Active Directory multi-sites, network shares and user rights management

Context

Infrastructure

A company has 3 sites, each with 1 Windows server:

SRV-CHA (AD) in Chassignieu (company headquarters)
SRV-VIR in Virieu
SRV-BLA in Blandin

Each site contains 2 departments:

Administrative
Technical

And the headquarters contains 3:

Management
Administrative
Technical

Organization Units (OU) Structure

1
▶️SRV-CHA
2
├── 👨‍👦‍👦Management
3
│   ├── GG-CHA-DIR
4
│   ├── 🧑CEO
5
│   └── 🧑HR
6
├── 👨‍👦‍👦Administrative
7
│   ├── GG-CHA-ADM
8
│   └── 🧑ADM1C
9
└── 👨‍👦‍👦Technical
10
    ├── GG-CHA-TECH
11
    └── 🧑TECH1C
12

13
▶️SRV-VIR
14
├── 👨‍👦‍👦Administrative
15
│   ├── GG-VIR-ADM
16
│   └── 🧑ADM1V
17
└── 👨‍👦‍👦Technical
18
    ├── GG-VIR-TECH
19
    └── 🧑TECH1V
20

21
▶️SRV-BLA
22
├── 👨‍👦‍👦Administrative
23
│   ├── GG-BLA-ADM
24
│   └── 🧑ADM1B
25
└── 👨‍👦‍👦Technical
26
    ├── GG-BLA-TECH
27
    └── 🧑TECH1B

The GG (Global Groups) link users to LGs. They group all users from the same department. Each user belongs to their department’s GG.

Shares and Permissions

1
▶️SRV-CHA
2
├── 📁DATA-CHA
3
│   ├── 📁Tech-Common
4
│   │   └── 🔓GL-SRV-CHA-DATA-TECH-COMMON-FC
5
│   ├── 📁Adm-Common
6
│   │   ├── 🔓GL-SRV-CHA-DATA-TECH-COMMON-FC
7
│   │   └── 🔒GL-SRV-CHA-DATA-ADM-COMMON-R
8
│   ├── 📁Adm-Chassignieu
9
│   │   ├── 🔓GL-SRV-CHA-DATA-ADM-CHASSIGNIEU-FC
10
│   │   └── 🔒GL-SRV-CHA-DATA-ADM-CHASSIGNIEU-R
11
│   ├── 📁Tech-Chassignieu
12
│   │   └── 🔓GL-SRV-CHA-DATA-TECH-CHASSIGNIEU-FC
13
│   └── 📁Management | 🔓GL-SRV-CHA-DATA-MANAGEMENT-FC
14
│       ├── 📁Investments
15
│       └── 📁HR
16
├── 📁PROFILES-CHA
17
└── 📁DBASE-CHA
18

19
▶️SRV-VIR
20
├── 📁DATA-VIR
21
│   ├── 📁Adm-Virieu
22
│   │   ├── 🔓GL-SRV-VIR-DATA-ADM-VIRIEU-FC
23
│   │   └── 🔒GL-SRV-CHA-DATA-ADM-VIRIEU-R
24
│   └── 📁Tech-Virieu
25
│       └── 🔓GL-SRV-VIR-DATA-TECH-VIRIEU-FC
26
├── 📁PROFILES-VIR
27
└── 📁DBASE-VIR
28

29
▶️SRV-BLA
30
├── 📁DATA-BLA
31
│   ├── 📁Adm-Blandin
32
│   │   ├── 🔓GL-SRV-BLA-DATA-ADM-BLANDIN-FC
33
│   │   └── 🔒GL-SRV-CHA-DATA-ADM-BLANDIN-R
34
│   └── 📁Tech-Blandin
35
│       └── 🔓GL-SRV-BLA-DATA-TECH-BLANDIN-FC
36
├── 📁PROFILES-BLA
37
└── 📁DBASE-BLA

We will use the above topology for this entire practical work.

The steps detailed below indicate the procedure to follow to create each element.

Creating an OU

OU Organizational Unit is an element in Active Directory that allows us to manage a set of elements. In the diagram above, we can see there are “sub-Organizational Units”:

For example: The user: CEO is located in SRV-CHA > Management So in the sub-OU Management which depends on SRV-CHA

Go to server SRV-CHA (active directory):

Uncheck the box Protect container from accidental deletion

Creating a GG

A Global Group allows grouping one or more users.

Creating a User

Set a password that complies with your security policy

Creating an LG

LG (Local Domain Groups) apply rights to resources.

FC Full Control R Read

Creating the “DATA” shared folder

LGs will be applied in these subfolders

Enable Access-based Enumeration

Enabling enumeration shows only the folders that the user has access to.

Enable access-based enumeration

Check Enable access-based enumeration

Linking a User to GG

Linking a GG to LG

Applying an LG to Shared Directory

Allows applying permissions to the shared path.

Allow access only to GG-Management members

Base Folder

The base folder is simply an empty directory for each user, where they can store their documents for example. This folder is in a shared path.

Create network share

The $ symbol hides the directory

Link base folder to user

Paste the network share path.
%USERNAME% creates a folder named after each user

Mapping Network Drives

Each user will automatically map 3 network drives to their session (common, partitioned, and base folder, depending on their location), using the script assigned to them:

Chassignieu:

1
net use Y: \\SRV-CHA\DATA-CHA$

Note

Contains only 2 since both Common and Partitioned folders are in DATA-CHA

Virieu:

1
net use Y: \\SRV-CHA\DATA-CHA$
2
net use Z: \\SRV-VIR\DATA-VIR$

Blandin:

1
net use Y: \\SRV-CHA\DATA-CHA$
2
net use Z: \\SRV-BLA\DATA-BLA$

Example: Let’s take the example of a user in Blandin:

X: will contain the shared directory \\SRV-BLA\DBASE-BLA$\USER_NAME
Y: will contain the common shared directory \\SRV-CHA\DATA-CHA$ (user will only see folders where they have access (minimum read) from the common share).
Z: will contain the shared directory \\SRV-BLA\DATA-BLA$ if I’m in Blandin (user will only see folders where they have access (minimum read), site partitioning).