properties dialog box are:

> Up - Moves the script above the selected script

> Down - Move the script below the selected script

> Add - Creates a new logon script

> Edit - Modifies the logon script

> Remove - Deletes the logon script

> Show Files - Displays the scripts

5. Click Add. The Add a Script dialog box appears.

The different options on the Add a Script dialog box are:

> Script Name - Specifies a name for the script

> Browse - Displays the Netlogon folder to add scripts

> Script Parameters - Specifies the conditions for the script

6. Enter the name for the script in the Script Name text box.

7. Enter the parameters for the script in the Script Parameters text box.

8. Click OK to close the Add a Script dialog box.

9. Click Apply.

When the user logons on to the domain on the network, Windows Server 2003 executes the script and displays the appropriate results. Similarly, you can add a logoff script for a user on the domain.

To add a logoff script:

1. Open Group Policy Object Editor Console. The Group Policy Object Editor Console appears.

2. Expand Windows Settings under User Configuration.

3. Click Scripts (LogonlLogoff). Windows Server 2003 lists the Logon and Logoff Scripts.

4. Double-click Log off. The Log off Properties dialog box appears.

5.Click Add. The Add a Script dialog box appears.

6.Enter the name for the script in the Script Name text box.

7.Enter the parameters for the script in the Script Parameters text box.

8.Click OK to close the Add a Script dialog box.

9.Click Apply.

Adding a Computer to the Domain

The computer must be a member of the domain for the domain controller to monitor and control the client computer. The client becomes a member of the domain when you attach the computer to the domain. When you add the computer to the domain, Windows Server 2003 creates a computer account under Domain Computers in Active Directory Users and Computers. You can attach multiple client computers, such as, computers running Window 2000 and Windows XP to the domain.

To add a Windows 2000 computer to the domain:

1. Select Start > Settings > Control Panel. The Control Panel window appears.

2. Double-click System. The System Properties dialog box appears.

3. Click the Network Identification tab. The Network Identification tab appears.

4. Click Properties. The Identification Changes dialog box appears.

5. Select the Domain option.

6. Enter the name of the domain in the Domain text box.

7. Click OK. The Domain User name and Password dialog box appears.

8. Enter the user name in the Name text box.

9. Enter the password in the Password text box.

10. Click OK. Windows attaches the computer to the domain and displays a message box.

To attach a Windows XP computer to the domain:

1. Open the System Properties dialog box. The System Properties dialog box appears.

2. Click the Computer Name tab. The Computer Name tab appears.

3. Click Change. The Computer Name Changes dialog box appears.

4. Select the Domain option.

5. Enter the domain name in the Domain text box.

6. Click OK. Windows XP prompts for the user name and password.

7. Enter the user name and password.

8. Click OK. Windows XP attaches the computer to the domain and displays a message box.

Troubleshooting Logons

Users access the network resources, using a domain user account. You can secure the user accounts to prevent misuse of the accounts. The computer must be a member of Domain computers group on the domain to ensure access to domain resources. You must add the computer to the domain to make the computer a member of the Domain Computers group.

Dleting Domain Groups

Consider a scenario, where an organization is under the process of restructuring. The organization has decided to eliminate the Purchase department. You as the system administrator of the organization have been assigned the task of deleting the Purchase group from the domain.

To delete the Purchase Group:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Users. The list of groups appears.

3. Select Purchases.

4. Select Action > Delete. The Confirmation message box appears.

5. Click Yes. Windows Server 2003 deletes the Purchases group.

Moving Domain Groups

You can move groups in the domain to secure access to the domain. When you move groups, the groups are granted permissions according to the location. For example, as a system administrator, you are asked to mo Sales group to another object in the domain.

To move the Sales group:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of groups appears.

3. Select Sales.

4. Select Action > Move. The Move dialog box appears.

5. Select the location to move Sales account, for example, Built in.

6. Click OK. Windows Server 2003 moves the Sales group under Built in.

Assing User Rights to Groups

Windows Server 2003 enables you to specify permissions to groups in the form of user rights. The domain controller security settings console enables you to assign rights to users and groups on the domain. For example, you can restrict the user or users in a group to logon to the domain controller from the domain controller machine.You can use the deny logon locally rights to enable and disable logon locally rights to users and groups.

To deny Logon locally rights to groups:

1. Select Start > Programs > Administrative Tools > Domain Controller Security Policy. The Default Domain Controller Security Settings console appears.

2. Expand Local Policies.

3. Click User Rights Assignment. The Default User Rights appears.

4. Select Deny log on locally.

5. Select Action > Properties. The Deny log on locally Properties dialog box appears.


The different options available on the Deny log on Locally Properties dialog box are:

> Define this policy setting - Enables the setting to deny logon locally

> Add User or Group - Includes the user or group to deny logon locally

6. Click Add User or Group. The Add User or Group dialog box appears.

7. Click Browse. The Select Users, Computers or Groups dialog box appears,

8. Enter the group name in the Enter the object names to select text area.

9. Click OK. Windows Server 2003 adds the group to the Deny log on Locally Properties.

10. Click Apply.

11. Click OK.

12. Click OK to close the Logon Workstations dialog box.

13. Click Apply in the Account tab of Steve Martins Properties dialog box.

Adding a Member to a Group

Consider a scenario where, you are the system administrator of the company. A user Steve Martins has to be allowed only limited rights on the domain. You must add Steve Martins to the Domain Guests group to restrict permissions to Steve Martins.

To add Steve Martins to the domain guests group:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of groups appears.

3. Select Domain Guests.

4. Select Action > Properties. The Domain User Properties dialog box appears.

The options available in the Domain Guests Properties dialog box are:

> Group name(pre-Windows 2000) - Specifies the name that clients using earlier versions of Windows 2000 use to identify the group

> Description - Provides an explanation about the group

> E-mail - Specifies the email address for the group

> Group scope - Specifies the scope of the group

> Group type - Specifies the type for the group

> Notes - Specifies additional information for the group

5. Click the Members tab. The Members tab appears.

6. Click Add. The Select Users, Contacts, or Computers dialog box appears.

7.Enter the domain user name, Steve Martins, in the Enter the object names to select text area.

8.Click OK. Windows Server 2003 adds the user to the group.

9. Click Apply. Windows Server 2003 saves the changes.

10. Click OK.

Managing Domain Groups

You can create groups to mange permissions for a set of users. You can also change the scope of the group. In addition, you can also change the group type. You can secure the domain by adding members to groups. You can manage the groups on the domain by executing tasks, such as adding a member to a group, modifying the group type and scope, assigning user rights to groups, and deleting a group.

Creating a domain group

Windows Server 2003 enables you to assign permissions to users on the domain by creating groups. You can create groups and add users to the group. After adding the users to the group, you can assign permissions to the group. The group permissions are applied to all the users in the group.

To create a domain group:

1. Select All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Built in. The list of groups appears.

3. Select Action > New > Group. The New Object - Group dialog box appears.

The different options on the New Object - Group dialog box are:

> Group name - Specifies the name for the group

> Group name (pre-Windows 2000) - Specifies the group name for computers using a version earlier than Windows 2000

> Group type - Enables to select the group type. Windows Server 2003 supports two types of groups. They are:

• Security: Assigns permissions for Active Directory objects and user rights. In addition to Active Directory objects, security groups also assign permissions for resources on the network.

• Distribution: Enables you to send e-mail to all the users using a single email address. The distribution type of group creates e-mail distribution list in MS-Exchange Server.

> Group scope - Determines the extent to which the permissions are applied to users and groups in the domain. Windows Server 2003 supports universal scope, they are:

• Universal Scope - Assigns permissions to all the objects in the domain under the forest. The universal group can contain user accounts, computer accounts. It also contains global and universal groups from other domains in the forest. You can create groups with universal scope
only when the functionality level of the domain is set to Windows 2000 native and Windows Server 2003.

• Global Scope - Determines that the group can assign permissions to all the objects in the domain under the same forest. A global group can contain only user accounts and global groups of the same domain. You can change a global group to a universal group if the global group is not a member of other global groups in the domain.

• Domain Local Scope - Implies that the group can assign permissions to objects in the same domain only. The domain local groups can contain user and computer accounts from the same domain. It can also contain user and computer accounts from other domains in the same forest. You can convert a domain local group to a universal group if the group does not contain other domain local groups as members.

4. Enter the group name, Sales, in Group name text box.

5. Select the group scope, for example, Domain local.

6. Select the group type, for example, Security.

7. Click OK. Windows Server 2003 creates the domain group and adds it to the Active Directory Users and Computers.

Default Domain Groups

The Active Directory service in Windows Server 2003 configures the Windows Server 2003 computer as a domain controller. The Active Directory service creates default groups to configure and manage the domain. The default groups are created under built in and the users container in the Active Directory Users and Computers console. In addition, the Active Directory service also creates default domain groups under Active Directory Users and Computers console. You can move the groups, under Users container, from one location to another.

Domain Groups under Built in container
You cannot move the groups, under built ins, from one location to another. The default domain groups under built ins container are:

> Administrators - Enables complete and unrestricted access to the domain controller. The members of the Administrator group can manage users in the domain. The administrators can add, delete, and move users and groups in the domain. The Domain Admins and the Enterprise Admins are the members of the Administrators group.

> Operators - Enables to administer domain user accounts and groups. The members of this group own the permissions to log on locally to the domain controller and shut down the domain controller. However, they are restricted from modifying the administrators and Domain Admins group.

> Backup Operators - Enables to perform backup and restoring files and folders on the domain. The members of this group override the deny permissions of other groups for the backup and restore process. The members of this group also possess the rights to log on locally to the domain and shut down the domain.

> Guests - Assigns very restricted rights to the members. The members of this group have read only access on the domain and network resources. The members in the guests group are further restricted access to critical system areas, such as, % System Root % drive and the system properties.

> Network Configuration Operators - Enables users to modify the network configuration, such as TCP/ IP settings on the domain. The members of this group are assigned administrative privileges to modify the network settings.

> Print Operators - Enables users to manage printing operations on the domain controller in the domain. The printing operations include tasks, such as, installing and configuring, and sharing printers. The members of this group can log on locally and shut down the domain controller.

> Remote Desktop Operators - Enables users to remotely access the domain controller. By default user are not permitted to access the domain controller from a remote location. The members of the remote desktop operators group override the permissions to remotely access the domain controller.

> Server Operators - Enables to execute administrative tasks on the domain controller. The administrative functions include tasks, such as, creating shares and managing services. The server operators can also shut down the domain controller on a domain. However, the server operators do not possess the administrative privileges on the domain.

> Users - Enables the users of the group to execute common tasks on the domain, such as running applications, using printers and network shares. The users are restricted from making changes to the
system configuration on the domain controller.

> Incoming Forest Trust Builders - Enables to create one-way trust relationships between domain,controllers in the domain.

> Replicator - Enables the users of the group to execute replication tasks, such as file and folder replication on the domain controller.

Domain Groups under Users Container

In addition to the built ins container, Windows Server 2003 also provides default groups under Users in the Active Directory Users and Computers console. They are:

> Domain Admins - Enables complete access to the domain controller on the domain. This group is a member of the Administrators group by default.

> Domain Computers - Contains all the clients and servers attached to the domain controller in the domain. The computer becomes a member of the Domain Computers group when you attach a computer to the domain.

> Domain Controllers - Contains all the domain controllers in the domain. A domain can contain more than one domain controller. All the domain controllers in the domain are added to the domain controller group by default.

> Domain Users - Contains all the domain users on the domain. All the domain users in the domain are added to the domain users group by default.

> Enterprise Admins - Enables complete and unrestricted access over the domain controller in the domain. The Enterprise Admins group is a member of the administrators group by default.

> Schema Admins - Enables the members of the group to modify the schema. The Active Directory on a domain controller consists of a schema. The schema contains configuration information about the
Active Directory service. The members of the Schema Admins group possess the rights to modify the schema of the Active Directory on the domain.

> Cert Publishers - Possess permissions to issue digital certificates for Users and Computers. There are no default users in the Cert Publishers group.

> Group Policy Creator Owners - Determines the security level for the group. Members of the Group Policy Creator Owners possess the permissions to create and modify the group policy for any object in
the domain controller on the domain.

> Domain Guests - Contains all the guests accounts in the domain. Every domain has a guest account.The domain guests group contains user accounts of the domain guests. All the domain guests in the domain are added to the domain guests group by default.

> RAS and lAS Servers - Possess permissions to access the remote properties of the domain controller in a domain.

Domain groups

The user account stores information about the user. The user information includes the user name, password, and the logon name. The user account validates the user when the user logs on to a Windows Server 2003 domain. The user account verifies the user name and password of the user and enables access to the network resources. You can create domain groups in Windows Server 2003 to simplify the managing users on a domain. When you add users to the group, 9ou can assign permissions to all the users in the group. A group can contain user accounts, computer accounts, and users. The group scope and group type determine the objects in a group.

WORKING WITH DOMAIN GROUPS

Windows Server 2003 enables you to create domain groups and add domain users to these groups. A domain group contains user accounts that enable users to access the domain resources. You can ad domain user accounts to domain groups to ensure security. Windows Server 2003 creates a computer account when you add the computer to a domain. You can add users to domain groups to restrict access to the domain. When you add a user to a group, the user is assigned permissions of the group.