Active Directory multi-sites, network shares and user rights management

Context

A company has 3 sites, each with 1 Windows server:

SRV-CHA (AD) in Chassignieu (company headquarters)
SRV-VIR in Virieu
SRV-BLA in Blandin

Each site contains 2 departments:

Administrative
Technical

And the headquarters contains 3:

Management
Administrative
Technical

Organization Units (OU) Structure

File tree

The GG (Global Groups) link users to LGs. They group all users from the same department. Each user belongs to their department’s GG.

Shares and Permissions

File tree

We will use the above topology for this entire practical work.

The steps detailed below indicate the procedure to follow to create each element.

Creating an OU

OU Organizational Unit is an element in Active Directory that allows us to manage a set of elements. In the diagram above, we can see there are “sub-Organizational Units”:

For example: The user: CEO is located in SRV-CHA > Management So in the sub-OU Management which depends on SRV-CHA

Go to server SRV-CHA (active directory):

Uncheck the box Protect container from accidental deletion

Creating a GG

A Global Group allows grouping one or more users.

Creating a User

Set a password that complies with your security policy

Creating an LG

LG (Local Domain Groups) apply rights to resources.

FC Full Control R Read

Creating the “DATA” shared folder

LGs will be applied in these subfolders

Enable Access-based Enumeration

Enabling enumeration shows only the folders that the user has access to.

Enable access-based enumeration

Check Enable access-based enumeration

Linking a User to GG

Linking a GG to LG

Applying an LG to Shared Directory

Allows applying permissions to the shared path.

Allow access only to GG-Management members

Base Folder

The base folder is simply an empty directory for each user, where they can store their documents for example. This folder is in a shared path.

Create network share

The $ symbol hides the directory

Link base folder to user

Paste the network share path.
%USERNAME% creates a folder named after each user

Mapping Network Drives

Each user will automatically map 3 network drives to their session (common, partitioned, and base folder, depending on their location), using the script assigned to them:

Chassignieu:

net use Y: \\SRV-CHA\DATA-CHA$

Note

Contains only 2 since both Common and Partitioned folders are in DATA-CHA

Virieu:

net use Y: \\SRV-CHA\DATA-CHA$
net use Z: \\SRV-VIR\DATA-VIR$

Blandin:

net use Y: \\SRV-CHA\DATA-CHA$
net use Z: \\SRV-BLA\DATA-BLA$

Example: Let’s take the example of a user in Blandin:

X: will contain the shared directory \\SRV-BLA\DBASE-BLA$\USER_NAME
Y: will contain the common shared directory \\SRV-CHA\DATA-CHA$ (user will only see folders where they have access (minimum read) from the common share).
Z: will contain the shared directory \\SRV-BLA\DATA-BLA$ if I’m in Blandin (user will only see folders where they have access (minimum read), site partitioning).