Lab A: Implementing an Organizational Unit Structure Answer Key
Exercise 1 Creating Organizational Units
In this exercise, you will use the Dsadd command-line tool to create the organizational units in your domain. Task 1
! Use the Dsadd command line utility to create the Accounting and
Research organizational units 1. Log on as Nwtradersx\ComputerNameUser with a password of P@ssw0rd 2. At the command prompt, type dsadd ou organizationalunitDN -desc "description of the organizational unit" -d YourDomain -u Administrator -p P@ssw0rd and then press ENTER. 3. Repeat step 2 for each organizational unit. 4. At the command prompt, type exit, and then press ENTER.
Lab A: Implementing an Organizational Unit Structure Answer Key
Exercise 2 Delegating Administrative Control
In this exercise, you will use Active Directory Users and Computers to create groups, add global groups from the nwtraders.msft domain to the groups that you create, and then delegate control of each organizational unit to the appropriate group. Task 1
! Create the following domain local groups in the ComputerName\IT
organizational unit: DL AccountingAdmins DL ResearchAdmins
1. Log on as Nwtradersx\ComputerNameUser with a password of P@ssw0rd 2. Use Run as to start Active Directory Users and Computers as YourDomain\Administrator with a password of P@ssw0rd 3. In the console tree, expand your domain, expand the YourComputerName organizational unit, and then click IT. 4. Right-click IT, point to New, and then click Group. 5. In the Group name box, type the name of the group that you are creating, click Domain local, and then click OK. 6. Repeat steps 4 and 5 to create the other domain local group. Task 2
! Add the G ComputerNameAdmins global group to
DL AccountingAdmins and DL ResearchAdmins 1. In the console tree, expand your domain, and then click IT. 2. In the details pane, right-click DL AccountingAdmins, and then click Properties. 3. On the Members tab, click Add. 4. In the Select Users, Computers or Groups dialog box, type Nwtraders\G ComputerNameAdmins and then click OK twice. 5. Repeat steps 2 through 4 to add the Nwtraders\G ComputerNameAdmins global group to the DL ResearchAdmins local group.
Error! No text of specified style in document.
Task 3
! Delegate the ability to create, delete, and manage user accounts in the
Accounting and Research OUs 1. In the console tree, click YourComputerName. 2. In the details pane, right-click Accounting, click Delegate control, and then click Next. 3. Click Add. 4. In the Select Users, Computers or Groups dialog box, type DL AccountingAdmins, and then click OK. 5. On the Users or Groups page, click Next. 6. On the Tasks to Delegate page, click Delegate the following common tasks, select the check box next to Create, delete, and manage user accounts, and then click Next. 7. On the Completing the Delegation of Control Wizard page, click Finish. 8. Repeat steps 2 through 7 to delegate control of the Research OU to the DL ResearchAdmins group. 9. Close Active Directory Users and Computers.
Lab A: Implementing an Organizational Unit Structure Answer Key
Exercise 3 Verifying Delegation of Control
In this exercise, you will verify that the DL AccountingAdmins and DL ResearchAdmins groups have been assigned the appropriate permissions to the Accounting OU and the Research OU. Task 1
! Enable the Advanced Features view in Active Directory Users and
Computers 1. Log on as Nwtradersx\ComputerNameUser with a password of P@ssw0rd 2. Use Run as to start Active Directory Users and Computers as YourDomain\Administrator with a password of P@ssw0rd 3. In Active Directory Users and Computers, click View, and then ensure that the Advanced Features is selected.
Task 2
! View the permissions assigned to the DL Accounting Admins and
DL ResearchAdmins groups 1. In the console tree, expand your domain, and then click YourComputerName. 2. In the details pane, right-click Accounting, and then click Properties. 3. On the Security tab, click Advanced. 4. In the Permission entries box, double-click each entry for the DL AccountingAdmins local group. What permissions are assigned to the DL AccountingAdmins group, and what objects do the permissions apply to? The DL AccountingAdmins group is assigned Full Control permissions for all user objects and Create User Objects and Delete User Objects permissions for this object and all child objects. 5. In the Advanced Security Settings for Accounting dialog box, click OK. 6. In the Accounting Properties dialog box, click OK. 7. In the details pane, right-click Research, and then click Properties. 8. On the Security tab, click Advanced. 9. In the Permission entries box, double-click each entry for the DL ResearchAdmins local group. What permissions are assigned to the DL ResearchAdmins group and what objects do the permissions apply to? The DL ResearchAdmins group is assigned Full Control permissions for all user objects and Create User Objects and Delete User Objects permissions for this object and all child objects. 10. In the Advanced Security Settings for Research dialog box, click OK. 11. In the Research Properties dialog box, click OK. 12. Close Active Directory Users and Computers.
