Managing Users, Computers, and Groups in C#.NET

Printer Code 3 of 9 in C#.NET Managing Users, Computers, and Groups

15

Monday morning she received an error message stating that her account has expired and that she should see her systems administrator. Which of the following commands could you issue to allow Oksana to log on to the domain A. dsmod user cn=Oksana,ou=users,dc=Contoso,dc=com -acctexpires never B. dsmod user cn=Oksana,cn=users,dc=Contoso,dc=com -acctexpires never C. dsmod user cn=Oksana,cn=users,dc=Contoso,dc=com mustchpwd yes D. dsmod user cn=Oksana,cn=users,dc=Contoso,dc=com -disabled no E. dsmod user cn=Oksana,ou=users,dc=Contoso,dc=com -disabled no

15-49

Correct Answers: C A. Incorrect: The Logon Failed dialog box appears only if a password reset disk has been created for an account on the local computer. The domain user account is not involved in this problem. B. Incorrect: The Logon Failed dialog box appears only if a password reset disk has been created for an account on the local computer. The domain computer account is not involved in this problem. C. Correct: The password reset disk is created for local user accounts and can be used when a user is trying to access a local computer account with the incorrect credentials, as in this case. D. Incorrect: The computer s connection to the network or any network interaction does not cause the Logon Failed dialog box to appear.

Correct Answers: B A. Incorrect: The user s password would not affect the computer account, as the icon indicates, in Active Directory. B. Correct: The password between the laptop and the domain computer account has become unsynchronized and must be reset. C. Incorrect: This would solve the problem but might cause other problems if there are permissions set on resources for this laptop computer. Also, this process would take much more time than a computer password reset. D. Incorrect: This would compound the problem by having not only unsynchronized passwords, but also mismatched SIDs.

Correct Answers: A A. Correct: Password policies apply domain-wide. The only method by which users can have separate password policies is if their user accounts reside in different domains. A child domain does not inherit the password policy of its parent domain. B. Incorrect: Password policies apply domain-wide. Password policies applied at the OU level do not override the password policies set at the domain level. If you take this set of steps, the password policies will remain as they did before at the domain level. C. Incorrect: Password policies apply domain-wide. Password policies applied at the site level do not override the password policies set at the domain level. If you take this set of steps, the password policies will remain as they did before at the domain level.

15-50

15

D. Incorrect: Password policies apply domain-wide. Password policies applied at the local level do not override the password policies set at the domain level. If you take this set of steps, the password policies will remain as they did before at the domain level.

Correct Answers: B A. Incorrect: The contoso.com root domain password policy has no influence on Rooslan s account. B. Correct: Even though Rooslan logs on to computers in the engineering.fabrikam .com domain, the domain that hosts his account controls his authentication and stores his password. C. Incorrect: The fabrikam.com root domain password policy has no influence on Rooslan s account. D. Incorrect: The engineering.fabrikam.com domain password policy has no influence on Rooslan s account.

Correct Answers: B A. Incorrect: The default user s container is referenced as cn=users rather than ou=users. B. Correct: The above command changes Oksana s user account expiration from the end of her contract to never, allowing her to log on to the network. C. Incorrect: The problem exists with the expiration date on Oksana s account. There is no reason to force her to change her password. D. Incorrect: The problem is not that Oksana s account has become disabled, but that it has expired. It can be renewed only by changing the expiration date to sometime in the future or by setting the account to never expire. E. Incorrect: The user s container can be referenced only as cn=users rather than ou=users. Another problem is not that Oksana s account has become disabled, but that it has expired.

16 Managing and Maintaining Access to Resources (3.0)

Access to resources requires proper identification and proper permissions. There is no additional configuration to be done to access files across a network than to make sure that the resource is accessible (shared) and that the user has appropriate permissions to accomplish the desired action (read, write, delete, and so on). This transactional process of analyzing the user s access token involves reading the entries on the access control list (ACL) of the resource and comparing the list with the security identifiers (SIDs) on the token. If the security services governing the resource access process determine that the combination of SIDs and their permissions is sufficient to perform the requested task, permission and access is granted; if not, access to the resource is denied. Such permission-based access is accomplished by the operating system based upon the file system that is installed on the storage device where the resource resides. On a FAT32 file system, for example, even if the operating system version is Microsoft Windows Server 2003, permissions cannot be set at the file system level: NTFS file system (NTFS) permissions are required for this type of permission assignment. Share permissions, however, can be set regardless of the file system on which the resources are stored. The operating system alone controls the share permissions, which are valid for any entity attempting to access the resource from across the network. Terminal Services provides a different type of access to resources in that it presents a local environment to the user over the network. The creation and use of this virtual local environment requires additional permissions and configuration, but the resource access to files and folders is still governed by network (share) and file system (NTFS) permissions. The understanding of these additional configuration needs and possibilities is key to the proper use of Terminal Services.