Skip to content

README.md

Latest commit

 

History

History
37 lines (25 loc) · 2.43 KB

README.md

File metadata and controls

37 lines (25 loc) · 2.43 KB
Raw

IFT220_Lab4

This lab is about Group Policies and Fine-Grained Password Policies.

Deliverable

  • The deliverable for the lab is the completed "IFT220 Lab4 Worksheet" from this repo

Overview

  1. Create a GPO to configuring time synchronization for all computers in the domain.
  2. Create a GPO to configure default password policy for users in the domain.
  3. Create a FGPP to force Privileged Users (Users with administrator access) to have longer passwords than normal users.

Time Synchronization

  • As you read in Chapter 2, "Active Directory is highly dependent on all of the domain controllers and domain members having synchronized clocks" (Desmond, B., Richards, J., Allen, R., & Lowe-Norris, A. G. (2013). Active Directory (Fifth). O’Reilly Media.).
  1. We're following the "Configuring the Windows Time service to use an external time source" section at https://support.microsoft.com/en-us/help/816042/how-to-configure-an-authoritative-time-server-in-windows-server and using this list of peers 0.pool.ntp.org,0x1 1.pool.ntp.org,0x1 2.pool.ntp.org,0x1 3.pool.ntp.org,0x1 in step 4.
    1. If you are running VirtualBox, here's how to disable time sync on your VM https://superuser.com/questions/984040/how-to-disable-time-sync-with-windows-7-as-host-os-in-virtualbox/984041

Default Password Policy

  1. Create a GPO in your domain and link it to your domain. Configure the Account Policies/Password Policy as follows:

    Policy Setting
    Maximum password age 90 days
    Minimum password age 10 days
    Minimum password length 10 characters
    Password must meet complexity requirements Enabled
    Store passwords using reversible encryption Disabled

Fine-Grained Password Policy

  • Sparky Technologies is concerned about security and knows that if an administrator account is hacked it will be a nightmare, so they want to make all Privileged Account holders have stronger (longer) passwords then normal users.
  • The Information Security Officer found https://blogs.technet.microsoft.com/canitpro/2013/05/29/step-by-step-enabling-and-using-fine-grained-password-policies-in-ad online and wants you, the AD Lead, to implement it on the domain with a minimum password of 17 characters and a maximum password age of 30 days.
  • She knows it should be applied to the IT group, but wants to know if there are other Privileged Accounts outside of the IT group.