# Active Directory multi-sites, network shares and user rights management

> Active directory, installation, domain controller, shares and permissions.

Published on 2021-12-20 | Tags: windows server, AD, share, permissions, DC

https://xsec.fr/en/windows/ad-tp/

---

import Callout from '@shared/components/Callout.astro'
import { Collapsible } from '@shared/components/ui/collapsible'
import { Tree } from '@shared/components/ui/file-tree'
import AdMultiSiteTopology from '@shared/components/diagrams/AdMultiSiteTopology.astro'

## Context

<AdMultiSiteTopology />

A company has 3 sites, each with 1 Windows server:
- SRV-CHA (AD) in Chassignieu (company headquarters)
- SRV-VIR in Virieu
- SRV-BLA in Blandin

Each site contains 2 departments:
- Administrative
- Technical

And the headquarters contains 3:
- Management
- Administrative
- Technical

### Organization Units (OU) Structure

<Tree elements={[{id:'1',name:'SRV-CHA',children:[{id:'2',name:'Management',children:[{id:'f1',name:'GG-CHA-DIR',type:'file'},{id:'f2',name:'CEO',type:'file'},{id:'f3',name:'HR',type:'file'}]},{id:'3',name:'Administrative',children:[{id:'f4',name:'GG-CHA-ADM',type:'file'},{id:'f5',name:'ADM1C',type:'file'}]},{id:'4',name:'Technical',children:[{id:'f6',name:'GG-CHA-TECH',type:'file'},{id:'f7',name:'TECH1C',type:'file'}]}]},{id:'5',name:'SRV-VIR',children:[{id:'6',name:'Administrative',children:[{id:'f8',name:'GG-VIR-ADM',type:'file'},{id:'f9',name:'ADM1V',type:'file'}]},{id:'7',name:'Technical',children:[{id:'f10',name:'GG-VIR-TECH',type:'file'},{id:'f11',name:'TECH1V',type:'file'}]}]},{id:'8',name:'SRV-BLA',children:[{id:'9',name:'Administrative',children:[{id:'f12',name:'GG-BLA-ADM',type:'file'},{id:'f13',name:'ADM1B',type:'file'}]},{id:'10',name:'Technical',children:[{id:'f14',name:'GG-BLA-TECH',type:'file'},{id:'f15',name:'TECH1B',type:'file'}]}]}]} initialExpandedItems={['1','2','3','4','5','6','7','8','9','10']} sort="none" className="h-auto" client:load />
The `GG (Global Groups)` link users to LGs.
They group all users from the same department.
Each user belongs to their department's GG.

### Shares and Permissions

<Tree elements={[{id:'1',name:'SRV-CHA',children:[{id:'2',name:'DATA-CHA',children:[{id:'3',name:'Tech-Common',children:[{id:'f1',name:'GL-SRV-CHA-DATA-TECH-COMMON-FC',type:'file'}]},{id:'4',name:'Adm-Common',children:[{id:'f2',name:'GL-SRV-CHA-DATA-TECH-COMMON-FC',type:'file'},{id:'f3',name:'GL-SRV-CHA-DATA-ADM-COMMON-R',type:'file'}]},{id:'5',name:'Adm-Chassignieu',children:[{id:'f4',name:'GL-SRV-CHA-DATA-ADM-CHASSIGNIEU-FC',type:'file'},{id:'f5',name:'GL-SRV-CHA-DATA-ADM-CHASSIGNIEU-R',type:'file'}]},{id:'6',name:'Tech-Chassignieu',children:[{id:'f6',name:'GL-SRV-CHA-DATA-TECH-CHASSIGNIEU-FC',type:'file'}]},{id:'7',name:'Management',children:[{id:'f7',name:'GL-SRV-CHA-DATA-MANAGEMENT-FC',type:'file'},{id:'8',name:'Investments',type:'folder'},{id:'9',name:'HR',type:'folder'}]}]},{id:'10',name:'PROFILES-CHA',type:'folder'},{id:'11',name:'DBASE-CHA',type:'folder'}]},{id:'12',name:'SRV-VIR',children:[{id:'13',name:'DATA-VIR',children:[{id:'14',name:'Adm-Virieu',children:[{id:'f8',name:'GL-SRV-VIR-DATA-ADM-VIRIEU-FC',type:'file'},{id:'f9',name:'GL-SRV-CHA-DATA-ADM-VIRIEU-R',type:'file'}]},{id:'15',name:'Tech-Virieu',children:[{id:'f10',name:'GL-SRV-VIR-DATA-TECH-VIRIEU-FC',type:'file'}]}]},{id:'16',name:'PROFILES-VIR',type:'folder'},{id:'17',name:'DBASE-VIR',type:'folder'}]},{id:'18',name:'SRV-BLA',children:[{id:'19',name:'DATA-BLA',children:[{id:'20',name:'Adm-Blandin',children:[{id:'f11',name:'GL-SRV-BLA-DATA-ADM-BLANDIN-FC',type:'file'},{id:'f12',name:'GL-SRV-CHA-DATA-ADM-BLANDIN-R',type:'file'}]},{id:'21',name:'Tech-Blandin',children:[{id:'f13',name:'GL-SRV-BLA-DATA-TECH-BLANDIN-FC',type:'file'}]}]},{id:'22',name:'PROFILES-BLA',type:'folder'},{id:'23',name:'DBASE-BLA',type:'folder'}]}]} initialExpandedItems={['1','2','3','4','5','6','7','12','13','14','15','18','19','20','21']} sort="none" className="h-auto" client:load />

We will use the above topology for this entire practical work.

The steps detailed below indicate the procedure to follow to create each element.

## Creating an OU

`OU` Organizational Unit is an element in Active Directory that allows us to manage a set of elements.
In the diagram above, we can see there are "sub-Organizational Units":

For example: The user: CEO is located in `SRV-CHA > Management`
So in the sub-OU `Management` which depends on `SRV-CHA`

- Go to server `SRV-CHA` (active directory):

![](/media/windows/ad_multisites/util.webp)

![](/media/windows/ad_multisites/1.webp)

![Uncheck the box `Protect container from accidental deletion`](/media/windows/ad_multisites/2.webp)

## Creating a GG

A `Global Group` allows grouping one or more users.

![](/media/windows/ad_multisites/3.webp)

![](/media/windows/ad_multisites/4.webp)

## Creating a User

![](/media/windows/ad_multisites/5.webp)

![](/media/windows/ad_multisites/6.webp)

![Set a password that complies with your security policy](/media/windows/ad_multisites/7.webp)

![](/media/windows/ad_multisites/8.webp)

## Creating an LG

`LG (Local Domain Groups)` apply rights to resources.

`FC` Full Control
`R` Read

![](/media/windows/ad_multisites/22.webp)

![](/media/windows/ad_multisites/23.webp)

![](/media/windows/ad_multisites/24.webp)

![](/media/windows/ad_multisites/25.webp)

## Creating the "DATA" shared folder

![](/media/windows/ad_multisites/17.webp)

![](/media/windows/ad_multisites/18.webp)

![](/media/windows/ad_multisites/19.webp)

![](/media/windows/ad_multisites/20.webp)

![](/media/windows/ad_multisites/21.webp)

![LGs will be applied in these subfolders](/media/windows/ad_multisites/22.webp)

### Enable Access-based Enumeration

Enabling enumeration shows only the folders that the user has access to.

![Enable access-based enumeration](/media/windows/ad_multisites/x1.webp)

![](/media/windows/ad_multisites/x2.webp)

![Check `Enable access-based enumeration`](/media/windows/ad_multisites/x3.webp)

### Linking a User to GG

![](/media/windows/ad_multisites/26.webp)

![](/media/windows/ad_multisites/27.webp)

![](/media/windows/ad_multisites/28.webp)

### Linking a GG to LG

![](/media/windows/ad_multisites/29.webp)

![](/media/windows/ad_multisites/30.webp)

![](/media/windows/ad_multisites/31.webp)

![](/media/windows/ad_multisites/32.webp)

### Applying an LG to Shared Directory

<Collapsible client:load title="Allows applying permissions to the shared path.">

![](/media/windows/ad_multisites/33.webp)

![](/media/windows/ad_multisites/34.webp)

![](/media/windows/ad_multisites/35.webp)

![Allow access only to GG-Management members](/media/windows/ad_multisites/36.webp)

![](/media/windows/ad_multisites/37.webp)

![](/media/windows/ad_multisites/38.webp)

![](/media/windows/ad_multisites/39.webp)

![](/media/windows/ad_multisites/40.webp)

</Collapsible>

## Base Folder

The base folder is simply an empty directory for each user, where they can store their documents for example.
This folder is in a shared path.

<Collapsible client:load title="Create network share">

![](/media/windows/ad_multisites/9.webp)

![](/media/windows/ad_multisites/10.webp)

![The `$` symbol hides the directory](/media/windows/ad_multisites/11.webp)

![](/media/windows/ad_multisites/12.webp)

![](/media/windows/ad_multisites/13.webp)

![](/media/windows/ad_multisites/14.webp)

</Collapsible>

<Collapsible client:load title="Link base folder to user">

![](/media/windows/ad_multisites/15.webp)

![Paste the network share path.
`%USERNAME%` creates a folder named after each user](/media/windows/ad_multisites/16.webp)

</Collapsible>

## Mapping Network Drives

Each user will automatically map 3 network drives to their session (common, partitioned, and base folder, depending on their location), using the script assigned to them:

<Collapsible client:load title="Chassignieu:">

```bat
net use Y: \\SRV-CHA\DATA-CHA$
```

<Callout variant="note">
Contains only 2 since both `Common` and `Partitioned` folders are in `DATA-CHA`
</Callout>

</Collapsible>

<Collapsible client:load title="Virieu:">

```bat
net use Y: \\SRV-CHA\DATA-CHA$
net use Z: \\SRV-VIR\DATA-VIR$
```

</Collapsible>

<Collapsible client:load title="Blandin:">

```bat
net use Y: \\SRV-CHA\DATA-CHA$
net use Z: \\SRV-BLA\DATA-BLA$
```

</Collapsible>

Example: Let's take the example of a user in Blandin:

- `X:` will contain the shared directory `\\SRV-BLA\DBASE-BLA$\USER_NAME`

- `Y:` will contain the common shared directory `\\SRV-CHA\DATA-CHA$` (user will only see folders where they have access (minimum read) from the common share).

- `Z:` will contain the shared directory `\\SRV-BLA\DATA-BLA$` if I'm in Blandin (user will only see folders where they have access (minimum read), site partitioning).

<Collapsible client:load title="Create scripts">

![](/media/windows/ad_multisites/41.webp)

![Check `File name extensions`](/media/windows/ad_multisites/42.webp)

![](/media/windows/ad_multisites/43.webp)

![](/media/windows/ad_multisites/44.webp)

</Collapsible>

<Collapsible client:load title="Link script to user">

![](/media/windows/ad_multisites/45.webp)

![](/media/windows/ad_multisites/46.webp)

</Collapsible>

## Roaming Profiles

Roaming Profiles facilitate machine or location changes.
The user profile is stored remotely on a shared directory.

<Collapsible client:load title="Create shared directory">

![](/media/windows/ad_multisites/47.webp)

![](/media/windows/ad_multisites/48.webp)

![](/media/windows/ad_multisites/49.webp)

![](/media/windows/ad_multisites/50.webp)

![](/media/windows/ad_multisites/51.webp)

</Collapsible>

<Collapsible client:load title="Link profile to user">

![](/media/windows/ad_multisites/52.webp)

![](/media/windows/ad_multisites/53.webp)

</Collapsible>

## Testing a Domain User

<Callout variant="warning">
You must be a local administrator of the machine to join the domain.
</Callout>