Hey everybody welcome back to the next video.
So in this video we're going to be going over the 80 Treme what is so a way for us to view this tree
or to manage Active Directory is to use the Active Directory using computers application.
So now we click on the start menu and we go to administrative tools just like we've done before will
notice that there's a quite a few extras on here such as let's see here.
Eighty eight CSI after director uses a computer's sites and services modules domains and trust DNS.
These are all new.
But we're going to be focusing on in this video is active directory using computers so we'll go ahead
and open that and we'll give it a second.
Perfect.
So what this is doing is it's going to show us our domain.
So red team nation dot local.
Now if we open this up we're going to see that we have what looked like a few folders.
Right.
So with six folders now each folder is called is called an O U.
It's not actually a folder.
Now you can think of these as branches as well.
So this is the trunk of the tree resignation at local and then built in is a branch.
Computers is a branch domain.
Jaws is a branch but each branch may have sub branches as well.
So these are called organizational units or use.
It's important to understand that concept.
They're not folders there.
Oh yes.
So when you ask when you talk to somebody about an active directory you're going to be referring to
it as an oh you not a folder or a branch.
So let's go do a quick overview of the of the base levels here.
So we have built in which is the built in user accounts.
I'm sorry the built in user groups for Active Directory.
So we have things like administrators guests hyper we want to see here performance users standard users
terminal users remote desktop.
So it's got a good good amount and it's also got a description for each one.
If you need to have a quick look at some of these.
So for example if we opened up administrators we can see the members include our administrator account
and everybody with the user's domain with the look the group domain admin
and standard users.
Yeah.
So there's our brand name brand and user.
And then we also have domain users.
So it's important to note that the default going here and that's why it's under built in.
Next we have computers now if we had a Windows desktop added to the domain we would see the computer
here which we'll go over later.
But understand that we can add that when we add a computer to a domain.
It pops up here.
Next we have the domain controller.
So we have the actual domain controller itself has an entry into the act directory.
So if we added two of them you would see the other one pop up here.
So if we do a quick look at this we get some general information such as the full DNS name.
It's a global catalog and it's the first site we had the operating system.
And it's a member of the group called domain controllers.
There's no delegations.
We didn't set anything like that.
Location is fine managed by spying and dialogue as default for not doing anything with it.
So it's important thing.
So if you remove this it would remove that bombing controller from the domain.
It's not a good way to do it but it doesn't stop the other domain controller that you remove on the
machine itself from thinking it's part of the domain.
So that's a way you'll end up breaking quite a few things.
So we're going to skip over foreign Principi for security principles and for managed servers account
service accounts there's a special type of account that you're allowed to use that you can use without
a password.
I'm not going to go into it specifically because it's a little bit out of the scope for here but it
a lot think of this as it allows it a service account to be used on a windows service without having
to supply the password to the service every single time.
Next.
Next up we have users so we can see our administrator which is our default one was added to domain admin
our regular user was added to the user to a standard user group.
Now we've got a few groups in here as well but we've also got a few users of guest is disabled default
account is disabled.
We have our standard user and our administrator.
Now if we wanted to add a user like we did before it's just as easy as right clicking on user so you
want.
We want to add it to this or you or if you click directly on it we can come in here and click No.
And then we'll do user come in here we give it test one
last name as does two then we'll use the user name test so we can see its test at resignation and local
and then like we saw with administrator.
This is our full user name user it will change that and we'll just give it a random password and go
in and put next and finish that's it.
Now this user test is just a standard user nothing nothing special about this individual.
They are a member of domain users.
So there is they're able to log into the domain.
So if we click here and we do domain admin we now have the test user as a domain Edmonds.
They have the full rights to the domain.
Now like I said what the value is we can always add more so we can add one here and just do new organizational
unit.
We're gonna go over this protect from accidental deletion later but we'll say test oh you go ahead.
Okay perfect.
And then we can even go inside of here and create another.
Oh you so we'll do a test to you perfect and we can create whatever we want.
So this is a structure that allows you to kind of do whatever you want with it so you can organize this
however you want.
Yes.
3 Next we'll do just another password.
Then we see now we've got a user in this group instead of stuck in the user.
So if you wanted to organize this by let's say this was Mountain View and then you had another oh you
appear or let's say this is sites right.
So then you have Mountain View New York City Sydney whatever whatever case an office you want then you
can have the users underneath that based on their group so you can have a security group.
You can have a developers group so you can break it down as much as you want the same thing goes with
computers.
You tend to want to make jeweller's alone but in larger environments you can again move it just understand
that you can create 0 use as much as you want.
But one interesting note is you won't be able to just delete it.
Now I'm going to go over that in different video.
So if you created an o you for example or just show this real quick.
So if you create an organizational unit and you did not check that folder we created that we can indeed
go ahead and just delete it because there is no protection on it.
But the protection is there to save you from yourself because there's a lot of instances where you do
not want to delete something because there might be some policy restrictions which will over later around
it or it might be used by an application.
It's it's saving you from from fat fingering something so you don't want to actually hit the delete
button on accident because when it deletes it it deletes all of the ideas associated with it.
And that is you can't just you can't just undo that.
It's not a it's not a.
You'd have to rebuild everything right at all policies and rebuild everything from inside of it that
was inside of the unit so just keep in mind play around with creating a few a few organizational units
or use.
Give it a different data structure what I want you to do is take a second and build something with built
the first one called site name and then the followed by three or four different locations and then inside
of each one of those have a development a security and an H R O U and then throw some test users in
there just so you can kind of understand the structure.
You can even put groups in there as well and make your users part of the development group as well.
So go ahead and play around this get familiar with O use in traversing and see what each thing has.
So open up.
Open up your group so domain controllers.
We have our members we have our one.
So get familiar with the area and especially with the user accounts get familiar with what options you
have for the user.
And you can also right click to double check select resetting passwords and disabling the account etc.
go out and play around with it let us know in the Facebook group if you have any issues.