Configuring and Troubleshooting AccessLesson 12

Skills Matrix

Technology SkillObjective Domain SkillDomain #Accessing Local and Network ResourcesConfigure and troubleshoot access to resources2.6Understanding and Configuring Remote AssistanceConfigure and troubleshoot remote access Remote Assistance4.3Configuring Remote Assistance Through Group Policy Remote Assistance4.3Using Remote DesktopRemote Desktop4.3

Skills Matrix

Technology SkillObjective Domain SkillDomain #Configuring Remote Desktop Through Group PolicyRemote Desktop4.3Understanding and Configuring Virtual Private NetworksVPN connections4.3Configuring VPN ConnectionsVPN connections4.3Troubleshooting Networking with Command-Line ToolsTroubleshoot connectivity issues4.4

Skills Matrix

Technology SkillObjective Domain SkillDomain #Using Windows Network DiagnosticsUse the Network Connections Diagnostics tool4.4Troubleshooting NetworkingTroubleshoot connectivity issuesConfigure and troubleshoot wireless networkingTroubleshoot access to network resources4.4

4.5

4.7Accessing Local and Network ResourcesTroubleshoot access to network resources4.7

Skills Matrix

Technology SkillObjective Domain SkillDomain #Understanding PermissionsFiles and folders4.7Configuring NTFS PermissionsFiles and folders4.7Configuring Network Sharing Printers Configure Network Discovery and Sharing4.7

Remote Assistance Enables a technology professional or other user to connect to your computer remotely. The connected user (herein called the assistant, also called an expert) can view your computer screen and chat using text messages.Understanding and Configuring Remote AssistanceUnderstanding and Configuring Remote Assistance

Configuring Remote Assistance Settings LocallyUnderstanding and Configuring Remote AssistanceClick Start, right-click Computer, and then click Properties.Click Remote settings in the task list.Provide credentials, and then click OK.Click the Remote tab.

Configuring Remote Assistance Settings Locally (cont.)Understanding and Configuring Remote AssistanceRemote Assistance Settings dialog box

Click Start. In the Start Search text box, key msra and then press Enter. The Windows Remote Assistance Wizard appears.Click Invite someone you trust to help you. The How do you want to invite someone to help you? page appears.Inviting Remote AssistanceUnderstanding and Configuring Remote Assistance

Click one of the following:Use e-mail to send an invitationSave this invitation as a fileClick an existing invitationInviting Remote Assistance (cont.)Understanding and Configuring Remote Assistance

On the Choose a password for connecting to your computer page, key a password in the Password text box and confirm it. Click Next.Your mail client appears with a pre-created message and subject. The invitation file is automatically attached.Inviting Remote Assistance (cont.)Understanding and Configuring Remote Assistance

Three conditions must be met in order to offer Remote Assistance.You must be added to the list of helpers in the Offer Remote Assistance Group Policy setting.Windows Firewall must except msra.exe and raserver.exe.Windows Firewall must allow communication on DCOM port 135 (TCP).Offering Remote AssistanceUnderstanding and Configuring Remote Assistance

This procedure assumes that you are a support professional offering to assist a user.Click Start. In the Start Search text box, key msra, and then press Enter. The Windows Remote Assistance Wizard appears.Click Offer to help someone. The Choose a way to connect to the other persons computer page appears.Offering Remote Assistance (cont.)Understanding and Configuring Remote Assistance

Do one of the following:Use the Enter an invitation file location text box.Select an existing invitation.Use the Type a computer name or IP address option.Offering Remote Assistance (cont.)Understanding and Configuring Remote Assistance

You access Remote Assistance Group Policy settings in the Windows Settings > Administrative Templates > System > Remote Assistance node in Group Policy objects.Configuring Remote Assistance Through Group PolicyUnderstanding and Configuring Remote Assistance

Remote Desktop Enables you to connect to a computer (computer A) from a remote computer (computer B) over a network. Remote Desktop can be an excellent tool for remote administration of servers.Remote DesktopUsing Remote Desktop

Before you can connect to a computer using Remote Desktop, you must first:Add the user account with which you want to connect to the target computer to the Remote Desktop Users group of the target computer.Configure the firewall to allow Remote Desktop connections.Ensure that the target computer allows Remote Desktop connections.Remote Desktop (cont.)Using Remote Desktop

In the Remote Desktop section, select one of the following:Dont allow connections to this computerAllow connections from computers running any version of Remote Desktop (less secure)Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)Configuring Remote Desktop Settings LocallyUsing Remote Desktop

Network Level Authentication (NLA) A reordering of the normal authentication process. Ordinarily, to authenticate to a server, you contact the server and then provide your credentials. In NLA, you provide your user name and password first. Only after that procedure is completed is the server contacted for authentication.Configuring Remote Desktop Settings Locally (cont.)Using Remote Desktop

Click Select Users.To enable a user or group to connect to this computer remotely, click Add.In the Enter the object names to select text box, key the user or group name, and then click Check Names.Configuring Remote Desktop Settings Locally (cont.)Using Remote Desktop

To search for a user, click Advanced.Add as many users and groups as you want, and then click OK.Configuring Remote Desktop Settings Locally (cont.)Using Remote Desktop

Configuring Remote Desktop Session Settings LocallyUsing Remote DesktopSettings on the General tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.)Using Remote DesktopSettings on the Display tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.)Using Remote DesktopSettings on the Local Resources tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.)Using Remote DesktopSettings on the Programs tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.)Using Remote DesktopSettings on the Experience tab of the Remote Desktop Connection dialog box

Configuring Remote Desktop Session Settings Locally (cont.)Using Remote DesktopSettings on the Advanced tab of the Remote Desktop Connection dialog box

Open the Remote Desktop Connection dialog box.In the General tab in the Computer combo box, type the FQDN or the IP address of the computer to which you want to connect.Click Connect.Connecting to a Computer Using Remote DesktopUsing Remote Desktop

In the User Name text box, key the user name of the user that you want to use to connect to the target computer in the form domain/user name. Click OK.Connecting to a Computer Using Remote Desktop (cont.)Using Remote Desktop

You can configure Terminal Services Group Policy settings in the Computer Configuration > Administrative Templates > Windows Components > Terminal Services folder and sub-folders of GPOs.Configuring Remote Desktop Through Group PolicyUsing Remote Desktop

Virtual private network (VPN) Private network established within a public network, most frequently the Internet. In an enterprise, it is most often used by users logging in from remote locations, such as their homes, to the enterprise domain through the Internet.Virtual Private NetworksUnderstanding and Configuring Virtual Private Networks

To emulate point-to-point links, VPNs encapsulate data in a package that contains a header with routing information and a payload of encrypted data.Virtual Private Networks (cont.)Understanding and Configuring Virtual Private Networks

From an implementation standpoint, there are three basic requirements for establishing a VPN.User Authentication and AuditingIP Address AssignmentData EncryptionVirtual Private Networks (cont.)Understanding and Configuring Virtual Private Networks

Enabling a User to Connect to a VPN Server Using ADUCUnderstanding and Configuring Virtual Private NetworksDial-in tab of an example users Properties dialog box

Connecting to a VPN Server Through RRASUnderstanding and Configuring Virtual Private NetworksFrom the Routing and Remote Access console, Expand ServerName. Right-click Remote Access Policies, and then click New Remote Access Policy.Click Next. The Policy Configuration Method page appears.

Connecting to a VPN Server Through RRAS (cont.)Understanding and Configuring Virtual Private NetworksEnsure that Use the wizard to set up a typical policy for a common scenario is selected.In the Policy name text box, key a name for the policy.Click Next. The Access Method page appears.

Connecting to a VPN Server Through RRAS (cont.)Understanding and Configuring Virtual Private NetworksSelect one of the following options:VPNDial-upWirelessEthernet

Connecting to a VPN Server through RRAS (cont.)Understanding and Configuring Virtual Private NetworksSelect one of the following:User Select this option to accept users according to the settings for each user.Group Select this option to add a group to the list of groups to authenticate, and then click Add. You can add more than one group.

Connecting to a VPN Server Through RRAS (cont.)Understanding and Configuring Virtual Private NetworksSelect one of the following to choose which authentication scheme to use.Extensible Authentication Protocol (EAP) EAP is typically used for wireless network authentication, but is falling out of use in favor of WEP and WEP2.

Connecting to a VPN Server Through RRAS (cont.)Understanding and Configuring Virtual Private NetworksSelect one of the following to choose which authentication scheme to use (cont.).Microsoft Encrypted Authentication version 2 (MS-CHAPv2) This is the default.Microsoft Encrypted Authentication (MS-CHAP) This is used for backward-compatibility reasons.

Connecting to a VPN Server Through RRAS (cont.)Understanding and Configuring Virtual Private NetworksConfigure the following check boxes according to which encryption methods you want to support.Basic encryption (IPSec 56-bit DES or MPEE 40-bit)Strong encryption (IPSec 56-bit DES or MPPE 56-bit)Strongest encryption (IPSec Triple DES or MPPE 128-bit)

Configuring a VPN Client ConnectionUsing Remote DesktopIn the Internet address text box, key the IP address of your VPN server (for example, 10.21.23.54) or its fully qualified domain name (FQDN) (for example, vpn12.contoso.com).

Connecting to a Domain Using a VPN ConnectionUnderstanding and Configuring Virtual Private NetworksClick Start, and then click Connect To. The Connect to a Network Wizard appears.Select the VPN connection in the list of network connections, and then click Connect.A Connect ConnectionName Connection dialog box may appear. Provide your credentials, and then click Connect.

Local and Network ResourcesAccessing Local and Network ResourcesResources in an enterprise come in two varieties.Local resources Include anything on or connected to your computer that is not part of a networkNetwork resources Include shared folders and files, printers, routers, gateways, DHCP servers, and many others

Understanding PermissionsAccessing Local and Network ResourcesNTFS File system used by Windows Vista and other, more recent versions of Windows to determine how data is stored on the hard-drivesNTFS permissions Part of NTFS that controls user access and control over files and folders

Understanding Permissions (cont.)Accessing Local and Network ResourcesEach file or folder in NTFS has separate permissions. The permissions are determined by access control entries (ACEs). There is an ACE for each user and each permission on each object. Files and folders can also have ACEs for groups as well as individual users.

Understanding Permissions (cont.)Accessing Local and Network ResourcesThe permissions under Permissions for Garrett Vargas are examples of standard permissions.

Configuring Permissions for a FolderAccessing Local and Network ResourcesSecurity tab in the Properties dialog box of an example folder

Configuring Permissions for a Folder (cont.)Accessing Local and Network ResourcesPermissions dialog box for an example folder

Configuring NTFS Permissions for a FolderAccessing Local and Network ResourcesPermission Entry dialog box for an example folder

Configuring Permission Inheritance for a Folder or FileAccessing Local and Network ResourcesIn the Security tab of the FolderName Properties dialog box, click Advanced. The Advanced Security Settings for the FolderName dialog box appears.Click Edit. Another Advanced Security Settings for the FolderName dialog box appears.Select the Include inheritable permissions from this object's parent check box.

Configuring Permission Inheritance for a Folder or File (cont.)Accessing Local and Network ResourcesConfigure the Replace all existing inheritable permissions on all descendants with inheritable permissions from this object check box.Select the user or group for which you want to configure permission inheritance, and then click Edit.

Configuring Permission Inheritance for a Folder or File (cont.)Accessing Local and Network ResourcesSelect one of the following from the Apply to list-box.This folder onlyThis folder, subfolder and filesThis folder and subfoldersThis folder and files

Configuring Permission Inheritance for a Folder or File (cont.)Accessing Local and Network ResourcesSelect one of the following from the Apply to list-box (cont.).Subfolder and files onlySubfolders onlyFiles onlyConfigure the Apply these permissions to objects and/or containers within this container only check box.

Determining Effective PermissionsAccessing Local and Network ResourcesEffective Permissions tab for an example folder

Determining Effective Permissions (cont.)Accessing Local and Network ResourcesEffective Permissions tab for an example folder with an example user selected

Enabling Network DiscoveryAccessing Local and Network ResourcesFor other users to see shares on your computer, network discovery must be enabled.Click Start, and then click Control Panel.Click Network and Internet.Click Network and Sharing Center.Under Sharing and Discovery, expand the Network and Discovery section by clicking the down arrow on the right.

Enabling Network Discovery (cont.)Accessing Local and Network ResourcesClick Turn on network discovery, and then click Apply. A User Account Control dialog box appearsProvide administrator credentials, and then click OK.

Enabling File SharingAccessing Local and Network ResourcesOpen the Network and Sharing Center.In the Network and Sharing Center under Sharing and Discovery, expand the File Sharing section.Click Turn on file sharing, and then click Apply. A User Account Control dialog box appears.Provide administrator credentials, and then click OK.

Enabling Public Folder SharingAccessing Local and Network ResourcesOpen the Network and Sharing Center.Under Sharing and Discovery, expand the Public Folder Sharing section.

Enabling Public Folder Sharing (cont.)Accessing Local and Network ResourcesSelect one of the following, and then click Apply.Turn on sharing so anyone with network access can open filesTurn on sharing so anyone with network access can open, change, and create filesTurn off sharing

Creating a Network Share Using the File Sharing WizardAccessing Local and Network ResourcesRight-click the folder that you want to share, and then click Share. In the drop-down text box, do one of the following:To specify a particular user or group with which to share the folder, type the user name or group name and then click Add.To share the folder with everyone, click the down arrow on the right, select Everyone, and then click Add.

Creating a Network Share Using the File Sharing Wizard (cont.)Accessing Local and Network ResourcesIn the drop-down text box, do one of the following (cont.):To browse for users or groups with which to share the folder, click the down arrow on the right and then select Find. Use the Select Users or Groups dialog box to select the user or group.

Creating a Network Share Using the File Sharing Wizard (cont.)Accessing Local and Network ResourcesPermission levelsReader The user or group is granted the following standard permissions: Read &execute, List folder contents, and Read.Contributor The user or group is granted the following standard permissions: Modify, Read & execute; List folder contents; Read; and Write.Co-owner Select this option if you want the user or group to have full control over the shared folder.

Printer SharingAccessing Local and Network ResourcesOpen the Network and Sharing Center.Under Sharing and Discovery, expand the Printer Sharing section.Click Turn on printer sharing, and then click Apply. A User Account Control dialog box appears.Provide administrator credentials, and then click OK.

Troubleshooting NetworkingTroubleshooting NetworkingMost network troubleshooting first involves determining where the network is failing. You should always check the simple stuff first, such as unplugged cables or out-of-range wireless connections.

Using PingTroubleshooting NetworkingExample output from the Ping command

Using IPConfig to Display TCP/IP SettingsTroubleshooting NetworkingExample output from the IPConfig command

Using IPConfig to Release and Renew a DHCP IP AddressTroubleshooting NetworkingIf you suspect a problem with an IP address, you can use IPConfig to release the old IP address and obtain a new IP address.ipconfig /releaseipconfig /renew

Using IPConfig to Flush the DNS Resolver CacheTroubleshooting NetworkingYou can use IPConfig to clear the DNS resolver cache so that you can be assured when troubleshooting that the DNS resolver cache is not the problem. ipconfig /flushdns

Using Net ViewTroubleshooting NetworkingExample output from the Net View command

Using Net View (cont.)Troubleshooting NetworkingExample output from the Net View command

Using TraceRtTroubleshooting NetworkingExample output from the TraceRt command

Using PathPingTroubleshooting NetworkingExample output from the PathPing command

Using NSLookupTroubleshooting NetworkingExample output from the NSLookup command

Using Windows Network DiagnosticsTroubleshooting NetworkingWindows Network Diagnostics (WND) Part of the Windows Diagnostic Infrastructure (WDI). It can help users solve some wireless and other networking issues. By helping users to solve problems, WND can reduce calls to the help desk.

Using Windows Network Diagnostics (cont.)Troubleshooting NetworkingSome common problems that WND can help users to solve:Receiving a weak wireless signalHaving a disabled wireless cardNot receiving an IP address assignmentTyping an incorrect security keyUsing invalid certificates when logging onExperiencing hardware or driver issues

Starting Windows Network DiagnosticsTroubleshooting NetworkingYou can manually start WND to help troubleshoot networking issues.Click Start, and then click Control Panel.Under Network and Internet, click View network status and tasks.In the tasks list, click Diagnose and Repair.

SummaryRemote Assistance enables support technicians to help clients remotely by viewing and controlling users desktops.You learned how to configure Remote Assistance settings locally and through Group Policy.You learned how to invite and offer remote assistance.You Learned

SummaryRemote Desktop enables you to connect to a computer from another computer over a network, such as a local area network or a virtual private network.You learned how to configure Remote Desktop settings locally and through Group Policy using Terminal Services policy settings.You learned how to connect to a computer using Remote Desktop.You Learned (cont.)

SummaryVirtual Private Networks are private networks established on public networks, such as the Internet.You can grant users permission to connect to a VPN server either through the Active Directory Users and Computers console or by using the Routing and Remote Access console.You learned how to enable a user or group to connect to a VPN server.You Learned (cont.)

SummaryYou learned how to configure a VPN client connection.You learned how to troubleshoot access denied messages.NTFS permissions control user access and level of control over files and folders. NTFS permissions are implemented using special permissions and standard permissions.You Learned (cont.)

SummaryYou learned how to configure permissions for a file or folder.You learned how to configure permission inheritance for a folder or file.You learned how to determine effective permissions on a particular object for a particular user.You Learned (cont.)

SummaryNetwork sharing controls access to local resources by network users.You learned how to enable network discovery.You learned how to enable file sharing, public folder sharing, and printer sharing.You learned how to create a network share using the File Sharing Wizard.You Learned (cont.)

SummaryYou learned how to troubleshoot networking using command-line tools and the Network Connections Diagnostic tool.You learned how to use Ping, IPConfig, Net View, TraceRT, PathPing, and NSlookup.You Learned (cont.)