CNET 222 Lab 3 Windows Server Users & Groups

Centennial College
Information and Communication Engineering Technology

Course: CNET 222

Lab 3: Managing Users and Groups in

Windows Server

Instructions:

• Create a new Microsoft Word document

• Take screen shots where specified in the lab manual and paste
them into your Word document in the correct order.
• Make sure each image shows all the required information
including your virtual machine name as well as date and time of
the host computer.
• Total number of screen shots: 6 + 4

F. Shafique Page 1 of 20
CNET 222 Lab 3 Windows Server Users & Groups

Active Directory Users and Computers

Power on the Windows Server virtual machine you created in lab 1.

Open the Active Directory Users and Computers console by either:

1. Start→Administrative Tools→Active Directory Users and Computers
OR
2. From the Server Manager click Tools→Active Directory Users and Computers

F. Shafique Page 2 of 20
CNET 222 Lab 3 Windows Server Users & Groups

Exercise 1. Creating New Organizational Units (OUs)

Creating new organizational units within the domain OU makes it easier to manage users
and groups that were created after installation based on the structure of the organization.
It allows for separation of built-in accounts from accounts created by the administrator. We
will start by creating a new OU with the name of our internal domain. Within this we will
create three more OUs for computers, users and security groups.
1. Right-click the top-level OU, in this case shafique.local and click New→Organizational
Unit.

2. Enter your last name in all capitals as the name for the OU, e.g. SHAFIQUE. Click OK. The
new OU should show in the list on the right.

F. Shafique Page 3 of 20
CNET 222 Lab 3 Windows Server Users & Groups

3. Now right-click the new OU you created, and create the following three OUs within it
one at a time:
a. Computers
b. Users
c. Security Groups

The final Organizational structure should be like that in the following figure.
Take screen shot #1 of the new OUs created.

F. Shafique Page 4 of 20
CNET 222 Lab 3 Windows Server Users & Groups

Exercise 2. Creating New Users

We will create all new users in the shafique.local\SHAFIQUE\Users organizational unit.
1. Navigate to the correct OU. Right-click this OU and click New→User.

2. Enter the user information according to the diagram below. Click Next.

3.

F. Shafique Page 5 of 20
CNET 222 Lab 3 Windows Server Users & Groups

4. Enter the password: Pa$$w0rd and check the box for Password never expires. Click
Next.

5. Verify the information is correct then click Finish to create the new user. It should
appear in the list of users now.

F. Shafique Page 6 of 20
CNET 222 Lab 3 Windows Server Users & Groups

6. You can view and set the properties for this user by right-clicking the user and clicking
on Properties.

7. In the properties window, click on the Account tab. Click on Logon Hours…
Select all of Sunday and select the radio button for Logon Denied. Repeat the same for
Saturday to deny logon for Steve on both Saturday and Sunday.
Take screen shot #2 of the Logon Hours for Steve Red.
Click OK to close both the Logon Hours for Steve Red and Steve Red Properties windows.

F. Shafique Page 7 of 20
CNET 222 Lab 3 Windows Server Users & Groups

8. You can also reset the password for Steve from this console. Right-click Steve and click
Reset password…
9. In the new password and confirm new password textboxes type Pa55w0rd and click
OK.
10. Create another user with the following information:
a. First name: Harry
b. Last name: Potter
c. Username: hpotter
d. Password: Pa$$w0rd
Take screen shot #3 showing the new users.

11. You can work with the properties of multiple users. Select both the new users and then
right-click and click Properties.

F. Shafique Page 8 of 20
CNET 222 Lab 3 Windows Server Users & Groups

12. A subset of the properties is visible. We will set the Office and Organization information.
Check the box beside Office in the General tab and enter A2-30 in the textbox.
13. Click to the Organization tab. Check the box beside Department and enter ICET in the
textbox. Check the box beside Company and enter Centennial College in the textbox.
Take screen shot #4 of the Organization information. Click OK.

Exercise 3. Creating New Groups

We will create all new groups in shafique.local\SHAFIQUE\Security Groups.
1. Navigate to the correct OU.
2. Right-click on Security Groups. Click New→Group.

F. Shafique Page 9 of 20
CNET 222 Lab 3 Windows Server Users & Groups

3. Enter the following:

a. Group name: Management
b. Group scope: Domain
c. Group type: Security
Click OK.
4. The group should appear in the console.
Take screen shot #5.

5. To add members to the group, right-click the group name and click Properties.
6. Click on the Members tab. The members should list should be empty. Click on Add. In
the object names text box type: sred; hpotter then click Check Names. Once the names
are verified click OK.

F. Shafique Page 10 of 20
CNET 222 Lab 3 Windows Server Users & Groups

7. Take screen shot #6 of the group members.

Click OK to close the group properties. Close the Active Directory Users and Computers
Console.

F. Shafique Page 11 of 20
CNET 222 Lab 3 Windows Server Users & Groups

Lab Challenge. Active Directory Administrative Center

The ADAC is a new feature introduced in Windows Server 2012. It provides a new interface
for managing users and groups. It also offers some additional features that are not a part of
the Active Directory Users and Computers interface, such as fine-grained password
policies. It can be accessed directly from the Server Manager by clicking Tools→Active
Directory Administrative Center.
You start off at the Overiew.

F. Shafique Page 12 of 20
CNET 222 Lab 3 Windows Server Users & Groups

Exercise 1. The Interface

1. From the Overview, you can directly reset the password for any user. Under Reset
Password, enter shafique\sred as the user name (be sure to use your domain name in
place of shafique). Give the password Pa$$w0rd. Uncheck the User must change
password at next log on. Click Apply.

2. You can customize the display and add new navigation nodes to the left pane. Click
Manage on the top right and click Add Navigation Nodes … (or right-click a blank
space on the left pane and click Add Navigation Nodes…)

F. Shafique Page 13 of 20
CNET 222 Lab 3 Windows Server Users & Groups

3. Navigate to the new OU created in the Active Directory Users and Computers Console
and add the Users and Security Groups nodes (refer to image above). Click OK.
Take screen shot #7 of the new nodes in ADAC.

Exercise 2. Creating a new User

1. In the ADAC navigation pane, open the Users container you just added in the previous
exercise (shafique-SHAFIQUE-Users). In the Tasks pane on the right, click New→User.

F. Shafique Page 14 of 20
CNET 222 Lab 3 Windows Server Users & Groups

2. Create a new user with the following information:

a. First name: your first name
b. Last name: your last name
c. User name: firstname initial + lastname
d. Password: Pa$$w0rd
e. Other password options: Password never expires
You can view and edit properties from the ADAC as well. Click OK.
Take screen shot #8 of the new user after it is created.

Exercise 3. Creating a New Group

1. Open the Security Groups container you added to the navigation pane in Exercise 1. In
the Tasks pane on the right, click New→Group.

F. Shafique Page 15 of 20
CNET 222 Lab 3 Windows Server Users & Groups

2. Enter the following group information:

a. Group name: Helpdesk
b. Group scope: Domain local
c. Group type: Security
3. To add members, click on Add under the Members section. Enter the username of the
user you created in Exercise 2 above, then click OK.
Take screen shot #9 showing the properties of the new group (including members).

Exercise 4. Creating a New Fine-Grained Password Policy

You can use fine-grained password policies to specify multiple password policies within a
single domain and apply different restrictions for password and account lockout policies to
different sets of users in a domain. For example, you can apply stricter settings to
privileged accounts and less strict settings to the accounts of other users. In other cases,
you might want to apply a special password policy for accounts whose passwords are
synchronized with other data sources.

F. Shafique Page 16 of 20
CNET 222 Lab 3 Windows Server Users & Groups

1. In the ADAC navigation pane, open the shafique(local)→System container and then
click Password Settings Container.
2. In the Tasks pane, click New→Password Settings.

3. Fill in or edit fields inside the property page to create a new Password Settings object.
The Name and Precedence fields are required. Enter the information according to the
figure below.

F. Shafique Page 17 of 20
CNET 222 Lab 3 Windows Server Users & Groups

4. UnderDirectly Applies To, click Add. Type hpotter, click Check and then click OK. This
associates the Password Policy object with the hpotter user.
Take screen shot #10 showing the new Password Policy Object Settings.
Click OK to submit the creation.

5. To delete the password policy you just created, click Password Settings Container.
Click the CNET222Lab2 password policy, and in the Tasks pane click Properties.

F. Shafique Page 18 of 20
CNET 222 Lab 3 Windows Server Users & Groups

6. Uncheck the Protect from accidental deletion and click OK.

7. Select the fine-grained password policy, and in the Tasks pane click Delete. Click OK in
the confirmation dialog.

8. Close all windows.

F. Shafique Page 19 of 20
CNET 222 Lab 3 Windows Server Users & Groups

Submit your Word Document to the correct Assignment Folder.

Shut down you Virtual Machine

Make sure you have all your work on your external USB hard disk.

You are done!

F. Shafique Page 20 of 20