11 DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE Chapter 7 Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE2 GATHERING AND ANALYZING DESIGN INFORMATION Administration model Active Directory structure Security group structure Group Policy structure User job roles Hardware resources Physical topology Forest and domain design Administration model Active Directory structure Security group structure Group Policy structure User job roles Hardware resources Physical topology Forest and domain design Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE3 CHOOSING AN ADMINISTRATION MODEL Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE4 UNDERSTANDING ORGANIZATIONAL UNITS Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE5 STANDARD MODELS FOR OU STRUCTURE Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE6 USING OUs TO DELEGATE ADMINISTRATIVE CONTROL Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE7 ENVISIONING THE OU STRUCTURE Physical locations Types of administrative tasks Types of objects Physical locations Types of administrative tasks Types of objects Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE8 PLANNING FOR INHERITANCE Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE9 USING OUs TO LIMIT OBJECT VISIBILITY Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE10 ORGANIZATIONAL UNITS AND GROUP POLICY Create GPOs for OUs as needed Add OUs to support Group Policy as needed. For example: Subdivide OUs so that you can apply different policies to different groups of users Create new OUs based on location Create new OUs based on the type of objects that will be stored in the OU Create GPOs for OUs as needed Add OUs to support Group Policy as needed. For example: Subdivide OUs so that you can apply different policies to different groups of users Create new OUs based on location Create new OUs based on the type of objects that will be stored in the OU Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE11 OU STRUCTURE AND GROUP POLICY Security requirements Administration requirements Software deployment and update requirements Planned network infrastructure Security requirements Administration requirements Software deployment and update requirements Planned network infrastructure Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE12 DETERMINING DESIGN REQUIREMENTS Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE13 SECURITY REQUIREMENTS Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE14 ADMINISTRATION REQUIREMENTS Planned administrative model and roles User requirements Computer requirements Remote office requirements Planned administrative model and roles User requirements Computer requirements Remote office requirements Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE15 SOF T WARE DEPLOYMENT AND UPDATE REQUIREMENTS Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE16 GROUP POLICY DESIGN CONSIDERATIONS Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE17 INHERITANCE AND FILTERING METHODS Group Policy inheritance review Security filtering through access control lists (ACLs) Windows Management Instrumentation (WMI) filters User Group Policy loopback processing mode Block Policy Inheritance Group Policy inheritance review Security filtering through access control lists (ACLs) Windows Management Instrumentation (WMI) filters User Group Policy loopback processing mode Block Policy Inheritance Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE18 PERFORMANCE CONSIDERATIONS Limit the number of GPOs Consider slow links Limit how often GPOs are updated Group Policy and slow link detection Disable unused portion of GPO (Computer Settings | User Settings) Monitor and track usage Limit the number of GPOs Consider slow links Limit how often GPOs are updated Group Policy and slow link detection Disable unused portion of GPO (Computer Settings | User Settings) Monitor and track usage Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE19 TESTING AND MAINTENANCE OF GROUP POLICIES Group Policy backup procedures Administrative strategy Change management plan Group Policy backup procedures Administrative strategy Change management plan Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE20 DEVELOPING AN ADMINSTRATIVE STRATEGY Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE21 DEVELOPING A CHANGE MANAGEMENT PLAN Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE22 GROUP POLICY IMPLEMENTATION FOR NEW USERS New computers and users added to default locations unless otherwise specified. Redirusr.exe Redircomp.exe Allows you to immediately apply user- and computer-specific GPOs to new objects. New computers and users added to default locations unless otherwise specified. Redirusr.exe Redircomp.exe Allows you to immediately apply user- and computer-specific GPOs to new objects. Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE23 FINALIZING THE GROUP POLICY DESIGN Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE24 PLANNING AN ACCOUNT STRATEGY Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE25 ACCOUNT NAMING STRATEGIES Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE26 PLANNING A PASSWORD POLICY Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE27 CREATING AN AUTHENTICATION, AUTHORIZATION, AND ADMINISTRATION STRATEGY Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE28 DESIGNING A SECURITY GROUP STRATEGY Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE29 SECURITY GROUP STRATEGY (continued) Chapter 7: DESIGNING AN ADMINISTRATIVE SECURITY STRUCTURE30 SUMMARY Gather information before making your design plans Name some factors that influence OU design Give some examples of IT administration models Top-level OU structure should be relatively static Identify and plan for security threats Carefully assess user and computer requirements Separate users, groups, and permissions to increase the efficiency of network administration Gather information before making your design plans Name some factors that influence OU design Give some examples of IT administration models Top-level OU structure should be relatively static Identify and plan for security threats Carefully assess user and computer requirements Separate users, groups, and permissions to increase the efficiency of network administration