This chapter from Exam Ref 70-414: Implementing an Advanced Server Infrastructure discusses objectives surrounding server infrastructure management, including designing an administrative model, designing a monitoring strategy, and planning and implementing automated remediation.
The 70-414 exam looks to stretch your understanding of planning, implementation, and management of an advanced Microsoft-based infrastructure. The tools and products included in the exam are used in enterprise-level networks and emphasize automation, high availability, and self-service. The first chapter of this book discusses objectives surrounding server infrastructure management. Within this chapter and indeed the entire book, you’ll find hands-on examples that directly tie to the exam objectives, and you’ll find numerous links to more information on TechNet.
Have you read page xv?
It contains valuable information regarding the skills you need to pass the exam.
Designing an administrative model for an enterprise network involves a large amount of planning, especially in complex or highly structured enterprises. A good administrative model will enable delegation of authority while also enforcing the principle of least privilege. Many organizations have unique needs, but the overall administrative model can follow a common pattern. For example, an organization that’s geographically dispersed may allow personnel at remote locations to change passwords for users at that remote site.
Typical enterprise administrative and privilege models use groups to assign and delegate permissions. Groups save time and administration overhead by combining similar users and computers into one entity that can then be assigned permissions.
This section examines user rights and built-in groups. If you’re unfamiliar with design strategies for Active Directory Domain Services (AD DS), you can find more information in the AD DS Design Guide at http://technet.microsoft.com/library/cc754678.aspx.
Groups can have users and computers and are created as a security group or a distribution group. The security group type is covered in this chapter; distribution groups are typically used to create email distribution lists and aren’t covered in this book. Groups are also scoped, which means that they can apply locally to a computer, to a domain, or to an entire forest. Table 1-1 describes the three types of group scopes available in AD DS.
Members in a Domain Local scoped group can have permissions within the same domain where the Domain Local group is located and can contain any combination of groups with domain local, global, or universal scope.
Members of groups with a Global scope can have permissions in any domain within a forest, but members can come from only the domain within which the group is defined.
Members of groups with Universal scope can have permissions in any domain or forest and can originate from any domain or forest.
Before looking at user rights, it’s important to agree on the definition of a user right. You can find a definition all the way back to Windows NT Server 4.0 in the “NT Server 4.0 Concepts and Planning Manual” on TechNet, where a right is defined as something that “authorized a user to perform certain actions on a computer system.” See http://technet.microsoft.com/en-us/library/cc751446.aspx for more discussion on the definition.
The Back Up Files and Directories right is just one example of this concept. Table 1-2 shows several other security-related user rights available with Windows Server 2012. An abbreviated constant name applies to each of the rights described in Table 1-2. The constant names are used for logging and can also be used for Windows PowerShell, as discussed later in this section.
Applies to Credential Manager during backup-related processes. This privilege is assigned to the Winlogon service only and should not be assigned to the account.
Determines whether a user can utilize protocols related to accessing a given computer, such as Service Message Block (SMB), NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+).
Applies to processes to determine whether they can use a user’s identity to gain access to the privileges granted to that user.
Enables a user to add a computer to a domain.
Enables a user to change the memory used by a process.
Enables a user to start an interactive session.
Enables a user to log on using Remote Desktop Services.
Enables an account to bypass permissions for backup purposes.
Enables an account to traverse an NTFS file system without needing to check the Traverse Folder permission.
Enables a user to change the time on the local computer.
Enables a user to change the time zone on the local computer.
Enables a user to change settings around the pagefile, including its size.
Enables a process to create a token using the privileged account.
Enables creation of global objects.
Enables creation of directory objects.
Enables an account to create a file system symbolic link.
Enables a user to attach to a process for debugging.
Prevents users from accessing the computer.
Prevents an account from logging on using batch-related methods.
Prevents an account from logging on as a service.
Prevents an account from logging on locally at a computer console.
Prevents users from logging on to a computer using Remote Desktop Services.
Enables a user to set the Trusted for Delegation setting.
Allows a user to shut down a computer when connected remotely.
Enables an account to generate audit records in the security log.
Enables a program to impersonate a user or account and act on behalf of that user or account.
Enables a user to increase the size of a working set of a process.
Enables a user to increase the base priority of a process.
Enables a user to dynamically load or unload device drivers.
Enables an account to keep data from a process in physical memory.
Enables an account to log on using batch-related methods, including Task Scheduler.
Enables a service account to register a process.
Enables a user to work with auditing and security log.
Enables an account to modify integrity labels used by Windows Integrity Controls (WIC).
Enables a user to modify non-volatile RAM (NVRAM) settings.
Enables a user to do volume- and disk management–related tasks.
Enables a user to view performance aspects of a process.
Enables a user to use the Windows Performance Monitor tools.
Enables a user to undock a computer without logging on.
Enables a process to replace an access token of a child process.
Enables a user to bypass the normal permission checks when restoring.
Enables a local user to shut down the system.
Enables a user to synchronize service data, such as LDAP directory synchronization.
Enables an account to take ownership of objects in the computer.
As described in Table 1-2, user rights generally shouldn’t be applied to accounts directly, but rather should be granted through the use of groups.
See http://technet.microsoft.com/library/dn221963 for more information on user rights assignment.
Table 1-3 shows the local groups for a computer and the user rights granted to them by default.
See http://technet.microsoft.com/library/cc771990.aspx for more information on default local groups.
AD DS also contains default groups. These groups are placed into either the Builtin or Users container.
Table 1-4 describes the groups in the Builtin container.
Table 1-5 describes the groups in the Users container.
Built-in groups are different from special identities. A special identity is a group for which membership cannot be modified, such as the Everyone group. Special identities include those in Table 1-6.
See http://technet.microsoft.com/en-us/library/cc733001 for more information on special identities.
Microsoft System Center 2012 R2 consists of several products, including Configuration Manager, Operations Manager, Data Protection Manager, Service Manager, AppController, and Virtual Machine Manager (VMM). The products used in the organization determine the delegation structure. For example, certain roles are only applicable for Virtual Machine Manager and others are applicable for Configuration Manager. If the organization doesn’t use VMM, then those roles wouldn’t be used. However, the concepts of delegated authority and role-based administration are applicable no matter what products are being used. This section examines delegation for Configuration Manager and Operations Manager. Other products such as Virtual Machine Manager and Data Protection Manager are covered in other objectives in this chapter.
See http://technet.microsoft.com/en-us/library/65fffa65-5c09-4f6c-82bf-e01d567cda20#BKMK_PlanningForRBA for more information on role-based administration planning.
Security roles, which you might think of like a group in Active Directory, are used to grant sets of permissions to users based on their role. For example, the Asset Analyst role is granted certain permissions to view Asset Intelligence and inventory information. Users can then be given the Asset Analyst role to do their job.
Each security role is granted specific permissions, such as Approve, Create, Delete, Modify, and so on. The permissions apply to specific object types within System Center. There are several built-in security roles that come with Configuration Manager and with other System Center products. The permissions granted to these roles can’t be changed. However, the roles can be copied, and a new role can be built and modified as needed.
Identify tasks. Examine the responsibilities for administrators. For example, you might have administrators that are responsible for client security while others are responsible for software updates.
Map tasks to roles. Determine how the responsibilities connect to built-in security roles.
Assign roles. Assign roles to users. If a user has responsibilities across multiple roles, assign that user to multiple roles.
Create new roles (optional). Create new roles if the responsibilities don’t map to one or more of the built-in roles.
Computers and users are grouped into collections in Configuration Manager. Collections are important in the hierarchical delegation of administration for Configuration Manager. Collections can be created to meet the needs of the organization. For example, you might create a collection for each physical location in an organization, or you might create a functional collection that includes all servers or all client computers. Like security roles, there are several built-in collections that can’t be modified. Collections become very useful when you want to distribute software, provide reporting, or ensure configuration changes are consistent across the devices within the collection.
See http://technet.microsoft.com/en-us/library/gg682177 for more information on collections.
Security scopes can be used to grant access to securable objects by type. Security scopes provide granular access control. However, security scopes can’t be nested or used in a hierarchical manner. Security scopes are useful for segregating objects of the same type so that different levels of access can be granted to them. For instance, if a set of administrators should be granted full access only to non-production servers, the servers can be scoped to separate production from development servers.
All Includes all scopes. Objects cannot be added to this scope.
Default Installed with Configuration Manager, the default scope also includes all objects.
Security scopes are configured within Configuration Manager in the Set Security Scopes dialog box found in the Classify group.
Hierarchical structure is important for designing a delegated administration for System Center. When it is properly structured, you can delegate responsibilities merely by using scopes and security roles. However, as the organization’s needs change, so too will the needs for delegated administration. For example, if a merger takes place, the newly merged company may need to manage its own site.
Who Who is responsible for managing a given client computer or server? Determine the various tasks involved in administration, whether that’s software updates, security, or anything else that System Center can do. These tasks will map to security roles.
Which and Where Which computers, servers, or other objects will those people manage, based on their roles? Where are those objects located, both physically and logically? For instance, there may be different responsibilities based on physical location or logical location (production versus test). Collections are used to group the objects together in Configuration Manager, and security scopes can be used to provide more granular control over the objects.
What What permissions do administrators need on a given object? Permissions can be changed within the security roles, and their scope can be limited through security scopes.
System Center 2012 R2 Configuration Manager is an important piece of enterprise IT management. Configuration Manager provides a unified solution for management of operating systems, devices, software updates, asset inventory, and more. Using Configuration Manager, an enterprise can deliver software to devices within the organization and ensure consistency of updates and configurations. Configuration Manager also integrates with other System Center products and with other services like Windows Intune.
Configuration Manager can be configured as a standalone set of services or in a hierarchy, known as primary site and central administration site, respectively. The primary site-only scenario is useful for small implementations or small networks, whereas the central administration site scenario is useful for larger enterprises, especially those that need hierarchical or delegated management.
Within Configuration Manager, site system roles are used to define what tasks the various servers perform within a site. Site system roles shouldn’t be confused with role-based administration, which is also covered in this section. Table 1-7 describes some of the typical site system roles.
A basic service that is responsible for running Configuration Manager services. This role is automatically installed for all roles except the distribution point role.
The server that runs the SQL Server database and is used to store information and data related to the Configuration Manager deployment.
The server from which the core functionality of Configuration Manager is provided.
The site system role is a basic role installed on any computer hosting a site system.
Provides the interface between the Configuration Manager console and the site database. Note that the SMS Provider role can be used only on computers that are in the same domain as the site server.
Multiple site system roles typically run on a single server, especially in new or small implementations of Configuration Manager. Additional servers can be deployed as distribution points to ensure availability of software packages and related files or to provide those files at strategic locations. For example, you might place a distribution point close to a large number of client computers.
Aside from the core site system roles, other site system roles may be used. Table 1-8 describes some other site system roles.
Responsible for providing information from the Software Library to the Application Catalog website.
A website that displays available software from the Application Catalog.
Exchanges Asset Intelligence information with Microsoft.
New for System Center 2012 R2, this role provides for communication for devices using Simple Certificate Enrollment Protocol (SCEP) with Network Device Enrollment Service. This role cannot exist on the same server as the computer running Network Device Enrollment Service.
A role that holds software packages, updates, system images, and other files for clients to download.
Accepts Endpoint Protection license terms and configures default membership for Microsoft Active Protection Service.
Enrolls mobile devices and Mac computers using public key infrastructure and also provisions Intel Active Management Technology computers.
Manages enrollment requests for mobile devices and Mac computers.
Monitors client installation and identifies clients that can’t communicate with their management point.
A role that interacts with client computers to receive configuration data and send policy and service location information.
Configures Intel AMT computers for out of band management.
A role that creates and manages Configuration Manager reports. This role works with SQL Server Reporting Services.
Together with Windows Software Update Services (WSUS), this role provides software updates to clients.
Holds client user state data during migration to a new operating system.
Validates Network Access Protection (NAP) policies. The role must be installed on a NAP health policy server.
Manages mobile devices with Windows Intune through the Configuration Manager console. This role is available with Service Pack 1 (SP1).
See http://blogs.technet.com/b/hhoy/archive/2012/03/07/role-based-administration-in-system-center-2012-configuration-manager.aspx for more information on Role-Based Administration in Configuration Manager.
System Center 2012 R2 Operations Manager provides monitoring capabilities to computers across an enterprise. The roles necessary within Operations Manager include those to create monitoring configurations, view and edit reports, and provide overall administration, among others.
Each of these built-in user roles can be changed through its properties settings. The scopes can be changed, as can the tasks and dashboards and views available to the user role. This is illustrated in Figure 1-1.
Each of the built-in user roles can contain one or more local or Active Directory–based groups or users. For example, the Operations Manager Administrators user role (shown in Figure 1-1) contains the BUILTIN\Administrators group.
Each of these profiles provides certain privileges that are connected to that profile. For example, the Author profile contains privileges specific to creating monitoring configurations.
See http://technet.microsoft.com/en-us/library/hh230728.aspx for more information on implementation of user roles in Operations Manager.
Maintaining an enterprise server infrastructure can be accomplished in a number of ways, but when considering management solutions that scale to large environments, the System Center 2012 R2 family of products comes to the forefront. For example, with Service Manager, you can create a self-service portal for end users, among other things. Service Manager provides incident and configuration management while enabling visibility into current issues. Service Manager uses a Configuration Management Database (CMDB) to provide a master location for all changes, issues, and requests for an infrastructure. Service Manager integrates with other System Center 2012 R2 products to provide an end-to-end solution.
At a minimum, there are three components to a Service Manager implementation: a management server, a configuration management database server, and the management console. Additional components can be added for things like data warehousing, which then facilitates reporting.
Using the self-service portal, users can find answers to common support questions, change their passwords, create help-desk tickets, and request software. When designing a management structure, you should consider deployment of the self-service portal to ease the burden on IT and the help desk for common requests. The end-user self-service portal requires a Silverlight component to run on the client computer and thus is applicable only to those platforms that can run Silverlight through the browser.
See http://technet.microsoft.com/library/hh667344.aspx for more information on the self-service portal in Service Manager.
System Center 2012 Virtual Machine Manager provides a centralized management console for virtual machines, such as those managed by Hyper-V. VMM manages virtual machines, networks, and storage as resources, which are then configured within the organization. A VMM deployment consists of a management server, database, library (and library server), and console.
Another component of managing the private cloud is App Controller. App Controller looks at service provision from a service-oriented view rather than from a server or software view. In other words, using App Controller you can connect the components that make up a service to facilitate management.
User roles can be created to manage various aspects of private cloud-based virtualization infrastructure. Virtual Machine Manager can be used to create such a delegation, and then App Controller can be used to manage the private cloud.
Rights are managed within the User Roles area of the Security section in the Settings area of Virtual Machine Manager. User roles can be created using individual user accounts or using Active Directory groups. The scope of the user role can then be assigned to the private cloud, as shown in Figure 1-2.
Members that have been assigned to the new user role will be able to log on to App Controller and manage private clouds within the user role scope.
An alternate method to assign access is by clicking Assign Cloud from the VMs and Services section in Virtual Machine Manager. Doing so enables you to select the user role to be assigned privileges for a given cloud or to create a new user role for the private cloud, as shown in Figure 1-3.
See http://technet.microsoft.com/en-us/library/hh221343.aspx for more information on rights delegation.
In the following thought experiment, apply what you’ve learned about this objective to predict what steps you need to take. You can find answers to these questions in the “Answers” section at the end of this chapter.
You’re working on delegating administrative authority for your Configuration Manager deployment. You need to enable certain individuals to apply updates to test computers and, once tested, enable another set of individuals to apply those updates in the production environment.
Describe the overall concepts and types of configuration items that you’ll use in Configuration Manager to facilitate this design.
User rights and built-in groups can be used to provide a robust administrative model.
Certain user rights shouldn’t be assigned to users or groups but are instead used by system processes and functions.
Built-in groups have certain user rights inherently assigned to them.
System Center 2012 R2 can utilize a delegated administration structure that enables separation of responsibilities within an infrastructure.
Security roles, security scopes, and collections are all used to facilitate the delegated administration structure necessary.
Determining who, which and where, and what can be helpful for designing a delegation of role structure.
Service Manager is used to provide end-user self service.
Service Manager requires at least three servers to run including a management server, configuration management database server, and console.
Answer the following questions to test your knowledge of the information in this objective. You can find the answers to these questions and explanations of why each answer choice is correct or incorrect in the “Answers” section at the end of this chapter.
Which of the following permissions allows the currently logged on user to shut the computer down?
Which of the following is not a privilege of the built-in Backup Operators group?
Which of the following roles provides the core functionality for System Center?
Which of the following are not built-in security scopes in Configuration Manager?