Lab 2 K 8

TRUNG TM O TO MNG MY TNH NHT NGH I TC O TO CA MICROSOFT TI VIT NAM 105 B Huyn Thanh Quan, Q3, TP.
HCM Tel: 3.9322.735 0913.735.906 Fax: 3.9322.734 www.nhatnghe.com
LI M U
Hin nay cc doanh nghip u s dng my tnh v cc ng dng trn my tnh nh mt cng c lm vic thit yu. iu cng ng ngha vi vic xy dng, qun tr v pht trin h mng my tnh l mt cng tc c nh hng quan trng n hot ng sn xut kinh doanh. Cng ty MICROSOFT Vit Nam phi hp cng Cng Ty C Phn Gio Dc NHT NGH bin son b sch XY DNG QUN TR - M RNG H MNG MY TNH DOANH NGHIP TRN NN WINDOWS SERVER 2008 V WINDOWS 7 vi mong mun: - Cung cp cho cc Qu c gi mt tm nhn tng quan v cc khun mu chi tit trong vic xy dng v pht trin h mng doanh nghip trn nhiu quy m khc nhau. - Gii thiu hai h iu hnh Server v Client mi nht ca Microsoft: Windows Server 2008 v Windows 7 vi nhiu tnh nng vt tri so vi cc phin bn trc. B sch ny m phng thc t pht trin h mng my tnh ca mt doanh nghip, t lc khi u (mng n gin ti mt vn phng) cho n khi ln mnh (mng phc tp ti nhiu chi nhnh): Lab 01: H mng ngang hng, chia s ti nguyn trn c s Local User. Lab 02: Trin khai h thng Mail Online nh dch v min ph Windows Live Custom Domains ca Microsoft. Lab 03: H mng domain, qun l tp trung, trin khai cc ng dng t ng, kh nng bo mt cao. Lab 04: Doanh nghip m rng quy m dn n nhu cu tch h thng mng thnh nhiu phn on c th hp l ha bng thng, v khng ch truy cp. Lab 05: Ci t v cu hnh Microsoft firewall Forefront Threat Management Gateway (TMG) bo v h mng, chng li cc cuc tn cng t bn ngoi v kim sot truy cp internet ca nhn vin. Lab 06: Xy dng web server v publish trn TMG server p ng nhu cu qung b thng hiu, giao tip i tc v to thun li cho cng vic ca nhn vin. Lab 07: Trin khai VPN server trn TMG server gip nhn vin t internet c th kt ni vi mng ni b mt cch bo mt v kt ni cc chi nhnh ti cc v tr a l khc nhau vi chi ph thp nht. Lab 08: Tng kh nng chu li ca h mng bng cch xy dng additional domain controller. Lab 09: Xy dng child domain p ng cc nhu cu a dng v qun l v bo mt. Hai h iu hnh Windows Server 2008 v Windows 7 c rt nhiu u im v chi tit m b 09 bi lab ny khng th trnh by y c. V th, chng ti rt mong nhn c phn hi v gp t Qu c gi cc phin bn sau c th hon thin hn. Xin vui lng lin h ti: - Din n: http://www.nhatnghe.com/forum - E-mail: info@nhatnghe.com - Hot line: 08 393 22735 Chng ti xin chn thnh cm n ng Phng Phc Linh, Partner Strategy & Program Manager Microsoft Vit Nam v ng Trn Vn Hu, Gim c cng ty Nht Ngh c nhng h tr thit thc trong sut qu trnh bin son b sch ny. Xin hn ti ng Qu c gi trong nhng b sch khc v cng ngh mng Microsoft. Nhng ngi thc hin: 1. Nguyn Trnh Khnh Vn MCITP EA 2. Nguyn Mnh Trng MCITP EA 3. L Ngc Hin MCT Tp. H Ch Minh, thng 10 nm 2009. Trang 1/250
TRUNG TM O TO MNG MY TNH NHT NGH I TC O TO CA MICROSOFT TI VIT NAM 105 B Huyn Thanh Quan, Q3, TP. HCM Tel: 3.9322.735 0913.735.906 Fax: 3.9322.734 www.nhatnghe.com
Trang 2/250
MC LC
LAB 01 THIT LP H THNG MNG CHO DOANH NGHIP NH ................................................ Trang 05 LAB 02 MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN .................................................... Trang 35 LAB 03 GII THIU H THNG MNG DOMAIN DNG TRONG QUN L DOANH NGHIP .. Trang 47 LAB 04 H THNG MNG NHIU NETWORK ................................................................................... Trang 117 LAB 05 CI T V CU HNH FOREFRONT THREAT MANAGEMENT GATEWAY (TMG)... Trang 127 LAB 06 PUBLISH WEB SERVER TRN FOREFRONT THREAT MANAGEMENT GATEWAY .... Trang 163 LAB 07 VIRTUAL PRIVATE NETWORK (VPN)................................................................................... Trang 183 LAB 08 CHIA SITE CHO DOMAIN NETWORK.................................................................................... Trang 219 LAB 09 XY DNG CHILD DOMAIN................................................................................................... Trang 237
Trang 3/250
Trang 4/250
LAB 01 THIT LP H THNG MNG CHO DOANH NGHIP NH

I. M HNH M hnh dng 02 my tnh v 01 router ADSL cng kt ni vo 1 switch: - Server: Windows 2008 - Client: Windows 7
II. GII THIU Gii php cho Doanh nghip nh vi cc yu cu c bn nh: - Chia s d liu, chia s my in. - Truy cp internet vi 1 ng truyn ADSL III. CC BC TRIN KHAI 1. Cu hnh IP. 2. Cu hnh Router ADSL Th truy cp internet 3. To local user account & group 4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s. 5. Cu hnh Print Server - Thit lp u tin v permission trn printer. IV. TRIN KHAI CHI TIT 1. Cu hnh IP Server 192.168.1.253 255.255.255.0 192.168.1.1 203.162.4.190 Client 192.168.1.10 255.255.255.0 192.168.1.1 203.162.4.190
IP address Subnet mask Default gateway Preferred DNS
Trang 5/250
- Thc hin ti Server
Start
Settings
Network Connections
- Click phi LAN
Properies
- Chn Internet Protocol Version 4 (TCP/IPv4)
Properties
Trang 6/250
- Nhp thng s IP nh hnh v
OK
OK
- Thc hin ti Client: Start
Control Panel
Chn Network and Sharing Center
Trang 7/250
- Chn Change adapter settings
- Click phi card LAN
Properties
- Nhp kp Internet Protocol Version 4 (TCP/IPv4)
Trang 8/250
- Nhp cc thng s IP nh trong hnh
OK
OK
2. Cu hnh Router ADSL - Reset router ADSL. Kim tra ng truyn t Client n router (IP mc nh ca Router l 192.168.1.1) Phi bo m nhn c phn hi t router - M chng trnh Internet Explorer (IE) Nhp 192.168.1.1 Go - Nhp username v password ca Router OK
- Chn Run Wizard
Trang 9/250
- Choose Time Zone
Chn GMT+07:00 (Bangkok, HaNoi, Jakarta)
Next
- Select Internet Connection Type (WAN)
Chn PPPoE/PPPoA
Next
- Set PPPoE/PPPoA
Nhp thng tin do ISP cung cp
Next
Trang 10/250
- Setup Completed
Restart.
- Tab Status
Quan st nhn Public IP.
- Th nghim truy cp internet
Trang 11/250
3. To cc local user & group (thc hin ti Server) - Start Run Nhp LUsrMgr.msc OK
- Click phi Users
New User
- Nhp User name: KT1, Password: 123, Confirm password: 123, b chn User must change password at next logon Create
- Nhp User name: KT2, Password: 123, Confirm password: 123, b chn User must change password at next logon Create. Trang 12/250
- Nhp User name: NS1, Password: 123, Confirm password: 123, b chn User must change password at next logon Create. - Nhp User name: NS2, Password: 123, Confirm password: 123, b chn User must change password at next logon Create Close. - Click phi Groups New Group
- Nhp Group name: KeToan
Add
- Nhp KT1; KT2
Check Names
OK
- Hp thoi New Group
Create Trang 13/250
- Hp thoi New Group
Nhp Group Name: NhanSu
Add
- Nhp NS1; NS2
Check Names
OK
- Hp thoi New Group
Create
Close. Trang 14/250
4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s. a. Trong Windows Explorer, to cy th mc nh hnh minh ha.
b. Chia s th mc Data - Click phi th mc Data
Properties
- Tab Sharing
Advanced Sharing Trang 15/250
- nh du chn Share this folder
Permissions
- Chn Full Control ti ct Allow
OK
OK
Trang 16/250
c. Thit lp NTFS permission. Mc tiu: H s ca phng ban no th phng ban qun l. Thit lp permission trn th mc DATA: ch cho php KETOAN & NHANSU c - Click phi th mc DATA Properties - Tab Security Advanced
- Chn Edit
Trang 17/250
- B du chn Include inheritable permission
- Chn Copy
- Chn OK 2 ln
- Chn Edit
Chn Group Users
Remove Trang 18/250
- Chn Add - Nhp KETOAN;NHANSU
Check Names
OK
Kim tra thy Group KETOAN v NHANSU c permission Allow Read
Trang 19/250
Thit lp permission trn th mc DATA CHUNG: cho php KETOAN & NHANSU c, ghi, xa, sa. - Click phi th mc DATA CHUNG Properties - Tab Security Edit
- Ln lt cho Group KETOAN v NHANSU quyn Modify
OK 2 ln
Trang 20/250
Thit lp permission trn th mc KETOAN: ch cho php KETOAN c, ghi, xa, sa. - Click phi th mc KETOAN Properties - Tab Security Advanced
- Chn Edit
Trang 21/250
- B du chn Include inheritable permission.
Chn Copy
OK 2 ln
- Chn Edit
Trang 22/250
- Chn group NHANSU
Remove
Chn group KETOAN
chn Allow Modify
OK 2 ln
Thit lp permission trn th mc NHANSU: ch cho php NHANSU c, ghi, xa, sa. Thc hin tng t trn th mc KETOAN c kt qu:
Kim tra: - Log on KT1, truy cp vo folder DATA CHUNG v KETOAN, to 1 file bt k - Truy cp th folder NHANSU, b bo li
to thnh cng
Trang 23/250
d. Thit lp NTFS permission. Mc tiu: Cc user ch c th xa ti nguyn do chnh mnh to ra - Click phi th mc KETOAN Properties - Tab Security Advanced
- Chn Edit
Trang 24/250
- Chn KETOAN
Chn Edit
- B du chn 2 Delete subfolders and files v Delete
OK
- Kim tra: Log on KT2, truy cp vo folder KETOAN, xa th file do user KT1 to
khng th xa
Trang 25/250
5. Cu hnh Print Server a. Ci t Local printer (Thc hin ti SERVER) - Start Settings Printers
- Chn Add Printer
- Chn Add a local printer
Trang 26/250
- Chn Next
- Chn my in nh hnh minh ha
Next
- Printer name : HP
Next
Trang 27/250
- Chn Next
- Chn Finish
- Quan st kt qu
Trang 28/250
b. Ci t Network printer (Thc hin ti CLIENT) - Start truy cp \\192.168.1.253
- Click phi ln my in HP
Connect
Trang 29/250
- Chn Install driver
Start
Printer
Quan st thy c my in HP
c. u tin Phn quyn (Thc hin ti SERVER) Xa printer HP to , to 2 printer mi : VIP v Member
- Click phi ln printer VIP
Properties
Trang 30/250
- Tab Security
chn Everyone
Remove
- Chn Add
Trang 31/250
- Nhp BanGiamDoc
Check Names
OK
- Chn group BanGiamDoc
chn thm Allow Manage printer & Allow Manage documents
- Tab Advanced
Nhp gi tr Priority: 99
OK
Kim tra : Trang 32/250
- Truy cp \\192.168.1.253
- Click phi printer VIP
Connect
Trang 33/250
- Khai bo user name: KT1 (& password)
OK
- Chn Yes
- Bo li khng c quyn
No
- Kt ni my in Member vi credential KT1
Thnh cng.
Trang 34/250
LAB 02 MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN

I- GII THIU trin khai h thng e-mail vi tn min ring, chng ta c cc gii php nh: Mail Online, Mail Offline. Bi lab ny s trnh by cch trin khai h thng mail nh dch v min ph Windows Live Custom Domains ca Microsoft. Doanh nghip ch phi tr chi ph mua public domain name. Trong bi lab s dng public domain name NhatNghe.edu.vn. II- CC BC TRIN KHAI 1. 2. 3. 4. To account trn trang web domains.live.com Cp nht d liu DNS ca public domain kch hot account live Cp nht bn ghi MX ca public domain Kim tra To mail account Th nghim gi v nhn mail.
III- TRIN KHAI CHI TIT 1. To account trn trang web domains.live.com
- Truy cp trang web http://domains.live.com > Chn Get started
- Khung Provide your domain name > Nhp tn ca public domain Trang 35/250
- nh du chn mc No mail for my domain... > Continue
- nh du chn mc Create a new Windows Live ID... > Continue
Trang 36/250
- Nhp cc thng tin theo yu cu > chn I accept
- Quan st kt qu > chn I accept
Trang 37/250
- Ghi nhn cc thng tin trong phn Domain Ownership (DNS record type, Host & Value) > Sign out.
2.
Cp nht d liu DNS ca public domain kch hot account live
- ng nhp trang web qun l public domain.
Trang 38/250
- To mt bn ghi DNS theo thng tin ghi nhn trong phn Domain Ownership > Sign out.
3.
Cp nht bn ghi MX ca public domain & to mail account
- ng nhp trang web http://domains.live.com bng account to phn 1. - Chn Domain Settings > chn Edit mail settings.
Trang 39/250
- Hp thoi Update mail settings > chn Windows Live Hotmail > OK
- Trong phn Mail setup (required) > Ghi nhn tn ca MX server
Trang 40/250
- ng nhp trang web qun l public domain.
- To bn ghi loi MX tr t public domain name n tn ghi nhn trong phn Mail setup (required) > Sign out.
Trang 41/250
* Kim tra : - Start > Run > Nhp cmd > OK - Nhp cc cu lnh nh hnh minh ha.
Trang 42/250
- To mail account : Quay li trang web http://domains.live.com chn Member accounts > chn Add
- Khai bo cc thng tin Mail account > OK
- Kim tra kt qu : mail account c to. Trang 43/250
4. Th nghim gi v nhn mail. - Truy cp trang web : Http://Mail.Live.com Nhatnghe.edu.vn * Kim tra : - Gi mail ti Gmail thnh cng
ng nhp bng ti khon to trn domain
- Nhn mail t domain bn ngoi thnh cng Trang 44/250
Trang 45/250
Trang 46/250
LAB 03 GII THIU H THNG MNG DOMAIN DNG TRONG QUN L DOANH NGHIP
I. M HNH M hnh dng 03 my tnh: 01 Server Windows 2008 (c 02 volume C & F) + 02 Client Windows 7 v 01 router ADSL cng kt ni vo 1 switch:
II. GII THIU H mng workgroup (Lab 01) c li im l n gin, d trin khai nhng khng thun li cho cng tc qun tr v kh nng bo mt km. Lab 03 k tha m hnh v cc kt qu ca lab 01 nng cp thnh h thng Domain Network vi cc u im: Qun l tp trung mi thnh phn trong h thng. Kh nng bo mt cao nhng thun li nh c ch Single Set of Credential. Kh nng co gin linh ng cho mi quy m, d dng m rng. p dng c ch qun l da trn Policy (Policy-based Administration). Cho php trin khai cc Application tch hp trong AD Database do vy tn dng c c ch Replication ca AD. III. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. CC BC TRIN KHAI Dng domain controller trn my Server vi domain l nhatnghe.local. B sung thng s DNS server. Ci t v cu hnh DHCP server trn my Server. Client nhn IP t DHCP server v gia nhp domain nhatnghe.local.. Client th truy cp internet. Trn client, ci t cng c qun tr server. Xy dng cu trc OU, phn b cc user account v group account. T chc h thng v phn quyn qun tr (Delegate) To Home Directory cho Domain User To Roamming Profile cho Domain User Ci t ng dng t ng, hng lot (Deploy Software) Kim ton (Audit) Ngn chn s dng ng dng (Software restriction) i tn 2 built-in account Administrator & Guest Ci t my in mng trn hng lot my trm (Deploy Printer) Sao lu d liu Domain Controller v phc hi khi c s c. Trang 47/250
IV. TRIN KHAI CHI TIT 1. Dng domain controller trn my Server vi domain name l NhatNghe.local. - Cu hnh IP nh hnh minh ha
- Start
Run
nhp DCPROMO
Trang 48/250
- Chn Next
- Chn Next
Trang 49/250
- Chn Create a new domain in a new forest
Next
- Nhp DNS domain name NhatNghe.local
Next
Trang 50/250
- Chn Next
- Chn Forest functional level Windows Server 2008
Next
Trang 51/250
- Chn Next
- Chn Yes
Trang 52/250
- Chn Next
- Nhp Password v Confirm password: P@ssword
Next
Trang 53/250
- Chn Next
- nh du chn Reboot on completion
Trang 54/250
2. B sung thng s DNS server. a. To reverse lookup zone v pointer - Start Programs Administrative Tools DNS - Console DNS Manager Click phi Reverse Lookup Zone
New zone
- Chn Primary zone & bo m c du chn store the zone in Active Directory
Next
Trang 55/250
- Chn Next
- chn Next
- Nhp Network ID: 192.168.11
Next
Trang 56/250
- Chn Next
- Chn Finish
- Click phi zone 11.168.192.in-addr.arpa
chn New Pointer (PTR)
Trang 57/250
- Nhp gi tr host ID: 254
Browse
- Nhp kp vo i tng nh hnh minh ha
Trang 58/250
- Quay li hp thoi New Resource Record
OK
b. Cu hnh Forwarder - Click phi SERVER Properties - Tab Forwarders Edit
Trang 59/250
- Chn Click here to add
Nhp 203.162.4.190
OK
- Chn OK
2. Ci t v cu hnh DHCP server trn my Server. - Start Programs Administrative Tools Server Manager - Click phi Roles Add Roles
Trang 60/250
- Chn Next
- Chn DHCP Server
Next
Trang 61/250
- Chn Next
- Chn Next
Trang 62/250
- Chn Validate
- Chn Next
Trang 63/250
- Chn Next
- Hp thoi Add orEdit DHCP Scopes > Chn Add
Trang 64/250
- Nhp cc gi tr thng s nh hnh minh ha
OK
- Chn Next
Trang 65/250
- Chn Disable DHCP v6 stateless mode for this server
Next
- Chn Next
Trang 66/250
- Chn Install
- Hon tt
Close
Trang 67/250
4.Client nhn IP t DHCP server v gia nhp domain nhatnghe.local. . Client th truy cp internet. - Start Control Panel
- Chn Network and Sharing Center
Trang 68/250
- Chn Change adapter settings
- Click phi LAN
Properties
- Chn Obtain an IP address automaticcally v Obtain DNS server address automatically
OK
Trang 69/250
- Chn Cancel
- Start
Nhp cmd (nh hnh minh ha)
Enter
Trang 70/250
- Nhp lnh ipconfig /all
Enter
- Quan st thy nhn c IP t DHCP server
- Client th truy cp internet
thnh cng
5. Trn client, ci t cng c qun tr server. - Kch hot b ci t Remote Server Administration Tool
- Chn Yes
Trang 71/250
- Chn I accept
Hon tt
Close
- Kch hot Remote Server Administrative Tool: Start Control Panel Program And Features On or Off Program and Features nh du chn cc cng c nh hnh minh ha OK
Turn
Trang 72/250
- Start Administrative Tools d liu ca DC.
Active Directory Users and Computers: kt ni thnh cng n c s
6. Xy dng cu trc OU, phn b cc user account v group account - Start Run DSA.MSC
- Click phi NhatNghe.Local
New
Organizational Unit
Trang 73/250
- Name : Nhatnghe
OK
- Click phi Nhatnghe
New
Group
- t tn KETOAN
OK
- Tng t, to group NHANSU Trang 74/250
- Click phi ln Nhatnghe
New
User
- Nhp thng tin nh hnh minh ha
Next
- Nhp Password & Confirm password: Password
Next
- Chn Finish Trang 75/250
- Tng t, to cc user NS1 v Manager - Kt qu :
- Click phi Group KETOAN
Properties
Trang 76/250
- Tab Members
Chn Add
- Nhp KT1
Check Names
OK 2 ln
- Lm tng t add user NS1 vo group NHANSU
OK
Trang 77/250
7. T chc h thng v phn quyn qun tr (Delegate) - Click phi OU NhatNghe Delegate Control
- Welcome
Chn Next
- Chn Add
- Nhp Manager
Check Names
OK Trang 78/250
- Next
- Chn Full Coltrol
Next
Finish
Trang 79/250
8. To Home Directory cho Domain User - To th mc Home_Folder Click phi
Properties
- Tab Sharing
Advanced Sharing
Trang 80/250
- Chn Permission - nh du Full Control
OK
OK
- Tab Security - Chn Users
Chn Edit nh du Allow Modify
OK
Close
Trang 81/250
- Start
Run
nhp DSA.MSC
OK
- Click phi KT1
Properties
- Tab Profile
Chn Connect : Z:
Nhp : \\192.168.11.254\Home_folder\%UserName%
Apply
Trang 82/250
- Quan st phn %UserName% c i thnh KT1
OK
Kim tra : thc hin trn client : User KT1 log on my client vi
M My computer quan st thy c thm 1 a mng Z
Trang 83/250
9. To Roamming Profile cho Domain User - To th mc Profile Share permission: Everyone Allow Full Control Allow Modify. - M DSA.MSC Properties KT1 NTFS permission: Users
- Profile path : Nhp \\192.168.11.254\Profile\%UserName%
Apply
Trang 84/250
- Quan st thy phn %UserName% i thnh KT1
OK
Kim tra: - KT1 log on Client 1 - KT1 log on Client 2
Trn desktop to th mc HoSoKT1 Log off Trn desktop quan st thy c th mc HoSoKT1.
Trang 85/250
10. Ci t ng dng t ng, hng lot (Deploy Software) - Chp source Office 2003 vo th mc Office2k3 trong C. Share folder Office2k3. - Kim NTFS Permission: mc nh groups Users Allow Read & Execute.
- M DSA.MSC
Computers
Click phi ln tn PC Client
chn Move
Trang 86/250
- Chn OU NhatNghe
OK
- M Group Policy Management
Trang 87/250
- Click phi OU NhatNghe
Chn Create a GPO in this domain , and Link it here
- t tn : Deploy Software
OK
Trang 88/250
- Click phi ln Deploy Software
Edit
- Click phi ln Software installation
New
Package
Trang 89/250
- Trong phn File name Nhp : \\192.168.11.254\office2k3
Chn file PRO11.msi
Open
- Chn Assigned
OK
- Quan st kt qu
Trn command line nhp lnh GPUpdate /Force
Kim tra : thc hin trn Client Trang 90/250
- Restart client
log on bng account KT1
M menu Start
quan st thy Office c ci
11. Kim ton file (Audit File) - M th mc DATA click phi th mc NHANSU
Properties
- Tab Security
Chn Advanced
Trang 91/250
- Tab Auditing
Chn Edit
- Chn Add
- Nhp Everyone
Check Names
OK
Trang 92/250
- Chn tt c cc chn la
OK
- OK
OK
OK
Trang 93/250
- M Group Policy Management
- Click phi ln Default Domain Policy
Edit
Trang 94/250
- Click phi Audit object access
Properties
- Chn Define these policy settings
Chn Success , Failure
- Trn command line nhp lnh GPUpdate /Force Trang 95/250
Kim tra : - Trn my client - Trn my Server
log on KT1 truy cp vo th mc NHANSU M Event Viewer
bo li khng c quyn truy cp
- M Windows Logs
Security
M cc event Audit Failure (& event id 4656)
Trang 96/250
- Quan st thy trng hp truy cp tri php ca KT1 vo th mc NHANSU c ghi nhn li
12. Ngn chn s dng ng dng (Software restriction): Cm mi user thuc OU Nht Ngh khng c dng Internet Explorer, ngoi tr user Manager. - M Group Policy Management
Trang 97/250
- Click phi ln OU NhatNghe
Chn Create a GPO in this domain , and Link it here
- t tn Deny_IE
- Click phi ln Deny_IE
chn Edit
Trang 98/250
- Click phi ln New Software Restriction Policies
New Software Restriction Policies
- Click phi ln Additional Rule
New Hash Rule
Trang 99/250
- Chn Browse
- Tr n C:\Program Files\iexplore.exe
Open
Trang 100/250
- OK
ng console Group Policy Management Editor
- Chn Deny_IE
tab Delegation
Chn Advanced
Trang 101/250
- Chn Add
- Nhp Manager
Check Names
OK
- Chn Deny Read
OK
Trang 102/250
- Yes
- Trn command line
nhp lnh Gpupdate /Force
- Kim tra (thc hin trn client) - Log on KT1 : M chng trnh Internet Explorer khng truy cp c - Log on Manager : M chng trnh Internet Explorer truy cp thnh cng 13. i tn 2 built-in account Administrator & Guest - M Group Policy Management
Trang 103/250
- Click phi ln NhatNghe
Create a GPO in this domain , and link it here
- t tn nh trong hnh
OK
- Click phi ln GPO va to
Edit
Trang 104/250
- Click phi ln policy nh trong hnh
Properties
- Chn Define this policy settings
t tn mi NguoiQuanTri
OK
Trang 105/250
- Click phi ln Policy trong hnh
Properties
- Chn Define this policy setting
Nhp vo : Khach
OK
ng cc chng trnh
- Trn command line nhp lnh GPUpdate /Force
OK
Trang 106/250
Kim tra : Thc hin trn client - Restart Client Log on Domain Admins - Start nhp vo search : LUsrMgr.MSC Quan st thy 2 account Built-in Administrator v Guest c i tn.
Trang 107/250
14. Ci t my in mng trn hng lot my trm (Deploy Printer) - M Group Policy Management
- Click phi ln OU Nhatnghe
Chn Create a GPO in this domain, and link it here
Trang 108/250
- t tn GPO
OK
- Click phi Deploy Printer
Edit
Trang 109/250
- Click phi ln Printers
New
Shared Printer
- Khai bo nh trong hnh
OK
Trang 110/250
- Kim tra trn client : Log on KT1 Start 192.168.11.254) t ng connect v client
Devices and Printers
Quan st thy my in (HP on
15.Sao lu d liu Domain Controller v phc hi khi c s c. A. BACKUP SYSTEM STATE - Vo cmd, Nhp lnh: wbadmin start systemstatebackup backuptarget:F: Backup
Nhp Y tin hnh vic
- Qu trnh Backup din ra khong 30 pht Trang 111/250
- M Active Directory Users and Computers, vo menu View
Advanced Features
Trang 112/250
- Click phi OU KYTHUAT accidental deletion OK
Properties. Tab Object, b du check mc Protect object from
- Thc hin tng t cho OU GIANGVIEN. - Click phi vo 2 OU KYTHUAT v GIANGVIEN
Delete
Trang 113/250
B. Restore System Sate: - Trn command line, Nhp lnh: bcdedit /set safeboot dsrepair
- H thng t ng khi ng li ng nhp bng username v password ca Directory Service Restore Mode ( khai bo khi nng cp DC)
- Xem danh sch cc file backup, Nhp lnh : wbadmin get versions
Trang 114/250
- Chn phin bn backup gn nht, nhp lnh: wbadmin start systemstaterecovery version:02/17/200921:17 Tham s version tng ng vi Version identifier Nhn Y bt u qu trnh restore
- Ch khong 30 pht
qu trnh restore thnh cng.
- tr v ch boot bnh thng, nhp lnh: bcdedit /deletevalue safeboot
- H thng khi ng li ng nhp bng Domain Admin v Password. Hp thoi thng bo System State c khi phc thnh cng Enter Trang 115/250
- M Active Directory Users and Computers ln kim tra, thy cc OU c khi phc li nh c
Trang 116/250
LAB 04 H THNG MNG NHIU NETWORK

I. M HNH
II. GII THIU Trn mt h thng mng c nhiu ti nguyn v c s phn cp trong vic truy cp cc loi ti nguyn, vic phn chia h thng mng vt l ra cc Network_IDs hoc Subnets khc nhau s em li cc li th: Trnh hin tng nghn ng truyn do s Hosts trong Logical Network qu nhiu. Ngn chn cc hin tng lan truyn ton mch (broadcast) D dng thit lp cc b lc (Filter) nh tuyn khi truy cp ti nguyn. III. CC BC TRIN KHAI M hnh di y pht trin t h thng Domain ca Lab 03, phn chia thnh 03 Network_IDs: VIP, USER, SERVER. S dng : 01 my Windows Server 2008 dng lm Domain Controller ti Network SERVER 01 my Windows 7: dng lm my User VIP 01 my Windows 7: dng lm my User USER 01 my Windows Server 2008 dng lm ROUTER, c 04 NICs: LAN1: ni trc tip router ADSL LAN11: ni switch 1 (subnet 1) gm cc SERVER LAN12: ni switch 2 (subnet 2) gm cc my VIP LAN13: ni switch 3 (subnet 3) gm cc my USER Trang 117/250
Cu hnh Router v cc b lc (Filter) sao cho: Tt c cc Networks (VIP, SERVER, USER) c th truy cp Internet. Network VIP v USER u c th truy cp Network SERVER. Network VIP v USER khng th truy cp nhau. IV. TRIN KHAI CHI TIT 1. Cu hnh router ADSL Cu hnh IP port LAN: 192.168.1.1/24 Cu hnh ADSL kt ni ra Internet 2. Cu hnh IP cc thnh phn trong h thng mng ADSL router 192.168.1.1 255.255.255.0 SERVER 192.168.11.254 255.255.255.0 192.168.11.250 192.168.11.254 VIP 192.168.12.10 255.255.255.0 192.168.12.250 192.168.11.254 USER 192.168.13.10 255.255.255.0 192.168.13.250 192.168.11.254
IP address Subnet Mask Default Gateway Preferred DNS
ROUTER NIC IP address Subnet Mask Default Gateway 3. Kch hot router a. Add role Routing and Remote Access - Start Programs Administrative Tools - Click phi Roles Add Roles Server Manager LAN1 192.168.1.250 255.255.255.0 192.168.1.1 LAN11 192.168.11.250 255.255.255.0 LAN12 192.168.12.250 255.255.255.0 LAN13 192.168.13.250 255.255.255.0
Trang 118/250
- Hp thoi Before You Begin
Next
- Hp thoi Select Server Roles
nh du chn Network Policy and Access Services
Next
Trang 119/250
- Hp thoi Network Policy and Access Services
Next
- Hp thoi Select Role Services
nh du chn Routing and Remote Access
Next
Trang 120/250
- Hp thoi Confirm Installation Selections
Next
- Hp thoi Installation Results
Close
Trang 121/250
b. Kch hot router - Start Programs
Administrative Tools
Routing and Remote Access
- Click phi server (local)
Configure and Enable Routing and Remote Access
- Next
Trang 122/250
- Chn Custom configuration
Next
- Chn NAT & chn LAN routing
Next
- Finish
Trang 123/250
- Chn Start service
4. Cu hnh NAT outbound - Start Programs Administrative Tools - Click phi NAT chn New Interface Routing and Remote Access
- Chn LAN11
OK
Chn Private interface
OK
- Thc hin tng t vi LAN12 v LAN13. Ch : chn private interface - Click phi NAT chn New Interface - Chn LAN1 OK Chn Public interface & nh du Enable NAT Trang 124/250
OK
5. Cu hnh IP packet filter chn thng tin gia network VIP (LAN12) v USER (LAN13) - Chn General Click phi LAN13 Properties
Trang 125/250
- Chn Inbound Filter
chn New
- Chn Destination network - Chn Receive all except
Nhp IP address: 192.168.12.0 & Subnet mask: 255.255.255.0 OK 2 ln.
OK
6. Kim tra kt qu - Cc PC VIP v USER truy cp SERVER: Start Run Nhp: \\192.168.11.253 - PC VIP truy cp USER: Start Run Nhp: \\192.168.13.10 tht bi. - PC USER truy cp VIP: Start Run Nhp: \\192.168.12.10 tht bi. thnh cng.
Trang 126/250
LAB 05 CI T V CU HNH FOREFRONT THREAT MANAGEMENT GATEWAY (TMG)

I. M HNH
II. GII THIU Khi kt ni h thng mng ni b vi Internet, tt yu pht sinh nhu cu kim sot cc giao dch thc hin gia mng ni b v Internet. Gii php thch hp l s dng cc Firewall. Bi lab ny gii thiu vic ci t phn mm Firewall ca Microsoft: Forefront Threat Management Gateway (TMG) v mt s cu hnh th hin qun tr. M hnh lab ny k tha v pht trin t m hnh lab 04. Server firewall TMG dng h iu hnh Windows Server 2008 64 bit c b tr gia software router v router ADSL. Interface LAN kt ni trc tip vi software router, Interface WAN kt ni trc tip vi router ADSL. III. CC BC TRIN KHAI 1. 2. 3. 4. 5. Cu hnh thng s IP ca software router v TMG firewall. B sung route trn TMG server. TMG server join domain. Ci t Forefront TMG trn TMG Server. Ci t Forefront Client trn TMG Client. Thit lp cc Access Rule cho php truy cp. Cu hnh chn download file.
Trang 127/250
IV. THC HIN 1. Cu hnh thng s IP Join domain a. iu chnh IP ca software router v cu hnh IP ca TMG server theo bng sau: Interface IP address Subnet mask Default gateway Preferred DNS Software router LAN1 10.0.1.250 255.255.255.0 10.0.1.2 TMG LAN 10.0.1.2 255.255.255.0 192.168.11.254 WAN 192.168.1.2 255.255.255.0 192.168.1.1
b. B sung route trn TMG server - Start Run Nhp cmd OK Trn Command line ln lt nhp cc cu lnh: route add 192.168.11.0 mask 255.255.255.0 10.0.1.250 p route add 192.168.12.0 mask 255.255.255.0 10.0.1.250 p route add 192.168.13.0 mask 255.255.255.0 10.0.1.250 p
- Trn Command line nhp cu lnh hin th routing table: route print
Cc route c b sung.
c. TMG server join domain NhatNghe.Local Trang 128/250
2. Ci t Forefront TMG trn TMG Server - Log on TMG server bng user Domain Admins Kch hot tp tin ci t: ISAAutoRun.exe
- Chn Install Forefront TMG
- Mn hnh Welcome
Next
Trang 129/250
- Mn hnh License Agreement, chn I Accept the term
Next
- Mn hnh Customer Information
Next
- Chn Install Forefront Threat Management Gateway
Next
- Mn hnh Component Selection
Next Trang 130/250
- Mn hnh Internal Network
Add.
Trang 131/250
- Chn Add Range
- Nhp vo dy a ch: Start Address: 192.168.11.0 End Address: 192.168.11.255
OK
- Tng t nhp ln lt cc dy sau: 192.168.12.0 192.168.12.255 192.168.13.0 192.168.13.255 10.0.1.0 10.0.1.255 OK
Trang 132/250
- Chn Next
- Mn hnh Service Warning
Next
- Mn hnh Ready To Install
Install
Trang 133/250
- Qu trnh ci t
- Mn hnh Complete
Finish
- Chn Exit
- Start
Programs
Microsoft Forefront TMG
Forefront TMG Management
Trang 134/250
- Chn Configure Network Settings
Trang 135/250
- Mn hnh Welcome
Next
- Chn Edge Firewall
Next
Trang 136/250
- Mn hnh LAN Settings
Chn network adapter LAN
Add
- Nhp vo cc thng s sau: IP Address: 192.168.11.0 Subnet mask: 255.255.255.0 Gateway: 10.0.1.250
- Tng t, nhp thm cc dy IP sau IP Address: 192.168.12.0 Subnet mask: 255.255.255.0 Gateway: 10.0.1.250 IP Address: 192.168.13.0 Subnet mask: 255.255.255.0 Gateway: 10.0.1.250
Trang 137/250
- Kt qu
Next
- Mn hnh Internet Settings
chn network adapter WAN
Next
Trang 138/250
- Chn Configure System Settings
- Mn hnh Welcome
Next
Trang 139/250
- Mn hnh Host Identification
Next
- Mn hnh Complete
Finish
Trang 140/250
- Chn Define deployment options
- Mn hnh Welcome
Next
Trang 141/250
- Mn hnh Microsoft Update Setup, chn Use the Microsoft Update service
Next
- Mn hnh Define Upadte Settings, chn thi gian Update
Next
Trang 142/250
- Mn hnh Customer Feedback, chn Yes, I am willing
Next
- Mn hnh Microsoft Telemetry Service, chn Join with a basic membership
Next
Trang 143/250
- Mn hnh Complete
Finish
- Chn Close
Trang 144/250
3. Ci t Forefront Client trn TMG Client - Kch hot tp tin MS_FWC.msi
- Mn hnh Welcome
Next
- Mn hnh License Agreement, chn I accept the term
Next
Trang 145/250
- Mn hnh Destination Folder
Next
- Mn hnh ISA Server Computer Selection, chn Connect to this ISA Server computer, nhp vo tn ISA Server: TMG.NHATNGHE.LOCAL Next
Trang 146/250
- Mn hnh Ready to Install
Next
Trang 147/250
- Mn hnh Complete
Finish
- Chn Yes khi ng li my
- M chng trnh Microsoft Firewall Client Management
Trang 148/250
- Tab Settings
chn Test Server
- Qu trnh kim tra kt ni n ISA Server thnh cng
- M IE, truy cp trang web bt k
Khng thnh cng
Trang 149/250
3. Thit lp cc Access Rule kim sot giao dch - Click phi Firewall Policy New Access Rule
- Mn hnh New Access Rule, nhp DNS Outbound
Next
- Mn hnh Rule Action, chn Allow
Next
Trang 150/250
- Mn hnh Protocols, chn Selected Protocols
Add
- Chn DNS
Add
Close
Trang 151/250
- Mn hnh Access Rule Source
Add
- Chn Internal
Add
Close
Trang 152/250
- Mn hnh Access Rule Destination
Add
- Chn External
Add
Close
Trang 153/250
- Mn hnh User Sets
Next
- Mn hnh Complete
Finish
Trang 154/250
- Tng t, to thm 1 Access Rule, t tn l Web Access
Trang 155/250
- Mn hnh Protolcols
Add
- Chn HTTP v HTTPS
Add
Close
Trang 156/250
- Next
- Mn hinh Malware Inspection, chn Enable malware inspection
Next
- Mn hnh Access Rule Sources
Add Internal
Trang 157/250
- Mn hnh Access Rule Desninations
Add External
- Mn hnh User Sets
Next
- Mn hnh Complete
Finish
Trang 158/250
- Chn Apply
Kim tra trn my Client: m IE truy cp vo trang web bt k
Truy cp thnh cng
Trang 159/250
4. Cu hnh chn download file - M Forefront TMG, khung bn tri chnWeb Acess Policy. Trong Action Pane bn phi, chn Configure Malware Inspection
- Qua tab Inspection Settings, mc Block file larger than (MB), nhp vo: 1
Apply
OK
Trang 160/250
- Chn Apply
Kim tra trn Client: Truy cp web
download 1 tp tin dung lng ln hn 1 MB
thng bo li.
Trang 161/250
Trang 162/250
LAB 06 PUBLISH WEB SERVER TRN FOREFRONT THREAT MANAGEMENT GATEWAY

I. M HNH
II. GII THIU Doanh nghip tng cng qung b thng hiu v giao dch vi i tc thng qua trang web. Lab ny k tha m hnh lab 05, thc hin xy dng web server trn server 192.168.11.254, to 1 trang web mc nh v publish (xut bn) trn TMG server. III. CC BC THC HIN 1. Xy dng Web Server trn server 192.168.11.254. 2. Cu hnh Web Publishing Rule trn TMG. 3. Cu hnh NAT Inbound trn Router ADSL.
Trang 163/250
IV. TRIN KHAI 1. Xy dng Web Server - Server Manager Click phi Roles Add Roles
- Next
Trang 164/250
- Chn Web Server (IIS)
-Chn Add Required Features
Next
Next
Trang 165/250
- Next
- Install
Trang 166/250
- Close
- Truy cp C:\InterPub\WWWRoot
To 1 file Text Document
Trang 167/250
- Menu Tools
Folder Options
- B chn Hide extensions for known file types
Trang 168/250
- Chn Yes
- M file text va to
nhp ni dung trang web
Lu thnh file: Default.htm
- Truy cp th website ni b : http://LocalHost
truy cp thnh cng
Trang 169/250
2. Cu hnh Access Rule v Publishing Rule trn Forefront cho Web Server - Click phi Firewall Policy New Website Publishing Rule
- t tn Rule
Next
Trang 170/250
- Chn Allow
Next
- Chn Publish a single Web site or load balancer
Next
Trang 171/250
- Chn Use non-secured connections to connect
Next
- Nhp Fully Qualified Domain Name ca web server
Next
Trang 172/250
- Next
- Chn Any domain name
Next
Trang 173/250
- Chn New
- t tn Port 80
Next
Trang 174/250
- Chn Do not required SSL secured connections with clients
Next
- Chn External
Next
Trang 175/250
- Chn No Authentication
Next
- Chn Port 80
Next
Trang 176/250
- Chn No delegation, and client cannot authenticate directly
Next
- Next
Finish
Trang 177/250
- Apply
OK
5. Cu hnh NAT Inbound trn Router ADSL - Truy cp modem ADSL Status Kim tra IP WAN hin c: 222.254.179.98
Trang 178/250
- Chn Advanced
LAN Clients
nhp IP card WAN ca TMG server:192.168.1.2
- Advanced
Virtual Server
Category
Chn User
Add
- Nhp thng tin nh trong hnh minh ha
Apply Trang 179/250
- Chn Add a rules va to vo Applied Rules
Apply
- Quan st kt qu
ng chng trnh Trang 180/250
- ng nhp vo trang qun tr domain
to thm host WWW tr v IP public
Trang 181/250
Kim tra: Internet client truy cp: http://www.nhatnghe.edu.vn
truy cp trang web thnh cng
Trang 182/250
LAB 07 VIRTUAL PRIVATE NETWORK (VPN)

I. M HNH
II. GII THIU Doanh nghip m rng hot ng kinh doanh v m thm chi nhnh.T , pht sinh mt s nhu cu: Nhn vin lm vic ngoi cng ty cn kt ni an ton n h mng Si Gn. Trao i d liu an ton gia 02 h mng Si Gn & H Ni khi doanh nghip khng c ng thu bao ring. Lab 07 k tha kt qu ca lab 05 v pht trin thm h mng ngang hng ti chi nhnh H Ni. H mng H Ni c network id 192.168.21.0 / 24, gm 01 file server Windows 2008 v 01 TMG firewall. Nhu cu pht sinh nu trn c gii quyt bng cch tn dng ng truyn DSL c sn ti cc chi nhnh thit lp kt ni VPN. VPN server cng chnh l TMG server. III. CC BC TRIN KHAI A. CLIENT GATEWAY 1. Cp php Dial-in cho user KT1. 2. Cu hnh VPN server trn TMG server. 3. To VPN Connection trn Client. 4. Thc hin kt ni & truy cp d liu B. GATEWAY GATEWAY 1. To User & cp php Dial-in. 2. Cu hnh trn server TMG ti Si Gn. 3. Cu hnh trn server TMG ti H Ni. 4. Kim tra: Kt ni VPN c t ng thit lp khi 2 site pht sinh nhu cu truy cp nhau. Trang 183/250
IV. TRIN KHAI CHI TIT A.CLIENT - GATEWAY 1. Cho user quyn dial-in (Thc hin trn DC) - M DSA.MSC Properties account KT1
- Tab Dial-in
Chn Allow Acess
OK
Trang 184/250
2. Cu hnh VPN trn TMG - Chn Virtual Private Network (VPN) tab VPN Clients Configure Address Assignment Method
- Chn Add
Trang 185/250
- Khai bo dy IP chnh xc theo hnh minh ha
OK
- OK
Trang 186/250
- Chn Enable VPN Client Access
- Chn Enable VPN client access
OK
Trang 187/250
- To Access Rule
t tn rule l VPN client
Next
- Chn Allow
Next
Trang 188/250
- Chn All outbound traffic
Next
- Chn Enable malware inspection for this rule
next
Trang 189/250
- Chn Add
- Chn VPN Clients
Add
Close
Trang 190/250
- Chn Next
- Add network Internal
Next
Trang 191/250
- Next
Finish
- Apply
Ok
Trang 192/250
- Truy cp Modem ADSL
NAT port 1723 v card WAN my TMG
3. To VPN Connection trn Client - Start Control Panel Network and Sharing Center
Trang 193/250
- Chn Set up a new connection or network
- Chn Connect to a workplaced
Next
Trang 194/250
- Chn Use my Internet connection (VPN)
- Khai bo public name hoc public IP address ca site SaiGon
Next
Trang 195/250
- Khai bo account KT1 v password tng ng
Connect
Trang 196/250
- Sau khi kt ni thnh cng
truy cp \\192.168.11.254
truy cp thnh cng
B. GATEWAY GATEWAY 1. To User cho php Dial-in - Start Run DSA.MSC
Trang 197/250
- To New User
- Khai bo thng tin chnh xc theo hnh minh ha
Next
- Nhp Password & Confirm Password : P@ssword log on Next Finish
B du check User must change password at next
Trang 198/250
- Properties user HN
- Tab Dial-in
Chn Allow Access
Ok
Trang 199/250
2.Thc hin trn my TMG SITE SI GN - Chn Virtual Private Network (VPN) connection tab Remote Sites chn link Create VPN Site-to-Site
- t tn site l HN
Next
Trang 200/250
- Chn Point-to-Point Tunneling Protocol (PPTP)
Next
- OK
- Chn my TMG
Next
Trang 201/250
- Khai bo public name hoc public IP address ca site HaNoi
Next
- Khai bo chnh xc user name SG v password P@ssword
Next
- Chn Add Range
Trang 202/250
- Khai bo dy IP site HaNoi nh hnh minh ha
OK
Next
- B du chn The remote site is enable
Next
- Chn Next
Trang 203/250
Next
Finish
- OK
- OK
Trang 204/250
- Apply
OK
3.Thc hin ti my TMG SITE H NI - Start Run nhp lnh LUsrMgr.msc OK
Trang 205/250
- To New User
- To user vi cc gi tr chnh xc: user name: SG & password P@ssword password at next logon Create Close
B du User must change
Trang 206/250
- Properties user SG
- Tab Dial-in
chn Allow Access
OK
Trang 207/250
- Chn Virtual Private Networks (VPN)
tab VPN Clients
Configure Address Assignment Method
- Chn Add
Trang 208/250
- Khai bo dy IP chnh xc nh hnh minh ha
OK
- OK
Trang 209/250
- Chn Enable VPN Client Access
- Chn Enable VPN client access
OK
Trang 210/250
- Tab Remote Sites
Chn link Create VPN Site-to-Site Connection
- t tn chnh xc l SG
Next
Trang 211/250
- Chn Point-to-Point Tunnneling Protocol (PPTP)
Next
- Chn OK
- Chn my TMG site H Ni
Next
Trang 212/250
- Khai bo public name hoc public IP address ca site SaiGon
Next
- Khai bo chnh xc: user name: HN & password: P@ssword
Next
- Chn Add Range
Trang 213/250
- Khai bo chnh xc dy IP SERVER ti site SaiGon nh hnh minh ha
OK
- Thc hin tng t thm cc dy IP ca site SaiGon nh hnh minh ha
Next
- B du The remote site is enabled
Next
Trang 214/250
- Next
Next
- Finish
Trang 215/250
- OK
- OK
Apply
Ok
4. Kim tra: - Client ti site HaNoi truy cp \\192.168.11.254 (IP add. Ca Server SaiGon)
Trang 216/250
- Kt ni VPN c thit lp
nhp user name & password
truy cp thnh cng
- Client ti site SaiGon truy cp \\192.168.21.254 (IP add. Ca File server HaNoi) - Ti TMG server HaNoi: Chn Monitoring tab Sessions
thnh cng
Quan st thy kt ni c thit lp.
Trang 217/250
Trang 218/250
LAB 08 CHIA SITE CHO DOMAIN NETWORK

I. M HNH
II.GII THIU Chi nhnh H Ni s dng m hnh Workgroup. S lng nhn vin ti chi nhnh ngy cng tng ln nn pht sinh nhu cu: Ti chi nhnh s dng cng Domain Network vi vn phng chnh qun l tp trung. Tuy nhin vic cc my chi nhnh gia nhp domain tt yu lm pht sinh lung thng tin chng thc trn ng WAN. Gii php: Xy dng thm Domain Controller ti chi nhnh H Ni v chia domain thnh 2 site. Kt qu t c sau khi thc hin cu hnh site l ti u ha bng thng trn ng WAN do 02 yu t: Cc b ha thng tin chng thc. Khng ch hot ng ng b gia 2 DC theo mt lch biu xc nh. Lab 08 k tha Lab 07. Chi nhnh HaNoi gm 01 server Windows 2008 v 01 client Windows 7. III. CC BC TRIN KHAI 1. B sung cu hnh Primary Domain Controller ti SaiGon. 2. Chia site. 3. Nng cp server ti HaNoi thnh Additional Domain Controller. 4. Cu hnh lch biu ng b. 5. Th nghim
Trang 219/250
IV. TRIN KHAI CHI TIT 1. B sung cu hnh trn Primary Domain Controller - Start Run nhp DNSMgmt.msc
- Click phi Forward Lookup Zone
New Zone
- Mn hnh Welcome
Next
Trang 220/250
- Bo m du chn Primary Zone v Store the zone in Active Directory
Next
- Bo m du chn To all DNS servers in this domain: NHATNGHE.LOCAL
Next
- Bo m du chn IPv4 Revese Lookup Zone
Next
Trang 221/250
- khung Network ID, nhp vo: 192.168.21
Next
- Chn Allow only secure dynamic update
Next
- Mn hnh Finish
Next
Trang 222/250
- M Reverse Lookup Zone, kim tra c zone 21.168.192.in-addr.arpa
2. Chia site - Start Run, nhp DSSite.msc
- Click phi Default-First-Site-Name, chn Rename
Trang 223/250
- t tn l 01-SaiGon
- Click phi vo Sites
chn New Site
- khung Name, t tn 02-HaNoi
chn DEFAULTIPSITELINK
OK
Trang 224/250
- OK
- Click phi vo Subnets
chn New Subnet
- khung Prefix, nhp vo 192.168.11.0/24 v chn Site 01-SaiGon
OK
- Thc hin tng t khai bo thm cc subnet 192.168.12.0/24 v 192.168.13.0/24 cho Site SaiGon. Trang 225/250
- Tng t to thm Subnet 192.168.21.0/24 cho Site HaNoi
Trang 226/250
- Kt qu:
3. Nng cp my DC2 thnh Additional Domain Controller - Chnh IP Card LAN theo thng s sau
- DC2 join domain NHATNGHE.LOCAL
Restart
Trang 227/250
- ng nhp bng quyn Domain Admin. Vo Start
Run, nhp DCPROMO
- Mn hnh Welcome
Next
Trang 228/250
- Mn hnh Operating System Compatiblity
Next
- Mn hnh Choose a Deployment Configuration, chn Existing Forest to an existing domain Next
chn Add a Domain Controller
Trang 229/250
- Mn hnh Network Credentials, gi cu hnh mc nh
Next
- Mn hnh Select a Domain
Next
Trang 230/250
- Mn hnh Select a Site
Next
- Mn hnh Additional Domain Controller Options, m bo c du chn DNS server v Global Catalog Next
Trang 231/250
- Hp thoi Active Directory Domain Services Installation Wizard, chn Yes
- Mn hnh Location for Database, Log Files and SYSVOL
Next
- Hp thoi Directory Services Restore Mode Administrator Password
nhp P@ssword
Next
Trang 232/250
- Mn hnh Summary
Next
- Qu trnh nng cp din ra
nh du chn Reboot on completion
- Server restart Logon Domain Admins Start Program Administrative Tools zone NhatNghe.local, kim tra bo m c cc record nh hnh minh ha.
DNS. Trong
- Trong zone _tcp, kim tra bo m c cc record nh hnh minh ha. Trang 233/250
- M Active Directory Sites and Services, kim tra thy trong Site HANOI c ADC01
4. Cu hnh lch biu ng b. - Inter-Site Transports IP Click phi vo DEFAULTIPSITELINK chn Properties
Trang 234/250
- Chn Change Schedule - Chn lch ng b vo 10:00pm n 6:00am cc ngy th Hai, T, Su
OK
- OK
5. Th nghim Gi lp hng ng truyn DSL. Ti site HANOI, log on domain user bt k
Log on thnh cng.
Trang 235/250
Trang 236/250
LAB 09 XY DNG CHILD DOMAIN

I. M HNH
II. GII THIU S pht trin ca doanh nghip lm ny sinh nhu cu phn cp qun l v bo mt, c th l: C th xy dng h thng Account Policy dc lp cho Chi Nhnh. Ti u ha quy trnh ng b (Replication) gia cc Domain Controller trong ton Domain. Hng gii quyt: Xy dng Child Domain trong Site SaiGon Lab 09 k tha Lab 08. Ti SaiGon, xy dng domain controller ca child domain SG.Nhatnghe.Local trn 01 server Windows 2008. III. CC BC THC HIN 1. B sung thng tin trn DNS server ca domain NHATNGHE.LOCAL 2. Nng cp Domain Controller xy dng Child Domain 3. Cu hnh Account Policy ring cho domain SG.NHATNGHE.LOCAL 4. Kim tra
Trang 237/250
IV. THC HIN 1. B sung thng tin trn DNS server ca domain NHATNGHE.LOCAL - Console DNS Click phi Forward Lookup Zones New Zone
- Next
Trang 238/250
- Bo m chn Primary Zone & Store the zone in Active Directory
Next
- Bo m chn To All domain Controllers in this domain
Next
- Nhp zone name: SG.NhatNghe.Local
Next
Trang 239/250
- Bo m chn Allow only secure dynamic updates
Next
- Finish
Trang 240/250
2. Nng cp Domain Controller xy dng Child Domain - Cu hnh IP nh hnh minh ha
- Start
Run
DCPROMO
Trang 241/250
- Next
- Next
Trang 242/250
- Chn Exiting forest
Chn Create a new domain in an exiting forest
Next
- Chn Set
Trang 243/250
- Khai bo account Administrator ca Nhatnghe.Local
OK
- Next
Trang 244/250
- Nhp domain name: SG.NHATNGHE.LOCAL
Next
- Next
Trang 245/250
- Next
- Bo m chn DNS server v Global catalog
Next
Trang 246/250
- Chn Use this specific domain controller
Chn my Primary Domain
Next
- Next
Trang 247/250
- t password : P@ssword
Next
- Next
Trang 248/250
- Chn Reboot on completion
3. Cu hnh Account Policy ring cho domain SG.NHATNGHE.LOCAL - Trn DC ca Child Domain Chnh Password Policy nh hnh minh ha
Trang 249/250
4. Kim Tra - Trn DC ca Child Domain to user vi password n gin thnh cng. - Trn DC ca Parent Domain to user vi password n gin tht bi. - M TCP/IP quan st gi tr DNS c t ng iu chnh
- M DNS ca c 2 DC u c cp nht thng tin trong zone SG.NhatNghe.Local
--
Trang 250/250

Lab 2 K 8

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lab 2 K 8

Uploaded by

Copyright:

Available Formats

TRUNG TM O TO MNG MY TNH NHT NGH I TC O TO CA MICROSOFT TI VIT NAM 105 B Huyn Thanh Quan, Q3, TP.

HCM Tel: 3.9322.735 0913.735.906 Fax: 3.9322.734 www.nhatnghe.com

LAB 01 THIT LP H THNG MNG CHO DOANH NGHIP NH

IP address Subnet mask Default gateway Preferred DNS

- Thc hin ti Server

- Click phi LAN

- Chn Internet Protocol Version 4 (TCP/IPv4)

- Nhp thng s IP nh hnh v

- Thc hin ti Client: Start

Chn Network and Sharing Center

- Chn Change adapter settings

- Click phi card LAN

- Nhp kp Internet Protocol Version 4 (TCP/IPv4)

- Nhp cc thng s IP nh trong hnh

- Chn Run Wizard

- Choose Time Zone

Chn GMT+07:00 (Bangkok, HaNoi, Jakarta)

- Select Internet Connection Type (WAN)

Nhp thng tin do ISP cung cp

Quan st nhn Public IP.

- Th nghim truy cp internet

- Click phi Users

- Nhp Group name: KeToan

- Nhp KT1; KT2

- Hp thoi New Group

Create Trang 13/250

- Hp thoi New Group

Nhp Group Name: NhanSu

- Nhp NS1; NS2

- Hp thoi New Group

Close. Trang 14/250

b. Chia s th mc Data - Click phi th mc Data

Advanced Sharing Trang 15/250

- nh du chn Share this folder

- Chn Full Control ti ct Allow

- B du chn Include inheritable permission

Chn Group Users

Remove Trang 18/250

- Chn Add - Nhp KETOAN;NHANSU

Kim tra thy Group KETOAN v NHANSU c permission Allow Read

- Ln lt cho Group KETOAN v NHANSU quyn Modify

- B du chn Include inheritable permission.

- Chn group NHANSU

Chn group KETOAN

chn Allow Modify

- B du chn 2 Delete subfolders and files v Delete

- Chn Add Printer

- Chn Add a local printer

- Chn my in nh hnh minh ha

b. Ci t Network printer (Thc hin ti CLIENT) - Start truy cp \\192.168.1.253

- Chn Install driver

- Click phi ln printer VIP

- Chn group BanGiamDoc

chn thm Allow Manage printer & Allow Manage documents

Kim tra : Trang 32/250

- Click phi printer VIP

- Khai bo user name: KT1 (& password)

- Kt ni my in Member vi credential KT1

LAB 02 MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN

- Truy cp trang web http://domains.live.com > Chn Get started

- nh du chn mc No mail for my domain... > Continue

- nh du chn mc Create a new Windows Live ID... > Continue

- Nhp cc thng tin theo yu cu > chn I accept