Contents Overview 1 Introduction to Designing an Administrative Plan 2 Designing Administrative Groups to Manage Tasks 9 Delegating Administrative Authority 21 Lab A: Designing Northwind Traders Administrative Groups 28 Lab B: Configuring an Administrative Topology 32 Lab Discussion 43 Module 3: Designing an Administrative Plan Information in this document is subject to change without notice. The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. Complying with all applicable copyright laws is the responsibility of the user. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Microsoft Corporation. If, however, your only means of access is electronic, permission to print one copy is hereby granted. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.  2001 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, BackOffice, FrontPage, NetMeeting, Outlook, PowerPoint, SQL Server, Visio, Visual Studio, Win32, Windows, Windows Media, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. Module 3: Designing an Administrative Plan iii Instructor Notes This module provides students with the information necessary to design a Microsoft ® Exchange 2000 administrative plan that meets a company’s business requirements. After completing this module, students will be able to: !" Describe the administrative models commonly used to manage Exchange 2000, and explain how various factors and features affect the design of an administrative plan. !" Create administrative groups that can be used to manage administrative tasks and responsibilities. !" Delegate administrative authority by determining which users need access and which resources they need access to, and then assigning roles and granting permissions accordingly. Materials and Preparation This section provides the materials and preparation tasks that you need to teach this module. Required Materials To teach this module, you need the following materials: !" Microsoft PowerPoint ® file 1573A_03.ppt !" The Northwind Traders Case Study !" The Fourth Coffee Case Study !" The Determining Administrative Group Boundaries job aid !" The Determining Administrative Roles job aid Preparation Tasks To prepare for this module, you should: !" Read all of the materials for this module. !" Complete the labs and review the lab discussion questions. !" Review the Northwind Traders Case Study. !" Review the Fourth Coffee Case Study. !" Review the Determining Administrative Group Boundaries job aid. !" Review the Determining Administrative Roles job aid. The job aids are in the Exchange 2000 Design Tool located at C:\MOC\1573A\LabFiles\Exchange_2000_Design_Tool, and on the student compact disc. The case studies are in the Appendices and on the student compact disc. Presentation: 55 Minutes Labs: 90 Minutes Note iv Module 3: Designing an Administrative Plan Instructor Setup for a Lab This section provides setup instructions that are required to prepare the instructor computer or classroom configuration for a lab. Lab B: Configuring an Administrative Topology !" To prepare for the lab !" Complete Lab D in Module 2, “Analyzing Active Directory for Exchange 2000.” !" To prevent students from performing the instructor-only portion of Lab B, you should demonstrate this portion of the lab to the class before the students begin Lab B. Module Strategy Use the following strategy to present this module: !" Introduction to Designing an Administrative Plan Briefly discuss the three administrative models. Explain that developing an administrative group strategy involves analyzing both the existing administrative model and the planned administrative model, as well as analyzing factors that influence the design of an administrative plan, such as mergers and acquisitions, and existing and planned human resources. !" Designing Administrative Groups to Manage Tasks Discuss the administrative tasks that students can manage by creating administrative groups. !" Delegating Administrative Authority Explain when to grant access to an organization, an administrative group, an object, and a property. Describe the administrative roles that can be delegated on an organizational object or an administrative group, and then explain when to grant permissions to child objects. Module 3: Designing an Administrative Plan v Customization Information This section identifies the lab setup requirements for a module and the configuration changes that occur on student computers during the labs. This information is provided to assist you in replicating or customizing Microsoft Official Curriculum (MOC) courseware. Lab Setup The following list describes the setup requirements for the labs in this module. !" For each student, a Microsoft Management Console (MMC) custom console must be created. This custom console must include both the Active Directory Users and Computers snap-in and the Exchange System snap-in, and must be named your_firstname Console. !" For each student, a personalized user account must be created in the appropriate domain. This user account must be added to the Domain Admins group, and assigned a mailbox on the server running Exchange 2000 that the student is using. !" For each student, a user profile must be created on the student’s computer that enables the student to access their mailbox by using Microsoft Outlook ® 2000. !" To have completed Lab D in Module 2, “Analyzing Active Directory for Exchange 2000.” Lab Results Performing the labs in this module introduces the following configuration changes: !" An administrative group named Central Admin Group is created. !" Administrative roles are delegated to each administrative group in Northwind Traders. Module 3: Designing an Administrative Plan 1 Overview ! Introduction to Designing an Administrative Plan ! Designing Administrative Groups to Manage Tasks ! Delegating Administrative Authority A well-designed administrative plan for a Microsoft ® Exchange 2000 organization enables you to effectively plan and manage resources, allocate administrative responsibilities, and provide secure access. After completing this module, you will be able to: !" Describe the administrative models commonly used to manage Exchange 2000, and explain how various factors and features affect the design of an administrative plan. !" Create administrative groups that can be used to manage administrative tasks and responsibilities. !" Delegate administrative authority by determining which users need access and which resources they need access to, and then assigning roles and granting permissions accordingly. Topic Objective To provide an overview of the module topics and objectives. Lead-in In this module, you will learn to design an administrative plan. Delivery Tip Emphasize that administrators should manage their environment by creating groups of administrators, identifying management tasks for those administrators, and then determining the level of control that each group needs in order to perform its assigned tasks. 2 Module 3: Designing an Administrative Plan # ## # Introduction to Designing an Administrative Plan ! Analyzing Administrative Models ! Administrative Plan Design Considerations ! Discussion: Choosing an Administrative Model An administrative group is a collection of Exchange 2000 objects that are grouped together for the purpose of managing and delegating permissions. An administrative group may contain policies, routing groups, public folder hierarchies, servers, conferencing objects, and chat networks. For example, if your organization has two sets of administrators that manage two sets of servers running Exchange 2000, you can create two administrative groups that contain those two sets of servers. Based on the administrative model that your company uses (centralized, distributed, or a combination of both), you can develop an administrative plan that fits your company’s business needs. To administer Exchange 2000, use the Exchange System Manager Microsoft Management Console (MMC). To install this console, run Exchange 2000 setup, and then install only the System Management tools. Topic Objective To provide an introduction to administrative groups and administrative models. Lead-in Before you can design an administrative plan, you need to understand the function of an administrative group. Note Module 3: Designing an Administrative Plan 3 Analyzing Administrative Models Organization Administrative Group Europe Administrative Group NAmerica Administrative Group Africa Administrative Group Policies Routing Groups The first step in designing an administrative plan involves analyzing the administrative model that your company currently uses, and then determining which model your company plans to use in the future. For example, your company may need to manage its servers running Exchange 2000 centrally, or it may need to delegate server management to several groups. If Exchange 2000 and Exchange Server 5.5 will coexist in your organization, then your administrative group design must match your Exchange Server 5.5 site design. The Centralized Administrative Model Companies that use the centralized administrative model allocate the administrative tasks of the entire Exchange 2000 organization to one person, group, or department. In Exchange 2000, a company organized around a centralized model can create a single administrative group to contain all Exchange 2000 objects. Doing so enables you to delegate control over the entire organization to your centralized group of administrators by assigning permissions on the Exchange 2000 organization object. The organization object is the top-level container for all other Exchange 2000 system objects. You can assign various roles to individual administrators or groups of administrators; however, it is important to remember that all permissions are assigned at the organization level and, by default, propagate down from the parent object to all its child objects. This method of propagation is known as inheritance. Topic Objective To introduce the various administrative models, and to discuss the administrative groups that can be created by using each model. Lead-in Designing an administrative plan involves analyzing the current administrative model, determining if this model is still appropriate, and then creating an administrative group based on the administrative model that is used. Note 4 Module 3: Designing an Administrative Plan The Distributed Administrative Model Companies that use the distributed administrative model create an administrative group for each location or department, and then assign the appropriate groups of administrators the permissions to manage the groups. Servers that are intended to be used by each location or department can be added to the local administrative group. Policy objects, routing components, and other management objects can either be added to the same local administrative group or delegated separately. For example, you can assign routing administration to one group of administrators and then assign server administration to another group of administrators. The Hybrid Administrative Model The hybrid administrative model combines characteristics of both the centralized and the distributed administrative models. This model is frequently chosen by medium to large companies, because these companies often have complex networks. Companies using this model usually establish one group of administrators that have permissions to manage the entire organization, and then establish regional and departmental administrators to manage the everyday operation of the local servers. Depending on your company’s needs, you can also manage other Exchange 2000 organization objects, such as policies or routing components. These objects can be managed separately by creating a new administrative group that contains the policies and/or routing components, or they can be managed together by adding them to the local server administrative group. When you name administrative groups, you should use a consistent naming strategy that reflects your particular company. For example, the group names may represent the regions where your company’s offices are located, the departments within your company, or the objects that you are managing, such as the Policy Administrative group. Note [...].. .Module 3: Designing an Administrative Plan 5 Administrative Plan Design Considerations Topic Objective To identify the main Exchange 2000 administrative plan design considerations Lead-in There are several issues to consider when designing your administrative plan ! Providing Access to a Domain Controller ! Running Exchange 2000 in Native Versus Mixed Mode ! Evaluating IT Resources ! Analyzing... administrative plan can help you to delegate the management of any new services, such as a chat service or an instant messaging service Evaluating Planned IT Resources The possibility of adding additional human resources in the future is another important consideration If your company plans to add new services, and if new people will be hired to handle the additional responsibilities, you can design your administrative. .. administrator of an administrative group has permissions to expand the organization object and manage the administrative group Delegating Exchange View Only on the administrative group assigns Read permissions on the Exchange 2000 object in Active Directory, but it does not assign Exchange View Only permissions on the organization object 10 Module 3: Designing an Administrative Plan Regional or Departmental... Acquisitions ! Changing Policies When designing an administrative plan, it is important to ensure that you have access to a domain controller, and that you understand your options when running Exchange 2000 in native mode versus mixed mode You must also understand the consequences of mergers, acquisitions, and policy changes Important Because the country where your company plans to deploy Exchange 2000 may... use a single administrative group Module 3: Designing an Administrative Plan 21 # Delegating Administrative Authority Topic Objective To explain how to identify the level of access and the permissions that a user in an administrative role will require and then grant the appropriate access level and assign the appropriate administrative role Lead-in ! Granting Access Level ! Assigning Administrative. .. might want to delegate administrative rights Module 3: Designing an Administrative Plan 9 # Designing Administrative Groups to Manage Tasks Topic Objective To describe some of the administrative groups that can be created to manage administrative tasks ! ! Server and Store Policy Administrator Tasks ! Chat Services Administrator Tasks ! Public Folders Administrator Tasks ! Tracking and Monitoring Administrator... mode, it is a good idea to consider creating additional administrative groups with which you can manage objects, such as routing groups (native mode only), server and store policies, chat services, public folders, and conferencing objects 6 Module 3: Designing an Administrative Plan Evaluating IT Resources When designing an administrative plan, you need to evaluate your current IT resources, as well... components Module 3: Designing an Administrative Plan 7 Changing Policies Policies can be used to control servers, mailbox stores, and public folder stores If you deploy policies in your organization and you subsequently need to change the enforcement of your policies, you can reconfigure your policy properties, and the changes will automatically be applied to all objects that the policy controls You can also... there may be circumstances in which you do not want to grant the administrator permissions to child objects For example, you can grant an administrator permissions to administer a specific administrative group, but block their ability to make changes to a specific server object in that administrative group Module 3: Designing an Administrative Plan 27 Discussion: Determining Administrative Permissions... administrator that has Exchange Administrator permission or equivalent permission on the objects that you want to add to or remove from the policy Note For more information about server and store policies, see course 1572B, Implementing and Managing Microsoft Exchange 2000 8 Module 3: Designing an Administrative Plan Discussion: Choosing an Administrative Model Topic Objective To reinforce module objectives . Module 3: Designing an Administrative Plan 1 Overview ! Introduction to Designing an Administrative Plan ! Designing Administrative Groups to Manage. tasks. 2 Module 3: Designing an Administrative Plan # ## # Introduction to Designing an Administrative Plan ! Analyzing Administrative Models ! Administrative