Day 7: Adding Roles and Scripts to Active Directory

More fun today! We began the day with an exercise to check the system functionality. Essentially we were to login to another team's workstation using one of the users created from yesterday ... ??? We did not complete this step yesterday, so this provided a starting point for the day. Review the exercises from the day before and find what we missed. This was it:
"Inside the Groups' container you will need to create two groups for your team that will use your team's members in the name. For example, 'Students Joe Pete', and 'Teachers Joe Pete' ... In the Students container create a user with a password and assign them to the group "Students xxx xxx" (the x's represent team names) that you've just set up. In the Teachers container create a user with a password and assign them to the group "Teachers xxx xxx" (the x's represent team names)."
Actually, now that I read that I am wondering if we created them in the correct container ... will have to check that again in the morning.

Once we had completed the activities from the previous day, we started on today's assignments. They included two mini exercises. The first was to create logon scripts using group policies. This is done through the Group Policy Management menu in the Administrative tools on the server. First you have to be sure to find and select the folder that you want to apply the policy to. This is important as the rule you make will apply to all folders under that file in the directory's hierarchy. Once we decided which container to apply the policy to, you can right click on the file [or container's] name and choose 'Create and link GPO here'.

A new menu appeared [titled 'New GPO'] and in it we named the policy. We were directed to name them "Login Script XXXX" where the Xs are replaced with our team name. When the script appeared in the directory, we right clicked it and choose 'Edit' so that we could define the policy. We then had to take this path to find the preset selection of policies we wanted to use. It is important to right click on the GPO and make sure 'enforce' is checked. This way your policy is activated, if you do not enforce it, your policy will not be implemented. You may choose to leave a policy as not enforced if you create them ahead of when you need them. This is the path we took:

In the cascading file system on the left, select: User Configuration >> Windows Settings >> Scripts [Logon/Logoff] 

We had to configure the policy and this took a lot of searching. The online help tutorials were helpful to certain points [we really like Daniel Petri's posts], but often they are not created by large network users, and so they are only helpful up to certain points. When this happens, we begin to 'guess and check' and when this proves to be not helpful, we ask the others how they are doing and what they are doing and if what they are doing is working ... we search for the answers using all the talent in the room and on the internet!

Another task for the day included creating a folder on the server that all the users would save their documents in. This is a basic step of creating a new folder, but then you have to be sure all your network users can access it. This is done by right clicking on the folder and choosing Sharing and Security > Sharing tab > Share this folder > Permissions > check the Read/Change boxes to allow all users the ability to read and change the documents in the folder.


Now that there is a place for our network users to store their documents, we had to create a path so that when they saved the document, it would be automatically saved to this file. To do this we had to map a drive. This was an interesting task. We first typed "net use s: \\ksserver\shared\" on a notepad document and then saved the file as 'login.bat' in the this folder path: C:\Windows\SYSVOL\sysvol\network5769\scripts\.  Now we have the file to save in and a way to get there. Now we have to redirect the documents to this file through this drive. This way our user's documents will be automatically saved through the root server to ours.

 Once again, we opened the Group Policy Management menu and created a new GPO in the correct file and named it accordingly.  When the policy appeared in the left hand file structure, we right clicked it, and edited  it through this path:

User Configuration >> Policies >> Window Settings >> Folder Redirection >> locate the folder on your server that you created for storing your user's files.

Now that all may have sounded easy, but believe me there were many moments of frustration and confusion. Finding the online materials with correct directions for our setting was not easy and things kept rolling along until I was sure we would never be able to catch up. EVER! However, many others in the class are having huge issues beyond their control and so I should celebrate the successes we have made. We did not get all tasks completed today. And we may not get through tomorrow's either. The patience of the instructor and the help from colleagues goes a long way to making this a worthwhile endeavour. 

Only three days left ...