Windows Server 2019: Active Directory, GPO, R. Server Access

Compare workgroups and domains by showing how workgroups rely on local machine settings, while domains centralize management with Active Directory and group policy, enabling controlled logon, automation, and scalability.

Install Active Directory on server one using the add roles and features wizard, then promote it to a domain controller and learn the differences between domain, child domain, and forest.

Understand that a domain is the maximum administrative unit and a family of resources; Active Directory stores domain objects on domain controllers within a forest of root and subordinate domains.

Create a new forest in Windows Server 2019 Active Directory by configuring a domain controller, DNS, and forest and domain functional levels for a local infrastructure.

Create organizational units in Active Directory to organize domain objects by department, with separate users and computers for administration and sales, establishing structure for future group policies.

Create a domain user in the administration organizational unit using Active Directory users and computers, assign a unique login name, and set a temporary password with change-at-next-login.

Learn to add a Windows 10 computer to a Windows Server 2019 domain by configuring IP and DNS, verifying connectivity, and placing the machine in Active Directory.

Log off the local user, log in as the domain administrator, and remove the local user via the control panel to ensure only domain users can log in.

Learn to grant a temporary user a password without complexity using Active Directory password settings, create a profile with a length of three characters, and apply it to the user.

Link a global security group to a no-complexity password profile in Active Directory and verify multi-user assignment, enabling password change at next login for all group members.

Enable the Active Directory recycle bin to recover deleted objects, learn to purge it when needed, and test restoration by deleting and restoring a user in a domain.

Learn to create users from the command line in Active Directory with PowerShell, locating the accurate OU path and expanding from a single user to batch creation via a CSV.

Create a large set of Active Directory users by importing a CSV file with PowerShell, using Import-Csv and New-ADUser for each row, then verify in Active Directory Users and Computers.

Configure logon hours in Active Directory for users or groups via the account tab, setting allowed days and times such as Monday to Friday, 9 a.m. to 5 p.m.

Illustrates restricting logon to specific computers in Active Directory by adding a domain, moving the PC to an OU, and applying computer restrictions for a sales unit, using group policies.

Map a shared public folder for domain users, configure domain-only permissions with full control, and apply a mapped drive path via Active Directory users and computers and group policies.

Create a hidden domain users$ share and map each user's home folder with %USERNAME%, then remove inherited permissions and grant full control to domain users, ensuring subfolders are owner-restricted.

Map multiple folders for users with a startup script via group policies. Create a batch file using net use to map the public and files shares.

Add a second server to the domain in Windows Server 2019, configure network and DNS, rename the server, and join the domain for promotion to an additional domain controller.

If the first domain controller fails, clients won't automatically switch to the second. Set second server as primary DNS or add it as secondary DNS (192.168.100.11) to ensure login continues.

Explore how group policy objects (GPO) provide centralized management of user and computer settings in Active Directory, restricting actions, deploying software, and configuring wallpapers across organizational units.

Map folder sharing for domain users via a GPO, configuring a mapped drive to \\server1\public with the W letter, enable reconnect, and force policy updates.

Create a security group named GRP underscore administration in the administration OU, then share a hidden administration$ folder with that group and map it as drive K: via a GPO.

Block and release control panel access in a Windows Server 2019 domain using group policy objects, administrative templates, and gpupdate commands.

Deny the control panel GPO for the domain admins group using delegation, then run gpupdate /force to verify that the user administrator's control panel access is released.

Apply desktop wallpapers to the administration organizational unit and sales organizational unit by creating and linking GPOs, configuring wallpaper paths to the server one shared folder, and testing logon.

Apply group policy to domain computers and users to enforce an account lockout after three failed attempts within 60 minutes, with a five-minute reset, using Active Directory and GPO.

Apply a group policy to create a local C:\files folder and copy paper1.jpeg and paper2.jpeg to client machines from the server share.

Restrict sales users from logging onto administration organizational unit computers by creating the GRP_sales group and applying a deny log on locally policy in the administration organizational unit.

Deploy Google Chrome across the domain via a group policy, using a 64-bit msi, add to administration OU, enable domain computers security filtering, and force gpupdate.

Learn how to verify that group policies are applied on a domain machine using gpresult, distinguish applied from effective, and identify computer and user policy scopes with administrator access.

Demonstrates differentiating software deployment by architecture using WMI filters and separate group policies to install 64-bit and 32-bit Google Chrome, with a hands-on lab and testing steps.

Learn to install specialized software on Windows Server using group policies for compatible installers and PDQ Deploy for non-compatible mass installations, with LibreOffice and Office installation steps.

Install LibreOffice on selected domain computers using PDQ Deploy by creating an installation package, specifying the install file path, and deploying to Active Directory targets.

Learn to download and prepare Office 365 installation files with the Office Deployment Tool. Create 32-bit and 64-bit folders, edit XML configurations, and deploy via group policies or PDQ Deploy.

Edit 32-bit and 64-bit Office 365 XML files, move installation files to a shared folder, and create a domain group policy to run the install scripts.

Create a GPO in the sales OU to install Office 365 on 32-bit machines via startup script, adjust runtime and UAC privileges, and test with gpupdate /force.

Create and enforce a 64-bit Office 365 installation GPO for the sales OU, add a startup script, set a 3000-second wait, and apply a 64-bit WMI filter for testing.

Configure AppLocker via group policy to restrict program execution using executable rules, default rules, and blocking by publisher, path, or hash, then block Internet Explorer and test with gpupdate /force.

Block task manager for all domain users with a GPO named Disabled Task Manager, excluding admins. Configure Remove Task Manager under user policies and apply a deny to domain admins.

Navigate the group policy objects container to view policies, delete links, restore to an organizational unit, disable without deleting, permanently delete, and back up and restore policies.

Back up all group policies to a separate server by creating a hidden share \\ServerTwo\\Backup$\\GPO and using Group Policy Management to perform the backup, preparing for recovery.

Recover a group policy from backup by selecting the GPO in the Group Policy Objects container and confirming restoration, while noting that WMI filters and scripts aren’t restored automatically.

Learn to centralize server management by installing Windows Admin Center on a domain machine, log in as a domain administrator, and configure port 6516 for remote administration.

Connect to servers via Windows Admin Center, monitor bandwidth and usage, and remotely create and share a sales folder with the sales group; RSAT will be covered next class.

Install RSAT on the ADM one machine to enable remote server administration beyond Windows Admin Center, then use Windows administrative tools to manage Active Directory and group policies.

Learn to enable and use remote desktop connections to Windows Server 2019, grant admin access, and administer servers from any networked computer.

Connect a mobile device to a remote server via the Microsoft Remote Desktop app on the same wifi, then use ipconfig to find the second network card IP.

Learn how to delegate Active Directory management by assigning a department a limited scope using the delegation wizard to create, delete, and edit user accounts and reset passwords.

Audit domain users' log on and log on attempts, including password mishandling, using active auditing. Enable auditing via the Default Domain Policy and verify results in Event Viewer by username.

Apply a group policy to the sales organizational unit to audit file access in the public folder, logging create, edit, and delete events for GRP Underscore Sales users.

Schedule Windows Update via group policy (GPO) to minimize internet bandwidth and processing load by assigning update times to organizational units, such as sales, with a specific day and time.

Create a 150 GB dynamic virtual disk on server two, format as an MBR new simple volume labeled Windows update, to host downloaded updates.

Install Windows Server Update Services by adding the WSUS role, selecting database or SQL Server Connectivity, and saving updates to a folder named Updates with web server for client access.

Configure Windows Server Update Services by running the configuration wizard, synchronizing with Microsoft Update, selecting English updates (Windows 8.1), and enabling automatic approvals for network computers.

Create and enforce a GPO named Windows 8.1 Update to route updates through server two on port 8530, using a Windows 8.1 WMI filter and automatic update settings.

Define a 150 MB quota for the domain users folder with file server resource manager, applying the quota to existing and new subfolders, and test using PowerShell fsutil.

Block specific file types in user folders by creating file groups and templates, enable active screening with logs, apply to domain users, and verify results in the event viewer.

Use the storage reports tool to locate duplicate and large files on the file server and save disk space; the hands-on lab demonstrates generating a duplicate report.

Schedule this report with the file server resource manager for every Friday at noon to identify duplicate and large files over 80 MB in domain users and public folders.

Apply dfs namespace to consolidate multiple file shares under a domain-based folder, map drives via group policy, and simplify access to folders like worksheets, images, databases, and forms.

Learn how to configure dfs replication on Windows Server to continuously synchronize folders like worksheets, images, databases, and forms across two servers using a full mesh topology and bandwidth control.

Test replication between server one and server two by creating files in worksheets and forms folders, and verify files reach worksheets BCP folder and forms BCP folder.

Install Windows Server Backup, create a custom backup of server files and folders (public worksheets, images, domain users), and store it on a remote shared folder with administrator-only access.

Master restoring backups on Windows Server 2019 by selecting remote backup location, choosing the backup date, and recovering to disk C with the option to skip existing items.

Perform a full server backup by adding a new virtual disk, formatting it, and using Windows Server Backup to back up server to the local disk labeled server one backup.

Restore windows server 2019 from a virtual backup disk to a new virtual machine, then perform system image recovery to complete the restore.

Learn how to install and configure Internet Information Services (IIS) on Windows Server 2019 to host websites in a lab environment.

Test the IIS service on server 3, replace the provisional site by copying new files into inetpub/wwwroot, then test access by name as DNS configuration follows in the next class.

Learn how a DNS server resolves names to IPs by configuring forward lookup zones, creating hosts like www and intranet pointing to 192.168.100.13, and testing access.

Create a new primary dns zone named mybusiness.com, replicate to all domain controllers, and enable dynamic updates via Active Directory; then add a www host at 192.168.100.13 for local testing.

Host multiple websites on a single IIS server by creating site folders, a Mysite.com DNS zone, and hostnames w-w-w.mybusiness.com and w-w-w.mysite.com.

Understand DNS in Windows Server 2019, mapping IP addresses back to hostnames and configuring a primary reverse zone, including pointers, secure updates, and nslookup testing for email servers.

Configure the DNS forwarders on the internal server to use Google public DNS (8.8.8.8 and 8.8.4.4) for external name resolution.

Install and configure a basic email server on Windows Server 2019, enabling net framework 3.5 via alternate source path, and outline essential security and connectivity basics.

Install the mail server software, select the internal Microsoft SQL Compact database, set the password for accessing the email management software, and finish installation with the default start menu name.

Create two domain email accounts for Active Directory domain My business local, specify usernames and mailbox sizes, save settings in the accounts folder, and open firewall ports 25 and ten.

Install and configure the Mozilla Thunderbird email client on a domain user machine, set up manual POP3/SMTP on server three (port 110/25), verify firewall, and send a test email.

Learn how DHCP automatically delivers IP addresses to devices on networks. Install the DHCP server role on Windows Server 2019 and configure clients to obtain IPs.

Configure a DHCP scope in Windows Server 2019 to deliver IPv4 addresses for 192.168.100.0 network using the 255.255.255.0 mask, and set exclusions for fixed IP devices, gateway, and DNS.