Question

Provide screenshots and detail instructions of how to do the following things in Windows Sever 2016

1. How to create an MMC console

2. How to create user and groups

3. How to add users to groups

4. How to configure NTFS permissions

Answer 1

1.

• In Windows Server 2016, switch to the Start screen and type mmc. In Windows 10, type mmc in the search box on the taskbar.
• Select MMC in the search results pane.
• In the MMC window, press CTRL+M to add a snap-in to the console.
• In the Add or Remove Snap-ins dialog, click Advanced.
• In the Advanced dialog, check Allow changing the parent snap-in and then click OK.
  Add or Remove Snap-ins You can select snap-ins for this console from those available on your computer and configure the selected set of snap-ins. For extensible snap-ins, you can configure which extensions are enabled. Available snap-ins: Parent snap-in: My MMC console Vendor Snap-in Activex Control Authorization Manager Microsoft Cor... Certificates Component Services Microsoft Co... Computer Managem... Microsoft Cor... Device Manager Disk Management Event Viewer Folder Group Policy Object. Microsoft Cor... IP Security Monitor IP Security Policy M.. Microsoft Cor... Link to Web Address Microsoft Cor... Local Backup Description: The Activex Control snap-in enables you to add an MMC node with a results view containing an Activex control. Microsoft Cor... Selected snap-ins: My MMC console Computer Management (Local) Device Manager on local cor Disk Management(Local) Remote servers Local Computer Policy Edit Extension Μσosoft Cor . . ons... Remove Microsoft Cor... Μσοsoft and . . Microsoft Cor... Add > Move Up Move Down Microsoft Cor... Μσosof Cor Advanced... Microsoft Cor... Cancel OK
  
• In the Add or Remove Snap-ins dialog, scroll through the list of available snap-ins and double click Computer Management. In the Computer Management dialog, select Local computer under This snap-in will always manage, and then click Finish.
• In the right of Add or Remove Snap-ins, click the Parent snap-in dropdown menu and select Computer Managementfrom the list.
• In the Add or Remove Snap-ins dialog, scroll through the list of available snap-ins and double click Device Manager. In the Device Manager dialog, select Local computer under This snap-in will always manage, and then click Finish.

What’s important to note here is how Device Manager appears as a child object of Computer Management, and not Console Root. If you want to add another root object, in the right of Add or Remove Snap-ins, click the Parent snap-in dropdown menu and select Console Root from the list. If you have a lot of snap-ins or groups of snap-ins that you’d like to organize in a console, note that there’s also a snap-in called Folder that be added and used to organize snap-ins.

Console1- [My MMC console Computer Management (Local)] File Action View Favorites Window Help My MMC console Name Actions Computer Management (Local) DDevice Manager on local computer DDisk Management(Local) 4System Tools D Task Scheduler DEvent Viewer DShared Folders DLocal Users and Groups DPerformance Device Manager Storage Windows Server Backup Disk Management DServices and Applications D Remote servers Device Manager on local computer Disk Management (Local) System Tools Storage Eb Services and Applications Computer Management (Local) More Actions

• Once you’re done adding snap-ins to the console, click OK in the Add or Remove Snap-ins dialog.
• In the main console window, right click Console Root, select Rename from the menu and give it a name appropriate for your customized console. You can repeat this process for Folder snap-ins.
• Press CTRL+S to save the MMC. In the Save As dialog, choose a location, give the MMC file a name and click Save. The default save location is the Administrative Tools folder.

Further customization options allow you to restrict user access to the console and change the default icon:

• In the console window, click File > Options.
• To change the console icon, click Change Icon in the Options dialog and select one of the available icons, or click Browseto select a .dll file that contains the icon you’d like to use. Click OK when you’re done.
• 

• In the Options dialog, you can choose a Console mode using the dropdown menu. Author is the default mode and allows full access to modify the console. But you can also choose from three different User modes. When you select a mode in the Console mode dropdown menu, a description of what the mode allows the user to do is given.
• When you’re done with all customizations in the Options dialog, click OK.

2.

Right click the Start Menu and choose Computer Management.

M Programs and Features Power Options Event Viewer D System Device Manager Network Connections Ur De Disk Management Computer Management Command Prompt Command Prompt (Admin) For Task Manager Control Panel File Explorer Search Run Shut down or sign out Desktop

In the Computer Management window click on Local Users and Groups and right click the Users folder. Select New User.

Computer Management X File Action View Help Computer Management (Local System Tools >Task Scheduler >Event Viewer Shared Folders Local Users and Groups Performance Device Manager Storage Windows Server Backup Disk Management Services and Applications Actions Name Local Users and Groups Use New User... Grc More Actions Refresh Users Help More Actions Creates a new Local User account

Once you create the user, you can then go to the left pane in the window and expand Local Users and Groups, then, click the Groups folder and double click Remote Desktop Users Group.

Click Add. Then, in the Select Users window you can enter the name of the session you just created in the given field. Click on Check Names next to it and the name will become underlined as an indication that the user was found and accepted.

Computer Management File Action View Help ?E Computer Management (Local System Tools Task Scheduler >Event Viewer Shared Folders Local Users and Groups Actions Description Name Access Control Assist... Administrators Members of this group can remot... Groups Administrators have complete an... Remote Desktop Users Properties 7 Backup Operators Backup Operators can override se... General Certificate Service DC... Members of this group are allowe... Cryptographic Opera... Distributed COM Users Members are authorized to perfor... Users Members are allowed to launch, a... Remote Desktop Users Groups Performance Device Manager Storage Windows Server Backup Disk Management Services and Applications &Event Log Readers Guests Members of this group can read e... Guests have the same access as m... Members in this group are granted the right to logon remotely Description: Hyper-V Administrators Members of this group have com.. lS_IUSRS Network Configuratio... Members in this group can have s... Performance Log Users Members of this group may sche... Performance Monitor Members of this group can acces... Power Users Built-in group used by Internet Inf.. Members Power Users are included for back... Print Operators RDS Endpoint Servers RDS Management Ser... Servers in this group can perform.. RDS Remote Access S... Servers in this group enable users.. Remote Desktop Users Members in this group are grante... Remote Management... Members of this group can acces... Replicator Storage Replica Adm... Members of this group have com... System Managed Ac... Members of this group are mana... Users Members can administer printers.. Servers in this group run virtual m... Supports file replication in a dom... Changes to a user's group membership are not effective until the next time the user logs on. Add. Remove Users are prevented from making.. Cancel OK Apply Help Select Users X Select this object type: Users Builtin security principals Object Types From this location WIN-GG1KDDCU7FT Locations Enter the object names to select (examples): WIN-GG1KDDCU7FT\Station 1 Check Names Advanced Cancel OK

Also, in the instance in which this may be practical, you can set up a general access to all sessions to connect and interact with the server. In such case, in the Select Users window, you can enter the word: Everyone. Click on Check Names and the name will become underlined as an indication that the entry was accepted. Now all connecting sessions will be admitted.

Select Users Select this object type: Users or Built-in security principals Object Types... From this location WIN-GG1KDDCU7FT Locations... Enter the object names to select (examples): Everyone Check Names Advanced... OK Cancel X

3.

just right-click the start menu and then click on Computer Management

Then expand the Local Users & Groups tree and right-click on Users and choose New User:

Fill out the New User form that comes up. remember to check Password never expires at the bottom:

Then click on Create.

If you want to add this account to the Administrators group, then click on on the Groups folder under local Users and Groups and double-click on the Administrators group:

Then click on Add on the screen that popup, type the name of the account you just created, then hit Apply then OK

sign out from your administrator account And login back with the account you just created..

4.

I’ve gone and setup some users and groups to play with inside of an Organizational Unit (OU). Bob and Sam are part of the People group. CEO is part of the CEO grp group. I also have the CEO grp group in the People group so that the CEO can keep an eye on Bob and Sam’s work.

Description Type Name Security Group-Global CEO grp People Security Group - Global User . Bob User CEO CEO. CEO User Sam

I’ve also gone and created some folders within the Shares folder for us to edit the permissions of.

Name Date modified Туре 31/08/2017 10:41 Private CEO ONLY Stuff File folder 31/08/2017 10:41. File folder Public 31/08/2017 11:23. Work File folder ...

To change the NTFS Permissions we’ll first need to disable inherited permissions. By default it’ll be on for all folders you create in the Shares folder meaning we can’t remove the Everyone group from subfolders within the Share unless we disable inheritance first.

Local Disk (C:) >Shares PC Date modified Name 31/08/2017 10:41... Private CEO ONLY Stuff Public 31/08/2017 10:41.. 31/08/2017 11:23.. Work Private CEO ONLY Stuff Properties General Sharing Security Previous Versions Customize Object name: C:ASharesPrivate CEO ONLY Stuff Group or user names: & Everyone SYSTEM Administrator Administrators (FISHYAdministrators) To change pemissions, click Edit. Edit... Pemissions for Everyone Allow Deny Full control Modify Read & execute List folder contents Read Write For special pemissions or advanced settings. click Advanced Advanced St OK Cancel Apply

Advanced Security Settings for Private CEO ONLY Stuff C:Shares Private CEO ONLY Stuff Name: Owner Administrators (FISHYAdministrators) Change Auditing Permissions Share Effective Access For additional information, double-click a permission entry. To modify a permission entry, select the entry and Permission entries: Туре Principal Access Inherited from Applies Full control Allow Administrator C:Shares This fol SAllow Full control Administrators (FISHY\Admin... C:AShares This fol Allow This fol Everyone Full control CShares\ Full control Allow SYSTEM CAShares This fol Add Remove View Disable inheritance Replace all child object permission entries with inheritable permission entries from this object OK

X Block Inheritance What would you like to do with the current inherited permissions? You are about to block inheritance to this object, which means that permissions inherited from a parent object will no longer be applied to this object. Convert inherited permissions into explicit permissions on this object. Remove all inherited permissions from this object. Cancel

Once you’ve done that, click OK and you’ll now be able to edit the NTFS Permissions however you like. We can edit the CEO’s folder so that only they have permission to it now.

Private CEO ONLY Stuff Properties General Sharing Security Previous Versions Customize Object name: CAShares\Private CEO ONLY Stuff Group or user names: S&Everyone S&SYSTEM administrator (FISHY\administrator) Administrators (FISHYLAdministrators) To change pemissions, click Edit. Edit... Pemissions for Everyone Allow Deny Full control Modify Read & execute List folder contents Read Write For special pemissions or advanced settings click Advanced Advanced Cancel OK Apply X

Remove the Everyone group, click add and type the group you would like to add.

Permissions for Private CEO ONLY Stuff Security CAShares Private CEO ONLY Stuff Object name: Group or user names: SYSTEM administrator (FISHYadministrator) Administrators (FISHY\Administrators) CEO grp (FISHY\CEO grp) Add... Remove Deny Pemissions for CEO grp Allow Full control Modify Read & execute List folder contents Read Cancel OK Apply X

I did the same to the Work folder, removing the Everyone group and adding the Peoplegroup. Now when the User Sam tries to view the share this is what they see.

Network server-01 Shares Name Public SAM Work

However when the CEO view the share they see this.

Network server-01 Shares Name Private CEO ONLY Stuff Public CEO Work