Installing RSAT

Samba AD management from Windows

We need install Windows 2003 Adminpak into Windows XP in order to use GUI tools to manage the domain. Before you begin, make sure that the domain administrators have administrative rights to control your computer.(To give any user administrative rights in Windows XP Pro, right click My Computer, select Manage-> choose Groups-> double click Administrators and add members from domain into the member list. When you add members from Active Directory, it will prompt you to enter an Active Directory username and password).

Step 1: Installing Windows Remote Administration Tools onto Windows

Windows Vista/7/8

1. Download the Windows Remote Administration Tools from:
   • http://www.microsoft.com/downloads/details.aspx?FamilyId=9FF6E897-23CE-4A36-B7FC-D52065DE9960&displaylang=en (Vista)
   • http://www.microsoft.com/downloads/details.aspx?FamilyID=7D2F6AD7-656B-4313-A005-4E344E43997D&displaylang=en (Windows 7)
   • http://www.microsoft.com/download/details.aspx?id=28972 (Windows 8)
2. Follow the "Install RSAT" instructions

• Note: After installing, you have to enable the features in "Turn Windows features on or off" in "Programs" of the Control Panel!).

Windows XP Pro

Administration Tools Pack & Support Tools

1. Download adminpak and supporttools from:
   • http://www.microsoft.com/downloads/en/details.aspx?FamilyID=86b71a4f-4122-44af-be79-3f101e533d95
   • http://download.microsoft.com/download/3/e/4/3e438f5e-24ef-4637-abd1-981341d349c7/WindowsServer2003-KB892777-SupportTools-x86-ENU.exe

   If you installed an older version of the adminpak, you'll notice the dial-in tab is missing from property pages. Just follow the link above to get SP2 which does not have this issue.

2. Run through the installation.
3. Press start->run, type 'dsa.msc', if a window 'active directory users and computers' prompt up, it mean you had install adminpak it successfully. You can also find this at Start>Programs>Administrative Tools, which should have a lot more items now.
4. Go to c:\Program Files\Support Tools to check whether the support tools were installed correctly; if yes, then your XP workstation is ready to manage the Samba 4 Active Directory.

Group Policy Management Console

1. You may also find the Group Policy Management Console useful. You can download it from
   • http://www.microsoft.com/downloads/details.aspx?FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en

   This is primarily useful when you have larger installs and are managing many machines. You may need to download the .NET Framework first.

Step 2: Viewing Samba Active Directory Content

1. When logged on as a Domain Administrator, start the Active Directory Users and Computers Snap-In, either by clicking Start -> Programs\Administrative Tools\Active Directory Users and Computers, or by clicking Start -> Run 'dsa.msc'
2. Expand the samdom.example.com tree to see existing objects in the domain.

   

• Note: You can also manage users using the normal Windows AD user management tools.

Setting Up Roaming Profiles

See the Samba & Windows Profiles HowTo.

Adding Organization Units (OU) Into a Samba Domain

The Organizational Unit (OU) is a powerful feature in Active Directory. This is a type of container which allows you to drag & drop users and/or computers into it.

We can link several types of group policies to an OU, and the settings will push out to all users/computers that sit under the OU. Within a single domain, you can have as many OUs and sub-OUs as you'd like. The result is that it can greatly reduce administrative overhead since you are able to manage everything via an OU. The implementation of Group Policy will be discussed in the next chapter.

Before we create an OU, we must know what one looks like. By default we can see a sample OU called 'Domain Controllers', which uses a different icon in the Windows management tools than the 'users' and 'computers' containers. We can deploy Group Policy to the users or the computers container.

1. To create an OU as the Domain Administrator, click Start -> Run -> dsa.msc
2. Right click your domain.
3. Select New -> Organizational Unit
4. Type 'OU Demo'
5. You will see a new OU appear, with the name 'OU Demo'.
6. You can drag the user 'demo' into the new OU (Don't move other users! Unless you want to get stuck!).
7. Right click 'OU Demo', A sub-OU can be created with New -> Organizational Unit.

Normally OUs are created according to the department setup of your organization. Be careful not to confuse Groups and OUs. Groups are used to control permissions, OUs are used for deploying settings to all users/computers within the OU.

Implementing Group Policies (GPO) in A Samba Domain

Samba Active Directory has support for Goup Plicies, and can create the Goup Plicy on the fly. The basic idea of Goup Plicies is:-

1. Group Policies have two kinds of settings: computers and users.
2. Computer settings apply to computers, while user settings apply to users.
3. We link the group policy to a particular OU, and the group policy will effect all computers/users under the OU.
4. To add a group policy, right click 'OU Demo' OU->properties.
5. Choose group policy.
6. Press new, and name it as 'GP Demo'.
7. Press edit to modify the policy.
8. Here will demonstrate how to block users from access to the control panel. Open the tree 'User Configuration'->'Administrative Templates'->'Control Panel'.
9. Double click on 'Prohibit access to the Control Panel'.
10. Press enabled and then press OK. Now the all users under 'OU Demo' won't able to access to the control panel.
11. Make sure that the user 'demo' is inside the 'OU Demo' (You can drag and drop it).
12. Logout and login as user 'demo'.
13. You'll find user demo is not able to access control panel.

Notes

User configuration will take effect once you logout and login.

Computer configuration will take effect when you restart the computer.

GPO Password Policies are not read by Samba when assigning passwords, to change the policy that Samba uses you must use samba-tool domain passwordsettings

To learn more about managing and implementing organizational units, group policies, and Active Directory, try a web search for Google in Windows 2003 Active Directory implementation.