Active Directory Users & Groups with Folder Permissions Server 2008

Set or remove permissions for a printer

1. Open Printers and Faxes.
   
2. Right-click the printer for which you want to set permissions, click Properties, and then click the Security tab.
   
3. Do one of the following:
   
   
   • To change or remove permissions from an existing user or group, click the name of the user or group.
     
   • To set up permissions for a new user or group, click Add. In Select Users, Computers, or Groups, type the name of the user or group you want to set permissions for, and then click OK to close the dialog box.
     
4. In Permissions, click Allow or Deny for each permission you want to allow or deny, if necessary. Or, to remove the user or group from the permissions list, click Remove.
   

Notes

• To change device settings, you must have the Manage Printers permission. For information about printing security permissions, see Related Topics.
  
• To open Printers and Faxes, click Start, and then click Printers and Faxes.
  
• To view or change the underlying permissions that make up Print, Manage Printers, and Manage Documents, click the Advanced button.
  
• A printer must be shared in order for the permission settings to affect the users and groups listed.
  
• You can also view the permissions assigned to you by clicking the group you belong to on the Security tab. For information on finding out what group you belong to, see Related Topics.

Install AD LDS on Windows Server 2008 and Windows Server 2008 R2

1. After you finish installing the operating system, a list of initial configuration tasks appears.
   To install AD LDS, in the list of tasks, click Add roles, and then click Active Directory Lightweight Directory Server.
2. After you add the AD LDS server role to your server, you can create an AD LDS instance. To create an AD LDS instance, click Start, point to Administrative Tools, and then click Active Directory Lightweight Directory Services Setup Wizard.

Active Directory Delegation Control wizerd

Adding Delegated Permissions with the Wizard

1. Open the Active Directory Users and Computers console.
2. Right-click the All Users OU and choose Delegate Control, as shown in Figure 1. Click the Next button to advance past the wizard's welcome page.

3. On the wizard's Users or Groups page, click the Add button.
4. In the Select Users, Computers, or Groups dialog box, enter the group's name (Password Reset), click the Check Names button to make sure the group's name is correct, and click OK, as shown in Figure 2.

Figure 2: Entering the Group's Name

5. After making sure the group's name is listed on the Users or Groups page, click Next, as shown in Figure 3.

Figure 3: Making Sure the Group's Name Is Listed

6. On the Tasks to Delegate page, select Reset user passwords and force password change at next logon and click Next, as shown in Figure 4.

Figure 4: Selecting the Tasks to Delegate

7. Verify the information in the final page of the wizard and click Finish.

When you click the Finish button, the Delegation of Control Wizard adds the requested permissions to the All Users OU. You can view the effects of the delegation by right-clicking the All Users OU, choosing Properties, and selecting the Security tab. (If the Security tab isn't visible, enable the Advanced Features option on the View menu of the Active Directory Users and Computers console.) For a detailed view, you can click the Advanced button. Figure 5 shows the Advanced Security Settings dialog box that appears.

Figure 5: Reviewing the DACL for the All Users OU

Enable the default policy

• Do not perform these steps if you plan to create a common or custom remote access policy, described next.

1. To enable the default policy, do one of the following:
   
   
   • If you use Windows authentication, on the answering router open Routing and Remote Access, and, if necessary, double-click Routing and Remote Access and the server name. (Use Windows authentication for a site-to-site only connection.)
   • If you use RADIUS authentication, on the IAS server open Internet Authentication Service, and, if necessary, double-click Internet Authentication Service. (Use either Windows or RADIUS authentication if the answering router for the site-to-site connection also supports remote access users.)
2. In the console tree, click Remote Access Policies. In the details pane, right-click the default policy Connections to Microsoft Routing and Remote Access server, and then click Properties.
3. Select Grant remote access permission. (The default selection is Deny remote access permission.)

Install Computer and User Certificates for EAP-TLS

When you use EAP-TLS as the user authentication method for your site-to-site connection, you must install a computer certificate on the authentication server of the answering router and a user certificate on the calling router. These steps are the same for a dial-up router and for a VPN router.

For information about how to deploy certificates required by EAP-TLS, see Deploying certificate-based authentication for demand-dial routing in Help and Support Center for Windows Server 2003.

Install Computer Certificates for L2TP/IPSec

If you use an L2TP/IPSec site-to-site connection, you must install a computer certificate on both the answering router and on the calling router. You must have a certification authority (CA) in your network to issue these certificates.

You can install a computer certificate for L2TP/IPSec by using one of three methods:

• Configure the automatic enrollment of computer certificates in a Windows Server 2003 domain system container by using Group Policy.
  
• Use the Certificates snap-in to request a computer certificate.
  
• Use your Web browser to connect to the CA Web enrollments pages to request a certificate.
  

Note

• It is also possible to use a preshared key to provide authentication for IPSec security associations for an L2TP/IPSec connection. However, using computer certificates is the recommended method.
  

For information about how to create a certificate infrastructure and install computer certificates, see Certificate Services in Help and Support Center for Windows Server 2003, and see "Designing a Public Key Infrastructure" in Designing and Deploying Directory and Security Services of this kit. For more information about configuring a preshared key, seeConfigure a pre-shared key for a demand-dial routing interface in Help and Support Center for Windows Server 2003.

Packet filters for L2TP/IPSec

Separate input and output packet filters can be configured on the Internet interface and the perimeter network interface.

Filters on the Internet interface

Configure the following input packet filters on the Internet interface of the firewall to allow the following types of traffic:

• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 500 (0x1F4).
  
  This filter allows IKE traffic to the VPN server.
  
• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 4500 (0x1194).
  
  This filter allows IPSec NAT-T traffic to the VPN server.
  
• Destination IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).
  
  This filter allows IPSec ESP traffic from the VPN client to the VPN server.
  

Configure the following output packet filters on the Internet interface of the firewall to allow the following types of traffic:

• Source IP address of the VPN server's perimeter network interface and UDP source port of 500 (0x1F4).
  
  This filter allows IKE traffic from the VPN server.
  
• Source IP address of the VPN server's perimeter network interface and UDP source port of 4500.
  
  This filter allows IPSec NAT-T traffic from the VPN server.
  
• Source IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).
  
  This filter allows IPSec ESP traffic from the VPN server to the VPN client.
  

There are no filters required for L2TP traffic at the UDP port of 1701. All L2TP traffic at the firewall, including tunnel maintenance and tunneled data, is encrypted as an IPSec ESP payload.

Important

• An IPSec NAT-T deployment for Windows that includes VPN servers that are located behind network address translators is not recommended. When a server is behind a network address translator, and the server uses IPSec NAT-T, unintended behavior might occur because of the way network address translators translate network traffic.
  

Filters on the perimeter network interface

Configure the following input packet filters on the perimeter network interface of the firewall to allow the following types of traffic:

• Source IP address of the VPN server's perimeter network interface and UDP source port of 500 (0x1F4).
  
  This filter allows IKE traffic from the VPN server.
  
• Source IP address of the VPN server's perimeter network interface and UDP source port of 4500.
  
  This filter allows IPSec NAT-T traffic from the VPN server.
  
• Source IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).
  
  This filter allows IPSec ESP traffic from the VPN server to the VPN client.
  

Configure the following output packet filters on the perimeter network interface of the firewall to allow the following types of traffic:

• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 500 (0x1F4).
  
  This filter allows IKE traffic to the VPN server.
  
• Destination IP address of the VPN server's perimeter network interface and UDP destination port of 4500 (0x1194).
  
  This filter allows IPSec NAT-T traffic to the VPN server.
  
• Destination IP address of the VPN server's perimeter network interface and IP Protocol ID of 50 (0x32).
  
  This filter allows IPSec ESP traffic from the VPN client to the VPN server.
  

There are no filters required for L2TP traffic at the UDP port of 1701. All L2TP traffic at the firewall, including tunnel maintenance and tunneled data, is encrypted as an IPSec ESP payload.

Important

• An IPSec NAT-T deployment for Windows that includes VPN servers that are located behind network address translators is not recommended. When a server is behind a network address translator, and the server uses IPSec NAT-T, unintended behavior might occur because of the way network address translators translate network traffic.

Join the Router to the Domain

After you install the Windows Server 2003 operating system on the computers that you want to use as the calling and answering routers, you can join the routers to the Active Directory domain.

If you have a calling router that is located in the branch office, and you already have a domain controller in the branch office, join the router computer to the domain there.

If you do not have a domain controller at the branch office yet, you can install the Windows Server 2003 operating system on the computer that you want to use as the calling router while that computer is located in the main office, join the computer to the domain, and then ship it to the branch office.

Note

• Alternatively, you can set up the routers to dial in once, install Active Directory on the computer in the branch office that you want to use as the domain controller, replicate, and then join the routers to the domain.

Configure the connection to the local intranet (Router)

1. Install a LAN adapter connected to the intranet.
   
2. On the LAN adapter’s Internet Protocol (TCP/IP) Properties page, configure the following:
   
   
   1. The public or private IP address and subnet mask that your network administrator assigned.
      
   2. The IP addresses of the DNS and WINS name servers for your organization’s intranet.
      
3. Typically, leave the default gateway value on the LAN adapter blank to avoid default route conflicts with the default route pointing to the Internet.
   
   Note
   
   
   • If a router is positioned between the demand-dial router that you are configuring and the intranet, the Routing and Remote Access Wizard might not be able to add the demand-dial router to the list of valid remote access servers in the Active Directory. One workaround to this problem is to temporarily configure the default gateway on the LAN adapter. To do this, enter a value for the default gateway, run the Routing and Remote Access and Demand-Dial Interface wizards (as described later), and then remove the default gateway from the LAN adapter.
     

Do not configure the intranet interface of the router to be a DHCP client. However, an answering router can still use DHCP to obtain IP addresses for calling routers, and vice versa.

Configure the DNS server IP acdress (if needed)

If you have a VPN connection, configure the DNS server IP address on the Internet-connected interface of the calling router if either of the following is true: 

• If you use the DNS name of the answering router (instead of its IP address), you must specify the DNS server IP address in the Internet-connected interface of the calling router. Because the Routing and Remote Access Wizard clears the Register this connection’s addresses in DNS check box (on the DNS tab) and selectsDisable NetBIOS over TCP/IP (on the WINS tab), you must configure the DNS server IP address on the VPN Internet-connected interface after you run the wizard.
  
• If the branch office calling router will provide users access to the Internet (in addition to supporting site-to-site traffic to the main office), you must specify the DNS server IP address in the Internet-connected interface of the calling router. For more information about configuring access to the Internet, see "Configure Internet Access Through the Calling Router" later in this chapter.

Configure the WAN adapter for a dedicated link from a VPN router to an ISP

1. On the demand-dial router at each site, install the Internet-connected WAN adapter. This WAN adapter is a DDS, T1, Fractional T1, or Frame Relay adapter.
   
2. On the WAN adapter’s Internet Protocol (TCP/IP) Properties page, configure the following:
   
   
   1. The public IP address and subnet mask allocated to you by your ISP (or by the InterNIC).
      
   2. The default gateway of the firewall (if you plan to have the router connect to a perimeter network) or of the ISP router (if you plan to have the router connect directly to the Internet).

Configure the WAN adapter for a dial-up connection

1. On the demand-dial router at each site, install the WAN adapter. This WAN adapter is a modem, an ISDN adapter, or other physical device connected to one of the following:
   
   
   • For a non-VPN dial-up connection, the line that links the two sites.
     
   • For a VPN with a dial-up connection to the local ISP, the line that links the branch office router to its local ISP.
     
2. Provide the phone number and the authorized user name and password. Leave the Domain field blank. The phone number is one of the following:
   
   
   • For a non-VPN dial-up connection, the phone number of the answering router.
     
   • For a VPN that uses a modem, ISDN, or PPPoE dial-up connection to its local ISP, the phone number of the local ISP.

Add router user accounts to a group

1. Open the Active Directory Users and Computers snap-in, create an Active Directory group to contain the user accounts of the calling routers. Use an appropriate name, such as BranchOfficeRouters.
   
2. Add the user accounts of the calling routers to the group.

Create an Active Directory user account for a router

1. Open the Active Directory Users and Computers snap-in, and create a user account for the calling router (for a two-way connection, create a user account for the calling router in both sites). The name of the account must match the name of a corresponding demand-dial interface on the remote router.
   
2. To ensure that connectivity occurs, clear the User must change password at next logon check box and select the Password never expires check box on the Account tab on the property sheet for the user account object.
   
3. On the user account Dial-in tab, select one of the following options:
   
   
   • Allow access. This option overrides the grant or deny remote access permission setting specified on the Properties page of any associated remote access policy.
     
   • Control access through Remote Access Policy. This option ensures that the grant or deny remote access permission setting specified on the Properties page of any associated remote access policy is used.

Deploy a Certificate Infrastructure

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

If you plan to use EAP-TLS as your authentication protocol for user-level authentication on a dial-up, PPTP VPN, or L2TP/IPSec VPN connection, or if you plan to use L2TP/IPSec with computer certificates for your VPN connection, or if you plan to do both, you must have a certificate infrastructure in place in your network.

For information about creating a certificate infrastructure, see Certificate Services in Help and Support Center for Windows Server 2003, and see "Designing a Public Key Infrastructure" in Designing and Deploying Directory and Security Services of this kit.

Deploy a domain controller for a new branch office site

• This procedure assumes that both sites belong to the same Active Directory domain.
  

1. Install the Windows Server 2003 operating system on a computer at the main office, promote it to a domain controller, and then confirm that it successfully replicates with the existing domain controllers.
   
2. Log on as a member of either the Domain Administrators or Enterprise Administrators security group of the forest root domain, open Active Directory Sites and Services, right-click Sites, select New Site, type a name for the new branch office site, and then, under Link Name, select the appropriate site link (such as DEFAULTIPSITELINK).
   
3. Right-click the server object of the new branch office domain controller from its current location (which might be under Default-First-Site-Name), click Move, and then, in the Move Server dialog box, click the new site that you just created.
   
4. Right-click Subnets, click New, and then click Subnet to create a new child for the new remote site, providing the appropriate network ID and subnet mask.
   
   Note
   
   
   • If, until now, your domain has had only one site, you must create two child objects under Subnets — one for the main office site and one for the branch office site, each with its own network ID and subnet mask.
     
5. If necessary to optimize network performance, make the domain controller a global catalog.
   
6. Ship the new domain controller to the remote site.
   
7. Install a LAN adapter connected to the branch office intranet, and then, on the LAN adapter’s Internet Protocol (TCP/IP) Properties page, configure an IP address, subnet mask, and gateway appropriate for the branch office subnet.
   

The domain controllers in the main and branch offices cannot replicate yet, because the demand-dial connection does not exist yet. For information about how to configure replication after a connection exists, see "Configure Replication for Active Directory" later in this chapter.

Confirm reciprocal replication over a one-way initiated on-demand connection

1. On the branch office domain controller, create a user account called TestReplication.
   
2. On the calling router in the branch office, establish a connection to the answering router in the main office.
   
3. Wait 15 to 20 minutes, and then open Active Directory Users and Computers on a domain controller in the main office. If your connection is working correctly, the TestReplication user account will be listed.
   
4. To confirm that replication did in fact take place over the one-way initiated site-to-site connection, perform the following steps:
   
   
   1. On both the calling router and the answering router, type ipconfig at a command prompt. If, when you ran the Routing and Remote Access wizard, you chose the recommended option to configure IP address assignment from a specified range of addresses, the output of both ipconfig commands will include IP addresses from the specified address ranges.
      
   2. On the branch office domain controller, type tracert at a command prompt. If, when you ran the Routing and Remote Access wizard, you configured IP address assignment from a specified range of addresses, the output of the tracert command will include an IP address from the specified range that the answering router assigns to the calling router.

Enable reciprocal replication on a site link for a one-way initiated on-demand connection

1. On a domain controller, type adsiedit.msc in the Run dialog box to open the ADSI Edit snap-in.
   
2. Expand the Configuration container, expand the Sites container, expand the Inter-Site Transports container, and then click CN=IP.
   
3. In the details pane, right-click the site link object for the sites for which you want to enable reciprocal replication, and then click Properties.
   
4. In the Attributes box, double-click Options.
   
5. In the Integer Attribute Editor dialog box, take one of the following actions:
   
   
   1. If the Value box displays <not set>, type 2.
      
   2. If a value is displayed, convert the integer value to a binary value and use the binary OR operation to combine that value with the binary value 0010, and then type the integer value of the result in the Value box.
      
      For a job aid that includes a table of examples showing how to perform this operation, see "Example: Contoso Connects Remote Sites" (DNSREM_1.doc) on theWindows Server 2003 Deployment Kit companion CD (or see "Example: Contoso Connects Remote Sites" on the Web at http://www.microsoft.com/reskit).
      

Alternatively, you can enable reciprocal replication on a connection, instead of on a site link.