Table of Contents

1. Introduction
1. A Brief History of Windows NT
2. What Is Windows NT?
3. Windows NT Architecture
4. Why Would You Use Windows NT?
5. Why Would You Not Use Windows NT?
6. A Quick Look at Windows NT
2. Installation
1. Before You Start
2. Hardware Requirements
3. File System Options
4. Hard Drive Partitions
5. Bootstrap Options
6. Fault Tolerance Provisions
3. Networking
1. Internet Services
2. Macintosh Support
3. Routing
4. Printing
5. Network Control Panel
6. NT Domains
7. Client Machine Configuration
8. Dynamic Host Control Protocol
9. Browsing
4. System Administration
1. Responsibilities
2. Managing User Accounts
3. Managing User Groups
4. Using Logon Scripts
5. Managing Shares
6. Mapping Share
7. Server Manager
8. Services
9. Installing Applications
10. Disk Quotas
5.  Securing Your Systems
1. File and Directory Level Security
2. Share Level Security
3. Setting Share Permissions
4. Setting File/Directory Permissions
5. Event Logs
6. Emergency Repair Disks
7. Uninterruptible Power Supply
8. Backups
9. Security Pitfalls
10. Choosing Passwords
11. Updating Windows NT
6.  Resources
1.   Publications
2.  Web Sites
3.   Listservs
7. Exercises
1. Exercise One
2. Exercise Two
3. Exercise Three
4. Exercise Four

Introduction

A Quick Look at Windows NT

• Acts as a client or a server depending on your needs.
• Acts as a server for Windows 95, Windows 3.1.x, and Macintoshes.
• Provides central storage and print sharing services.
• Runs on a variety of different networks such as Ethernet, Fast Ethernet, Token Ring.
• Runs on Intel 32 bit platforms as well as the Alpha, MIPS and the Motorola PowerPC platforms (MIPS and PowerPC support has been dropped).
• Supports symmetrical multiprocessing.

A Brief History of Windows NT

What is Windows NT?

• Portable means that it offers support for multiple hardware platforms.  It runs on Intel (486 and up) as well as RISC-based systems (Alpha, MIPS and PowerPC)  Microsoft has dropped the support for MIPS and PowerPC.
• It is Secure software, meeting C2-level security criteria.
• The OS is Compliant with Posix, runs existing Windows applications, and supports open standards.
• Scalable means that it supports symmetric multiprocessing (multiple processors).
• You can add new functionality to the system using API's (Application Programming Interface) which makes the system Extensible.
• It is an International system, which means that it is easily ported to run in different languages and writing systems.
• You can create Fault Tolerant disk configurations with NT.

NT is Not a DOS Shell

Supported Filesystems

Windows NT Architecture

A Modular Architecture

User Mode vs. Kernel Mode

Kernel Mode

• Hardware Abstraction Layer (HAL)
• Microkernel
• Executive Services

The Microkernel is basically the traffic control center of the operating system.  It controls all threads and handles all interupts and exceptions.  In multi-processor systems, the Microkernel is responsible for scheduling all threads between available processors which is called symmetric multiprocessing.  The Microkernel enables the system to act efficiently, by best utilizing all available resources.  It won't let one processor stand idle, while another one does all the work.  Each process is assigned a priority number, which determines how quickly the thread is processed.  You can manually change the priority of a process, but I wouldn't recommend it unless you are an advanced administrator.  If you do reset the priority of a process, the system will set the priorities back to the default settings when you reboot the machine.

Executive Services include essential software services which are invoked by an operating system component.  Examples are I/O Manager, Process Manager, Virtual Memory Manager, and the Graphics Device Drivers and Interface services.  These services are situated just below the System Services, which act as the interface between User mode and Kernel mode.

User Mode

Protected Memory Model and Preemptive Multitasking

Windows NT uses preemptive multitasking to control the use of the processor.  The operating system does not allow a single program to maintain control of the CPU if many other programs also need to execute. Each program gets a small slice of time during which time it may use the CPU.  This is controlled by the Microkernel.

What This Architecture Does For Us

Why Would You Use Windows NT?

• You have an application that only runs on Windows NT.
• You have a new server and it ships with Windows NT.
• You are comfortable with Microsoft's graphical user interface.
• You want to run applications on the server console.
• You need a file and/or a print server.
• You feel that Windows NT is the wave of the future and don't want to be left behind.

Why Would You Not Use Windows NT?

• You have some older hardware or memory constraints but still need a fileserver.
• You wish to be a part of the campus Novell Network Directory Services tree.
• You are familiar with Novell NetWare and its administration.
• You already have licensing for NetWare.
• You have an application that will not run on Windows NT

Installation

Before you Start

• Determine whether your hardware is compatible with Windows NT.
• Decide to use FAT, NTFS or both.
• Decide how you want your disk partitioned.
• Decide what kind, if any, fault tolerance you require.
• Decide which networking parameters you will need:
• What protocols will you use?
• Will you need IPX, NetBEUI, and/or TCPIP?
• Will you be running a Web/ftp/gopher server?
• Will you be supporting Macintoshes?
• Will you be doing networked printing?
• Will the machine be part of a Domain or a workgroup?

Hardware Requirements

File System Options

• file-level security permissions
• long Filename support
• support for software fault tolerance
• file-level compression via an attribute bit
• support for multiple data forks in file (necessary for Macintosh support.)

• NTFS is not supported on floppies.
• Risc systems running NT must boot to a FAT partition.
• In some situations FAT has less overhead and may be a little faster.
• Some 16bit applications may not be certified to run in NTFS and may run better in FAT.

Hard Drive Partitions

Another thing to think about is the fact that Fat partitions can be converted to NTFS with the convert.exe tool but NTFS cannot be converted to FAT.

 FAT will not handle more than 4 gigabytes or 2^32 bytes per partition. NTFS should handle up to 2 terabytes or 2^41 bytes.

Bootstrap Options

If you plan to Dual boot NT and Win95, install Win95 first. Win95 will overwrite the masterboot record and if installed second will overwrite important data for NT.

Fault Tolerance Provisions

• Striping: This allows for faster reads and writes over volumes. Two or more disks or disks and controllers are used to spread a volume over separate drives. This enable more heads to write and read at once. However if one drive goes the entire volume is destroyed.
• Disk Mirroring: This allows a machine with two disks to act as if there is only one and make all writes to both. That way if one disk fails, the other should contain all of the data.
• Disk Duplexing: This is similar to mirroring but uses two controllers. If a single disk or controller goes down the system will still function. Mirroring and Duplexing may increase read speeds with certain hardware. Mirroring and duplexing will generally cut your available disk space in half.
• Disk Striping with Parity:With at least three separate hard drives of the same size, data can be placed on all drives and an algorithm is applied to give fault tolerance and lose only 1/3 to 1/4 of available disk space.

Good server class machines are available with hardware fault tolerance which may be not only safer but also faster. The use of hardware fault tolerance should make your server easier to manage and machines are available with hot swappable drives which may be replaced as the machine is running with no down time and no noticeable performance hit. The system processor isn't burdened with the overhead of the processes because the RAID controller handles the parity.

Networking

• TCP/IP - The major Internet protocol.
• IPX - The main protocal that Novell Netware machines use.
• NetBEUI - The protocol designed to support NetBIOS.

It's important that you get IP addresses assigned to you from your Domain Network Liason or from the Network Information Center (NIC) before you begin installation. You should also request a name from the NIC to correspond to the IP address.

Internet Services

 
• A World Wide Web Server
• An anonymous or non-anonymous ftp server
• A gopher server

Macintosh Support

Routing

Don't.

Printing

Printers that are networked with Microsoft networking require that the printer be shared from a computer via Microsoft networking and are accessible from the server.  This is true even for network attached printers, which have their own network card.  When you install a networked printer on a client, you are actually installing a logical printer which directs the print job to the print server.  This is termed 'connecting to a printer.'  When you install a printer which is physically attached to a computer via a serial cable, it is termed 'creating a printer'. These two terms are often confused.

Windows NT (as well as the 9x's) have a feature called 'Drag and Drop Printing.'  This feature allows you to simply find the printer you wish to connect to using Network Neighborhood and drag it to the desktop which will initiate the installation of the appropriate drivers by the operating system.

Printer Services allow you to expand the client base from which you can print by adding services for Netware and Macintosh clients.  TCP/IP services add LPD (Line Printer Daemon) and LPR (Line Printer Remote) functionality to the NT print system.  This allows Unix and/or TCP/IP clients to print to NT hosted printers It also allows NT clients to print to printers which are hosted by Unix print servers.  Netware hosted printers require that NT has File and Print Services for Netware or that a Netware client be installed on the server. For most NT servers the installation of a Netware client is not recommended.

Network Control Panel

• Identification of the server on the network
• Services available to the server and clients
• Protocols enabled on the server
• Adapters installed on the server
• Bindings of the services and protocols to the various devices on the server

Identification

The Computer Name should be 15 characters or less and should be a unique name on your network (in our case, the campus network)  The Domain can be any existing Domain  within the network or a new Domain.  You may not add a second Primary Domain Controller to an existing domain.

Services

 Certain services are here by default.

• Computer Browser -- allows browsing for other MS networking devices.
• NetBIOS Interface -- Defines an interface and naming convention for MS networking.
• RPC Configuration -- Allows programs to perform programs on multiple computers.
• Server -- Server Support for SMB, the core of MS networking.
• Workstation -- Client support for SMB.

• DHCP agents and servers
• Gateway and client services for Netware
• Microsoft DNS server
• Microsoft Internet Information Server
• Gopher server
• FTP Server
• WWW Server
• TCP printing
• Network monitoring tools and agent
• Routing tools --Don't Install
• Remote Access Service
• Services for Macintosh
• Windows Internet Name Service

Protocols

 The main protocols for use on campus are TCP/IP and IPX/SPX.
NWLink NetBIOS is used to let NetBIOS run across IPX/SPX.

Adapters

Bindings

WinMSD

Link to the  Network Control Panel exercise.

NT Domains

 In order to create a domain, you must start by building a server.  The first server must be configured as the primary domain controller(PDC). This is the central repository of administrative and security information.  The PDC maintains the master copy of the security accounts (SAM) database.  Once the PDC has been created, any machine added to that domain is assigned a unique identifier by the PDC.  Once the PDC has been installed, other servers may be installed as backup domain controllers (BDC) which assist the PDC  in handling authentication.  The BDC replicates administrative information between itself and the PDC. The Netlogon Service on the NT Server performs the task of replication from the PDC to the BDCs. When a password or other security item is changed, it is always changed on the PDC, the BDC merely keeps a copy.

Microsoft recommends one BDC for every two thousand users.  This really depends upon your network.  If you have 300 hundred folks trying to log in at 8am every morning, you may want to add another BDC to help with the load.  If you have multiple locations, you will want a BDC at each location so logon doesn't have to occur over a WAN link.

Its possible that a server is assigned to be neither a PDC nor a BDC and may be installed as a stand-alone server. This is useful for a dedicated Web or Ftp server that needs to use all of its power for performing those tasks and doesn't need the extra load that domain administration might cause.  If you configure a server to be a stand alone server you may not change its status without reinstalling the server.  Thus, assigning server status needs to be well thought out before installation.

A PDC can be moved/renamed to a brand new domain, but not into an existing domain.  A BDC cannot be moved to another domain without reinstalling the server.

Any computer running MS networking that is not in a domain is automatically part of a workgroup (even if it is the only machine in the workgroup.)

Client Machine Configurations

You should set your machine name to its NetBIOS name and set your Workgroup to the name of the Domain you wish to join.   When a client machine is placed in an existing domain you also need to create a Computer account for the machine. You will need a user name and password for an account on the PDC with the rights to create a machine account (usually Domain Administrator.) This can also be accomplished by using the Server Manager for the Domain in which you are adding the computer.

By highlighting the client for Microsoft Networks and clicking on properties you will get the chance to place the Win95 machine into the domain.

Much of this is taken verbatim from the Windows 95 networking configuration document -- http://www.uga.edu/~ucns/lans/docs/win95doc/ -- which covers setting up Windows 95 networking on campus.

Dynamic Host Control Protocol (DHCP)

A static form of DHCP is also a good way to keep NIC and IP records since they should all be in the DHCP data records.

Browsing

System Administration

Responsibilities

• Configuring client workstations.
• Establishing user accounts.
• Creating login scripts.
• Assigning directory rights.
• Setting up and managing the environment.
• Modifying network databases, e.g list of MAC and IP addresses.
• Designing menus and user interfaces.
• Setting up and managing print services.
• Installing application software.
• Maintaining licenses properly for server based applications
• Training users.
• Backing up the file server(s) and possibly workstations too!
• Adding hardware and software upgrades as needed or instructed.
• Anything else that is necessary to secure the server and maintain its usefulness.

Managing User Accounts

Adding a new user is as easy as clicking on "User" and selecting "New User".

The New User dialog will come up and ask you for a username, fullname and password. You will also have the option of setting up password restictions, stating whether or not the password expires and disabling or reenabling the account. After selecting this you might want to add your user to some groups. Click "Groups".

Groups that are already created are shown and can be selected by double clicking or by single clicking and then clicking Add. You can see the groups the user belongs to and also those to which he/she doesn't belong. When you finish click "OK".

After groups you might want to set up some profiles or a home directory. Click "Profiles".

Profiles are simply a place to store a user's preferences. This means that if a user logs into a different machine than normal the desktop should still look familiar. Icons in the same places etc. The login script is a way to map drives for a user and run certain programs when they log in. This help to maintain a steady environment over different machines. The profiles work with Windows NT only. The home directory can be a local or remote directory where things can be stored. It won't be created in a place where the user has no rights.

Click on cancel to return the NEW USER dialogue box.  Click on "Hours".

Here you can set the hours during which users can access the domain.  This only prevents someone from logging in during unscheduled times.  It will not close down an open connection.

Click on Cancel to return the NEW USER dialogue box.  Click on "Logon To".

Here you can decide which machines a user can log in from.

Click on Cancel to return to the NEW USER Dialogue box.  Click on "Account".

You can set an expiration date for an account.  This is useful for temporary employees.

Managing User Groups

Why put users into groups?

• Users need permission to access resources.
• Assigning permissions to each individual user can be a very cumbersome task.
• It is generally easier to place users in groups and then give those groups rights to certain areas.

• Local
• Used in a single domain network.
• Global
• A group of users that can be added to local groups that exist in other domains.

Creating User Groups

Just fill out the name of the group and add the members.

Link to the User/Group Management Exercise.

Using Logon Scripts

 \\system root\system32\repl\import\scripts

Managing Shares

 It is possible to open shares on remote computers using the Server Manager . The computer selected in this example is called Clockwork. By clicking on "Computer" and then on "Shared Directories" you'll see the shares on the machine Clockwork.

Selecting "New Share" will give you the opportunity to add a new share to the machine.

Select your path and share name and click permissions to set them as a share. Then in the Server Manager you should see your new share.

Another way to view the shares on a computer is to double click on the computer in Server Manager.

Select "Shares" to see the available shares.

Mapping Shares

 net use g: \\PDC\Netlogon

Once inside the Browser you can choose the computer.  If it is not visible, doubleclick "Entire Network".  If you are looking for a Windows share doubleclick "Microsoft Windows Network".  Its possible that this window will be skipped if you only have the MS client installed.

Choose the Workgroup or Domain that your target computer is in. In this case the Domain is called UGACLASS.

Pick your target machine. We will use BDC for this example.
 

Then choose the share you wish to map. We'll map to the NETLOGON directory.

Clicking the right mouse button over the NETLOGON icon will give you these options. Choose "Map Network Drive..."

The following window will popup and allow you to choose which drive letter you want to point to it and who to connect as. Leaving this blank will cause it to try your current username and password to access the share. Since this share is on another machine you must authenticate. NT and 95 will try your current name and password by default. Also there is the option to reconnect at logon. This can be both useful but only use this if you want to connect to that share every time you logon.  If you map a drive as an administrator on a user machine, every time that user logs in they will be prompted for a password (yours) to reconnect.

Now L: looks like a regular drive except that instead of a disk drive icon there's a networked drive icon.  As seen in Explorer:

Server Manager

• You can view all users that currently have a session open on any particular computer in the domain
• You may view any resources which are open during each session, the length of time a user has a resource open and how long a session has been idle.
• This is a good tool for viewing the members of a domain, including other domains than the one of which you are currently a member.
• You may obtain information on open file locks, resources, and printers in use.
• This is also a great way to handle shares.  You can set up and manage shares on remote computers including the removal of existing sharesand creation of new shares.
• You can add and remove computers from the domain.
• You may set up alerts which can be received by specific computers regarding system events that you want to monitor.
• It is also possible to set up directory replication with the Server Manager, to force the replication between the PDC and BDCs on the network.
• Promotion and demotion of the PDC and BDC's is also accomplished within Server Manager.

Services

Installing Applications

Can they use the application? If they can't it might as well not be on the server. Often times things will work fine for you logged in as an adminstrator but not for anyone else. For this reason test the program as a regular user. The users must have enough rights for the program to work.

Are you creating a breach in security?  You don't want just any user to write things into the system directory or overwrite the NT kernel with a poorly named MS-Word document. This means that there are certain areas where normal users can't be allowed.  Often it seems that the off-limits areas are exactly where the program wants to write its temp files. In order to fulfill both of your primary duties in this area you have to make a compromise between the amount of useability needed and the value of your data or machine.

Disk Quotas

Securing Your Systems

Share level security applies strictly to users connecting via a network. File and directory level security applies to users local to the machine as well as those who connect via a network.

File and Directory Level Security

R  Read
W  Write
D  Delete
X  Execute
P  Change Permissions
O  Take Ownership

All of these permissions may be set for directories; but they are grouped for ease of use as shown in the following diagram:

Permissions on files are limited to No Access, Read, Change and Full Control.

There is another type of permission which you see above called Special Access.  There is one for files and another for directories.  This allows you to set exactly which permissions you want to set, without using the standard 'sets' of permissions.

Here are some examples of directories and how their permissions should be set:

• Applications -- The applications directory needs to be accessed by eveyone in the Users group. However, this group shouldn't be able to write to or erase anything in this directory.
• Home directories -- Users home directories need to be readable, writeable and changeable to the user. It's also possible that a user might wish to give others access to files or directories within their home directory.
• Dropbox -- A shared directory where all users can create and read but aren't allowed to overwrite existing documents.
• FAT, HPFS, and CDFS (Compact Disc File System) do not provide file and directory level security.
• If a user is a member of two or more groups and they have been granted differing levels of access to a directory, the user will receive the least restrictive level of access. Likewise if a user has been granted explicit rights to a directory but is also a member of a group who has rights to that directory the user will have the least restrictive access.
• The Administrator does not have access to all files and directories on the server. If members of the Administrators group need to access files from a directory they must have explicit access or they must take ownership of the files or directories. By default home directories only give access to the user they were created for.
• Member of the local group Backup Operators bypass file and directory level security in order to back up all files. You do not need to give the group Backup Operators explicit rights to a directory.

Share Level Security

• Full control -- Grants a User or Group viewing, modifying, deleting files and directories, the ability to change into subdirectories, changing file permissions and taking ownership of files. This assumes the user has control at the file level as well. If not the user must stay within the most restrictive set of permission.
• No Access -- Setting no access to a specific user or group denies access to the share, but not necessarily to the directory structure beneath it. It is possible a share further down or up in the directory is accessible.
• Change -- Change at the share level allows for viewing files, changing into subdirectories, running applications, modifying, creating or deleting files and directories if the file level permissions do not preclude it.
• Read -- Read at the share level allows users to view files and directories, change into subdirectories and run applications if the file level permissions do not preclude it.

Setting Share Permissions

To set Share permissions, click on the Permissions button.

You can add or remove permissions for various groups and users.  Click on "Add".  You can list all the users by clicking "Show Users."

Setting File/Directory Permissions

Click on the Security tab and then click on "Permissions".

You should see the following dialogue box:

You may add or remove users and group or alter the permissions for users and groups.

Event Logs

• System Log - for operating system and hardware events
• Security Log - to track audited events and security problems
• Applications Log - monitors application events

Emergency Repair Disks

Setup.log - an information file created during the setup process.
System._ - a copy of the SYSTEM hive from the Registry.
Sam._ - a copy of the SAM from the Registry.
Security._ - a copy of the SECURITY hive from the Registry.
Software._ - a copy of the SOFTWARE hive from the Registry.
Default._ - a copy of the DEFAULT hive from the Registry.
Config.nt - a copy of the Windows NT version of the DOS CONFIG.SYS file.
Autoexec.nt - a copy of the Windows NT version of the DOS AUTOEXEC.BAT file.
Ntuser.da_ - a copy of the default user profile.

When using the Rdisk.exe utility, you have two options.  Update Repair Info and Create Repair Disk.  Make sure that you update the repair information regularly, which updates the %systemroot%\system32\repair folder.  Once updated, use the rdisk utility to create a new Emergency Repair Disk which copies the information from the %systemroot%\system32\repair folder to disk.

Uninterruptible Power Supply (UPS)

System Backups

A good scheme might be weekly full backups and daily incremental backups. You might keep full backups for a month and incrementals for a week. You may also choose to keep duplicate backups or older backups off site. It's also important that your tapes can handle all of the data that you are generating.

Keep the following things in mind:

• You can use the standard NT backup software with most backup devices.
• Backup fully every time you make major changes.
• Do incremental backups often to protect your users.
• Backup more if your data is important.
• Keep some backups offsite in case of fire or theft.

A Security Pitfall inherent in NT

Even though the Administrators groups have full rights, no one can do anything to the directory. Any administrator is also a member of the group Everyone and since Everyone has No Access and No Access overrides all other rights this folder is essentially locked to all.

Remember!  The No Access right supercedes all others. If you give yourself full access to directories below and then no access to the current directory you can't get to the lower directory.

Choosing Passwords

• Do not use your name; first or last
• Do not use your birthday
• Do not use the birthday or name of your spouse or child
• Do not use "password" or "secret" or "love" or any other common word
• Do use a password that can be remembered.
• Do use a combination of letters and digits, such as 1puppy4billy!
• Do use a password that contains at least seven characters

Updating Windows NT

Services Packs are cumulative meaning the latest service pack should contain any "good" or wanted features from previous service packs and the hotfixes which applied to previous service packs. It is generally a good idea to patch to the latest service pack.

Hotfixes are specific patches to bugs or security holes. Many of these patches are very specific to certain applications or security holes. I don't recommend applying all hotfixes unless:

• The hotfix fixes a specific problem that you are seeing.
• The hotfix is reputed to correct some ideosyncracies that you are having.
• The hotfix fixes a security hole that could endanger your enterprise or seriously violate you ability to provide service or privacy to your users.

 Current patches for Windows NT 4.0 can be found at:

 http://harpo.dev.uga.edu/~jones/nt/patches.html
 

Link to the Security Level Exercise

System Policy

Resources

Publications

Windows NT Power Toolkit by Stu Sjouwerman and Ed Tittel (ISBN # 0-7357-0922-x)  Stu runs the NTSysadmin listserv, which I think is the best on the web!  This book stays on my desk.

Windows NT Security Guide by Stephen A. Sutton (ISBN# 0-201-41969-6)  A good read that will help you lock down your NT boxes.

The Windows NT and Windows 2000 Answer Book by John Savill (ISBN# 0-201-60636-4)  John's runs the NTFAQ site and resides in the UK.  There is a very large NT contingent in Brittain.  Another book which never leaves my desk.

Inside Windows NT Server 4 by Drew Heywood (ISBN# 1-56205-860-6)  A concise resource which is well organized.

Windows NT Server 4, Unleashed by Jason Garms, et al. (ISBN# 0-672-30933-5)  I pull this one off the shelf at least once a day.

Microsoft Windows NT Resource Kit,

There are many more great resources on NT.  Check back and you will find more listed here.

The Web

There are so many more sites for find information on NT.  I will continue to add resources to this page, so be sure to check back often.  These sites will MAKE you NT administrators.

Mailing Lists

Use the Knowledge Base and TechNet on the Microsoft website, the search engines at the NT sites I have listed above and most of all, use your books!  The NT books I listed above are great resources.  You don't have to read them cover to cover, in fact, I wouldn't recommend it.  Use them as resources when you see a word that you don't understand or need to clarify some piece of knowledge that you think you know but can't express in words.  Before you know it, you will actually understand about a third of what comes across on the listservs...and if the big guys take your head off for asking an easily researched question, don't say I didn't tell you so!
 

Exercises

Network Control Panel Exercise

1. Go to the "Start" menu and then up to "Settings" and over to "Control Panel". This will open the Control Panel window. Now double-click on the Network Control Panel to open it.
2. Check your adapter type.
1. Note your adapter brand and model.
3. Check the settings on your TCP/IP protocol stack.
1. Double-click on "TCP/IP"
2. Note the WINS Configuration.
3. Click on "OK" to return to the Network Control Panel.
4. Ensure that the Domain is set to UGACLASS.
5. Close the Network Control Panel by clicking on "OK" and reboot your workstation.
6. When the "Enter Network Password" dialog appears ensure that the domain name is "UGACLASS". Enter 'LabX, where x = your station number, e.g. if you are on station 10 enter Student10 (numbered from 01 - 18). Your password is "password".  What would happen if you logged into the Domain 'LabX'?
7. Do you know another way to access the Network Control Panel other than the way we accessed it in this example?
8. Go to the "Start" menu and then to Programs. Open up a DOS prompt and type "net view".  This is a 'command line' tool which allows you to see all shared resources in a domain.
9. Type "exit" at the DOS prompt to close the DOS window.
10. Go to Start/Shut down/ Close all Programs and log on as a different user.
11. Log on as LabX.  What happened?

User/Group Management Exercise

1. Make sure you are logged in as Labx (where x = the number on your workstation).
2. Go to the User Manager for Domains (Start/Programs/Client-based Network Tools)
3. Click User-->New user. 
4. When the New User dialog comes up set up a new user whose Username is userx. Fill out the rest of the dialogue box.
5. Why would you want to create an account that can't change its password?
6. Go into the groups dialog by clicking on Groups. 
7. Make sure UserX is in the group "Domain Users" only.
8. Exit the dialog box by hitting OK.
9. Enter the profiles dialog and map the \\PDC\Home\UserX directory to Z: by using the connect button and filling in the path.
10. Say Ok to exit the dialog.
11. Did it create the Home Directory for you?
12. Say Add to add the user
13. Say Close to exit the New User dialog.
14. Now create another user called NTAdminX (where x is the number of your workstation) and make that user a member of Domain Administrators and Domain Users.  Set the Primary group to Domain Administrator.  Say OK to exit the dialog box.
15. Now add a group ...
16. Click User -->New Global Group.
17. Name the new Global group "GroupX"
18. Add NTadminx and userx to GroupX.
19. Say Ok at the New Global Group.
20. Go to start --> shutdown -->close all programs and log on as another user.
21. Log on as UserX.

Drive Mapping Exercise

1. Logon as LabX.
2. Use the "net use" command to use g: as a pointer to \\PDC\netlogon.
3. Double click on My Computer to see the drive mapped.
4. Use the "net use" command to use h: as a pointer to \\PDC\Apps.
5. type net use /d h: to stop using h: to point to Apps.
6. use h: to map \\PDC\mb

Security Level Exercise

1. Logon as UserX.
2. Use notepad to save a file to your home directory.
3. Close all programs and log on as NTadminx.
4. Try to read the file you just created.
5. Close all programs and log back on as userx.
6. Give (RX)(RX)for your home directory to GroupX.
7. Add another file to your home directory.
8. Give NTadminX read permission for the file and No one Else.