1. LHG Inc. is a Dubai-based company providing luxury furniture items to customers around the globe through its retail stores chain and online portal. For providing round-the-clock services, the IT department has designated the LON-CL1 machine for general use by customers of the company. The customers can access details about their purchases, orders, and new products of the company. Recently, the management has expressed its concern over the security of the information stored in machines that are used for general purposes, such as LON-CL1. Eric, the Desktop Administrator, has been asked to ensure that the information in these machines is secure. To secure LON-CL1, Eric has identified the following tasks: The LON-CL1 machine should be easily accessible to customers. For this, the machine is kept in the reception area. As a result, the customers can gain access to domain resources. This can result in breach of some confidential company data. To prevent this unauthorized access to domain resources through LON-CL1, the machine should be in the Customer workgroup. Eric needs to manage this machine through a local administrator account. This local administrator account should have a different name that should not be guessed easily. Further, the guest account should also have a different name to enhance the security of the machine. In case a user enters wrong password three times, the machine should be locked for 20 minutes. The password of the local administrator account should not be less than five characters. How can Eric configure these settings? Experiment To accomplish the assigned task, Eric needs to perform the following tasks: Add the 20687B-LON-CL1 machine to the Customer workgroup. Configure GPO settings. Test GPO settings. Unlock the Admin account.
Task 1. Adding the 20687B-LON-CL1 Machine to the customer workgrou
to add the 20687B-LON-CL1 virtual machine to the customer workgroup. you need to perfrom the following steps:
1. Ensure that the Start screen is displayed.
2. Type system information.
3. select the system otion in the search pane.
4. click the system in the setting pane. the system window is displayed.
5. click the change setting link in the right pane. the system properties dialog box is displayed.
6. click the change button. the computer name/Domain change dialog box is displayed.
7. select the workgroup option in the Member of section.
8. type CUSTOMER in the Workgroup text box.
9. click the ok button. the computer name/Domain change dialog box is displayed.
10. click the ok button. After a few moments, the computer name/domain change message box is displayed with the message. Welcome to the CUSTOMER workgroup.
11. click the ok button twice.
12. click the clse button. the Microsoft windows dialog box is displayed.
13. click the restart now button. After a few moments, the lock screen is displayed.
14. Press the space bar.
15. click the Admin icon.
16. type Pa$$w0rd in the password text box.
17. press the enter key. the start screen is displayed.
Task 2. Configuring GPO setting.
to configure GPO setting in the 20687B-LON-CL1 virtual machine. you need to perfrom the following steps:
1. press the windows+C keys. the charms bar is displayed.
2. click search. the search charm is dislayed.
3. type mmc.exe in the apps text box. and then press the enter key. the user Account control dialog box is displayed.
4. click the yes button. the MMC window is displayed.
5. Maximiza the MMC window.
6. select the File--Add/Remove snap-in option from the menu bar. the Add or Remove snap-ins dialog box is displayed.
7. Select the Group policy object Editor option under the Snap-in column in the Available snop-ins list box.
8. Click the add button. the select Group policy object wizard is displayed.
9. click the Finish button. After a few moments, the Local computer policy option is displayed in the selected snap-ins list box.
10. click the ok button. the MMC window is displayed.
11. expand the local computer policy--computer configuration--windows settings--security setting--Account policies nodes.
12. select the password policy folder in the left pane.
13. Double-click the Minimum password lingth policy in the right pane. the Minimum password length properties dialog box is displayed.
14. type 5 in the password required spin box.
15. click the ok button.
16. select the Account Lockout policy folder in the left pane.
17. Double-click the Account lockout threshold policy in the middle pane. the Account lockout threshold propertie dialog box is displayed.
18. type 2 in the Account will not lock out spin box.
19. click the ok button. the suggested value changes dialog box diplayed.
20. click the ok button.
21. Double-click the Account lickout duration policy. the Account lockout duration properties dialog box is dislayed.
22. Type 20 in the Account is locked out for spin box.
23. click the ok button. the suggested value changes dislog box is displayed.
24. click the ok button.
25. Expand the local policies node under the security setting node in the lift pane.
26. select the security options folder in the left pane.
27. Double-click the Account: Adminstrator account status policy in the right pane. the Account: Administrator account status properties dialog box is displayed.
28. select the Enabled option.
29. click the ok button.
30. Double-click the Accounts: adiministrator account policy in the right pane. the Account: Rename administrator account properties dialog box is diplayed.
31. type secureadmin in the Account: Rename administrator account text box.
32. click the ok button.
33. Double-click the Account: Guest account status policy in the right pane. the Account: Guest account status properties dialog box is displayed.
34. select the Enabled option.
35. click the ok button.
36. Double-click the Accounts: Rename guest account policy in the right pane. the Account: Rename guest account properties dialog box is displayed.
37. type limiteduser in the Account: Rename guest account text box.
38. click the ok buttn.
39. clse the MMC window without saving any changes.
Task 3. Testing GPO settings
to test GPO setting in the 20687B-LON-CL1 virtual machine, you need to perform the following steps:
1. Open the command prompt window.
2. Type the gpupdate/ force command, and then press the Enter key. After a few moments, computer and user policies are udated successfully.
3. close the command prompt window.
4. press the windows_I keys. the setting the 20687B-LON-CL1 virtual machine is restarted. After a few moments, the lock screen is displayed.
5. click power, and then select restart, the lock screen is displayed.
6. Press the space bar. the Admin logn screen is displayed.
7. type Pa$$w0rd in the password text box.
8. press the enter key. After a few moments, the start screen is displayed.
9. click the admin tile. you will notice the Secureadmin and limiteduser accounts are displayed.
10. click the Secureadmin tile.
11. type Pa$$w0rd in the password text box, and then press the enter key.
12. click the secureadmin tile.
13. select the sign out option. the lock screen is displayed.
14. prees the space bar.
15. click the admin icon.
16. type Pa$$w0rd in the password text box, and then press the enter key.
17. Press the the ctrl+Alt_End keys.
18. select the change a password option. the change a password screen is displayed.
19. type Pa$$w0rd in the Old password text box.
20. type abcd in the new password and confirm password text boxes.
21. press the Enter key. the Change a password screen is displayed. you will notice that the password is not updated due to length requirements.
22. click the ok button. the change a password screen is dislayed.
23. type Pa$$w0rd in the Password text box.
24. type abcde in the new password and confirm password text boxes.
25. press the enter key. the change a password acreen is displayed. you will notice that the password is changed.
26. click the ok button. the start screen is displayed.
27. click the Admin tile.
28. select the sign out option. the lock screen is displayed.
29. press the space bar.
30. select the admin icon. the login screen is displayed.
31. type abcdr in the password rext box.
32. press the enter key. the password is incorrect message is displayed.
33. click the ok button.
34. type abcde in the password text box.
35. press enter key. the password is incorrect message is displayed.
36. click the ok button.
37. type abcde in the password text box, and then press the enter key. the refernced account is locked message is displayed.
38. click the ok button.
Task 4. Unlocking the Admin Account
to unlock the Admin account in the 20687B-LON-CL1 virtual machine. you need to perform the following steps:
1. click the switch user button.
2. click the Secureadmain icon.
3. type Pa$$w0rd in the Password text box.
4. press the Enter key. the Start screen is displayed.
5. type computer. the computer tile is displayed in the Apps screen.
6. Right-click the computer tile, and then select the Manage option in the bottom bar.The computer Management windiw is displayed.
7. Expand the Local Users and Groups node under the system Tools node in the left pane.
8. select the users folder. the user in the middle pane.
9. Right-click the Admin user in the middle pane.
10. select theproperties option. the Admin properties dialog box is displayed.
11. clear the Accont is locked out check box.
12. click the ok button.
13. close the computer Management window.
14. press the Windows key. the Start screen is displayed.
15. select the secureadmin tile.
16. select the sign out option. the lock screen is displayed.
17. press the space bar.
18. click the admin icon.
19. type abcde in the password text box, and then press the Enter key. After a few moments. the Start screen is displayed.
20. sign out and revert the 20687B-LON-CL1 and 20687B-LON-CL1 virtual machines.
to add the 20687B-LON-CL1 virtual machine to the customer workgroup. you need to perfrom the following steps:
1. Ensure that the Start screen is displayed.
2. Type system information.
3. select the system otion in the search pane.
4. click the system in the setting pane. the system window is displayed.
5. click the change setting link in the right pane. the system properties dialog box is displayed.
6. click the change button. the computer name/Domain change dialog box is displayed.
7. select the workgroup option in the Member of section.
8. type CUSTOMER in the Workgroup text box.
9. click the ok button. the computer name/Domain change dialog box is displayed.
10. click the ok button. After a few moments, the computer name/domain change message box is displayed with the message. Welcome to the CUSTOMER workgroup.
11. click the ok button twice.
12. click the clse button. the Microsoft windows dialog box is displayed.
13. click the restart now button. After a few moments, the lock screen is displayed.
14. Press the space bar.
15. click the Admin icon.
16. type Pa$$w0rd in the password text box.
17. press the enter key. the start screen is displayed.
Task 2. Configuring GPO setting.
to configure GPO setting in the 20687B-LON-CL1 virtual machine. you need to perfrom the following steps:
1. press the windows+C keys. the charms bar is displayed.
2. click search. the search charm is dislayed.
3. type mmc.exe in the apps text box. and then press the enter key. the user Account control dialog box is displayed.
4. click the yes button. the MMC window is displayed.
5. Maximiza the MMC window.
6. select the File--Add/Remove snap-in option from the menu bar. the Add or Remove snap-ins dialog box is displayed.
7. Select the Group policy object Editor option under the Snap-in column in the Available snop-ins list box.
8. Click the add button. the select Group policy object wizard is displayed.
9. click the Finish button. After a few moments, the Local computer policy option is displayed in the selected snap-ins list box.
10. click the ok button. the MMC window is displayed.
11. expand the local computer policy--computer configuration--windows settings--security setting--Account policies nodes.
12. select the password policy folder in the left pane.
13. Double-click the Minimum password lingth policy in the right pane. the Minimum password length properties dialog box is displayed.
14. type 5 in the password required spin box.
15. click the ok button.
16. select the Account Lockout policy folder in the left pane.
17. Double-click the Account lockout threshold policy in the middle pane. the Account lockout threshold propertie dialog box is displayed.
18. type 2 in the Account will not lock out spin box.
19. click the ok button. the suggested value changes dialog box diplayed.
20. click the ok button.
21. Double-click the Account lickout duration policy. the Account lockout duration properties dialog box is dislayed.
22. Type 20 in the Account is locked out for spin box.
23. click the ok button. the suggested value changes dislog box is displayed.
24. click the ok button.
25. Expand the local policies node under the security setting node in the lift pane.
26. select the security options folder in the left pane.
27. Double-click the Account: Adminstrator account status policy in the right pane. the Account: Administrator account status properties dialog box is displayed.
28. select the Enabled option.
29. click the ok button.
30. Double-click the Accounts: adiministrator account policy in the right pane. the Account: Rename administrator account properties dialog box is diplayed.
31. type secureadmin in the Account: Rename administrator account text box.
32. click the ok button.
33. Double-click the Account: Guest account status policy in the right pane. the Account: Guest account status properties dialog box is displayed.
34. select the Enabled option.
35. click the ok button.
36. Double-click the Accounts: Rename guest account policy in the right pane. the Account: Rename guest account properties dialog box is displayed.
37. type limiteduser in the Account: Rename guest account text box.
38. click the ok buttn.
39. clse the MMC window without saving any changes.
Task 3. Testing GPO settings
to test GPO setting in the 20687B-LON-CL1 virtual machine, you need to perform the following steps:
1. Open the command prompt window.
2. Type the gpupdate/ force command, and then press the Enter key. After a few moments, computer and user policies are udated successfully.
3. close the command prompt window.
4. press the windows_I keys. the setting the 20687B-LON-CL1 virtual machine is restarted. After a few moments, the lock screen is displayed.
5. click power, and then select restart, the lock screen is displayed.
6. Press the space bar. the Admin logn screen is displayed.
7. type Pa$$w0rd in the password text box.
8. press the enter key. After a few moments, the start screen is displayed.
9. click the admin tile. you will notice the Secureadmin and limiteduser accounts are displayed.
10. click the Secureadmin tile.
11. type Pa$$w0rd in the password text box, and then press the enter key.
12. click the secureadmin tile.
13. select the sign out option. the lock screen is displayed.
14. prees the space bar.
15. click the admin icon.
16. type Pa$$w0rd in the password text box, and then press the enter key.
17. Press the the ctrl+Alt_End keys.
18. select the change a password option. the change a password screen is displayed.
19. type Pa$$w0rd in the Old password text box.
20. type abcd in the new password and confirm password text boxes.
21. press the Enter key. the Change a password screen is displayed. you will notice that the password is not updated due to length requirements.
22. click the ok button. the change a password screen is dislayed.
23. type Pa$$w0rd in the Password text box.
24. type abcde in the new password and confirm password text boxes.
25. press the enter key. the change a password acreen is displayed. you will notice that the password is changed.
26. click the ok button. the start screen is displayed.
27. click the Admin tile.
28. select the sign out option. the lock screen is displayed.
29. press the space bar.
30. select the admin icon. the login screen is displayed.
31. type abcdr in the password rext box.
32. press the enter key. the password is incorrect message is displayed.
33. click the ok button.
34. type abcde in the password text box.
35. press enter key. the password is incorrect message is displayed.
36. click the ok button.
37. type abcde in the password text box, and then press the enter key. the refernced account is locked message is displayed.
38. click the ok button.
Task 4. Unlocking the Admin Account
to unlock the Admin account in the 20687B-LON-CL1 virtual machine. you need to perform the following steps:
1. click the switch user button.
2. click the Secureadmain icon.
3. type Pa$$w0rd in the Password text box.
4. press the Enter key. the Start screen is displayed.
5. type computer. the computer tile is displayed in the Apps screen.
6. Right-click the computer tile, and then select the Manage option in the bottom bar.The computer Management windiw is displayed.
7. Expand the Local Users and Groups node under the system Tools node in the left pane.
8. select the users folder. the user in the middle pane.
9. Right-click the Admin user in the middle pane.
10. select theproperties option. the Admin properties dialog box is displayed.
11. clear the Accont is locked out check box.
12. click the ok button.
13. close the computer Management window.
14. press the Windows key. the Start screen is displayed.
15. select the secureadmin tile.
16. select the sign out option. the lock screen is displayed.
17. press the space bar.
18. click the admin icon.
19. type abcde in the password text box, and then press the Enter key. After a few moments. the Start screen is displayed.
20. sign out and revert the 20687B-LON-CL1 and 20687B-LON-CL1 virtual machines.
2. LHG Inc. is a Dubai-based company providing luxury furniture items to customers around the globe through its retail stores chain and online portal. To maintain round-the-clock services, the IT department has designated the LON-CL1 machine for general use by sales executives. Multiple executives use this machine in rotational shifts. Recently, the company has received some suggestions and requests from the users of this machine for simplifying their daily tasks. In addition, Eric, the Desktop Administrator, is also having some concerns about the usage of this machine. Based on these suggestions, requests, and concerns, Eric has compiled the following tasks: Many users are unable to use the picture password. They are unable to configure or remember the password. In addition, the picture password uses cache memory that has slowed down the machine. Therefore, this feature should be disabled. The users forget to logout their account after they have switched to another account. This results in loss of data due to unsaved information. The users should not be allowed to switch accounts. Any user should not be able to change the taskbar location. This is to avoid problems for other users who are accustomed to uniform settings of taskbar for their sessions. Eric wants that any user should not be able to change the password of any account in the machine. This is to prevent any inconvenience to other users while accessing the machine. Some users are not finding the lock screen useful. Eric has decided to remove the lock screen. How can Eric configure these settings? Experiment To accomplish the assigned task, Eric needs to perform the following tasks: Configure Group Policy Objects (GPO) settings. Test the settings.
Task 1. Configuring GPO settings
to configure GPO setting, you need to erform the following steps:
1. Press the windows+C keys. the Charms bar is displayed.
2. click search. the search charm is displayed.
3. type mmc.exe in the apps text box. and then press the enter key. the MMC window is displayed.
4. Maximize the MMC window.
5. select the file--Add/Remove snap-in option from the menu bar. the add or Remove snap-in dialog box is dispalyed.
6. select the Group policy object editor option under the snap-in column in the Available snap-ins list box.
7. Click the add button. the select Group policy object wizard is displayed.
8. click the finish button. After a few moments, the Local computer policy option in the selected snap-in list box is displayed.
9. click the ok button. the MMC window is displayed.
10. Expand the Local computer policy-computer configuration--Administrative Templates-- system nodes in the left pane.
11. select the Logon fogon folder. After a few moments. the logon setting page is displayed in the middle pane.
12. select the Turn off picture password sign-in option in the midde pane.
13. click the policy setting link on the left-hand side of the middle pane. the Turn off picture password sign-in window is displayed.
14. select the Enablal option.
15. click the ok button.
16. select the hide entry points for fast user switching option in the middle pane.
17. click the policy setting link. the hide entry points for fast user switching window is displayed.
18. select the Enabled optin.
19. click the ok button.
20. Expand the user configuration--Administative Templates nodes in the left pane.
21. select the start menu and taskber folder. the start menu and Taskbar setting page is displayed in the middle pane.
22. select the lock the taskbar option in the middle pane.
23. click the policy setting link. the Lock the taskbar window is displayed.
24. select the Enabled option.
25. click the ok button.
26. Expand the system node under the user configuration--administrative templates nodes.
27. select the Ctrl+Alt_Detele options folder. the Ctrl+Alt_Detele options page is displayed in the middle pane.
28. select the Remove change password option in the middle pane.
29. click the policy setting link. the Remove change password window is displayed.
30. select the Enabled option.
31. click the ok button.
32. Expand the Control panel node under the computer configuration templates nodes.
33. select the Personalization folder.
34. select the do not disply the lovk screen option in the middle pane.
35. click the policy setting link. the do not display the lock screen window is displayed.
36. select the enabled option.
37. click the ok button.
38. close the MMC window without seving any changes.
Task 2. Testing the settings.
to test the settings, you need to perform the following steps:
1. Open the command Promot window.
2. type the gpupdate /force command, and then press the enter key. After a few moments. computer and user policies are updated successfully.
3. Restart the 20687B-LON-CL1 cirtual machine and log on with ADATUM\Administrator as the username and Pa$$w0rd as the password. After a few moments, the start screen is displayed.
4. click the administrator tile.you will notice that there is no option to switch account.
5. Open the desktop screen.
6. Right-click taskbar. you will notice that the lock the taskbar option is displayed.
7. select the properties option. you will notice that the lock the taskbar and taskbar location on screen options are displayed.
8. click the cancel button.
9. press the windows+C keys. the charms bar is dispalyed.
10. click setting. the setting screen is displayed.
11. select the change PC setting option. the PC setting screen is displayed.
12. select the users option in the left name. you will notice that the create a picture password button is displayed.
13. press the the Ctrl+Alt_End keys. you will notice that the change password option is not displayed.
14. click the cancel button.
15. close all the open windows.
16. Ensure that the start screen is displayed.
17. select the administrator--lock option. you will notice that the lock screen is not displayed. Instead, the login screen is displayed.
18. type the Pa$$w0rd in the password text box.
19. press the enter key. the start acreen is displayed.
20. Sign out and revert the both the virtual machines.
to configure GPO setting, you need to erform the following steps:
1. Press the windows+C keys. the Charms bar is displayed.
2. click search. the search charm is displayed.
3. type mmc.exe in the apps text box. and then press the enter key. the MMC window is displayed.
4. Maximize the MMC window.
5. select the file--Add/Remove snap-in option from the menu bar. the add or Remove snap-in dialog box is dispalyed.
6. select the Group policy object editor option under the snap-in column in the Available snap-ins list box.
7. Click the add button. the select Group policy object wizard is displayed.
8. click the finish button. After a few moments, the Local computer policy option in the selected snap-in list box is displayed.
9. click the ok button. the MMC window is displayed.
10. Expand the Local computer policy-computer configuration--Administrative Templates-- system nodes in the left pane.
11. select the Logon fogon folder. After a few moments. the logon setting page is displayed in the middle pane.
12. select the Turn off picture password sign-in option in the midde pane.
13. click the policy setting link on the left-hand side of the middle pane. the Turn off picture password sign-in window is displayed.
14. select the Enablal option.
15. click the ok button.
16. select the hide entry points for fast user switching option in the middle pane.
17. click the policy setting link. the hide entry points for fast user switching window is displayed.
18. select the Enabled optin.
19. click the ok button.
20. Expand the user configuration--Administative Templates nodes in the left pane.
21. select the start menu and taskber folder. the start menu and Taskbar setting page is displayed in the middle pane.
22. select the lock the taskbar option in the middle pane.
23. click the policy setting link. the Lock the taskbar window is displayed.
24. select the Enabled option.
25. click the ok button.
26. Expand the system node under the user configuration--administrative templates nodes.
27. select the Ctrl+Alt_Detele options folder. the Ctrl+Alt_Detele options page is displayed in the middle pane.
28. select the Remove change password option in the middle pane.
29. click the policy setting link. the Remove change password window is displayed.
30. select the Enabled option.
31. click the ok button.
32. Expand the Control panel node under the computer configuration templates nodes.
33. select the Personalization folder.
34. select the do not disply the lovk screen option in the middle pane.
35. click the policy setting link. the do not display the lock screen window is displayed.
36. select the enabled option.
37. click the ok button.
38. close the MMC window without seving any changes.
Task 2. Testing the settings.
to test the settings, you need to perform the following steps:
1. Open the command Promot window.
2. type the gpupdate /force command, and then press the enter key. After a few moments. computer and user policies are updated successfully.
3. Restart the 20687B-LON-CL1 cirtual machine and log on with ADATUM\Administrator as the username and Pa$$w0rd as the password. After a few moments, the start screen is displayed.
4. click the administrator tile.you will notice that there is no option to switch account.
5. Open the desktop screen.
6. Right-click taskbar. you will notice that the lock the taskbar option is displayed.
7. select the properties option. you will notice that the lock the taskbar and taskbar location on screen options are displayed.
8. click the cancel button.
9. press the windows+C keys. the charms bar is dispalyed.
10. click setting. the setting screen is displayed.
11. select the change PC setting option. the PC setting screen is displayed.
12. select the users option in the left name. you will notice that the create a picture password button is displayed.
13. press the the Ctrl+Alt_End keys. you will notice that the change password option is not displayed.
14. click the cancel button.
15. close all the open windows.
16. Ensure that the start screen is displayed.
17. select the administrator--lock option. you will notice that the lock screen is not displayed. Instead, the login screen is displayed.
18. type the Pa$$w0rd in the password text box.
19. press the enter key. the start acreen is displayed.
20. Sign out and revert the both the virtual machines.
No comments:
Post a Comment