Professional Web Hosting, Perl Scripting And Developing Blog

Using Remote Installation Services Adding Members to the RISInstallers Group To add members to the special RISInstallers group, follow these steps: 1 In Active Directory Users and Computers, access the folder that contains the RIS- Installers group. 2 Right-click the group entry, and then click Properties. 3 In the Members tab, click Add. 4 Find an account to add, and then click OK. Repeat this step to add other accounts. 5 Click OK to close the group Properties page. That s it! Yes, it was a lot of work, but now you can let users help themselves. Configuring RIS Clients RIS clients rely on PXE to load boot code from the network and establish communications with a RIS server. A PXE-compliant computer has a PXE-enabled BIOS and a NIC that supports remote booting. PXE allows computers to boot using code from a network location, and then to remotely install an operating system without user input, if desired. It does this using standard protocols and services, such as TCP/IP, DHCP, and Trivial File Transfer Protocol (TFTP). Tip In Windows Server 2003, RIS operates with NICs that support the PC 2001 specification. PXE includes extensions to DHCP that allow PXE systems to locate remote installation servers. When a PXE client machine boots from the network adapter, it first locates a DHCP server and then, using information supplied by the DHCP server, contacts a RIS server. The RIS server loads and automatically runs an operating system installation process, which can be a Windows installation (automated or interactive) or an image deployment (created using RIPrep). Not all computers support PXE in their system firmware, and Windows Server 2003 includes an alternative for those systems. If you have machines without PXE support, you can create a RIBF disk, which emulates the PXE boot process. See the section entitled Creating a RIBF Disk later in this chapter for details. In addition, even if your computer is PXE-compliant, you might need to change the BIOS settings to tell the computer to boot using PXE. How you do this depends on the computer. Most of the time, when you start the computer, you ll see an option to access the BIOS setup, then from within BIOS setup you ll typically have an option that lets you change the boot order and select boot options. On an IBM ThinkPad, for instance, restart the computer and press F1 to access the BIOS setup. Then access the Power On options on the Startup menu. Included there is a wide array of boot options, including Network Boot, Removable Devices, Hard Drive, and ATAPI CDROM Drive. The obvious choice seems to be Network Boot, but a Network Boot is typically for thin clients and not a standard system. The actual choice needed is under Hard Drive and is an option for Bootable Add-In Cards, which must be moved up so that the bootable card is checked for before the hard disk drive. Chapter 6 Part 2: Windows Server 2003 Installation
Note: In case you are looking for affordable and reliable webhost to host and run your j2ee application check Vision web and email hosting services

Microsoft Windows Server 2003 Inside Out 7 Find the RISInstallers group in the Group Or User Names list box, click it, and then click Advanced to display the Advanced Security Settings For Computers dialog box, as shown in the following screen: 8 Scroll down the list of labeled Permissions, as shown in the following screen. You should see that the Create Computer Objects permission is set to Allow. Select this entry, and then click Edit to display the Permission Entry For Computers dialog box, as shown in the following screen: Chapter 6 9 Select Allow for Write All Properties and for Delete Computer Objects. Click OK to return to the Advanced Security Settings For Computers dialog box. Click OK twice more to close the dialog boxes. Now all you need to do is add the users who should have these permissions to the RISInstallers group. 174 Part 2: Windows Server 2003 Installation
Note: If you are looking for best quality webspace to host and run your tomcat application check Vision shared web hosting services

Using Remote Installation Services Figure 6-1. Creating the RISInstallers group. 4 In Active Directory Users and Computers, select View, and click Advanced to enable the console to show advanced properties, such as the Security tab. 5 Grant permission to add computers to the domain to the group you just created using the Delegation Of Control Wizard, as discussed in the previous procedure. 6 By default, computer accounts are created in the Computers container. You must change the permissions on this folder to allow RIS installers to delete and change computer accounts. Right-click the Computers folder, and then choose Properties. On the Computers Properties page, click the Security tab, as shown in the following screen: Chapter 6 173 Part 2: Windows Server 2003 Installation
Note: If you are looking for reliable webhost to maintain and run your java application check Vision java hosting services

Microsoft Windows Server 2003 Inside Out Through delegation, you allow users to create computer accounts, but you don t miss out on the opportunity to allow users to help themselves. If Sally messes up her computer by installing things she shouldn t have installed, hand her a remote installation boot floppy disk, tell her to insert the disk, boot the machine and press F12 when prompted, and then follow the prompts, making sure to choose the appropriate image she needs. This way, Sally can help herself, and you can focus on other tasks, such as keeping the network running. As long as Sally has been authorized to join a computer to the domain, she ll be able to complete the installation process. If she hasn t, though, she ll see an error telling her that she doesn t have permission to create or modify a computer account in the domain. Now you might be wondering why you need to authorize Sally to join a computer to the domain when any ordinary user can create a computer account. Well, if there is an existing computer account, RIS must delete the computer account and create a new one with the same name or change the password for the computer account, depending on the operating system. These procedures cannot be performed by ordinary users, which is why you must authorize the user to join a computer to the domain. Users with the privilege to join a computer to the domain can create computer accounts and modify the computer accounts they ve created. They won t, however, be allowed to modify the computer accounts other users have created. If you want to allow users to modify computer accounts created by other users, you must create a special RIS installers group, grant it this permission, and then add users who should have this permission to the group. Creating a RIS Installers Group To create a special group for RIS installers, follow these steps: 1 Log on to the domain with an account that has Administrator privileges, and then run Active Directory Users and Computers by clicking Start, pointing to Programs or All Programs, clicking Administrative Tools, and then selecting Active Directory Users And Computers. 2 Right-click the existing folder or organizational group into which you want to place the special group for RIS installers. Typically, this is the Users container, so right-click the Users folder, click New, and then select Group. This opens the New Object Group dialog box. 3 Type a name for the group, such as RISInstallers (as shown in Figure 6-1), and then click OK. By default, the group is created as a Global Security Group which you ll learn all about in Chapter 37, Managing Users, Groups, and Computers. Chapter 6 172 Part 2: Windows Server 2003 Installation
Note: In case you are looking for affordable webhost to host and run your servlet application check Vision mysql5 web hosting services

Using Remote Installation Services Authorizing Users to Create New Computer Accounts When RIS installs an operating system on a computer, a computer account is created in Active Directory. Therefore, engineers and administrators who will be performing RIS installations must be able to add computers to the domain. If the individuals performing RIS installations don t already belong to a security group that can add computers to the domain, they must be granted the right to do so before they can use RIS. To do this, set permissions in Active Directory that allow the designated security group to add computers to the domain by following these steps: 1 Log on to the domain with an account that has Administrator privileges, and then run Active Directory Users and Computers by clicking Start, pointing to Programs or All Programs, clicking Administrative Tools, and then selecting Active Directory Users And Computers. 2 Right-click the appropriate domain node, and select Delegate Control to start the Delegation Of Control Wizard. 3 Select the specific Users or Groups to delegate. Click Add, and then select a user or security group that will be responsible for using RIS. Repeat this step to add other users or groups. 4 On the Tasks To Delegate page, select Join A Computer To The Domain as the task to delegate. 5 Click Finish to complete the delegation of control. Chapter 6 171 Part 2: Windows Server 2003 Installation
Note: If you are looking for high quality webhost to host and run your jsp application check Vision christian web host services

Microsoft Windows Server 2003 Inside Out Controlling Access to RIS Servers Access to RIS servers can be controlled by Group Policy, which allows you to manage network traffic and the workload of each RIS server. To access these settings, open a Group Policy Object, expand Computer Configuration, Windows Settings, Security Settings, Systems Services, and select Remote Installation Policy. By using this policy, you can configure the startup method for the RIS server and configure security permissions for users and groups. Access to RIS servers can also be controlled by setting up prestaged computer accounts. During account creation, by selecting This Is A Managed Computer and specifying a globally unique identifier (GUID)/universally unique identifier (UUID), you have the option to specify which RIS server to use or to allow any available RIS server to be used. The GUID/UUID can be found in the system BIOS or it can be posted on the computer case. Applying Security Permissions to RIS You can set security permissions on RIS services and images to control access to remote OS installation. By setting security permissions on the image, you can specify the users and groups that are allowed to install from this OS image. You control the remote installation of the OS images by applying permissions to the default answer file for that image. For a RIPrep image, this file is Riprep.sif. For RISetup, this file is Ristndrd.sif. Right-click the file, and select Properties. In the Properties dialog box, shown in the screen on the following page, select the Security tab, and configure group and user names and the appropriate permissions. Chapter 6 170 Part 2: Windows Server 2003 Installation
Note: If you are looking for reliable webhost to maintain and run your java application check Vision java hosting services

Using Remote Installation Services You can view and manage the RIS installation images in the Images tab (as shown in the following screen). Information concerning each installation image is displayed the image name, operating system it contains, platform it supports, and the language to which it is localized are all listed. You can add and remove images in this dialog box, while additional information and options are available by clicking Properties. Note The Add button lets you either associate an answer file with an image or create a new image. You can modify the name and description of the image presented by the CIW (as shown in the screen on the following page). This wizard also contains additional details about the image, including version, language, date last modified, type of image, and RIS image storage folder. Security for the image is accessed by clicking Permissions. This lets you limit access to each OS image based on security group membership. Chapter 6 Part 2: Windows Server 2003 Installation
Note: In case you are looking for affordable and reliable webhost to host and run your j2ee application check Vision best web hosting services

Microsoft Windows Server 2003 Inside Out The variables that can be used in computer names include the following: . %First First name of user . %Last Last name of user . %Username Logon name of user . %Mac MAC address of the client s NIC . %# Used to specify an incrementing number . %n Used to designate n characters of . %0n Used to pad n characters with zeros For example, to have computer names generated from the first 10 characters of the user logon name plus the first 5 characters of the MAC address of the NIC plus an incrementing number, use this syntax: %10Username%5MAC%# You needn t get that fancy, though. Maybe you just want to use a standard root name and increment? Well, you can do that, too. Consider the following example: cpandl%# Here, all computers names begin with cpandl (which is the abbreviated company name for City Power & Light) and end with a number that is automatically incremented by RIS. Tip It is important to note that name settings are ignored for prestaged clients. Pre- staged clients were assigned names when their accounts were created in Active Directory. Chapter 6 168 Part 2: Windows Server 2003 Installation
Note: In case you are looking for affordable and reliable webhost to host and run your j2ee application check Vision web and email hosting services

Using Remote Installation Services You can configure the naming format used for generating client computer names in the New Clients tab. Several naming formats are offered, including the following: . First initial, last name . Last initial, first name . First name, last initial . Last initial, first name . User name . The string NP with the Media Access Control (MAC) address appended . Custom You can also specify the client account location the place in the directory where the client computer accounts are established. You can store the new computer account in the default Active Directory location in the Computers container or the same location as the user creating the account, or you can select a specific location in the directory. Tip Computer accounts can have same name as user accounts For the purposes of applying Group Policy, computer accounts are commonly placed in Information Technology (IT) designated OUs. Note also that computer accounts can be the same name as user accounts, which is why the naming options using parts of the user s actual name or logon are allowed. To prevent conflicts between like-named user and computer accounts, Active Directory adds a hidden dollar sign to the computer account name. This means the computer account WRSTANEK is actually WRSTANEK$. Yes, this is a fix to resolve a naming problem found in Microsoft Windows NT. In Windows NT, you couldn t have user and computer accounts with the same name. To configure manually how the computer account names are created, select a naming option to use as the template, and then click Customize to open the Computer Account Generation dialog box, as shown in the screen on the following page. The initial custom name format is based on the naming option you used as a template. You can then modify the format and select from several variables to create a wide variety of name templates. A box at the bottom of the dialog box previews the naming formats for you. If you make a mistake in the formatting, it shows an error. Chapter 6 Part 2: Windows Server 2003 Installation
Note: If you are looking for best quality webspace to host and run your tomcat application check Vision shared web hosting services

Microsoft Windows Server 2003 Inside Out To verify that the RIS server is correctly configured, click Verify Server in the Remote Install tab. RIS will analyze the configuration, repair any problems if possible, and report on the status of the server. Clicking Show Clients loads the Find Remote Installation Clients dialog box, which lets you find and display known remote installation clients within the selected scope (the entire directory or a single domain). Tip Prestage client computers When you prestage a computer, you can specify which RIS servers can provide installation services to it or allow it to be serviced by any available RIS server. This is configured in the Remote Install tab of the client computer s properties in Active Directory. For more information on prestaging computers, see the section entitled Prestaging Clients in Active Directory later in this chapter. How client computer names are generated and where they are placed in Active Directory are controlled by settings available through the Advanced button (as shown in the following screen). Chapter 6 166 Part 2: Windows Server 2003 Installation
Note: If you are looking for high quality webhost to host and run your jsp application check Vision florida web design services