Certification Authority Web Enrollment vs Certificate Enrollment Web Services

Certification Authority (CA) Web Enrollment service was released in the Windows 2000 operating system. CA Web Enrollment allows client computers to submit PKCS #10 requests to the CA interactively through a web browser and Internet Information Services (IIS) application. For example, when this role service is installed, users in the contoso.com domain could enter http://ca.contoso.com/CertSrv, in their web browser and see an interactive web site that allows them to upload requests, download completed certificates, and download certificate revocation lists (CRLs).

Although CA Web Enrollment and Certificate Enrollment Web Services both use HTTPS, they are fundamentally different technologies. CA Web Enrollment provides a browser-based interactive method of requesting individual certificates that does not require specific client components or configuration. CA Web Enrollment only supports interactive requests that the requester creates and uploads manually through the web site. For example, if an administrator want to provision a certificate to an Apache Web server running the Linux operating system, a PKCS #10 request that was created by using OpenSSL could be uploaded. After the CA issued the request, the certificate could be downloaded by using the browser.

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service focus on automated certificate requests and provisioning by using the native client starting with the Windows 7 and Windows Server 2008 R2 operating systems. The end user does not have to make a request manually or interact with a web site.

Certificate Enrollment Web Services and CA Web Enrollment are complementary technologies. CA Web Enrollment supports certificate requests and a broad set of client operating systems. The Certificate Enrollment Web Services offer automated requests and certificate provisioning for client computers starting with the Windows 7 and Windows Server 2008 R2 operating systems.

Refer to: Certificate Enrollment Web Services in Active Directory Certificate Services

AD DS Auditing

In Windows Server 2000 and Windows Server 2003, Active Directory audit logs can show you who made changes to what object attributes, but the events do not display the old and new values. For example, the audit log can show that Administrator modified Domain Admin group members attribute in the directory, but it cannot show what Administrator changed or what the attribute was after the change. With the new auditing feature came from Windows Server 2008, you can log events that show old and new values.

Before the new feature applied, security event log 4662 was generated.

Administrator changed the value of Domain Admins group, but you could not see the value before and after the change.

After the new AD DS auditing applied:
# auditpol /set /subcategory:"directory service changes" /success:enable

One more event log 5136 generated.

The log showed that it was a add operation and which member was added.

List of some AD DS auditing events:

5136	A directory service object was modified.
5137	A directory service object was created.
5138	A directory service object was undeleted.
5139	A directory service object was moved.
5141	A directory service object was deleted.

Loopback Policy Processing

Your manager asks you to configure the computers in the training room. It is required to provide a single, consistent user experience for any student who logs on to the systems. Some details are listed: a specific desktop wallpaper, prevent users from accessing registry editing tools, and disable the password-protected screen saver.

You may implement the system as:
1. Create a global security group - Training Computers, and add all relevant computer objects to the group.
2. Create a group policy - Training Computer Configuration.  Configure the settings in User Configuration, and filter helps you to easier find the entry you need. Configure the loopback processing mode value in Computer Configuration.
3. Remove the default Authenticated Users in Security Filtering for Training Computer Configuration policy, and add Training Computers and Domain Users.
(It is an underdocumented fact that when you combine the loopback processing
with security group filtering, the application of user settings during policy refresh uses the credentials of the computer to determine which GPOs to apply as part of the loopback processing, but the logged-on user must also have the Apply Group Policy permission for the GPO to be successfully applied.)
4. Link the Training Computer Configuration policy to Client OU.

What must you do to prevent the domain’s screen saver policies from applying to
training room computers?
5. In delegation of the policy applied to the domain, add the Training Computers group and click deny Apply group policy.

Note: If the wallpaper correctly set by group policy, but you can't actually see the wallpaper, refer to the topic posted on Microsoft forum.

Refer to: Loopback processing of Group Policy, explained, very awesome explanation.

Fast Logon Optimization

By default in Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows XP, the Fast Logon Optimization feature is set for domain and workgroup members. Policy settings apply asynchronously when the computer starts and when the user signs in. As a result, these operating systems do not wait for the network to be fully initialized at startup and sign-in. Existing users are signed in by using cached credentials. This results in shorter sign-in times. Group Policy is applied after the network becomes available.

With Fast Logon Optimization, enabled Group Policy foreground processing runs asynchronously. When a CSE requires synchronous processing:

• Policy settings do not apply during the asynchronous processing cycle.
• The CSE that requires synchronous policy application can still be called during asynchronous policy application. Instead of applying policy settings, the CSE signals for synchronous processing to be applied at the next startup or sign-in.

When synchronous policy application is required and Fast Logon Optimization is enabled, it can take up to two reboots or two sign-ins for the policy settings to apply. This is demonstrated in the following examples.

• Example 1: Fast Logon Optimization with synchronous processing when the user is not signed in. A user is not signed in to the client computer when a change is made to user policy settings, and synchronous processing is not requested. In this case, the policy settings are applied after two sign-ins.
• policy settings changed 
• -> user signs in
• -> group policy engine determines the change and call client-side extensions 
• -> CSE determines that it requires synchronous processing and exits without applying the policy
• -> CSE signals to the group policy engine that synchronous processing is needed for the next sign-in 
• -> second sign-in 
• -> group policy engine determines that CSE did not completely process the policy settings during the last sing-in session 
• -> group policy engine calls the CSE and the CSE determines that group policy is processing synchronously and applies the policy settings.

• Example 2: Fast Logon Optimization with synchronous processing when the user is signed in. A user is signed in to the client computer when a change is made to user policy settings, and the user stays signed in to the computer so that background processing takes place prior to sign-out. In this case, the policy settings are applied after one sign-in.
• user signed in
• -> policy setting changed
• -> group policy background processing ((((
• -> the group policy engine determines the change and calls the CSE
• -> the CSE determines that it requires synchronous processing and exits
• -> the CSE signals to the group policy engine that synchronous processing is needed for the next sign-in
• -> subsequent background refreshes will call CSE as well, but CSE exits because it still requires synchronous processing. )))
• -> next sign-in
• -> group policy process synchronously and the group policy engine determines that CSE did not complete processing during the last sign-in session
• -> group policy engine calls the CSE and the CSE applies the policy settings

Group Policy settings or scripts that are applied during startup or shutdown might not be applied on computers that are running Windows 8.1 or Windows 8 because, by default, these computers are not fully shut down by the Shut down command. Instead, the computer enters a hibernate state. Full shutdown only occurs when the system is set to reboot or when a pending software update or other event causes the computer to process a full shutdown. You can use the Restart Computer command in Windows 8.1 and Windows 8 to achieve startup or shutdown on client computers.

If you do not want fast startup to apply to computers in your enterprise, you can apply a GPO that disables the Computer Configuration/Policies/Administrative Templates/System/Shutdown/Require use of fast startup policy setting. Be aware that disabling this policy setting results in full shutdowns and longer startup times for client computers. The enabled state of the Require use of fast startup policy setting does not take precedence over any Group Policy setting that disables hibernation.

Also, you can disable Fast Logon Optimization by using the following policy: Administrative Templates\System\Logon\Always wait for the network at computer startup and logon.

See More details

Resetting a computer account when the trust with the domain is lost

If the trust with the domain is lost, do not remove a computer from the domain and rejoin it. Instead, reset the secure channel. Removing and rejoining is not a good practice because it has the potential to delete the computer account altogether, which loses the computer’s SID and, more importantly, its group memberships. When you rejoin the domain, even though the computer has the same name, the account has a new SID, and all the group memberships of the previous computer object must be re-created.

Four ways to reset a computer account:

1. Active Directory Users And Computers snap-in
2. dsmod computer "Computer DN" -reset.

#1 and #2 require rejoining to domain and restarting computer.

3. netdom reset MachineName /domain DomainName /UserO UserName /PasswordO {Password | *}
4. nltest /Server:ServerName /SC_Reset:DOMAIN\DomainController

#3 and #4 are recommended because they reset the secure channel by attempting to reset the password on both the computer and the domain, so it does not require rejoining or restarting.

Restrict the AD users to join computers to the domain

By default, each authenticated AD user is allowed to create 10 computer objects in the default computer container. The quota is managed by the parameter ms-DS-MachineAccountQuota. It is highly recommended that you remove the ability by resetting the value to 0 in domain controller.

1. Open ADSI Edit from the Administrative Tools folder.
2. Right-click ADSI Edit and click Connect To.
3. In the Connection Point section, click Select A Well Known Naming Context, and then select Default Naming Context from the drop-down list.
4. Click OK.
5. In the console tree, expand Default Naming Context.
6. Right-click the domain folder—“dc=contoso,dc=com”, for example—and then choose Properties.
7. Select ms-DS-MachineAccountQuota and click Edit.
8. Type 0 and click OK.

You will see the below error message when you try to join the computer to the domain.

How to import user accounts

You are an administrator of a large university, and you have got a CSV file with all the information of new students next year. You need to create all users in AD four weeks before term starts, how you would do?

The file (students.csv) is like below -

name,sAMAccountName,GivenName,Surname
John Woods,john.woods,Johnathan,Woods
Kim Akers,kim.akers,Kimberly,Akers

PS C:\> import-csv ./students.csv | new-aduser -Path "OU=Students,OU=User Accounts,DC=contoso,DC=com" -AccountPassword (ConvertTo-SecureString -AsPlainText "********" -Force)

Students created and disabled for the moment.

You forget to add University property, then you need to -

PS C:\> dsquery user "OU=Students,OU=User Accounts,DC=contoso,DC=com" | dsmod user -company "XXX Univerisity"

How to create a user

How you would create a user in AD?

1. Template (Copy)

2. Dsadd

dsadd user "cn=Mike Fitzmaurice,ou=User Accounts,dc=contoso,dc=com"
-samid mike.fitz -pwd * -mustchpwd yes -company "Contoso, Ltd." -email
mike.fitz@contoso.com

3. CSVDE

newusers.txt -
DN,objectClass,sn,givenName,sAMAccountName,userPrincipalName
"CN=David Jones,OU=User Accounts,DC=contoso,DC=com",user,Jones,David,david.jones,david.jones@contoso.com
"CN=Lisa Andrews,OU=User Accounts,DC=contoso,DC=com",user,Andrews,Lisa,lisa.andrews,lisa.andrews@contoso.com

csvde -i -f newusers.txt -k

4. LDIFDE

newusers.ldf -
DN: CN=April Stewart,OU=User Accounts,DC=contoso,DC=com
changeType: add
CN: April Stewart
objectClass: user
sAMAccountName: april.stewart
userPrincipalName: april.stewart@contoso.com
givenName: April
sn: Stewart
displayName: Stewart, April
mail: april.stewart@contoso.com
description: Sales Representative in the USA
title: Sales Representative
department: Sales
company: Contoso, Ltd.
unicodePwd::IgBQAGEAJAAkAHcAMAByAGQAIgA=
userAccountControl:512

DN: CN=Tony Krijnen,OU= User Accounts,DC=contoso,DC=com
changeType: add
CN: Tony Krijnen
objectClass: user
sAMAccountName: tony.krijnen
userPrincipalName: tony.krijnen@contoso.com
givenName: Tony
sn: Krijnen
displayName: Krijnen, Tony
mail: tony.krijnen@contoso.com
description: Sales Representative in The Netherlands
title: Sales Representative
department: Sales
company: Contoso, Ltd.
unicodePwd::IgBQAGEAJAAkAHcAMAByAGQAIgA=
userAccountControl:512

ldifde -i -f newusers.ldf -k -h

Design Active Directory - 1

Suppose you are a system administrator of a global organization which has 3 different sites across the world. In each site, there is a tech-support team to handle daily computer tasks such as system installation, and there is a team in headquarters to deal with computer tasks across the company. Also, all users' requests would dispatch to any tech-support. How you design the AD?

One simple solution is like below -
Admins (OU)
    - Support HQ (Group)
    - Support B1 (Group)
    - Support B2 (Group)
    - Support B3 (Group)
    - Support All (Group)

Computers (OU) - Support HQ would be delegated control
    - B1 (Group) - Support B1 would be delegated control
    - B2 (Group) - Support B2 would be delegated control
    - B3 (Group) - Support B3 would be delegated control

User Accounts (OU) - Support All would be delegated control

Reset password failed and access denied

A common case in AD management is to set up a help desk group to handle simple management tasks, such as reset password. After you delegate the control of an OU to your help desk group and the user in help desk group failed to reset the password of the user in the OU, you probably need to check whether the "Include inheritable permissions from this object's parent" is checked or not for the OU user.

Install Active Directory Scheme snap-in

Active Directory Schema is one of AD Administration Tools, and it is for examining and modifying the definition of AD attributes and object classes. The schema is the blueprint for AD. However, it is rarely viewed and changed. Therefore, Schema snap-in is not installed by default.

To install the Active Directory Schema snap-in

1. Open Command Prompt.
2. Type: regsvr32 schmmgmt.dll
    This command will register Schmmgmt.dll on your computer.
3. Click Start, click Run, type mmc /a, and then click OK.
4. On the File menu, click Add/Remove Snap-in, and then click Add.
5. Under Available Standalone Snap-ins, double-click Active Directory Schema, click Close, and then click OK.
6. To save this console, on the File menu, click Save.
7. In Save in, point to the systemroot\system32 directory.
8. In File name, type schmmgmt.msc, and then click Save.

Actually, we can custom the console file and add more AD administration tools, such as -
Active Directory Users And Computer: Manage most common day-to-day resources, including users, groups, computers, printers, and shared folders. This is likely the most heavily used snap-in for an Active Directory administrator.
Active Directory Sites And Services: Manage replication, network topology, and related services.
Active Directory Domains And Trusts: Configure and maintain trust relationships and the domain and forest functional levels.