Lab 2 K 8

TRUNG TM O TO MNG MY TNH NHT NGH
I TC O TO CA MICROSOFT TI VIT NAM

105 B Huyn Thanh Quan, Q3, TP. HCM
Tel: 3.9322.735 0913.735.906 Fax: 3.9322.734 www.nhatnghe.com
LI M U
Hin nay cc doanh nghip u s dng my tnh v cc ng dng trn my tnh nh mt cng c lm
vic thit yu. iu cng ng ngha vi vic xy dng, qun tr v pht trin h mng my tnh l mt
cng tc c nh hng quan trng n hot ng sn xut kinh doanh.
Cng ty MICROSOFT Vit Nam phi hp cng Cng Ty C Phn Gio Dc NHT NGH bin son b
sch XY DNG QUN TR - M RNG H MNG MY TNH DOANH NGHIP TRN
NN WINDOWS SERVER 2008 V WINDOWS 7 vi mong mun:
- Cung cp cho cc Qu c gi mt tm nhn tng quan v cc khun mu chi tit trong vic xy
dng v pht trin h mng doanh nghip trn nhiu quy m khc nhau.
- Gii thiu hai h iu hnh Server v Client mi nht ca Microsoft: Windows Server 2008 v
Windows 7 vi nhiu tnh nng vt tri so vi cc phin bn trc.
B sch ny m phng thc t pht trin h mng my tnh ca mt doanh nghip, t lc khi u (mng
n gin ti mt vn phng) cho n khi ln mnh (mng phc tp ti nhiu chi nhnh):
Lab 01: H mng ngang hng, chia s ti nguyn trn c s Local User.
Lab 02: Trin khai h thng Mail Online nh dch v min ph Windows Live Custom Domains ca
Microsoft.
Lab 03: H mng domain, qun l tp trung, trin khai cc ng dng t ng, kh nng bo mt cao.
Lab 04: Doanh nghip m rng quy m dn n nhu cu tch h thng mng thnh nhiu phn on
c th hp l ha bng thng, v khng ch truy cp.
Lab 05: Ci t v cu hnh Microsoft firewall Forefront Threat Management Gateway (TMG) bo v
h mng, chng li cc cuc tn cng t bn ngoi v kim sot truy cp internet ca nhn vin.
Lab 06: Xy dng web server v publish trn TMG server p ng nhu cu qung b thng hiu,
giao tip i tc v to thun li cho cng vic ca nhn vin.
Lab 07: Trin khai VPN server trn TMG server gip nhn vin t internet c th kt ni vi mng
ni b mt cch bo mt v kt ni cc chi nhnh ti cc v tr a l khc nhau vi chi ph thp
nht.
Lab 08: Tng kh nng chu li ca h mng bng cch xy dng additional domain controller.
Lab 09: Xy dng child domain p ng cc nhu cu a dng v qun l v bo mt.
Hai h iu hnh Windows Server 2008 v Windows 7 c rt nhiu u im v chi tit m b 09 bi lab
ny khng th trnh by y c. V th, chng ti rt mong nhn c phn hi v gp t Qu c
gi cc phin bn sau c th hon thin hn. Xin vui lng lin h ti:
- Din n: http://www.nhatnghe.com/forum
- E-mail: info@nhatnghe.com
- Hot line: 08 393 22735
Chng ti xin chn thnh cm n ng Phng Phc Linh, Partner Strategy & Program Manager Microsoft Vit Nam v ng Trn Vn Hu, Gim c cng ty Nht Ngh c nhng h tr thit thc
trong sut qu trnh bin son b sch ny.
Xin hn ti ng Qu c gi trong nhng b sch khc v cng ngh mng Microsoft.
Nhng ngi thc hin:
1. Nguyn Trnh Khnh Vn MCITP EA
2. Nguyn Mnh Trng MCITP EA
3. L Ngc Hin MCT
Tp. H Ch Minh, thng 10 nm 2009.
Trang 1/250

Trang 2/250

MC LC
LAB 01
THIT LP H THNG MNG CHO DOANH NGHIP NH ................................................ Trang 05
LAB 02
MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN .................................................... Trang 35
LAB 03
GII THIU H THNG MNG DOMAIN DNG TRONG QUN L DOANH NGHIP .. Trang 47
LAB 04
H THNG MNG NHIU NETWORK ................................................................................... Trang 117
LAB 05
CI T V CU HNH FOREFRONT THREAT MANAGEMENT GATEWAY (TMG)... Trang 127
LAB 06
PUBLISH WEB SERVER TRN FOREFRONT THREAT MANAGEMENT GATEWAY .... Trang 163
LAB 07
VIRTUAL PRIVATE NETWORK (VPN)................................................................................... Trang 183
LAB 08
CHIA SITE CHO DOMAIN NETWORK.................................................................................... Trang 219
LAB 09
XY DNG CHILD DOMAIN................................................................................................... Trang 237
Trang 3/250

Trang 4/250

LAB 01
THIT LP H THNG MNG CHO DOANH NGHIP NH
I. M HNH
M hnh dng 02 my tnh v 01 router ADSL cng kt ni vo 1 switch:
- Server: Windows 2008
- Client: Windows 7
II. GII THIU

Gii php cho Doanh nghip nh vi cc yu cu c bn nh:
- Chia s d liu, chia s my in.
- Truy cp internet vi 1 ng truyn ADSL
III. CC BC TRIN KHAI
1. Cu hnh IP.
2. Cu hnh Router ADSL Th truy cp internet
3. To local user account & group
4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s.
5. Cu hnh Print Server - Thit lp u tin v permission trn printer.
IV. TRIN KHAI CHI TIT
1. Cu hnh IP
IP address
Subnet mask
Default gateway
Preferred DNS
Server
192.168.1.253
255.255.255.0
192.168.1.1
203.162.4.190
Trang 5/250
Client
192.168.1.10
255.255.255.0
192.168.1.1
203.162.4.190

- Thc hin ti Server Start Settings Network Connections
- Click phi LAN Properies
- Chn Internet Protocol Version 4 (TCP/IPv4) Properties
Trang 6/250

- Nhp thng s IP nh hnh v OK OK
- Thc hin ti Client: Start Control Panel Chn Network and Sharing Center
Trang 7/250

- Chn Change adapter settings
- Click phi card LAN Properties
- Nhp kp Internet Protocol Version 4 (TCP/IPv4)
Trang 8/250

- Nhp cc thng s IP nh trong hnh OK OK
2. Cu hnh Router ADSL

- Reset router ADSL. Kim tra ng truyn t Client n router (IP mc nh ca Router l 192.168.1.1)
Phi bo m nhn c phn hi t router
- M chng trnh Internet Explorer (IE) Nhp 192.168.1.1 Go
- Nhp username v password ca Router OK
- Chn Run Wizard
Trang 9/250

- Choose Time Zone Chn GMT+07:00 (Bangkok, HaNoi, Jakarta) Next
- Select Internet Connection Type (WAN) Chn PPPoE/PPPoA Next
- Set PPPoE/PPPoA Nhp thng tin do ISP cung cp Next

Trang 10/250

- Setup Completed Restart.
- Tab Status Quan st nhn Public IP.
- Th nghim truy cp internet
Trang 11/250

3. To cc local user & group (thc hin ti Server)

- Start Run Nhp LUsrMgr.msc OK
- Click phi Users New User
- Nhp User name: KT1, Password: 123, Confirm password: 123, b chn User must change password at
next logon Create
- Nhp User name: KT2, Password: 123, Confirm password: 123, b chn User must change password at
next logon Create.
Trang 12/250

- Nhp User name: NS1, Password: 123, Confirm password: 123, b chn User must change password at
next logon Create.
- Nhp User name: NS2, Password: 123, Confirm password: 123, b chn User must change password at
next logon Create Close.
- Click phi Groups New Group
- Nhp Group name: KeToan Add
- Nhp KT1; KT2 Check Names OK
- Hp thoi New Group Create

Trang 13/250

- Hp thoi New Group Nhp Group Name: NhanSu Add
- Nhp NS1; NS2 Check Names OK
- Hp thoi New Group Create Close.

Trang 14/250

4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s.

a. Trong Windows Explorer, to cy th mc nh hnh minh ha.
b. Chia s th mc Data
- Click phi th mc Data Properties
- Tab Sharing Advanced Sharing

Trang 15/250

- nh du chn Share this folder Permissions
- Chn Full Control ti ct Allow OK OK
Trang 16/250

c. Thit lp NTFS permission. Mc tiu: H s ca phng ban no th phng ban qun l.

Thit lp permission trn th mc DATA: ch cho php KETOAN & NHANSU c
- Click phi th mc DATA Properties
- Tab Security Advanced
- Chn Edit
Trang 17/250

- B du chn Include inheritable permission
- Chn Copy
- Chn OK 2 ln
- Chn Edit Chn Group Users Remove

Trang 18/250

- Chn Add
- Nhp KETOAN;NHANSU Check Names OK
Kim tra thy Group KETOAN v NHANSU c permission Allow Read
Trang 19/250

Thit lp permission trn th mc DATA CHUNG: cho php KETOAN & NHANSU c, ghi, xa, sa.
- Click phi th mc DATA CHUNG Properties
- Tab Security Edit
- Ln lt cho Group KETOAN v NHANSU quyn Modify OK 2 ln
Trang 20/250

Thit lp permission trn th mc KETOAN: ch cho php KETOAN c, ghi, xa, sa.
- Click phi th mc KETOAN Properties
- Chn Edit
Trang 21/250

- B du chn Include inheritable permission. Chn Copy OK 2 ln
- Chn Edit
Trang 22/250

- Chn group NHANSU Remove Chn group KETOAN chn Allow Modify OK 2 ln
Thit lp permission trn th mc NHANSU: ch cho php NHANSU c, ghi, xa, sa.
Thc hin tng t trn th mc KETOAN c kt qu:
Kim tra:
- Log on KT1, truy cp vo folder DATA CHUNG v KETOAN, to 1 file bt k to thnh cng
- Truy cp th folder NHANSU, b bo li
Trang 23/250

d. Thit lp NTFS permission. Mc tiu: Cc user ch c th xa ti nguyn do chnh mnh to ra

- Click phi th mc KETOAN Properties
- Chn Edit
Trang 24/250

- Chn KETOAN Chn Edit
- B du chn 2 Delete subfolders and files v Delete OK
- Kim tra: Log on KT2, truy cp vo folder KETOAN, xa th file do user KT1 to khng th xa
Trang 25/250

5. Cu hnh Print Server

a. Ci t Local printer (Thc hin ti SERVER)
- Start Settings Printers
- Chn Add Printer
- Chn Add a local printer
Trang 26/250

- Chn Next
- Chn my in nh hnh minh ha Next
- Printer name : HP Next
Trang 27/250

- Chn Next
- Chn Finish
- Quan st kt qu
Trang 28/250

b. Ci t Network printer (Thc hin ti CLIENT)

- Start truy cp \\192.168.1.253
- Click phi ln my in HP Connect
Trang 29/250

- Chn Install driver Start Printer Quan st thy c my in HP
c. u tin Phn quyn (Thc hin ti SERVER)

Xa printer HP to , to 2 printer mi : VIP v Member
- Click phi ln printer VIP Properties
Trang 30/250

- Tab Security chn Everyone Remove
- Chn Add
Trang 31/250

- Nhp BanGiamDoc Check Names OK
- Chn group BanGiamDoc chn thm Allow Manage printer & Allow Manage documents
- Tab Advanced Nhp gi tr Priority: 99 OK
Kim tra :
Trang 32/250

- Truy cp \\192.168.1.253
- Click phi printer VIP Connect
Trang 33/250

- Khai bo user name: KT1 (& password) OK
- Chn Yes
- Bo li khng c quyn No
- Kt ni my in Member vi credential KT1 Thnh cng.
Trang 34/250

LAB 02
MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN
I- GII THIU
trin khai h thng e-mail vi tn min ring, chng ta c cc gii php nh: Mail Online, Mail
Offline.
Bi lab ny s trnh by cch trin khai h thng mail nh dch v min ph Windows Live Custom
Domains ca Microsoft. Doanh nghip ch phi tr chi ph mua public domain name. Trong bi lab s
dng public domain name NhatNghe.edu.vn.
II- CC BC TRIN KHAI
1.
2.
3.
4.
To account trn trang web domains.live.com

Cp nht d liu DNS ca public domain kch hot account live
Cp nht bn ghi MX ca public domain Kim tra To mail account
Th nghim gi v nhn mail.
III- TRIN KHAI CHI TIT

1.
To account trn trang web domains.live.com
- Truy cp trang web http://domains.live.com > Chn Get started
- Khung Provide your domain name > Nhp tn ca public domain

Trang 35/250

- nh du chn mc No mail for my domain... > Continue
- nh du chn mc Create a new Windows Live ID... > Continue
Trang 36/250

- Nhp cc thng tin theo yu cu > chn I accept
- Quan st kt qu > chn I accept
Trang 37/250

- Ghi nhn cc thng tin trong phn Domain Ownership (DNS record type, Host & Value) > Sign out.
2.
Cp nht d liu DNS ca public domain kch hot account live
- ng nhp trang web qun l public domain.
Trang 38/250

- To mt bn ghi DNS theo thng tin ghi nhn trong phn Domain Ownership > Sign out.
3.
Cp nht bn ghi MX ca public domain & to mail account
- ng nhp trang web http://domains.live.com bng account to phn 1.

- Chn Domain Settings > chn Edit mail settings.
Trang 39/250

- Hp thoi Update mail settings > chn Windows Live Hotmail > OK
- Trong phn Mail setup (required) > Ghi nhn tn ca MX server
Trang 40/250

- ng nhp trang web qun l public domain.
- To bn ghi loi MX tr t public domain name n tn ghi nhn trong phn Mail setup (required) >
Sign out.
Trang 41/250

* Kim tra :
- Start > Run > Nhp cmd > OK
- Nhp cc cu lnh nh hnh minh ha.
Trang 42/250

- To mail account : Quay li trang web http://domains.live.com chn Member accounts > chn Add
- Khai bo cc thng tin Mail account > OK
- Kim tra kt qu : mail account c to.

Trang 43/250

4. Th nghim gi v nhn mail.

- Truy cp trang web : Http://Mail.Live.com ng nhp bng ti khon to trn domain
Nhatnghe.edu.vn
* Kim tra :
- Gi mail ti Gmail thnh cng
- Nhn mail t domain bn ngoi thnh cng

Trang 44/250

Trang 45/250

Trang 46/250

LAB 03
GII THIU H THNG MNG DOMAIN
DNG TRONG QUN L DOANH NGHIP
I. M HNH
M hnh dng 03 my tnh: 01 Server Windows 2008 (c 02 volume C & F) + 02 Client Windows 7 v
01 router ADSL cng kt ni vo 1 switch:
II. GII THIU

H mng workgroup (Lab 01) c li im l n gin, d trin khai nhng khng thun li cho cng tc
qun tr v kh nng bo mt km. Lab 03 k tha m hnh v cc kt qu ca lab 01 nng cp thnh
h thng Domain Network vi cc u im:
Qun l tp trung mi thnh phn trong h thng.
Kh nng bo mt cao nhng thun li nh c ch Single Set of Credential.
Kh nng co gin linh ng cho mi quy m, d dng m rng.
p dng c ch qun l da trn Policy (Policy-based Administration).
Cho php trin khai cc Application tch hp trong AD Database do vy tn dng c c ch
Replication ca AD.
III.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
CC BC TRIN KHAI
Dng domain controller trn my Server vi domain l nhatnghe.local.
B sung thng s DNS server.
Ci t v cu hnh DHCP server trn my Server.
Client nhn IP t DHCP server v gia nhp domain nhatnghe.local.. Client th truy cp internet.
Trn client, ci t cng c qun tr server.
Xy dng cu trc OU, phn b cc user account v group account.
T chc h thng v phn quyn qun tr (Delegate)
To Home Directory cho Domain User
To Roamming Profile cho Domain User
Ci t ng dng t ng, hng lot (Deploy Software)
Kim ton (Audit)
Ngn chn s dng ng dng (Software restriction)
i tn 2 built-in account Administrator & Guest
Ci t my in mng trn hng lot my trm (Deploy Printer)
Sao lu d liu Domain Controller v phc hi khi c s c.
Trang 47/250


1. Dng domain controller trn my Server vi domain name l NhatNghe.local.
- Cu hnh IP nh hnh minh ha
- Start Run nhp DCPROMO
Trang 48/250

- Chn Next
- Chn Next
Trang 49/250

- Chn Create a new domain in a new forest Next
- Nhp DNS domain name NhatNghe.local Next
Trang 50/250

- Chn Next
- Chn Forest functional level Windows Server 2008 Next
Trang 51/250

- Chn Next
- Chn Yes
Trang 52/250

- Chn Next
- Nhp Password v Confirm password: P@ssword Next
Trang 53/250

- Chn Next
- nh du chn Reboot on completion
Trang 54/250

2. B sung thng s DNS server.

a. To reverse lookup zone v pointer
- Start Programs Administrative Tools DNS
- Console DNS Manager Click phi Reverse Lookup Zone New zone
- Chn Primary zone & bo m c du chn store the zone in Active Directory Next
Trang 55/250

- Chn Next
- chn Next
- Nhp Network ID: 192.168.11 Next
Trang 56/250

- Chn Next
- Chn Finish
- Click phi zone 11.168.192.in-addr.arpa chn New Pointer (PTR)
Trang 57/250

- Nhp gi tr host ID: 254 Browse
- Nhp kp vo i tng nh hnh minh ha
Trang 58/250

- Quay li hp thoi New Resource Record OK
b. Cu hnh Forwarder
- Click phi SERVER Properties
- Tab Forwarders Edit
Trang 59/250

- Chn Click here to add Nhp 203.162.4.190 OK
- Chn OK
2. Ci t v cu hnh DHCP server trn my Server.

- Start Programs Administrative Tools Server Manager
- Click phi Roles Add Roles
Trang 60/250

- Chn Next
- Chn DHCP Server Next
Trang 61/250

- Chn Next
- Chn Next
Trang 62/250

- Chn Validate
- Chn Next
Trang 63/250

- Chn Next
- Hp thoi Add orEdit DHCP Scopes > Chn Add
Trang 64/250

- Nhp cc gi tr thng s nh hnh minh ha OK
- Chn Next
Trang 65/250

- Chn Disable DHCP v6 stateless mode for this server Next
- Chn Next
Trang 66/250

- Chn Install
- Hon tt Close
Trang 67/250

4.Client nhn IP t DHCP server v gia nhp domain nhatnghe.local. . Client th truy cp internet.
- Start Control Panel
- Chn Network and Sharing Center
Trang 68/250

- Chn Change adapter settings
- Click phi LAN Properties
- Chn Obtain an IP address automaticcally v Obtain DNS server address automatically OK
Trang 69/250

- Chn Cancel
- Start Nhp cmd (nh hnh minh ha) Enter
Trang 70/250

- Nhp lnh ipconfig /all Enter
- Quan st thy nhn c IP t DHCP server
- Client th truy cp internet thnh cng

5. Trn client, ci t cng c qun tr server.
- Kch hot b ci t Remote Server Administration Tool
- Chn Yes
Trang 71/250

- Chn I accept Hon tt Close
- Kch hot Remote Server Administrative Tool: Start Control Panel Program And Features Turn
On or Off Program and Features nh du chn cc cng c nh hnh minh ha OK
Trang 72/250

- Start Administrative Tools Active Directory Users and Computers: kt ni thnh cng n c s
d liu ca DC.
6. Xy dng cu trc OU, phn b cc user account v group account

- Start Run DSA.MSC
- Click phi NhatNghe.Local New Organizational Unit
Trang 73/250

- Name : Nhatnghe OK
- Click phi Nhatnghe New Group
- t tn KETOAN OK
- Tng t, to group NHANSU

Trang 74/250

- Click phi ln Nhatnghe New User
- Nhp thng tin nh hnh minh ha Next
- Nhp Password & Confirm password: Password Next
- Chn Finish
Trang 75/250

- Tng t, to cc user NS1 v Manager

- Kt qu :
- Click phi Group KETOAN Properties
Trang 76/250

- Tab Members Chn Add
- Nhp KT1 Check Names OK 2 ln
- Lm tng t add user NS1 vo group NHANSU OK
Trang 77/250

7. T chc h thng v phn quyn qun tr (Delegate)

- Click phi OU NhatNghe Delegate Control
- Welcome Chn Next
- Chn Add
- Nhp Manager Check Names OK

Trang 78/250

- Next
- Chn Full Coltrol Next Finish
Trang 79/250

8. To Home Directory cho Domain User

- To th mc Home_Folder Click phi Properties
- Tab Sharing Advanced Sharing
Trang 80/250

- Chn Permission
- nh du Full Control OK OK
- Tab Security Chn Edit

- Chn Users nh du Allow Modify OK Close
Trang 81/250

- Start Run nhp DSA.MSC OK
- Click phi KT1 Properties
- Tab Profile Chn Connect : Z: Nhp : \\192.168.11.254\Home_folder\%UserName% Apply
Trang 82/250

- Quan st phn %UserName% c i thnh KT1 OK
Kim tra : thc hin trn client :

User KT1 log on my client vi M My computer quan st thy c thm 1 a mng Z
Trang 83/250

9. To Roamming Profile cho Domain User

- To th mc Profile Share permission: Everyone Allow Full Control NTFS permission: Users
Allow Modify.
- M DSA.MSC Properties KT1
- Profile path : Nhp \\192.168.11.254\Profile\%UserName% Apply
Trang 84/250

- Quan st thy phn %UserName% i thnh KT1 OK
Kim tra:
- KT1 log on Client 1 Trn desktop to th mc HoSoKT1 Log off
- KT1 log on Client 2 Trn desktop quan st thy c th mc HoSoKT1.
Trang 85/250

10. Ci t ng dng t ng, hng lot (Deploy Software)

- Chp source Office 2003 vo th mc Office2k3 trong C. Share folder Office2k3.
- Kim NTFS Permission: mc nh groups Users Allow Read & Execute.
- M DSA.MSC Computers Click phi ln tn PC Client chn Move
Trang 86/250

- Chn OU NhatNghe OK
- M Group Policy Management
Trang 87/250

- Click phi OU NhatNghe Chn Create a GPO in this domain , and Link it here
- t tn : Deploy Software OK
Trang 88/250

- Click phi ln Deploy Software Edit
- Click phi ln Software installation New Package
Trang 89/250

- Trong phn File name Nhp : \\192.168.11.254\office2k3 Chn file PRO11.msi Open
- Chn Assigned OK
- Quan st kt qu Trn command line nhp lnh GPUpdate /Force
Kim tra : thc hin trn Client

Trang 90/250

- Restart client log on bng account KT1 M menu Start quan st thy Office c ci
11. Kim ton file (Audit File)
- M th mc DATA click phi th mc NHANSU Properties
- Tab Security Chn Advanced
Trang 91/250

- Tab Auditing Chn Edit
- Chn Add
- Nhp Everyone Check Names OK
Trang 92/250

- Chn tt c cc chn la OK
- OK OK OK
Trang 93/250

- Click phi ln Default Domain Policy Edit
Trang 94/250

- Click phi Audit object access Properties
- Chn Define these policy settings Chn Success , Failure
- Trn command line nhp lnh GPUpdate /Force

Trang 95/250

Kim tra :
- Trn my client log on KT1 truy cp vo th mc NHANSU bo li khng c quyn truy cp
- Trn my Server M Event Viewer
- M Windows Logs Security M cc event Audit Failure (& event id 4656)
Trang 96/250

- Quan st thy trng hp truy cp tri php ca KT1 vo th mc NHANSU c ghi nhn li
12. Ngn chn s dng ng dng (Software restriction): Cm mi user thuc OU Nht Ngh khng
c dng Internet Explorer, ngoi tr user Manager.
Trang 97/250

- Click phi ln OU NhatNghe Chn Create a GPO in this domain , and Link it here
- t tn Deny_IE
- Click phi ln Deny_IE chn Edit
Trang 98/250

- Click phi ln New Software Restriction Policies New Software Restriction Policies
- Click phi ln Additional Rule New Hash Rule
Trang 99/250

- Chn Browse
- Tr n C:\Program Files\iexplore.exe Open
Trang 100/250

- OK ng console Group Policy Management Editor
- Chn Deny_IE tab Delegation Chn Advanced
Trang 101/250

- Chn Add
- Nhp Manager Check Names OK
- Chn Deny Read OK
Trang 102/250

- Yes
- Trn command line nhp lnh Gpupdate /Force

- Kim tra (thc hin trn client)
- Log on KT1 : M chng trnh Internet Explorer khng truy cp c
- Log on Manager : M chng trnh Internet Explorer truy cp thnh cng
13. i tn 2 built-in account Administrator & Guest
Trang 103/250

- Click phi ln NhatNghe Create a GPO in this domain , and link it here
- t tn nh trong hnh OK
- Click phi ln GPO va to Edit
Trang 104/250

- Click phi ln policy nh trong hnh Properties
- Chn Define this policy settings t tn mi NguoiQuanTri OK
Trang 105/250

- Click phi ln Policy trong hnh Properties
- Chn Define this policy setting Nhp vo : Khach OK ng cc chng trnh
- Trn command line nhp lnh GPUpdate /Force OK
Trang 106/250

Kim tra : Thc hin trn client

- Restart Client Log on Domain Admins
- Start nhp vo search : LUsrMgr.MSC
Quan st thy 2 account Built-in Administrator v Guest c i tn.
Trang 107/250

14. Ci t my in mng trn hng lot my trm (Deploy Printer)

- Click phi ln OU Nhatnghe Chn Create a GPO in this domain, and link it here
Trang 108/250

- t tn GPO OK
- Click phi Deploy Printer Edit
Trang 109/250

- Click phi ln Printers New Shared Printer
- Khai bo nh trong hnh OK
Trang 110/250

- Kim tra trn client : Log on KT1 Start Devices and Printers Quan st thy my in (HP on
192.168.11.254) t ng connect v client
15.Sao lu d liu Domain Controller v phc hi khi c s c.

A. BACKUP SYSTEM STATE
- Vo cmd, Nhp lnh: wbadmin start systemstatebackup backuptarget:F: Nhp Y tin hnh vic
Backup
- Qu trnh Backup din ra khong 30 pht

Trang 111/250

- M Active Directory Users and Computers, vo menu View Advanced Features
Trang 112/250

- Click phi OU KYTHUAT Properties. Tab Object, b du check mc Protect object from
accidental deletion OK
- Thc hin tng t cho OU GIANGVIEN.

- Click phi vo 2 OU KYTHUAT v GIANGVIEN Delete
Trang 113/250

B. Restore System Sate:

- Trn command line, Nhp lnh: bcdedit /set safeboot dsrepair
- H thng t ng khi ng li ng nhp bng username v password ca Directory Service

Restore Mode ( khai bo khi nng cp DC)
- Xem danh sch cc file backup, Nhp lnh : wbadmin get versions
Trang 114/250

- Chn phin bn backup gn nht, nhp lnh: wbadmin start systemstaterecovery version:02/17/200921:17
Tham s version tng ng vi Version identifier
Nhn Y bt u qu trnh restore
- Ch khong 30 pht qu trnh restore thnh cng.
- tr v ch boot bnh thng, nhp lnh: bcdedit /deletevalue safeboot
- H thng khi ng li ng nhp bng Domain Admin v Password. Hp thoi thng bo System
State c khi phc thnh cng Enter
Trang 115/250

- M Active Directory Users and Computers ln kim tra, thy cc OU c khi phc li nh c
Trang 116/250

LAB 04
H THNG MNG NHIU NETWORK
I. M HNH
II. GII THIU

Trn mt h thng mng c nhiu ti nguyn v c s phn cp trong vic truy cp cc loi ti nguyn,
vic phn chia h thng mng vt l ra cc Network_IDs hoc Subnets khc nhau s em li cc li th:
Trnh hin tng nghn ng truyn do s Hosts trong Logical Network qu nhiu.
Ngn chn cc hin tng lan truyn ton mch (broadcast)
D dng thit lp cc b lc (Filter) nh tuyn khi truy cp ti nguyn.
M hnh di y pht trin t h thng Domain ca Lab 03, phn chia thnh 03 Network_IDs: VIP,
USER, SERVER. S dng :
01 my Windows Server 2008 dng lm Domain Controller ti Network SERVER
01 my Windows 7: dng lm my User VIP
01 my Windows 7: dng lm my User USER
01 my Windows Server 2008 dng lm ROUTER, c 04 NICs:
LAN1: ni trc tip router ADSL
LAN11: ni switch 1 (subnet 1) gm cc SERVER
LAN12: ni switch 2 (subnet 2) gm cc my VIP
LAN13: ni switch 3 (subnet 3) gm cc my USER
Trang 117/250

Cu hnh Router v cc b lc (Filter) sao cho:

Tt c cc Networks (VIP, SERVER, USER) c th truy cp Internet.
Network VIP v USER u c th truy cp Network SERVER.
Network VIP v USER khng th truy cp nhau.
1. Cu hnh router ADSL
Cu hnh IP port LAN: 192.168.1.1/24
Cu hnh ADSL kt ni ra Internet
2. Cu hnh IP cc thnh phn trong h thng mng
IP address
Subnet Mask
Default Gateway
Preferred DNS
ADSL router
192.168.1.1
255.255.255.0
SERVER
192.168.11.254
255.255.255.0
192.168.11.250
192.168.11.254
VIP
192.168.12.10
255.255.255.0
192.168.12.250
192.168.11.254
USER
192.168.13.10
255.255.255.0
192.168.13.250
192.168.11.254
ROUTER
NIC
IP address
Subnet Mask
Default Gateway
LAN1
192.168.1.250
255.255.255.0
192.168.1.1
LAN11
192.168.11.250
255.255.255.0
3. Kch hot router

a. Add role Routing and Remote Access
- Start Programs Administrative Tools Server Manager
- Click phi Roles Add Roles
Trang 118/250
LAN12
192.168.12.250
255.255.255.0
LAN13
192.168.13.250
255.255.255.0

- Hp thoi Before You Begin Next
- Hp thoi Select Server Roles nh du chn Network Policy and Access Services Next
Trang 119/250

- Hp thoi Network Policy and Access Services Next
- Hp thoi Select Role Services nh du chn Routing and Remote Access Next
Trang 120/250

- Hp thoi Confirm Installation Selections Next
- Hp thoi Installation Results Close
Trang 121/250

b. Kch hot router

- Start Programs Administrative Tools Routing and Remote Access
- Click phi server (local) Configure and Enable Routing and Remote Access
- Next
Trang 122/250

- Chn Custom configuration Next
- Chn NAT & chn LAN routing Next
- Finish
Trang 123/250

- Chn Start service
4. Cu hnh NAT outbound

- Start Programs Administrative Tools Routing and Remote Access
- Click phi NAT chn New Interface
- Chn LAN11 OK Chn Private interface OK
- Thc hin tng t vi LAN12 v LAN13. Ch : chn private interface

- Click phi NAT chn New Interface
- Chn LAN1 OK Chn Public interface & nh du Enable NAT OK
Trang 124/250

5. Cu hnh IP packet filter chn thng tin gia network VIP (LAN12) v USER (LAN13)
- Chn General Click phi LAN13 Properties
Trang 125/250

- Chn Inbound Filter chn New
- Chn Destination network Nhp IP address: 192.168.12.0 & Subnet mask: 255.255.255.0 OK
- Chn Receive all except OK 2 ln.
6. Kim tra kt qu
- Cc PC VIP v USER truy cp SERVER: Start Run Nhp: \\192.168.11.253 thnh cng.
- PC VIP truy cp USER: Start Run Nhp: \\192.168.13.10 tht bi.
- PC USER truy cp VIP: Start Run Nhp: \\192.168.12.10 tht bi.
Trang 126/250

LAB 05
CI T V CU HNH
FOREFRONT THREAT MANAGEMENT GATEWAY (TMG)
I. M HNH
II. GII THIU

Khi kt ni h thng mng ni b vi Internet, tt yu pht sinh nhu cu kim sot cc giao dch thc hin
gia mng ni b v Internet.
Gii php thch hp l s dng cc Firewall. Bi lab ny gii thiu vic ci t phn mm Firewall ca
Microsoft: Forefront Threat Management Gateway (TMG) v mt s cu hnh th hin qun tr.
M hnh lab ny k tha v pht trin t m hnh lab 04. Server firewall TMG dng h iu hnh
Windows Server 2008 64 bit c b tr gia software router v router ADSL. Interface LAN kt ni trc
tip vi software router, Interface WAN kt ni trc tip vi router ADSL.
1.
2.
3.
4.
5.
Cu hnh thng s IP ca software router v TMG firewall. B sung route trn TMG server. TMG
server join domain.
Ci t Forefront TMG trn TMG Server.
Ci t Forefront Client trn TMG Client.
Thit lp cc Access Rule cho php truy cp.
Cu hnh chn download file.
Trang 127/250

IV. THC HIN

1. Cu hnh thng s IP Join domain
a. iu chnh IP ca software router v cu hnh IP ca TMG server theo bng sau:
Interface
IP address
Subnet mask
Default gateway
Preferred DNS
Software router
LAN1
10.0.1.250
255.255.255.0
10.0.1.2
TMG
LAN
10.0.1.2
255.255.255.0
WAN
192.168.1.2
255.255.255.0
192.168.1.1
192.168.11.254
b. B sung route trn TMG server

- Start Run Nhp cmd OK Trn Command line ln lt nhp cc cu lnh:
route add 192.168.11.0 mask 255.255.255.0 10.0.1.250 p
route add 192.168.12.0 mask 255.255.255.0 10.0.1.250 p
route add 192.168.13.0 mask 255.255.255.0 10.0.1.250 p
- Trn Command line nhp cu lnh hin th routing table: route print Cc route c b sung.
c. TMG server join domain NhatNghe.Local

Trang 128/250

2. Ci t Forefront TMG trn TMG Server

- Log on TMG server bng user Domain Admins Kch hot tp tin ci t: ISAAutoRun.exe
- Chn Install Forefront TMG
- Mn hnh Welcome Next
Trang 129/250

- Mn hnh License Agreement, chn I Accept the term Next
- Mn hnh Customer Information Next
- Chn Install Forefront Threat Management Gateway Next
- Mn hnh Component Selection Next

Trang 130/250

- Mn hnh Internal Network Add.
Trang 131/250

- Chn Add Range
- Nhp vo dy a ch:
Start Address: 192.168.11.0
End Address: 192.168.11.255 OK
- Tng t nhp ln lt cc dy sau:

192.168.12.0 192.168.12.255
192.168.13.0 192.168.13.255
10.0.1.0 10.0.1.255 OK
Trang 132/250

- Chn Next
- Mn hnh Service Warning Next
- Mn hnh Ready To Install Install
Trang 133/250

- Qu trnh ci t
- Mn hnh Complete Finish
- Chn Exit
- Start Programs Microsoft Forefront TMG Forefront TMG Management

Trang 134/250

- Chn Configure Network Settings
Trang 135/250

- Chn Edge Firewall Next
Trang 136/250

- Mn hnh LAN Settings Chn network adapter LAN Add
- Nhp vo cc thng s sau:

IP Address: 192.168.11.0
Subnet mask: 255.255.255.0
Gateway: 10.0.1.250
- Tng t, nhp thm cc dy IP sau

IP Address: 192.168.12.0
Subnet mask: 255.255.255.0
Gateway: 10.0.1.250
IP Address: 192.168.13.0
Subnet mask: 255.255.255.0
Gateway: 10.0.1.250
Trang 137/250

- Kt qu Next
- Mn hnh Internet Settings chn network adapter WAN Next
Trang 138/250

- Chn Configure System Settings
Trang 139/250

- Mn hnh Host Identification Next
Trang 140/250

- Chn Define deployment options
Trang 141/250

- Mn hnh Microsoft Update Setup, chn Use the Microsoft Update service Next
- Mn hnh Define Upadte Settings, chn thi gian Update Next
Trang 142/250

- Mn hnh Customer Feedback, chn Yes, I am willing Next
- Mn hnh Microsoft Telemetry Service, chn Join with a basic membership Next
Trang 143/250

- Chn Close
Trang 144/250

3. Ci t Forefront Client trn TMG Client

- Kch hot tp tin MS_FWC.msi
- Mn hnh License Agreement, chn I accept the term Next
Trang 145/250

- Mn hnh Destination Folder Next
- Mn hnh ISA Server Computer Selection, chn Connect to this ISA Server computer, nhp vo tn ISA
Server: TMG.NHATNGHE.LOCAL Next
Trang 146/250

- Mn hnh Ready to Install Next
Trang 147/250

- Chn Yes khi ng li my
- M chng trnh Microsoft Firewall Client Management
Trang 148/250

- Tab Settings chn Test Server
- Qu trnh kim tra kt ni n ISA Server thnh cng
- M IE, truy cp trang web bt k Khng thnh cng
Trang 149/250

3. Thit lp cc Access Rule kim sot giao dch

- Click phi Firewall Policy New Access Rule
- Mn hnh New Access Rule, nhp DNS Outbound Next
- Mn hnh Rule Action, chn Allow Next
Trang 150/250

- Mn hnh Protocols, chn Selected Protocols Add
- Chn DNS Add Close
Trang 151/250

- Mn hnh Access Rule Source Add
- Chn Internal Add Close
Trang 152/250

- Mn hnh Access Rule Destination Add
- Chn External Add Close
Trang 153/250

- Mn hnh User Sets Next
Trang 154/250

- Tng t, to thm 1 Access Rule, t tn l Web Access
Trang 155/250

- Mn hnh Protolcols Add
- Chn HTTP v HTTPS Add Close
Trang 156/250

- Next
- Mn hinh Malware Inspection, chn Enable malware inspection Next
- Mn hnh Access Rule Sources Add Internal
Trang 157/250

- Mn hnh Access Rule Desninations Add External
- Mn hnh User Sets Next
Trang 158/250

- Chn Apply
Kim tra trn my Client: m IE truy cp vo trang web bt k Truy cp thnh cng
Trang 159/250

4. Cu hnh chn download file

- M Forefront TMG, khung bn tri chnWeb Acess Policy. Trong Action Pane bn phi, chn
Configure Malware Inspection
- Qua tab Inspection Settings, mc Block file larger than (MB), nhp vo: 1 Apply OK
Trang 160/250

- Chn Apply
Kim tra trn Client: Truy cp web download 1 tp tin dung lng ln hn 1 MB thng bo li.
Trang 161/250

Trang 162/250

LAB 06
PUBLISH WEB SERVER TRN
FOREFRONT THREAT MANAGEMENT GATEWAY
I. M HNH
II. GII THIU

Doanh nghip tng cng qung b thng hiu v giao dch vi i tc thng qua trang web. Lab ny k
tha m hnh lab 05, thc hin xy dng web server trn server 192.168.11.254, to 1 trang web mc nh
v publish (xut bn) trn TMG server.
III. CC BC THC HIN
1. Xy dng Web Server trn server 192.168.11.254.
2. Cu hnh Web Publishing Rule trn TMG.
3. Cu hnh NAT Inbound trn Router ADSL.
Trang 163/250

IV. TRIN KHAI

1. Xy dng Web Server
- Server Manager Click phi Roles Add Roles
- Next
Trang 164/250

- Chn Web Server (IIS)
-Chn Add Required Features Next Next
Trang 165/250

- Next
- Install
Trang 166/250

- Close
- Truy cp C:\InterPub\WWWRoot To 1 file Text Document
Trang 167/250

- Menu Tools Folder Options
- B chn Hide extensions for known file types
Trang 168/250

- Chn Yes
- M file text va to nhp ni dung trang web Lu thnh file: Default.htm
- Truy cp th website ni b : http://LocalHost truy cp thnh cng
Trang 169/250

2. Cu hnh Access Rule v Publishing Rule trn Forefront cho Web Server
- Click phi Firewall Policy New Website Publishing Rule
- t tn Rule Next
Trang 170/250

- Chn Allow Next
- Chn Publish a single Web site or load balancer Next
Trang 171/250

- Chn Use non-secured connections to connect Next
- Nhp Fully Qualified Domain Name ca web server Next
Trang 172/250

- Next
- Chn Any domain name Next
Trang 173/250

- Chn New
- t tn Port 80 Next
Trang 174/250

- Chn Do not required SSL secured connections with clients Next
- Chn External Next
Trang 175/250

- Chn No Authentication Next
- Chn Port 80 Next
Trang 176/250

- Chn No delegation, and client cannot authenticate directly Next
- Next Finish
Trang 177/250

- Apply OK
5. Cu hnh NAT Inbound trn Router ADSL

- Truy cp modem ADSL Status Kim tra IP WAN hin c: 222.254.179.98
Trang 178/250

- Chn Advanced LAN Clients nhp IP card WAN ca TMG server:192.168.1.2
- Advanced Virtual Server Category Chn User Add
- Nhp thng tin nh trong hnh minh ha Apply

Trang 179/250

- Chn Add a rules va to vo Applied Rules Apply
- Quan st kt qu ng chng trnh

Trang 180/250

- ng nhp vo trang qun tr domain to thm host WWW tr v IP public
Trang 181/250

Kim tra:
Internet client truy cp: http://www.nhatnghe.edu.vn truy cp trang web thnh cng
Trang 182/250

LAB 07
VIRTUAL PRIVATE NETWORK (VPN)
I. M HNH
II. GII THIU

Doanh nghip m rng hot ng kinh doanh v m thm chi nhnh.T , pht sinh mt s nhu cu:
Nhn vin lm vic ngoi cng ty cn kt ni an ton n h mng Si Gn.
Trao i d liu an ton gia 02 h mng Si Gn & H Ni khi doanh nghip khng c ng thu
bao ring.
Lab 07 k tha kt qu ca lab 05 v pht trin thm h mng ngang hng ti chi nhnh H Ni. H mng
H Ni c network id 192.168.21.0 / 24, gm 01 file server Windows 2008 v 01 TMG firewall.
Nhu cu pht sinh nu trn c gii quyt bng cch tn dng ng truyn DSL c sn ti cc chi
nhnh thit lp kt ni VPN. VPN server cng chnh l TMG server.
A. CLIENT GATEWAY
1. Cp php Dial-in cho user KT1.
2. Cu hnh VPN server trn TMG server.
3. To VPN Connection trn Client.
4. Thc hin kt ni & truy cp d liu
B. GATEWAY GATEWAY
1. To User & cp php Dial-in.
2. Cu hnh trn server TMG ti Si Gn.
3. Cu hnh trn server TMG ti H Ni.
4. Kim tra: Kt ni VPN c t ng thit lp khi 2 site pht sinh nhu cu truy cp nhau.
Trang 183/250


A.CLIENT - GATEWAY
1. Cho user quyn dial-in (Thc hin trn DC)
- M DSA.MSC Properties account KT1
- Tab Dial-in Chn Allow Acess OK
Trang 184/250

2. Cu hnh VPN trn TMG

- Chn Virtual Private Network (VPN) tab VPN Clients Configure Address Assignment Method
- Chn Add
Trang 185/250

- Khai bo dy IP chnh xc theo hnh minh ha OK
- OK
Trang 186/250

- Chn Enable VPN Client Access
- Chn Enable VPN client access OK
Trang 187/250

- To Access Rule t tn rule l VPN client Next
- Chn Allow Next
Trang 188/250

- Chn All outbound traffic Next
- Chn Enable malware inspection for this rule next
Trang 189/250

- Chn Add
- Chn VPN Clients Add Close
Trang 190/250

- Chn Next
- Add network Internal Next
Trang 191/250

- Next Finish
- Apply Ok
Trang 192/250

- Truy cp Modem ADSL NAT port 1723 v card WAN my TMG
3. To VPN Connection trn Client

- Start Control Panel Network and Sharing Center
Trang 193/250

- Chn Set up a new connection or network
- Chn Connect to a workplaced Next
Trang 194/250

- Chn Use my Internet connection (VPN)
- Khai bo public name hoc public IP address ca site SaiGon Next
Trang 195/250

- Khai bo account KT1 v password tng ng Connect
Trang 196/250

- Sau khi kt ni thnh cng truy cp \\192.168.11.254 truy cp thnh cng
B. GATEWAY GATEWAY
1. To User cho php Dial-in
- Start Run DSA.MSC
Trang 197/250

- To New User
- Khai bo thng tin chnh xc theo hnh minh ha Next
- Nhp Password & Confirm Password : P@ssword B du check User must change password at next
log on Next Finish
Trang 198/250

- Properties user HN
- Tab Dial-in Chn Allow Access Ok
Trang 199/250

2.Thc hin trn my TMG SITE SI GN

- Chn Virtual Private Network (VPN) tab Remote Sites chn link Create VPN Site-to-Site
connection
- t tn site l HN Next
Trang 200/250

- Chn Point-to-Point Tunneling Protocol (PPTP) Next
- OK
- Chn my TMG Next
Trang 201/250

- Khai bo public name hoc public IP address ca site HaNoi Next
- Khai bo chnh xc user name SG v password P@ssword Next
- Chn Add Range
Trang 202/250

- Khai bo dy IP site HaNoi nh hnh minh ha OK Next
- B du chn The remote site is enable Next
- Chn Next
Trang 203/250

- Chn All outbound traffic Next Finish
- OK
- OK
Trang 204/250

- Apply OK
3.Thc hin ti my TMG SITE H NI

- Start Run nhp lnh LUsrMgr.msc OK
Trang 205/250

- To New User
- To user vi cc gi tr chnh xc: user name: SG & password P@ssword B du User must change
password at next logon Create Close
Trang 206/250

- Properties user SG
- Tab Dial-in chn Allow Access OK
Trang 207/250

- Chn Virtual Private Networks (VPN) tab VPN Clients Configure Address Assignment Method
- Chn Add
Trang 208/250

- Khai bo dy IP chnh xc nh hnh minh ha OK
- OK
Trang 209/250

- Chn Enable VPN Client Access
- Chn Enable VPN client access OK
Trang 210/250

- Tab Remote Sites Chn link Create VPN Site-to-Site Connection
- t tn chnh xc l SG Next
Trang 211/250

- Chn Point-to-Point Tunnneling Protocol (PPTP) Next
- Chn OK
- Chn my TMG site H Ni Next
Trang 212/250

- Khai bo public name hoc public IP address ca site SaiGon Next
- Khai bo chnh xc: user name: HN & password: P@ssword Next
- Chn Add Range
Trang 213/250

- Khai bo chnh xc dy IP SERVER ti site SaiGon nh hnh minh ha OK
- Thc hin tng t thm cc dy IP ca site SaiGon nh hnh minh ha Next
- B du The remote site is enabled Next
Trang 214/250

- Next
- Chn All outbound traffic Next
- Finish
Trang 215/250

- OK
- OK Apply Ok
4. Kim tra:
- Client ti site HaNoi truy cp \\192.168.11.254 (IP add. Ca Server SaiGon)
Trang 216/250

- Kt ni VPN c thit lp nhp user name & password truy cp thnh cng
- Client ti site SaiGon truy cp \\192.168.21.254 (IP add. Ca File server HaNoi) thnh cng
- Ti TMG server HaNoi: Chn Monitoring tab Sessions Quan st thy kt ni c thit lp.
Trang 217/250

Trang 218/250

LAB 08
CHIA SITE CHO DOMAIN NETWORK
I. M HNH
II.GII THIU
Chi nhnh H Ni s dng m hnh Workgroup. S lng nhn vin ti chi nhnh ngy cng tng ln nn
pht sinh nhu cu: Ti chi nhnh s dng cng Domain Network vi vn phng chnh qun l tp
trung.
Tuy nhin vic cc my chi nhnh gia nhp domain tt yu lm pht sinh lung thng tin chng thc trn
ng WAN.
Gii php: Xy dng thm Domain Controller ti chi nhnh H Ni v chia domain thnh 2 site. Kt qu
t c sau khi thc hin cu hnh site l ti u ha bng thng trn ng WAN do 02 yu t:
Cc b ha thng tin chng thc.
Khng ch hot ng ng b gia 2 DC theo mt lch biu xc nh.
Lab 08 k tha Lab 07. Chi nhnh HaNoi gm 01 server Windows 2008 v 01 client Windows 7.
1. B sung cu hnh Primary Domain Controller ti SaiGon.
2. Chia site.
3. Nng cp server ti HaNoi thnh Additional Domain Controller.
4. Cu hnh lch biu ng b.
5. Th nghim
Trang 219/250


1. B sung cu hnh trn Primary Domain Controller
- Start Run nhp DNSMgmt.msc
- Click phi Forward Lookup Zone New Zone
Trang 220/250

- Bo m du chn Primary Zone v Store the zone in Active Directory Next
- Bo m du chn To all DNS servers in this domain: NHATNGHE.LOCAL Next
- Bo m du chn IPv4 Revese Lookup Zone Next
Trang 221/250

- khung Network ID, nhp vo: 192.168.21 Next
- Chn Allow only secure dynamic update Next
- Mn hnh Finish Next
Trang 222/250

- M Reverse Lookup Zone, kim tra c zone 21.168.192.in-addr.arpa
2. Chia site
- Start Run, nhp DSSite.msc
- Click phi Default-First-Site-Name, chn Rename
Trang 223/250

- t tn l 01-SaiGon
- Click phi vo Sites chn New Site
- khung Name, t tn 02-HaNoi chn DEFAULTIPSITELINK OK
Trang 224/250

- OK
- Click phi vo Subnets chn New Subnet
- khung Prefix, nhp vo 192.168.11.0/24 v chn Site 01-SaiGon OK
- Thc hin tng t khai bo thm cc subnet 192.168.12.0/24 v 192.168.13.0/24 cho Site SaiGon.
Trang 225/250

- Tng t to thm Subnet 192.168.21.0/24 cho Site HaNoi
Trang 226/250

- Kt qu:
3. Nng cp my DC2 thnh Additional Domain Controller

- Chnh IP Card LAN theo thng s sau
- DC2 join domain NHATNGHE.LOCAL Restart
Trang 227/250

- ng nhp bng quyn Domain Admin. Vo Start Run, nhp DCPROMO
Trang 228/250

- Mn hnh Operating System Compatiblity Next
- Mn hnh Choose a Deployment Configuration, chn Existing Forest chn Add a Domain Controller
to an existing domain Next
Trang 229/250

- Mn hnh Network Credentials, gi cu hnh mc nh Next
- Mn hnh Select a Domain Next
Trang 230/250

- Mn hnh Select a Site Next
- Mn hnh Additional Domain Controller Options, m bo c du chn DNS server v Global Catalog
Next
Trang 231/250

- Hp thoi Active Directory Domain Services Installation Wizard, chn Yes
- Mn hnh Location for Database, Log Files and SYSVOL Next
- Hp thoi Directory Services Restore Mode Administrator Password nhp P@ssword Next
Trang 232/250

- Mn hnh Summary Next
- Qu trnh nng cp din ra nh du chn Reboot on completion
- Server restart Logon Domain Admins Start Program Administrative Tools DNS. Trong
zone NhatNghe.local, kim tra bo m c cc record nh hnh minh ha.
- Trong zone _tcp, kim tra bo m c cc record nh hnh minh ha.

Trang 233/250

- M Active Directory Sites and Services, kim tra thy trong Site HANOI c ADC01
4. Cu hnh lch biu ng b.

- Inter-Site Transports IP Click phi vo DEFAULTIPSITELINK chn Properties
Trang 234/250

- Chn Change Schedule

- Chn lch ng b vo 10:00pm n 6:00am cc ngy th Hai, T, Su OK
- OK
5. Th nghim
Gi lp hng ng truyn DSL.
Ti site HANOI, log on domain user bt k Log on thnh cng.
Trang 235/250

Trang 236/250

LAB 09
XY DNG CHILD DOMAIN
I. M HNH
II. GII THIU

S pht trin ca doanh nghip lm ny sinh nhu cu phn cp qun l v bo mt, c th l:
C th xy dng h thng Account Policy dc lp cho Chi Nhnh.
Ti u ha quy trnh ng b (Replication) gia cc Domain Controller trong ton Domain.
Hng gii quyt: Xy dng Child Domain trong Site SaiGon
Lab 09 k tha Lab 08. Ti SaiGon, xy dng domain controller ca child domain SG.Nhatnghe.Local
trn 01 server Windows 2008.
III. CC BC THC HIN
1. B sung thng tin trn DNS server ca domain NHATNGHE.LOCAL
2. Nng cp Domain Controller xy dng Child Domain
3. Cu hnh Account Policy ring cho domain SG.NHATNGHE.LOCAL
4. Kim tra
Trang 237/250

IV. THC HIN

1. B sung thng tin trn DNS server ca domain NHATNGHE.LOCAL
- Console DNS Click phi Forward Lookup Zones New Zone
- Next
Trang 238/250

- Bo m chn Primary Zone & Store the zone in Active Directory Next
- Bo m chn To All domain Controllers in this domain Next
- Nhp zone name: SG.NhatNghe.Local Next
Trang 239/250

- Bo m chn Allow only secure dynamic updates Next
- Finish
Trang 240/250

2. Nng cp Domain Controller xy dng Child Domain

- Cu hnh IP nh hnh minh ha
- Start Run DCPROMO
Trang 241/250

- Next
- Next
Trang 242/250

- Chn Exiting forest Chn Create a new domain in an exiting forest Next
- Chn Set
Trang 243/250

- Khai bo account Administrator ca Nhatnghe.Local OK
- Next
Trang 244/250

- Nhp domain name: SG.NHATNGHE.LOCAL Next
- Next
Trang 245/250

- Next
- Bo m chn DNS server v Global catalog Next
Trang 246/250

- Chn Use this specific domain controller Chn my Primary Domain Next
- Next
Trang 247/250

- t password : P@ssword Next
- Next
Trang 248/250

- Chn Reboot on completion
3. Cu hnh Account Policy ring cho domain SG.NHATNGHE.LOCAL

- Trn DC ca Child Domain Chnh Password Policy nh hnh minh ha
Trang 249/250

4. Kim Tra
- Trn DC ca Child Domain to user vi password n gin thnh cng.
- Trn DC ca Parent Domain to user vi password n gin tht bi.
- M TCP/IP quan st gi tr DNS c t ng iu chnh
- M DNS ca c 2 DC u c cp nht thng tin trong zone SG.NhatNghe.Local
--
Trang 250/250

Lab 2 K 8

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lab 2 K 8

Uploaded by

Copyright:

Available Formats

TRUNG TM O TO MNG MY TNH NHT NGH

I TC O TO CA MICROSOFT TI VIT NAM

TRUNG TM O TO MNG MY TNH NHT NGH

TRUNG TM O TO MNG MY TNH NHT NGH

TRUNG TM O TO MNG MY TNH NHT NGH

TRUNG TM O TO MNG MY TNH NHT NGH

II. GII THIU

TRUNG TM O TO MNG MY TNH NHT NGH

- Thc hin ti Server Start Settings Network Connections

- Click phi LAN Properies

- Chn Internet Protocol Version 4 (TCP/IPv4) Properties

TRUNG TM O TO MNG MY TNH NHT NGH

- Nhp thng s IP nh hnh v OK OK

TRUNG TM O TO MNG MY TNH NHT NGH

- Chn Change adapter settings

- Click phi card LAN Properties

- Nhp kp Internet Protocol Version 4 (TCP/IPv4)

TRUNG TM O TO MNG MY TNH NHT NGH

- Nhp cc thng s IP nh trong hnh OK OK

2. Cu hnh Router ADSL

- Chn Run Wizard

TRUNG TM O TO MNG MY TNH NHT NGH

- Choose Time Zone Chn GMT+07:00 (Bangkok, HaNoi, Jakarta) Next

- Select Internet Connection Type (WAN) Chn PPPoE/PPPoA Next

- Set PPPoE/PPPoA Nhp thng tin do ISP cung cp Next

TRUNG TM O TO MNG MY TNH NHT NGH

- Setup Completed Restart.

- Tab Status Quan st nhn Public IP.

- Th nghim truy cp internet

TRUNG TM O TO MNG MY TNH NHT NGH

3. To cc local user & group (thc hin ti Server)

- Click phi Users New User

TRUNG TM O TO MNG MY TNH NHT NGH

- Nhp Group name: KeToan Add

- Nhp KT1; KT2 Check Names OK

- Hp thoi New Group Create

TRUNG TM O TO MNG MY TNH NHT NGH

- Hp thoi New Group Nhp Group Name: NhanSu Add

- Nhp NS1; NS2 Check Names OK

- Hp thoi New Group Create Close.

TRUNG TM O TO MNG MY TNH NHT NGH

4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s.

- Tab Sharing Advanced Sharing

TRUNG TM O TO MNG MY TNH NHT NGH

- nh du chn Share this folder Permissions

- Chn Full Control ti ct Allow OK OK

TRUNG TM O TO MNG MY TNH NHT NGH

c. Thit lp NTFS permission. Mc tiu: H s ca phng ban no th phng ban qun l.

TRUNG TM O TO MNG MY TNH NHT NGH

- B du chn Include inheritable permission

- Chn Edit Chn Group Users Remove

TRUNG TM O TO MNG MY TNH NHT NGH

Kim tra thy Group KETOAN v NHANSU c permission Allow Read

TRUNG TM O TO MNG MY TNH NHT NGH

- Ln lt cho Group KETOAN v NHANSU quyn Modify OK 2 ln

TRUNG TM O TO MNG MY TNH NHT NGH

TRUNG TM O TO MNG MY TNH NHT NGH

- B du chn Include inheritable permission. Chn Copy OK 2 ln

TRUNG TM O TO MNG MY TNH NHT NGH

TRUNG TM O TO MNG MY TNH NHT NGH

d. Thit lp NTFS permission. Mc tiu: Cc user ch c th xa ti nguyn do chnh mnh to ra

TRUNG TM O TO MNG MY TNH NHT NGH

- Chn KETOAN Chn Edit