In this post we will perform two configurations on our Active Directory Domain Services instance: We’ll define security tiers which later become cornerstones of our privilege delegation principles and we’ll tune domain-joining parameters. Also a quick tweak for the DNS service.
Careful privilege delegation planning is very important when you work with information systems, especially when you work with Active Directory. Ideally, you should implement the least privilege model and split your network into separated security tiers. Several security tiers, though, can be managed by a single AD DS forest, if it is acceptable for the members of the Domain/Enterprise Admins groups to be able to acquire full access on resources residing in that forest.
Mind, that in an AD infrastructure, a forest is a security boundary, not a domain. A malicious Domain Administrator in any domain in a forest can hijack the Enterprise Admins group relatively easy. Learn more about it:
Every AD DS forest has a security tier, which we shall call “Tier 0”. This tier includes domain controllers, Domain/Enterprise/Schema admins groups, built-in Administrator group, Group Policy Creator Owners group etc. — basically, everything, which is not assigned to any other tier yet. Only members of Domain/Enterprise Admins groups should be able to modify Tier 0 objects.
In the real world, we do not erect AD DS domains to just leave them as is – we populate them with servers, users, workstations, DFS shares and other network resources. In medium and large enterprises, different people are responsible for different network services which usually means that you have at least one servers team, a help desk team etc. Of course, following the least privileges principle, all these people should not mess with each other’s resources, meaning helpdesk are not to configure servers and servers team should not have administrative permissions at users’ workstations.
How does one achieve that? By carefully assessing their resources and determining to which security tier would be best to assign each object.
Tier 1 – A set of servers/resources to which only a selected group of server administrators should have access.
The idea behind these optional tiers is that a machine owner with local admin rights will not be able to hijack an account which is also used to manage Active Directory objects.
Under Tiers 1, 2 and 3, I’ll organize a hierarchy to place computer, user and group objects into respective OUs. I will also place Tier 1 and Tier 2 OUs into a single OU for the sake of applying Group Policy to all my servers at once – the name of this OU is $Tiers12CombinedOUName.
There will be no OUs under the Tier 0 OU – due to the small number of objects of this type, I am cool with all them hanging together. Besides, there ARE several Tier 0 organizational units and containers already: everything not covered by other 3 tiers, including Domain Controllers OU and Users/Computers containers.
WTF is this “-f” technique and why not double quotes? This is the format operator and you can learn more about it here. Why not to use double quotes? Jonathan Angliss and Warren Frame have great coverage of this topic.
By default, in a fresh AD DS installation, any authenticated user can join up to ten computers into the domain — computer objects will be created in the default “Computers” container. While some might find this very convenient, the best practice is to manage and restrict such ability, because:
You cannot assign group policies to the default Computers container, meaning those computers will receive only GPOs linked to the root of the domain.
The lack of proper delegation: You cannot distinguish servers from workstations in that container and you certainly would like to, since usually we delegate different permissions to those computer types.
The common approach to deal with that is to set the ms-DS-MachineAccountQuota attribute to 0, preventing semi-automatic computer object creation. But it has no effect on user and group objects.
Forbid chaotic object creation by setting explicitly deny access control entry (ACE) at the OU. From there on, only delegated administrators will be able to create accounts, and they will be able to do it only in organizational units where they have appropriate permissions, meaning a HelpDesk administrator will not be able to place a workstation object along with servers.
Implement the classic approach to restrict computer creation operations by modifying the ms-DS-MachineAccountQuota attribute.
What happens here? The first command is obvious: we create an Active Directory OU. Then we set the Active Directory root as our current location. Why do we need it? Because *-Acl cmdlets can work with drives only, be it classic disk volumes or virtual drives as the one we have here for Active Directory.
Then we have several long commands with magic numbers inside. Let’s split these long rows to better understand what’s going on:
First, what we see here, is a Get-Acl cmdlet: We need it because Set-Acl cmdlet cannot change access control lists but only rewrite them with other objects of the System.Security.AccessControl.DirectoryObjectSecurity class. Therefore, we must create such object with all required access control entries separately. And when I’m saying “required”, I talk not only about new deny entries: the new object must contain all entries which are already set on the OU.
Get-Acl allows us to achieve this lazily, returning the object of the required type, containing all current access control entries. Mind that we do not store this object in a variable – instead we pass it down to the pipeline, to the ForEach-Object cycle (% is a standard alias for the ForEach-Object cmdlet). We need the cycle, because we will perform two operations on that ACL object and we cannot pipeline just to a scriptblock. Another solution would be to store the ACL object in a variable.
Write this modified object as a new access control list back into the OU properties with help of the Set-Acl cmdlet.
The Set-Acl command is quite straightforward, while the command just above it, is not: There we execute AddAccessRule method which adds an access rule (or access control entry) into the ACL object. The access rule is, of course, an object too — its class is System.DirectoryServices.ActiveDirectoryAccessRule. We construct the object using New-Object cmdlet. Each object in .NET (and PowerShell uses .NET objects since it is written in .NET) has a constructor with at least one overload. An overload defines what data you must use to create an instance of an object. You can find overloads for ActiveDirectoryAccessRule here.
I decided to use the most specific overload, the last one. For this overload we must define a security principal to which the rule will be applied, a set of rights which the security principal will have by this rule, whether those rights will be allowed or denied, to which objects the rule will be applied, will the rule be inherited or not and objects of which type will inherit it.
As you see, I use “CreateChild, Self, WriteProperty, DeleteTree, Delete” as the set of rights. Than I specify that those rights must be denied and should propagate to all objects under that OU and applied to the OU itself. Slightly more complex parts are those two GUIDs 00000000-0000-0000-0000-000000000000 — this means “objects of any type”. I append the GUIDs with the type decorator to convert them from strings into GUID-class objects on the fly.
Finally, to the first argument of ActiveDirectoryAccessRule creation command: Here we see another New-Object cmdlet. Why? Because the argument accepts objects of IdentityReference class only, therefore we cannot just type “Everyone” here. So how do we apply the rule to everyone? IdentityReference class is the base class for the NTAccount and SecurityIdentifier classes. Since “Everyone” is not a real account, we must use one of the SecurityIdentifier class constructors. Since “Everyone” is a well-known security principal, we’ll just use this one.
Thanks to the WellKnownSidType enumeration, we do not need to know the actual SID which stands behind the “Everyone” security principal — we’ll just use “WorldSid” as the value which represents the required principal. I left the second parameter as NULL since it is ignored for the most of well-known security identifiers.
Combining all this together we get the command shown above. Oh, and that semi-colon before the Set-Acl command is very important — it separates two commands when they are written in a single line. But useless when line breaks are used.
It consists of a single Set-ADObject cmdlet call which removes an element from multi-valued attribute wellKnownObjects and adds the different one back. wellKnownObjects attribute contains pointers to important Active Directory containers. Two of them are the default users container and the default computers container. Using this article, you can determine that we change the users container pointer here, because “A9D1CA15768811D1ADED00C04FD8D5CD” means GUID_USERS_CONTAINER_W.
The first (-Remove) parameter removes the current value. Since initially we do not know what this is, we request it from the $Domain object which we created at the beginning of this blog post using Get-ADDomain cmdlet. We concatenate two strings using the same “format operator” technics as discussed above. The resulted string is the one we must remove from the attribute.
Next, we add the new pointer, which points to the Redirected OU, which we created a couple of commands ago. No rocket science here, just two nested string concatenations.
Why do I explicitly point to the PDC emulator when writing the wellKnownObjects attribute back? Because the modification of this attribute actually takes place on the PDC emulator and you’ll receive an error “A referral was returned from the server”, if you try to run this command against non-PDC-e domain controller.
The last Set-ADObject cmdlet just ensures that even if wellKnownObjects parameters will be restored to the default settings, authenticated users still wouldn’t be able to join computers into the domain w/o pre-creating its accounts.
At last, the least important setting in this whole blog series: reverse lookup DNS-zone. It does not do anything useful, just makes your network traces easier for reading and understanding — you will see DNS-names there, instead of IP-addresses.
While I have a single subnet in this lab (at least for now), that command would be enough for me. Your environment, especially the production one, might be much more complex — create additional DNS zones if needed.
Mind that the subnet address in the $ReverseDNSZoneName variable is written in the reverse order. You can found more about “in-addr.arpa” suffix here.
When I was still smoking, anger and a smoke went hand and hand...as did many many things, emotions, you name it, any flux of emotions required a smoke for me.
As a non-smoker I deal differently with all of it. I learned, the smokes NEVER simplified or changed anything for those uncomfortable moments. They may have sedated the moment...but the problem was still there.
Nicotine is a vicious drug. It screws your mind into believing it's lies. Please please please learn about this, read about this, understand this. I so promise you ...that once you do,.....you will beat the addition because it will truly anger you to see what the drug Nicotine has on you....it will truly make your QUIT so much more desirable. Educating yourself on this addiction is SO KEY.
PLease read as many articles as you possibly can to inforce how Nicotine effects your brain. Please blog OFTEN. Please ask for help 24/7 here as needed.
The anger has dissipated a bit, but still flairs up. It is the nicotine leaving, but from inside me it feels like I am right, and no one is smart enough to see that I am right. And the anger grows, explodes, at the inability of anyone to see that I am right and the world is wrong. It is especially frustrating when it is a cup, or couch, or porch railing that is TOO STUPID to see that I am right and they are wrong!!!
You know what, from reading your posts, I sincerely think your gonna make it. You have a determination about you that so admirable. I really like your attitude, your 'get to the point' ability to muddle through the crappy times.. it's tuff Gregg, no doubt. I failed a lot before I finally did it. I will be praying you keep it up, your doing great my friend!
Thank you for sharing your story, I know the anger is all to real. I'm going on 10 weeks with out a puff, smoke free, praise GOD, but yes some days I am one angry woman and don't know how to deal with the anger, I just snap at family members but it doesn't help.
When you first quit smoking cold turkey the anger and mood swings were really bad for me, I thought I was going to hurt someone (not really, you know what I mean) figure of speech people. I had to learn how to stop fighting with my mind and start distracting my mind anytime a craving would hit. I was going to justify any reason to smoke when I first quit, how desperate my body and mind was addicted to the nicotine, yikes.
I still get a craving once in a while and I'm still dealing with mood swings but its not as bad, it does taper off, you have to make your mind up that you will not smoke no matter what, there will be no more excuses to ever smoke again, its not worth it.
My mom is 58 and was diagnosed this year with emphysema she has smoked all her life, she is now on an inhaler for her emphysema and she still smokes. I have watched a handful of people in my family die due to smoking cigarettes and not one of them quit, they smoked until the day they died, they all died in their 50's. Its a rude awakening but I don't want to die like that, I want to have an opportunity to live past the age of 60 and be in good health.
God Bless you on your journey, you can quit and break free of the addiction, stay positive and promise yourself everyday that you will not smoke for the next 24 hours!
Ditto, protect the quit... theres no other option for me. I was recently told have COPD, but that was before any actual testing. I recently had the testing and am waiting results. Getting scoped Wednesday. UGH! Love your attitude/quittatude:)
Would you keep us posted on your test results, and let us know how the scope goes. I'm praying for you!
Hi Katherine...yes I will keep everyone posted. Scope is being moved up a week because a friend of ours died and her funeral is Wednesday. So they hope to just do it the following week. Thanks for the prayers !
gregp136 and katherineu and Mandolinrain I think we were all so used to stuffing our uncomfortable feelings like anger, grief, stress, fear...whatever it may be that we have to learn that it really is okay to be angry some times. Clearly, it is not okay to hurt someone but if you snap at someone, an apology is usually pretty acceptable....I asked my family to try to understand, I am sure there were times when they wanted to punch ME. I had the misfortune of going through a terrible loss at ten months when I lost my home and my beloved cats but I let the tears come when they needed to and I realized that it was OTHER PEOPLE who were uncomfortable with me tearing up or crying, there was absolutely nothing wrong with me expressing that grief. I stuffed things for so long that I had forgotten how to let them out. Anger sometimes needs to come out, punch a pillow, go somewhere private and SCREAM, get in the water and punch like you are boxing under water, see your enemy as addiction and let it out when you need to. Stuffing is for teddy bears. My anger needs to come out and not get stuffed back in.
Today’s sales leaders are bombarded with digital information — about customers, transactions, and product mix — but how do they avoid information overload and access the right data to motivate and lead their teams and align their sales processes to the imperatives of their business?
Wharton and INSEAD sales and marketing faculty joined forces to offer one of the world’s first and most effective programs for sales executives — a program that links sales and corporate strategy with proven technologies and rich opportunities to apply learnings in real-world cases. Leading the Effective Sales Force leverages tools to improve sales performance, motivate teams, and grow revenue.
Wharton and INSEAD offer the program three times a year, at Wharton’s Philadelphia campus and INSEAD’s locations in Singapore and France. Ideal participants include chief sales officers, global sales managers, and other leaders who spend at least half of their time managing sales organizations.
“I have recommended this program to everyone at my level and to my boss. It was invaluable — a great combination of real data, real research, and then making it practical and applicable. It delivered ten-fold on my expectations.”
“They will be able to close more of their leads with less effort, while increasing their revenue and profits through improved deployment of their sales force,” notes Leonard Lodish, the program’s academic director and the Samuel R. Harrell Professor Emeritus in the Marketing Department at the Wharton School.
Lodish, who has been with the program since its inception, leads the sales force application workshop that includes training on specialized software that participants can use to forecast increases in profitability through better allocation of their sales resources. The tool has helped sales leaders increase revenue and profits from three to as much as 30 percent with no additional resources.
Kevin Podd, with LexisNexis in Denver, attended the June 2016 program in Philadelphia. He is employing the allocation software to better align his sales resources in the corporate Enterprise Legal Management sales group he leads for LexisNexis’s software division. “I’m using this tool to determine whether I want to strike a headcount in one division and reallocate it to another division as well as get funding for another spot. I ran the numbers and I expect to be able add about 10% in sales to my group,” he says.
V. “Paddy” Padmanabhan, Unilever Professor of Marketing, INSEAD-Singapore, and academic director of INSEAD’s newly established Emerging Markets Institute, will lead sessions focused on key account management, motivation and alignment, and how best to lead sales in the emerging market versus developed markets like North America.
“A big challenge for sales organizations is how to deliver on the expectations given what they have on the ground,” notes Padmanabhan. “This program helps leaders ensure they and their sales organizations can actually be more productive and deliver the results their companies are looking for.”
“We broaden participants’ horizons on what types of tools are available to them as a sales executive to use with their sales force,” adds Bob Davenport, a leading authority on sales compensation best practices who has been one of the instructors in this Wharton/INSEAD program for the past 15 years. According to Davenport, many organizations rely on what has worked in the past to determine sales pay. “We show leaders how they can structure their compensation to be most effective with individual sales roles,” he explains.
“I have recommended this program to everyone at my level and to my boss,” says Kevin Podd. “It was invaluable — a great combination of real data, real research, and then making it practical and applicable. It delivered ten-fold on my expectations.”
Below result forTranslee Feat Gfmbryyce on Exina.net. Download mp3 and videos that you want and it's FREE forever!