Xay Dung Va Quan Tri He Thong Mang Doanh Nghiep Tren Nen 2k8(New)

TRUNG TM O TO MNG MY TNH NHT NGH I TC O TO CA MICROSOFT TI VIT NAM 105 B Huyn Thanh Quan, Q3, TP. HCM Tel: 3.9322.735 0913.735.906 Fax: 3.9322.734 www.nhatnghe.com

Trang 1/250

LI M U Hin nay cc doanh nghip u s dng my tnh v cc ng dng trn my tnh nh mt cng c lm vic thit yu. iu cng ng ngha vi vic xy dng, qun tr v pht trin h mng my tnh l mt cng tc c nh hng quan trng n hot ng sn xut kinh doanh. Cng ty MICROSOFT Vit Nam phi hp cng Cng Ty C Phn Gio Dc NHT NGH bin son b sch XY DNG QUN TR - M RNG H MNG MY TNH DOANH NGHIP TRN NN WINDOWS SERVER 2008 V WINDOWS 7 vi mong mun:

- Cung cp cho cc Qu c gi mt tm nhn tng quan v cc khun mu chi tit trong vic xy dng v pht trin h mng doanh nghip trn nhiu quy m khc nhau.

- Gii thiu hai h iu hnh Server v Client mi nht ca Microsoft: Windows Server 2008 v Windows 7 vi nhiu tnh nng vt tri so vi cc phin bn trc.

B sch ny m phng thc t pht trin h mng my tnh ca mt doanh nghip, t lc khi u (mng n gin ti mt vn phng) cho n khi ln mnh (mng phc tp ti nhiu chi nhnh): Lab 01: H mng ngang hng, chia s ti nguyn trn c s Local User. Lab 02: Trin khai h thng Mail Online nh dch v min ph Windows Live Custom Domains ca

Microsoft. Lab 03: H mng domain, qun l tp trung, trin khai cc ng dng t ng, kh nng bo mt cao. Lab 04: Doanh nghip m rng quy m dn n nhu cu tch h thng mng thnh nhiu phn on

c th hp l ha bng thng, v khng ch truy cp. Lab 05: Ci t v cu hnh Microsoft firewall Forefront Threat Management Gateway (TMG) bo v

h mng, chng li cc cuc tn cng t bn ngoi v kim sot truy cp internet ca nhn vin. Lab 06: Xy dng web server v publish trn TMG server p ng nhu cu qung b thng hiu,

giao tip i tc v to thun li cho cng vic ca nhn vin. Lab 07: Trin khai VPN server trn TMG server gip nhn vin t internet c th kt ni vi mng

ni b mt cch bo mt v kt ni cc chi nhnh ti cc v tr a l khc nhau vi chi ph thp nht.

Lab 08: Tng kh nng chu li ca h mng bng cch xy dng additional domain controller. Lab 09: Xy dng child domain p ng cc nhu cu a dng v qun l v bo mt. Hai h iu hnh Windows Server 2008 v Windows 7 c rt nhiu u im v chi tit m b 09 bi lab ny khng th trnh by y c. V th, chng ti rt mong nhn c phn hi v gp t Qu c gi cc phin bn sau c th hon thin hn. Xin vui lng lin h ti:

- Din n: http://www.nhatnghe.com/forum - E-mail: [email protected] - Hot line: 08 393 22735

Chng ti xin chn thnh cm n ng Phng Phc Linh, Partner Strategy & Program Manager - Microsoft Vit Nam v ng Trn Vn Hu, Gim c cng ty Nht Ngh c nhng h tr thit thc trong sut qu trnh bin son b sch ny.

Xin hn ti ng Qu c gi trong nhng b sch khc v cng ngh mng Microsoft. Nhng ngi thc hin:

1. Nguyn Trnh Khnh Vn MCITP EA 2. Nguyn Mnh Trng MCITP EA 3. L Ngc Hin MCT

Tp. H Ch Minh, thng 10 nm 2009.


Trang 2/250


Trang 3/250

MC LC

LAB 01 THIT LP H THNG MNG CHO DOANH NGHIP NH ................................................ Trang 05 LAB 02 MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN .................................................... Trang 35 LAB 03 GII THIU H THNG MNG DOMAIN DNG TRONG QUN L DOANH NGHIP .. Trang 47 LAB 04 H THNG MNG NHIU NETWORK ................................................................................... Trang 117 LAB 05 CI T V CU HNH FOREFRONT THREAT MANAGEMENT GATEWAY (TMG)... Trang 127 LAB 06 PUBLISH WEB SERVER TRN FOREFRONT THREAT MANAGEMENT GATEWAY .... Trang 163 LAB 07 VIRTUAL PRIVATE NETWORK (VPN)................................................................................... Trang 183 LAB 08 CHIA SITE CHO DOMAIN NETWORK.................................................................................... Trang 219 LAB 09 XY DNG CHILD DOMAIN................................................................................................... Trang 237


Trang 4/250


Trang 5/250

LAB 01 THIT LP H THNG MNG CHO DOANH NGHIP NH

I. M HNH M hnh dng 02 my tnh v 01 router ADSL cng kt ni vo 1 switch:

- Server: Windows 2008 - Client: Windows 7

II. GII THIU Gii php cho Doanh nghip nh vi cc yu cu c bn nh:

- Chia s d liu, chia s my in. - Truy cp internet vi 1 ng truyn ADSL

III. CC BC TRIN KHAI 1. Cu hnh IP. 2. Cu hnh Router ADSL Th truy cp internet 3. To local user account & group 4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s. 5. Cu hnh Print Server - Thit lp u tin v permission trn printer. IV. TRIN KHAI CHI TIT 1. Cu hnh IP

Server Client IP address 192.168.1.253 192.168.1.10 Subnet mask 255.255.255.0 255.255.255.0 Default gateway 192.168.1.1 192.168.1.1 Preferred DNS 203.162.4.190 203.162.4.190


- Thc hin ti Server Start Settings Network Connections

- Click phi LAN Properies

- Chn Internet Protocol Version 4 (TCP/IPv4) Properties

Trang 6/250


Trang 7/250

- Nhp thng s IP nh hnh v OK OK

- Thc hin ti Client: Start Control Panel Chn Network and Sharing Center


- Chn Change adapter settings

- Click phi card LAN Properties

- Nhp kp Internet Protocol Version 4 (TCP/IPv4)

Trang 8/250


Trang 9/250

- Nhp cc thng s IP nh trong hnh OK OK

2. Cu hnh Router ADSL - Reset router ADSL. Kim tra ng truyn t Client n router (IP mc nh ca Router l 192.168.1.1) Phi bo m nhn c phn hi t router - M chng trnh Internet Explorer (IE) Nhp 192.168.1.1 Go - Nhp username v password ca Router OK

- Chn Run Wizard


- Choose Time Zone Chn GMT+07:00 (Bangkok, HaNoi, Jakarta) Next

- Select Internet Connection Type (WAN) Chn PPPoE/PPPoA Next

- Set PPPoE/PPPoA Nhp thng tin do ISP cung cp Next

Trang 10/250


Trang 11/250

- Setup Completed Restart.

- Tab Status Quan st nhn Public IP.

- Th nghim truy cp internet


3. To cc local user & group (thc hin ti Server) - Start Run Nhp LUsrMgr.msc OK

- Click phi Users New User

- Nhp User name: KT1, Password: 123, Confirm password: 123, b chn User must change password at next logon Create

- Nhp User name: KT2, Password: 123, Confirm password: 123, b chn User must change password at next logon Create.

Trang 12/250


Trang 13/250

- Nhp User name: NS1, Password: 123, Confirm password: 123, b chn User must change password at next logon Create. - Nhp User name: NS2, Password: 123, Confirm password: 123, b chn User must change password at next logon Create Close. - Click phi Groups New Group

- Nhp Group name: KeToan Add

- Nhp KT1; KT2 Check Names OK

- Hp thoi New Group Create


- Hp thoi New Group Nhp Group Name: NhanSu Add

- Nhp NS1; NS2 Check Names OK

- Hp thoi New Group Create Close.

Trang 14/250


Trang 15/250

4. Cu hnh File Server: Thit lp permission trn ti nguyn chia s. a. Trong Windows Explorer, to cy th mc nh hnh minh ha.

b. Chia s th mc Data - Click phi th mc Data Properties

- Tab Sharing Advanced Sharing


- nh du chn Share this folder Permissions

- Chn Full Control ti ct Allow OK OK

Trang 16/250


Trang 17/250

c. Thit lp NTFS permission. Mc tiu: H s ca phng ban no th phng ban qun l. Thit lp permission trn th mc DATA: ch cho php KETOAN & NHANSU c - Click phi th mc DATA Properties - Tab Security Advanced

- Chn Edit


- B du chn Include inheritable permission

- Chn Copy

- Chn OK 2 ln

- Chn Edit Chn Group Users Remove

Trang 18/250


Trang 19/250

- Chn Add - Nhp KETOAN;NHANSU Check Names OK

Kim tra thy Group KETOAN v NHANSU c permission Allow Read


Thit lp permission trn th mc DATA CHUNG: cho php KETOAN & NHANSU c, ghi, xa, sa. - Click phi th mc DATA CHUNG Properties - Tab Security Edit

- Ln lt cho Group KETOAN v NHANSU quyn Modify OK 2 ln

Trang 20/250


Trang 21/250

Thit lp permission trn th mc KETOAN: ch cho php KETOAN c, ghi, xa, sa. - Click phi th mc KETOAN Properties - Tab Security Advanced

- Chn Edit


- B du chn Include inheritable permission. Chn Copy OK 2 ln

- Chn Edit

Trang 22/250


Trang 23/250

- Chn group NHANSU Remove Chn group KETOAN chn Allow Modify OK 2 ln

Thit lp permission trn th mc NHANSU: ch cho php NHANSU c, ghi, xa, sa. Thc hin tng t trn th mc KETOAN c kt qu:

Kim tra: - Log on KT1, truy cp vo folder DATA CHUNG v KETOAN, to 1 file bt k to thnh cng - Truy cp th folder NHANSU, b bo li


d. Thit lp NTFS permission. Mc tiu: Cc user ch c th xa ti nguyn do chnh mnh to ra - Click phi th mc KETOAN Properties - Tab Security Advanced

- Chn Edit

Trang 24/250


Trang 25/250

- Chn KETOAN Chn Edit

- B du chn 2 Delete subfolders and files v Delete OK

- Kim tra: Log on KT2, truy cp vo folder KETOAN, xa th file do user KT1 to khng th xa


5. Cu hnh Print Server a. Ci t Local printer (Thc hin ti SERVER) - Start Settings Printers

- Chn Add Printer

- Chn Add a local printer

Trang 26/250


Trang 27/250

- Chn Next

- Chn my in nh hnh minh ha Next

- Printer name : HP Next


- Chn Next

- Chn Finish

- Quan st kt qu

Trang 28/250


Trang 29/250

b. Ci t Network printer (Thc hin ti CLIENT) - Start truy cp \\192.168.1.253

- Click phi ln my in HP Connect


- Chn Install driver Start Printer Quan st thy c my in HP

c. u tin Phn quyn (Thc hin ti SERVER) Xa printer HP to , to 2 printer mi : VIP v Member

- Click phi ln printer VIP Properties

Trang 30/250


Trang 31/250

- Tab Security chn Everyone Remove

- Chn Add


- Nhp BanGiamDoc Check Names OK

- Chn group BanGiamDoc chn thm Allow Manage printer & Allow Manage documents

- Tab Advanced Nhp gi tr Priority: 99 OK

Kim tra :

Trang 32/250


Trang 33/250

- Truy cp \\192.168.1.253

- Click phi printer VIP Connect


- Khai bo user name: KT1 (& password) OK

- Chn Yes

- Bo li khng c quyn No

- Kt ni my in Member vi credential KT1 Thnh cng.

Trang 34/250


Trang 35/250

LAB 02 MAIL ONLINE VI WINDOWS LIVE CUSTOM DOMAIN

I- GII THIU trin khai h thng e-mail vi tn min ring, chng ta c cc gii php nh: Mail Online, Mail Offline. Bi lab ny s trnh by cch trin khai h thng mail nh dch v min ph Windows Live Custom Domains ca Microsoft. Doanh nghip ch phi tr chi ph mua public domain name. Trong bi lab s dng public domain name NhatNghe.edu.vn. II- CC BC TRIN KHAI 1. To account trn trang web domains.live.com 2. Cp nht d liu DNS ca public domain kch hot account live 3. Cp nht bn ghi MX ca public domain Kim tra To mail account 4. Th nghim gi v nhn mail. III- TRIN KHAI CHI TIT 1. To account trn trang web domains.live.com - Truy cp trang web http://domains.live.com > Chn Get started

- Khung Provide your domain name > Nhp tn ca public domain


- nh du chn mc No mail for my domain... > Continue

- nh du chn mc Create a new Windows Live ID... > Continue

Trang 36/250


Trang 37/250

- Nhp cc thng tin theo yu cu > chn I accept

- Quan st kt qu > chn I accept


- Ghi nhn cc thng tin trong phn Domain Ownership (DNS record type, Host & Value) > Sign out.

2. Cp nht d liu DNS ca public domain kch hot account live - ng nhp trang web qun l public domain.

Trang 38/250


Trang 39/250

- To mt bn ghi DNS theo thng tin ghi nhn trong phn Domain Ownership > Sign out.

3. Cp nht bn ghi MX ca public domain & to mail account - ng nhp trang web http://domains.live.com bng account to phn 1. - Chn Domain Settings > chn Edit mail settings.


- Hp thoi Update mail settings > chn Windows Live Hotmail > OK

- Trong phn Mail setup (required) > Ghi nhn tn ca MX server

Trang 40/250


Trang 41/250

- ng nhp trang web qun l public domain.

- To bn ghi loi MX tr t public domain name n tn ghi nhn trong phn Mail setup (required) > Sign out.


* Kim tra : - Start > Run > Nhp cmd > OK - Nhp cc cu lnh nh hnh minh ha.

Trang 42/250


Trang 43/250

- To mail account : Quay li trang web http://domains.live.com chn Member accounts > chn Add

- Khai bo cc thng tin Mail account > OK

- Kim tra kt qu : mail account c to.


4. Th nghim gi v nhn mail. - Truy cp trang web : Http://Mail.Live.com ng nhp bng ti khon to trn domain Nhatnghe.edu.vn * Kim tra : - Gi mail ti Gmail thnh cng

- Nhn mail t domain bn ngoi thnh cng

Trang 44/250


Trang 45/250


Trang 46/250


Trang 47/250

LAB 03 GII THIU H THNG MNG DOMAIN DNG TRONG QUN L DOANH NGHIP

I. M HNH M hnh dng 03 my tnh: 01 Server Windows 2008 (c 02 volume C & F) + 02 Client Windows 7 v 01 router ADSL cng kt ni vo 1 switch:

II. GII THIU H mng workgroup (Lab 01) c li im l n gin, d trin khai nhng khng thun li cho cng tc qun tr v kh nng bo mt km. Lab 03 k tha m hnh v cc kt qu ca lab 01 nng cp thnh h thng Domain Network vi cc u im: Qun l tp trung mi thnh phn trong h thng. Kh nng bo mt cao nhng thun li nh c ch Single Set of Credential. Kh nng co gin linh ng cho mi quy m, d dng m rng. p dng c ch qun l da trn Policy (Policy-based Administration). Cho php trin khai cc Application tch hp trong AD Database do vy tn dng c c ch

Replication ca AD. III. CC BC TRIN KHAI 5. Dng domain controller trn my Server vi domain l nhatnghe.local. 6. B sung thng s DNS server. 7. Ci t v cu hnh DHCP server trn my Server. 8. Client nhn IP t DHCP server v gia nhp domain nhatnghe.local.. Client th truy cp internet. 9. Trn client, ci t cng c qun tr server. 10. Xy dng cu trc OU, phn b cc user account v group account. 11. T chc h thng v phn quyn qun tr (Delegate) 12. To Home Directory cho Domain User 13. To Roamming Profile cho Domain User 14. Ci t ng dng t ng, hng lot (Deploy Software) 15. Kim ton (Audit) 16. Ngn chn s dng ng dng (Software restriction) 17. i tn 2 built-in account Administrator & Guest 18. Ci t my in mng trn hng lot my trm (Deploy Printer) 19. Sao lu d liu Domain Controller v phc hi khi c s c.


IV. TRIN KHAI CHI TIT 1. Dng domain controller trn my Server vi domain name l NhatNghe.local. - Cu hnh IP nh hnh minh ha

- Start Run nhp DCPROMO

Trang 48/250


Trang 49/250

- Chn Next

- Chn Next


- Chn Create a new domain in a new forest Next

- Nhp DNS domain name NhatNghe.local Next

Trang 50/250


Trang 51/250

- Chn Next

- Chn Forest functional level Windows Server 2008 Next


- Chn Next

- Chn Yes

Trang 52/250


Trang 53/250

- Chn Next

- Nhp Password v Confirm password: P@ssword Next


- Chn Next

- nh du chn Reboot on completion

Trang 54/250


Trang 55/250

2. B sung thng s DNS server. a. To reverse lookup zone v pointer - Start Programs Administrative Tools DNS - Console DNS Manager Click phi Reverse Lookup Zone New zone

- Chn Primary zone & bo m c du chn store the zone in Active Directory Next


- Chn Next

- chn Next

- Nhp Network ID: 192.168.11 Next

Trang 56/250


Trang 57/250

- Chn Next

- Chn Finish

- Click phi zone 11.168.192.in-addr.arpa chn New Pointer (PTR)


- Nhp gi tr host ID: 254 Browse

- Nhp kp vo i tng nh hnh minh ha

Trang 58/250


Trang 59/250

- Quay li hp thoi New Resource Record OK

b. Cu hnh Forwarder - Click phi SERVER Properties - Tab Forwarders Edit


- Chn Click here to add Nhp 203.162.4.190 OK

- Chn OK

2. Ci t v cu hnh DHCP server trn my Server. - Start Programs Administrative Tools Server Manager - Click phi Roles Add Roles

Trang 60/250


Trang 61/250

- Chn Next

- Chn DHCP Server Next


- Chn Next

- Chn Next

Trang 62/250


Trang 63/250

- Chn Validate

- Chn Next


- Chn Next

- Hp thoi Add orEdit DHCP Scopes > Chn Add

Trang 64/250


Trang 65/250

- Nhp cc gi tr thng s nh hnh minh ha OK

- Chn Next


- Chn Disable DHCP v6 stateless mode for this server Next

- Chn Next

Trang 66/250


Trang 67/250

- Chn Install

- Hon tt Close


4.Client nhn IP t DHCP server v gia nhp domain nhatnghe.local. . Client th truy cp internet. - Start Control Panel

- Chn Network and Sharing Center

Trang 68/250


Trang 69/250

- Chn Change adapter settings

- Click phi LAN Properties

- Chn Obtain an IP address automaticcally v Obtain DNS server address automatically OK


- Chn Cancel

- Start Nhp cmd (nh hnh minh ha) Enter

Trang 70/250


Trang 71/250

- Nhp lnh ipconfig /all Enter

- Quan st thy nhn c IP t DHCP server

- Client th truy cp internet thnh cng 5. Trn client, ci t cng c qun tr server. - Kch hot b ci t Remote Server Administration Tool

- Chn Yes


- Chn I accept Hon tt Close

- Kch hot Remote Server Administrative Tool: Start Control Panel Program And Features Turn On or Off Program and Features nh du chn cc cng c nh hnh minh ha OK

Trang 72/250


Trang 73/250

- Start Administrative Tools Active Directory Users and Computers: kt ni thnh cng n c s d liu ca DC.

6. Xy dng cu trc OU, phn b cc user account v group account - Start Run DSA.MSC

- Click phi NhatNghe.Local New Organizational Unit


- Name : Nhatnghe OK

- Click phi Nhatnghe New Group

- t tn KETOAN OK

- Tng t, to group NHANSU

Trang 74/250


Trang 75/250

- Click phi ln Nhatnghe New User

- Nhp thng tin nh hnh minh ha Next

- Nhp Password & Confirm password: Password Next

- Chn Finish


- Tng t, to cc user NS1 v Manager - Kt qu :

- Click phi Group KETOAN Properties

Trang 76/250


Trang 77/250

- Tab Members Chn Add

- Nhp KT1 Check Names OK 2 ln

- Lm tng t add user NS1 vo group NHANSU OK


7. T chc h thng v phn quyn qun tr (Delegate) - Click phi OU NhatNghe Delegate Control

- Welcome Chn Next

- Chn Add

- Nhp Manager Check Names OK

Trang 78/250


Trang 79/250

- Next

- Chn Full Coltrol Next Finish


8. To Home Directory cho Domain User - To th mc Home_Folder Click phi Properties

- Tab Sharing Advanced Sharing

Trang 80/250


Trang 81/250

- Chn Permission - nh du Full Control OK OK

- Tab Security Chn Edit - Chn Users nh du Allow Modify OK Close


- Start Run nhp DSA.MSC OK

- Click phi KT1 Properties

- Tab Profile Chn Connect : Z: Nhp : \\192.168.11.254\Home_folder\%UserName% Apply

Trang 82/250


Trang 83/250

- Quan st phn %UserName% c i thnh KT1 OK

Kim tra : thc hin trn client : User KT1 log on my client vi M My computer quan st thy c thm 1 a mng Z


9. To Roamming Profile cho Domain User - To th mc Profile Share permission: Everyone Allow Full Control NTFS permission: Users Allow Modify. - M DSA.MSC Properties KT1

- Profile path : Nhp \\192.168.11.254\Profile\%UserName% Apply

Trang 84/250


Trang 85/250

- Quan st thy phn %UserName% i thnh KT1 OK

Kim tra: - KT1 log on Client 1 Trn desktop to th mc HoSoKT1 Log off - KT1 log on Client 2 Trn desktop quan st thy c th mc HoSoKT1.


10. Ci t ng dng t ng, hng lot (Deploy Software) - Chp source Office 2003 vo th mc Office2k3 trong C. Share folder Office2k3. - Kim NTFS Permission: mc nh groups Users Allow Read & Execute.

- M DSA.MSC Computers Click phi ln tn PC Client chn Move

Trang 86/250


Trang 87/250

- Chn OU NhatNghe OK

- M Group Policy Management


- Click phi OU NhatNghe Chn Create a GPO in this domain , and Link it here

- t tn : Deploy Software OK

Trang 88/250


Trang 89/250

- Click phi ln Deploy Software Edit

- Click phi ln Software installation New Package


- Trong phn File name Nhp : \\192.168.11.254\office2k3 Chn file PRO11.msi Open

- Chn Assigned OK

- Quan st kt qu Trn command line nhp lnh GPUpdate /Force

Kim tra : thc hin trn Client

Trang 90/250


Trang 91/250

- Restart client log on bng account KT1 M menu Start quan st thy Office c ci 11. Kim ton file (Audit File) - M th mc DATA click phi th mc NHANSU Properties

- Tab Security Chn Advanced


- Tab Auditing Chn Edit

- Chn Add

- Nhp Everyone Check Names OK

Trang 92/250


Trang 93/250

- Chn tt c cc chn la OK

- OK OK OK


- M Group Policy Management

- Click phi ln Default Domain Policy Edit

Trang 94/250


Trang 95/250

- Click phi Audit object access Properties

- Chn Define these policy settings Chn Success , Failure

- Trn command line nhp lnh GPUpdate /Force


Kim tra : - Trn my client log on KT1 truy cp vo th mc NHANSU bo li khng c quyn truy cp - Trn my Server M Event Viewer

- M Windows Logs Security M cc event Audit Failure (& event id 4656)

Trang 96/250


Trang 97/250

- Quan st thy trng hp truy cp tri php ca KT1 vo th mc NHANSU c ghi nhn li

12. Ngn chn s dng ng dng (Software restriction): Cm mi user thuc OU Nht Ngh khng c dng Internet Explorer, ngoi tr user Manager. - M Group Policy Management


- Click phi ln OU NhatNghe Chn Create a GPO in this domain , and Link it here

- t tn Deny_IE

- Click phi ln Deny_IE chn Edit

Trang 98/250


Trang 99/250

- Click phi ln New Software Restriction Policies New Software Restriction Policies

- Click phi ln Additional Rule New Hash Rule


- Chn Browse

- Tr n C:\Program Files\iexplore.exe Open

Trang 100/250


Trang 101/250

- OK ng console Group Policy Management Editor

- Chn Deny_IE tab Delegation Chn Advanced


- Chn Add

- Nhp Manager Check Names OK

- Chn Deny Read OK

Trang 102/250


Trang 103/250

- Yes

- Trn command line nhp lnh Gpupdate /Force - Kim tra (thc hin trn client)

- Log on KT1 : M chng trnh Internet Explorer khng truy cp c - Log on Manager : M chng trnh Internet Explorer truy cp thnh cng

13. i tn 2 built-in account Administrator & Guest - M Group Policy Management


- Click phi ln NhatNghe Create a GPO in this domain , and link it here

- t tn nh trong hnh OK

- Click phi ln GPO va to Edit

Trang 104/250


Trang 105/250

- Click phi ln policy nh trong hnh Properties

- Chn Define this policy settings t tn mi NguoiQuanTri OK


- Click phi ln Policy trong hnh Properties

- Chn Define this policy setting Nhp vo : Khach OK ng cc chng trnh

- Trn command line nhp lnh GPUpdate /Force OK

Trang 106/250


Trang 107/250

Kim tra : Thc hin trn client - Restart Client Log on Domain Admins - Start nhp vo search : LUsrMgr.MSC Quan st thy 2 account Built-in Administrator v Guest c i tn.


14. Ci t my in mng trn hng lot my trm (Deploy Printer) - M Group Policy Management

- Click phi ln OU Nhatnghe Chn Create a GPO in this domain, and link it here

Trang 108/250


Trang 109/250

- t tn GPO OK

- Click phi Deploy Printer Edit


- Click phi ln Printers New Shared Printer

- Khai bo nh trong hnh OK

Trang 110/250


Trang 111/250

- Kim tra trn client : Log on KT1 Start Devices and Printers Quan st thy my in (HP on 192.168.11.254) t ng connect v client

15.Sao lu d liu Domain Controller v phc hi khi c s c. A. BACKUP SYSTEM STATE - Vo cmd, Nhp lnh: wbadmin start systemstatebackup backuptarget:F: Nhp Y tin hnh vic Backup

- Qu trnh Backup din ra khong 30 pht


- M Active Directory Users and Computers, vo menu View Advanced Features

Trang 112/250


Trang 113/250

- Click phi OU KYTHUAT Properties. Tab Object, b du check mc Protect object from accidental deletion OK

- Thc hin tng t cho OU GIANGVIEN. - Click phi vo 2 OU KYTHUAT v GIANGVIEN Delete


B. Restore System Sate: - Trn command line, Nhp lnh: bcdedit /set safeboot dsrepair

- H thng t ng khi ng li ng nhp bng username v password ca Directory Service Restore Mode ( khai bo khi nng cp DC)

- Xem danh sch cc file backup, Nhp lnh : wbadmin get versions

Trang 114/250


Trang 115/250

- Chn phin bn backup gn nht, nhp lnh: wbadmin start systemstaterecovery version:02/17/2009-21:17

Tham s version tng ng vi Version identifier

Nhn Y bt u qu trnh restore

- Ch khong 30 pht qu trnh restore thnh cng.

- tr v ch boot bnh thng, nhp lnh: bcdedit /deletevalue safeboot

- H thng khi ng li ng nhp bng Domain Admin v Password. Hp thoi thng bo System State c khi phc thnh cng Enter


- M Active Directory Users and Computers ln kim tra, thy cc OU c khi phc li nh c

Trang 116/250


Trang 117/250

LAB 04 H THNG MNG NHIU NETWORK

I. M HNH

II. GII THIU Trn mt h thng mng c nhiu ti nguyn v c s phn cp trong vic truy cp cc loi ti nguyn, vic phn chia h thng mng vt l ra cc Network_IDs hoc Subnets khc nhau s em li cc li th: Trnh hin tng nghn ng truyn do s Hosts trong Logical Network qu nhiu. Ngn chn cc hin tng lan truyn ton mch (broadcast) D dng thit lp cc b lc (Filter) nh tuyn khi truy cp ti nguyn. III. CC BC TRIN KHAI M hnh di y pht trin t h thng Domain ca Lab 03, phn chia thnh 03 Network_IDs: VIP, USER, SERVER. S dng : 01 my Windows Server 2008 dng lm Domain Controller ti Network SERVER 01 my Windows 7: dng lm my User VIP 01 my Windows 7: dng lm my User USER 01 my Windows Server 2008 dng lm ROUTER, c 04 NICs: LAN1: ni trc tip router ADSL LAN11: ni switch 1 (subnet 1) gm cc SERVER LAN12: ni switch 2 (subnet 2) gm cc my VIP LAN13: ni switch 3 (subnet 3) gm cc my USER


Cu hnh Router v cc b lc (Filter) sao cho: Tt c cc Networks (VIP, SERVER, USER) c th truy cp Internet. Network VIP v USER u c th truy cp Network SERVER. Network VIP v USER khng th truy cp nhau. IV. TRIN KHAI CHI TIT 1. Cu hnh router ADSL Cu hnh IP port LAN: 192.168.1.1/24 Cu hnh ADSL kt ni ra Internet 2. Cu hnh IP cc thnh phn trong h thng mng

ADSL router SERVER VIP USER IP address 192.168.1.1 192.168.11.254 192.168.12.10 192.168.13.10

Subnet Mask 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 Default Gateway 192.168.11.250 192.168.12.250 192.168.13.250 Preferred DNS 192.168.11.254 192.168.11.254 192.168.11.254

ROUTER

NIC LAN1 LAN11 LAN12 LAN13 IP address 192.168.1.250 192.168.11.250 192.168.12.250 192.168.13.250

Subnet Mask 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 Default Gateway 192.168.1.1

3. Kch hot router a. Add role Routing and Remote Access - Start Programs Administrative Tools Server Manager - Click phi Roles Add Roles

Trang 118/250


Trang 119/250

- Hp thoi Before You Begin Next

- Hp thoi Select Server Roles nh du chn Network Policy and Access Services Next


- Hp thoi Network Policy and Access Services Next

- Hp thoi Select Role Services nh du chn Routing and Remote Access Next

Trang 120/250


Trang 121/250

- Hp thoi Confirm Installation Selections Next

- Hp thoi Installation Results Close


b. Kch hot router - Start Programs Administrative Tools Routing and Remote Access

- Click phi server (local) Configure and Enable Routing and Remote Access

- Next

Trang 122/250


Trang 123/250

- Chn Custom configuration Next

- Chn NAT & chn LAN routing Next

- Finish


- Chn Start service

4. Cu hnh NAT outbound - Start Programs Administrative Tools Routing and Remote Access - Click phi NAT chn New Interface

- Chn LAN11 OK Chn Private interface OK

- Thc hin tng t vi LAN12 v LAN13. Ch : chn private interface - Click phi NAT chn New Interface - Chn LAN1 OK Chn Public interface & nh du Enable NAT OK

Trang 124/250


Trang 125/250

5. Cu hnh IP packet filter chn thng tin gia network VIP (LAN12) v USER (LAN13) - Chn General Click phi LAN13 Properties


- Chn Inbound Filter chn New

- Chn Destination network Nhp IP address: 192.168.12.0 & Subnet mask: 255.255.255.0 OK - Chn Receive all except OK 2 ln.

6. Kim tra kt qu - Cc PC VIP v USER truy cp SERVER: Start Run Nhp: \\192.168.11.253 thnh cng. - PC VIP truy cp USER: Start Run Nhp: \\192.168.13.10 tht bi. - PC USER truy cp VIP: Start Run Nhp: \\192.168.12.10 tht bi.

Trang 126/250


Trang 127/250

LAB 05 CI T V CU HNH

FOREFRONT THREAT MANAGEMENT GATEWAY (TMG) I. M HNH

II. GII THIU Khi kt ni h thng mng ni b vi Internet, tt yu pht sinh nhu cu kim sot cc giao dch thc hin gia mng ni b v Internet. Gii php thch hp l s dng cc Firewall. Bi lab ny gii thiu vic ci t phn mm Firewall ca Microsoft: Forefront Threat Management Gateway (TMG) v mt s cu hnh th hin qun tr. M hnh lab ny k tha v pht trin t m hnh lab 04. Server firewall TMG dng h iu hnh Windows Server 2008 64 bit c b tr gia software router v router ADSL. Interface LAN kt ni trc tip vi software router, Interface WAN kt ni trc tip vi router ADSL.

III. CC BC TRIN KHAI

1. Cu hnh thng s IP ca software router v TMG firewall. B sung route trn TMG server. TMG server join domain.

2. Ci t Forefront TMG trn TMG Server. 3. Ci t Forefront Client trn TMG Client. 4. Thit lp cc Access Rule cho php truy cp. 5. Cu hnh chn download file.


IV. THC HIN 1. Cu hnh thng s IP Join domain a. iu chnh IP ca software router v cu hnh IP ca TMG server theo bng sau:

Software router TMG Interface LAN1 LAN WAN IP address 10.0.1.250 10.0.1.2 192.168.1.2 Subnet mask 255.255.255.0 255.255.255.0 255.255.255.0 Default gateway 10.0.1.2 192.168.1.1 Preferred DNS 192.168.11.254

b. B sung route trn TMG server - Start Run Nhp cmd OK Trn Command line ln lt nhp cc cu lnh: route add 192.168.11.0 mask 255.255.255.0 10.0.1.250 p route add 192.168.12.0 mask 255.255.255.0 10.0.1.250 p route add 192.168.13.0 mask 255.255.255.0 10.0.1.250 p

- Trn Command line nhp cu lnh hin th routing table: route print Cc route c b sung.

c. TMG server join domain NhatNghe.Local

Trang 128/250


Trang 129/250

2. Ci t Forefront TMG trn TMG Server - Log on TMG server bng user Domain Admins Kch hot tp tin ci t: ISAAutoRun.exe

- Chn Install Forefront TMG

- Mn hnh Welcome Next


- Mn hnh License Agreement, chn I Accept the term Next

- Mn hnh Customer Information Next

- Chn Install Forefront Threat Management Gateway Next

- Mn hnh Component Selection Next

Trang 130/250


Trang 131/250

Mn hnh Internal Network Add. -


- Chn Add Range

- Nhp vo dy a ch: Start Address: 192.168.11.0 End Address: 192.168.11.255 OK

- Tng t nhp ln lt cc dy sau:

192.168.12.0 192.168.12.255 192.168.13.0 192.168.13.255 10.0.1.0 10.0.1.255 OK

Trang 132/250


Trang 133/250

- Chn Next

- Mn hnh Service Warning Next

- Mn hnh Ready To Install Install


- Qu trnh ci t

- Mn hnh Complete Finish

- Chn Exit

- Start Programs Microsoft Forefront TMG Forefront TMG Management

Trang 134/250


Trang 135/250

- Chn Configure Network Settings



- Chn Edge Firewall Next

Trang 136/250


Trang 137/250

- Mn hnh LAN Settings Chn network adapter LAN Add

- Nhp vo cc thng s sau: IP Address: 192.168.11.0 Subnet mask: 255.255.255.0 Gateway: 10.0.1.250

- Tng t, nhp thm cc dy IP sau IP Address: 192.168.12.0 Subnet mask: 255.255.255.0 Gateway: 10.0.1.250

IP Address: 192.168.13.0 Subnet mask: 255.255.255.0 Gateway: 10.0.1.250


- Kt qu Next

- Mn hnh Internet Settings chn network adapter WAN Next

Trang 138/250


Trang 139/250

- Chn Configure System Settings



- Mn hnh Host Identification Next


Trang 140/250


Trang 141/250

- Chn Define deployment options



- Mn hnh Microsoft Update Setup, chn Use the Microsoft Update service Next

- Mn hnh Define Upadte Settings, chn thi gian Update Next

Trang 142/250


Trang 143/250

- Mn hnh Customer Feedback, chn Yes, I am willing Next

- Mn hnh Microsoft Telemetry Service, chn Join with a basic membership Next



- Chn Close

Trang 144/250


Trang 145/250

3. Ci t Forefront Client trn TMG Client - Kch hot tp tin MS_FWC.msi


- Mn hnh License Agreement, chn I accept the term Next


- Mn hnh Destination Folder Next

- Mn hnh ISA Server Computer Selection, chn Connect to this ISA Server computer, nhp vo tn ISA Server: TMG.NHATNGHE.LOCAL Next

Trang 146/250


Trang 147/250

- Mn hnh Ready to Install Next



- Chn Yes khi ng li my

- M chng trnh Microsoft Firewall Client Management

Trang 148/250


Trang 149/250

- Tab Settings chn Test Server

- Qu trnh kim tra kt ni n ISA Server thnh cng

- M IE, truy cp trang web bt k Khng thnh cng


3. Thit lp cc Access Rule kim sot giao dch - Click phi Firewall Policy New Access Rule

- Mn hnh New Access Rule, nhp DNS Outbound Next

- Mn hnh Rule Action, chn Allow Next

Trang 150/250


Trang 151/250

- Mn hnh Protocols, chn Selected Protocols Add

- Chn DNS Add Close


- Mn hnh Access Rule Source Add

- Chn Internal Add Close

Trang 152/250


Trang 153/250

- Mn hnh Access Rule Destination Add

- Chn External Add Close


- Mn hnh User Sets Next


Trang 154/250


Trang 155/250

- Tng t, to thm 1 Access Rule, t tn l Web Access


- Mn hnh Protolcols Add

- Chn HTTP v HTTPS Add Close

Trang 156/250


Trang 157/250

- Next

- Mn hinh Malware Inspection, chn Enable malware inspection Next

- Mn hnh Access Rule Sources Add Internal


- Mn hnh Access Rule Desninations Add External

- Mn hnh User Sets Next


Trang 158/250


Trang 159/250

- Chn Apply

Kim tra trn my Client: m IE truy cp vo trang web bt k Truy cp thnh cng


4. Cu hnh chn download file - M Forefront TMG, khung bn tri chnWeb Acess Policy. Trong Action Pane bn phi, chn Configure Malware Inspection

- Qua tab Inspection Settings, mc Block file larger than (MB), nhp vo: 1 Apply OK

Trang 160/250


Trang 161/250

- Chn Apply

Kim tra trn Client: Truy cp web download 1 tp tin dung lng ln hn 1 MB thng bo li.


Trang 162/250


Trang 163/250

LAB 06 PUBLISH WEB SERVER TRN

FOREFRONT THREAT MANAGEMENT GATEWAY I. M HNH

II. GII THIU Doanh nghip tng cng qung b thng hiu v giao dch vi i tc thng qua trang web. Lab ny k tha m hnh lab 05, thc hin xy dng web server trn server 192.168.11.254, to 1 trang web mc nh v publish (xut bn) trn TMG server. III. CC BC THC HIN

1. Xy dng Web Server trn server 192.168.11.254. 2. Cu hnh Web Publishing Rule trn TMG. 3. Cu hnh NAT Inbound trn Router ADSL.


IV. TRIN KHAI 1. Xy dng Web Server - Server Manager Click phi Roles Add Roles

- Next

Trang 164/250


Trang 165/250

- Chn Web Server (IIS)

-Chn Add Required Features Next Next


- Next

- Install

Trang 166/250


Trang 167/250

- Close

- Truy cp C:\InterPub\WWWRoot To 1 file Text Document


- Menu Tools Folder Options

- B chn Hide extensions for known file types

Trang 168/250


Trang 169/250

- Chn Yes

- M file text va to nhp ni dung trang web Lu thnh file: Default.htm

- Truy cp th website ni b : http://LocalHost truy cp thnh cng


2. Cu hnh Access Rule v Publishing Rule trn Forefront cho Web Server - Click phi Firewall Policy New Website Publishing Rule

- t tn Rule Next

Trang 170/250


Trang 171/250

- Chn Allow Next

- Chn Publish a single Web site or load balancer Next


- Chn Use non-secured connections to connect Next

- Nhp Fully Qualified Domain Name ca web server Next

Trang 172/250


Trang 173/250

- Next

- Chn Any domain name Next


- Chn New

- t tn Port 80 Next

Trang 174/250


Trang 175/250

- Chn Do not required SSL secured connections with clients Next

- Chn External Next


- Chn No Authentication Next

- Chn Port 80 Next

Trang 176/250


Trang 177/250

- Chn No delegation, and client cannot authenticate directly Next

- Next Finish


- Apply OK

5. Cu hnh NAT Inbound trn Router ADSL - Truy cp modem ADSL Status Kim tra IP WAN hin c: 222.254.179.98

Trang 178/250


Trang 179/250

- Chn Advanced LAN Clients nhp IP card WAN ca TMG server:192.168.1.2

- Advanced Virtual Server Category Chn User Add

- Nhp thng tin nh trong hnh minh ha Apply


- Chn Add a rules va to vo Applied Rules Apply

- Quan st kt qu ng chng trnh

Trang 180/250


Trang 181/250

- ng nhp vo trang qun tr domain to thm host WWW tr v IP public


Kim tra: Internet client truy cp: http://www.nhatnghe.edu.vn truy cp trang web thnh cng

Trang 182/250


Trang 183/250

LAB 07 VIRTUAL PRIVATE NETWORK (VPN)

I. M HNH

II. GII THIU Doanh nghip m rng hot ng kinh doanh v m thm chi nhnh.T , pht sinh mt s nhu cu: Nhn vin lm vic ngoi cng ty cn kt ni an ton n h mng Si Gn. Trao i d liu an ton gia 02 h mng Si Gn & H Ni khi doanh nghip khng c ng thu

bao ring. Lab 07 k tha kt qu ca lab 05 v pht trin thm h mng ngang hng ti chi nhnh H Ni. H mng H Ni c network id 192.168.21.0 / 24, gm 01 file server Windows 2008 v 01 TMG firewall. Nhu cu pht sinh nu trn c gii quyt bng cch tn dng ng truyn DSL c sn ti cc chi nhnh thit lp kt ni VPN. VPN server cng chnh l TMG server. III. CC BC TRIN KHAI

A. CLIENT GATEWAY 1. Cp php Dial-in cho user KT1. 2. Cu hnh VPN server trn TMG server. 3. To VPN Connection trn Client. 4. Thc hin kt ni & truy cp d liu B. GATEWAY GATEWAY 1. To User & cp php Dial-in. 2. Cu hnh trn server TMG ti Si Gn. 3. Cu hnh trn server TMG ti H Ni. 4. Kim tra: Kt ni VPN c t ng thit lp khi 2 site pht sinh nhu cu truy cp nhau.


IV. TRIN KHAI CHI TIT A.CLIENT - GATEWAY 1. Cho user quyn dial-in (Thc hin trn DC) - M DSA.MSC Properties account KT1

- Tab Dial-in Chn Allow Acess OK

Trang 184/250


Trang 185/250

2. Cu hnh VPN trn TMG - Chn Virtual Private Network (VPN) tab VPN Clients Configure Address Assignment Method

- Chn Add


- Khai bo dy IP chnh xc theo hnh minh ha OK

- OK

Trang 186/250


Trang 187/250

- Chn Enable VPN Client Access

- Chn Enable VPN client access OK


- To Access Rule t tn rule l VPN client Next

- Chn Allow Next

Trang 188/250


Trang 189/250

- Chn All outbound traffic Next

- Chn Enable malware inspection for this rule next


- Chn Add

- Chn VPN Clients Add Close

Trang 190/250


Trang 191/250

- Chn Next

- Add network Internal Next


- Next Finish

- Apply Ok

Trang 192/250


Trang 193/250

- Truy cp Modem ADSL NAT port 1723 v card WAN my TMG

3. To VPN Connection trn Client - Start Control Panel Network and Sharing Center


- Chn Set up a new connection or network

- Chn Connect to a workplaced Next

Trang 194/250


Trang 195/250

- Chn Use my Internet connection (VPN)

- Khai bo public name hoc public IP address ca site SaiGon Next


- Khai bo account KT1 v password tng ng Connect

Trang 196/250


Trang 197/250

- Sau khi kt ni thnh cng truy cp \\192.168.11.254 truy cp thnh cng

B. GATEWAY GATEWAY 1. To User cho php Dial-in - Start Run DSA.MSC


- To New User

- Khai bo thng tin chnh xc theo hnh minh ha Next

- Nhp Password & Confirm Password : P@ssword B du check User must change password at next log on Next Finish

Trang 198/250


Trang 199/250

- Properties user HN

- Tab Dial-in Chn Allow Access Ok


2.Thc hin trn my TMG SITE SI GN - Chn Virtual Private Network (VPN) tab Remote Sites chn link Create VPN Site-to-Site connection

- t tn site l HN Next

Trang 200/250


Trang 201/250

- Chn Point-to-Point Tunneling Protocol (PPTP) Next

- OK

- Chn my TMG Next


- Khai bo public name hoc public IP address ca site HaNoi Next

- Khai bo chnh xc user name SG v password P@ssword Next

- Chn Add Range

Trang 202/250

TRUNG TM O TO MNG MY TNH NHT NGH I TC O TO CA MICROSOFT TI VIT NAM 105 B Huyn Thanh Quan, Q3, TP. HCM Tel: 3.9322.735 0913.735.906 Fax: 3.9322.734 www.nhatng

Xay Dung Va Quan Tri He Thong Mang Doanh Nghiep Tren Nen 2k8(New)

Documents

Transcript of Xay Dung Va Quan Tri He Thong Mang Doanh Nghiep Tren Nen 2k8(New)