Lab 6
Controlling Access to local hardware and applications
-------------------------------------------------
This lab contains the following exercises and activities: Exercise 6.1 | Installing Remote Server Administration Tools | Exercise 6.2 | Configuring Removable Storage Access Policies | Exercise 6.3 | Using AppLocker | Lab ChallengeLab Challenge | Creating an AppLocker Rule Based on File Hash Using Assigned Access |
BEFORE YOU BEGIN
The lab environment consists of student workstations connected to a local area network, along with a server that functions as the domain controller for a domain called adatum.com. The computers required for this lab are listed in Table 6-1.

Table 6-1
Computers Required for Lab 6 Computer | Operating System | Computer Name | Server | Windows Server 2012 R2 | SERVERA | Client | Windows 8.1 Enterprise | CLIENTB |

In addition to the computers, you will also need the software listed in Table 6-2 to complete Lab 6.
Table 6-2
Software Required for Lab 6 Software | Location | Remote Server Administration Tools for Windows 8.1 (Windows8.1-KB2693643-x64.msu) | \\SERVERA\Downloads | Lab 6 student worksheet | Lab06_worksheet.docx (provided by instructor) |

Working with Lab Worksheets
Each lab in this manual requires that you answer questions, shoot screen shots, and perform other activities that you will document in a worksheet named for the lab, such as Lab06_worksheet.docx. You will find these worksheets on the book companion site. It is recommended that you use a USB flash drive to store your worksheets so you can submit them to your instructor for review. As you perform the exercises in each lab, open the appropriate worksheet file, type the required information, and then save the file to your flash drive.
SCENARIO
After completing this lab, you will be able to:
Install the Remote Server Administration Tools on a computer running Windows 8.1
Configure a Removable Storage Access Policy
Use AppLocker to restrict software applications for a user
Estimated lab time: 60 minutes * Exercise 6.1 | Installing Remote Server Administration Tools | Overview | In this exercise, you will install the Remote Server Administration Tools on a computer running Windows 8.1 so that you can use Active Directory tools and other administrative tools on a Windows 8.1 workstation. | Mindset | Since users work from their client computers, it is always convenient to have the Remote Server Administration Tools available on the administrator’s client computer. | `Completion time | 20 minutes |

1. On CLIENTB, log on using the adatum\Administrator account and the Pa$$w0rd password.
2. Click the Desktop tile.
3. On the Taskbar, click the File Explorer icon.
4. When File Explorer opens, open the \\SERVERA\downloads folder (see Figure 6-1).

Figure 6-1
The Downloads folder

5. Double-click the Windows8.1-KB2693643-x64.msu file.
6. If you are prompted to install this file, click Open. When you are prompted to install the Windows software update, click Yes.
6. On the Read these license terms page, click I Accept.
8. When the installation is complete, click Close.
10. Click the Start button, and on the Start screen, type admin and click the Administrative Tools tile. Question 1 | Which two tools are used to administer users for Active Directory? *Administrative Tools- Active Directory Administrative Center / Active Directory Users and Computers. |

11. Take a screen shot of the Administrative Tools window by pressing Alt+Prt Scr and then paste the resulting image into the Lab 6 worksheet file in the page provided by pressing Ctrl+V.
End of exercise. Leave the system logged in for the next exercise. Exercise 6.2 | Configuring Removable Storage Access Policies | Overview | In this exercise, you will restrict the ability to write to an optical disk. | Mindset | To prevent users from copying confidential information to a removable disk, you can create Removable Storage Access Policies. | Completion time | 15 minutes |

1. On CLIENTB, using the Administrative Tools folder, double-click Active Directory Users and Computers.
2. When the Active Directory Users and Computers console opens, expand the adatum.com node.
3. Right-click the adatum.com node and choose New > Organizational Unit.
4. When the New Object – Organizational Unit dialog box displays, in the Name text box, type Restricted.
5. Click OK to close the New Object – Organizational Unit dialog box.
6. Close Active Directory Users and Computers.
6. Go back to the Administrative Tools folder and double-click Group Policy Management.
8. When the Group Policy Management console opens, expand the Forest: adatum.com node, expand the Domains node, expand the adatum.com node, and then expand the Group Policy Objects node (see Figure 6-2).

Figure 6-2 The Group Policy Objects node

9. Right-click Group Policy Objects and choose New.
10. When the New GPO window displays, in the Name text box, type Hardware and Software Restrictions, and then click OK.
11. Right-click the Hardware and Software Restrictions GPO and choose Edit.
12. When the Group Policy Management Editor window opens, under the User Configuration node, expand the Policies node, expand the Administrative Templates, expand the System node, and then click the Removable Storage Access node. Question 2 | Which policy setting prevents writing to a USB device?*Removable Disks: Deny write access |

13. To stop writing to writable optical disks, in the right pane, double-click CD and DVD: Deny Write access.
14. When the CD and DVD: Deny write access dialog box displays, click the Enabled option.
15. Click OK to close the CD and DVD: Deny write access dialog box.
16. Take a screen shot of the Group Policy Management Editor window by pressing Alt+Prt Scr and then paste the resulting image into the Lab 7 worksheet file in the page provided by pressing Ctrl+V.
16. Close the Group Policy Management Editor.
18. Back on the Group Policy Management console, right-click the Restricted OU and choose Link an Existing GPO.
19. When the Select GPO dialog box displays, double-click Hardware and Software Restrictions.
End of exercise. Leave the Group Policy Management console open for the next exercise.

Exercise 6.3 | Using AppLocker | Overview | In this exercise, you will use AppLocker to restrict access to an application. | Mindset | To control what applications a user can run on her machine, you can create a GPO that will restrict or allow applications. | Completion time | 15 minutes |

1. On CLIENTB, using the Group Policy Management console, under the Group Policy Objects node, right-click the Hardware and Software Restricted GPO and then choose click Edit.
2. When the Group Policy Management Editor console displays, browse to the Computer Configuration\Policies\Windows Settings\Security Settings\Application Control Policies container and then click the AppLocker node.
3. Expand the AppLocker container and then click the Executable Rules node (see Figure 6-3).

Figure 6-3
A GPO that shows the AppLocker Executable Rules node

4. Right-click the Executable Rules node and choose Create Default Rules. Three rules display in the Executable Rules container. Question 3 | Based on the default rules that appear in the Executable Rules folder, which programs can a typical user run on a Windows 8.1 workstation? Which programs can members of the Administrators group run? *Everyone can run all files located in the windows folder as well as all files locates in the program files folder. Members of the Administrators group can run all files. |

5. Click the Windows Installer Rules node and then right-click the Windows Installer Rules node and choose Create Default Rules. Three rules display in the Windows Installer Rules container. Question 4 | Based on the default rules that appear in the Windows Installer Rules folder, which Windows Installer files can a typical user run on a Windows 8.1 workstation? Which Windows Installer files can members of the Administrators group run? *Everyone can run all Windows installer files in %systemdrive%\windows\installer folder as well as all digitally signed windows installer files. Members of the Administrators group can run all Windows installer files. |

6. Click the Script Rules node and then right-click the Script Rules node and choose Create Default Rules. Three rules display in the Script Rules container.
6. Click the Packaged app Rules node and then right-click the Packaged app Rules node and choose Create Default Rules. One rule appears in the Packaged app Rules container.
6. In the Executable Rules folder, double-click the All files located in the Windows folder rule. The Allow Properties dialog box appears.
8. On the General tab, modify the Name value to All files located in the Windows folder except Regedit.exe.
9. Click the Exceptions tab, and in the Add exception drop-down list, click Path.
10. Click Add. The Path Exception dialog box appears.
11. In the Path text box, type C:\Windows\Regedit.exe and then click OK twice.
12. Right-click the Executable Rules container and choose Create New Rule. The Create Executable Rules Wizard appears.
13. To bypass the Before You Begin page, click Next. The Permissions page appears.
14. Click Select. The Select User or Group dialog box appears.
15. In the Enter the object name to select box, type Group Policy Creator Owners and then click OK. The group name displays in the User or group field on the Permissions page.
16. Click Next. The Conditions page appears.
16. Select the Path option and then click Next. The Path page appears.
18. In the Path text box, type C:\Windows\Regedit.exe and then click Create. The new rule displays in the Executable Rules container.

Question 5 | Why is it necessary to create the additional rule for the Group Policy Creator Owners group? *To preserve administrators access to regedit.exe. It is also necessary because the exception you created in the all files located in the windows folder rule prevents the members of that group from running the registry editor program |

19. Take a screen shot of the Group Policy Management Editor console displaying the contents of the Executable Rules container by pressing Alt+Prt Scr and then paste the resulting image into the Lab 6 worksheet file in the page provided by pressing Ctrl+V. End of exercise. Leave the Group Policy Management console and Group Policy Editor for the Hardware and Software Restricted GPO open for the next exercise. Lab Challenge | Creating an AppLocker Rule Based on File Hash | Overview | In this exercise, you will create a rule that will deny users from running the Math Input Panel (mip.exe) based on the file hash. | Mindset | Sometimes, when administrators block a file based on a specific path, some users will try to install or copy a file to a different folder and run the program from there. You can block a file based on file hash, which will stop the program from running no matter where it is being executed from. | Completion time | 10 minutes |
During this exercise, you will create an AppLocker rule that will deny users from running the Math Input Panel based on file hash. The Math Input Panel file is located at C:\Program Files\Common\microsoft shared\ink\mip.exe. Write out the procedure you used to configure the settings, and then take a screen shot of the container where the settings are located by pressing Alt+Prt Scr and then paste the resulting image into the Lab 6 worksheet file in the page provided by pressing Ctrl+V.

1. Click on the start button then begin typing Administrative Tools (the search feature will automatically begin searching when you begin typing), select Administrative Tools. 2. Select Group Policy Management, then expand the Forest:adatum.com node, then the domains node, then the adatum.com node, then the Group Policy Objects node finnaly right click on hardware and software restrictions and choose edit.. 3. On the Group Policy Management Editor expand the Computer Configuration node, then the Policies node then the Windows Settings node, then the Security Settings node, then the Application Control Policies node and then expand Executable Rules then right click on Executable Rules then select Create New Rule… 4. A wizard pops up which will help you create an AppLocker rule. Click next. 5. Select the action Deny and the user or group: Everyone. Click Next. 6. Select the option File Hash. Click next. 7. Browse files for C:\Program Files\Common\microsoft shared\ink\mip.exe. Click next. 8. Add a name to identify this rule such as “mip.exe restriction.” 9. Click Create. Lab Challenge | Using Assigned Access | Overview | In this exercise, you create a local user account and limit its capabilities to running the Music app using Assigned Access. | Mindset | Assigned access enables you to create a kiosk environment, in which the user is limited to running a single application. | Completion time | 10 minutes |
To complete this challenge, write out the steps needed to create an Assigned Access environment, using a local user account called Kiosk and limiting it to the Music app.

1. On the Start screen, mouse over the lower right corner or swipe in from the right side to display the charms menu.

2. Select the Settings charm and then click PC Settings. The PC Settings page appears.
3. Click Accounts. The Accounts page appears.

4. Click Other accounts.
5. Click Add an account. The How will this person sign in? page appears.

6. Click sign in without a Microsoft account. The Add a user page appears

7. Click Local account. A second Add a user page appears.

8. In the User name text box, type Kiosk for the Assigned Access account, and type Password1 for the password. Then type a password hint in the remaining textbox and click Next.

9. Once the account is created, click Finish. The new account appears on the Manage other accounts page.

10. Restart the computer, log on using the new account, and install the Music app.

11. Click Set up an account for assigned access.
.
12. Click Choose an account and select the Kiosk account.
13. Click Choose an app and select the Music app.

End of lab. You can log off or start a different lab. If you want to restart this lab, you’ll need to click the End Lab button in order for the lab to be reset.
.