Windows 2000 Server System Administration Handbook

WINDOWS 2000 SERVER SYSTEM ADMINISTRATION HANDBOOK “ An insightful and detailed overview of the tools and tasks that th...

Author: Syngress | Martin Weiss | Paul Shields | Ralph Crump

33 downloads 771 Views 5MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

WINDOWS 2000 SERVER SYSTEM ADMINISTRATION HANDBOOK

“ An insightful and detailed overview of the tools and tasks that the Windows 2000 administrator faces. Great as an introduction and as a resource for any IT library.” —Lloyd Fray, Information Technology Manager Mutual Risk Management

FREE Monthly Technology Updates One-year Vendor Product Upgrade Protection Plan FREE Membership to Access.Globalknowledge

Paul Shields, MCSE Ralph Crump, MCSE, CCNA, Master CNE Martin Weiss, MCSE, MCP+I, CNA Technical Edit By: Sean Wallbridge, MCSE, MCSD, MCT, MCDBA, MCP+I

74_FM.qx 11/8/99 2:20 PM Page i

[email protected] With over 1,000,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we have come to know many of you personally. By listening, we've learned what you like and dislike about typical computer books. The most requested item has been for a web-based service that keeps you current on the topic of the book and related technologies. In response, we have created [email protected], a service that includes the following features: ■

A one-year warranty against content obsolescence that occurs as the result of vendor product upgrades. We will provide regular web updates for affected chapters.

■

Monthly mailings that respond to customer FAQs and provide detailed explanations of the most difficult topics, written by content experts exclusively for [email protected].

■

Regularly updated links to sites that our editors have determined offer valuable additional information on key topics.

■

Access to “Ask the Author”™ customer query forms that allow readers to post questions to be addressed by our authors and editors.

Once you've purchased this book, browse to www.syngress.com/solutions.

To register, you will need to have the book handy to verify your purchase. Thank you for giving us the opportunity to serve you.

74_FM.qx 11/8/99 2:20 PM Page ii

74_FM.qx 11/8/99 2:20 PM Page iii

WINDOWS 2000 SERVER SYSTEM ADMINISTRATION HANDBOOK

74_FM.qx 11/8/99 2:20 PM Page iv

Syngress Media, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable case, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media® and Syngress® are registered trademarks of Syngress Media, Inc. “Career Advancement Through Skill Enhancement™” is a trademark of Syngress Media, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY 001 002 003 004 005 006 007 008 009

SERIAL NUMBER F5H9L432M8 K93NCM5982 8AMC812KGF 28NNA9KJ2N 7VBAZZLNMA PJMAL4N87G 9H11MDGS9H UBAL848N61 Y78P98JL21

PUBLISHED BY Syngress Media, Inc. 800 Hingham Street Rockland, MA 02370 Windows 2000 Server System Administration Handbook Copyright © 2000 by Syngress Media, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-928994-09-1 Copy edit by: Adaya Henis Technical edit by: Sean Wallbridge Index by: Bob Saigh Project Editor: Eva Banaszek

Proofreading by: Adrienne Rebello Page Layout and Art by: Emily Eagar and Vesna Williams

74_FM.qx 11/8/99 2:20 PM Page v

Acknowledgments We would like to acknowledge the following people for their kindness and support in making this book possible. Richard Kristof, Duncan Anderson, Jennifer Gould, Robert Woodruff, Kevin Murray, Dale Leatherwood, Shelly Everett, and Robert Sanregret of Global Knowledge, for their generous access to the IT industry’s best courses, instructors and training facilities. Ralph Troupe and the team at Rt. 1 Solutions for their invaluable insight into the challenges of designing, deploying and supporting world-class enterprise networks. Karen Cross, Kim Wylie, Harry Kirchner, John Hays, Bill Richter, Michael Ruggiero, Kevin Votel, Brittin Clark, Sarah Schaffer, Luke Kreinberg, Ellen Lafferty and Sarah MacLachlan of Publishers Group West for sharing their incredible marketing experience and expertise. Peter Hoenigsberg, Mary Ging, Caroline Hird, Simon Beale, Julia Oldknow, Kelly Burrows, Jonathan Bunkell, Catherine Anderson, Peet Kruger, Pia Rasmussen, Denelise L'Ecluse, Rosanna Ramacciotti, Marek Lewinson, Marc Appels, Paul Chrystal, Femi Otesanya, and Tracey Alcock of Harcourt International for making certain that our vision remains worldwide in scope. Special thanks to the professionals at Osborne with whom we are proud to publish the best-selling Global Knowledge Certification Press series. And finally, to Thomas Edward O’Brien, for waiting.

v

74_FM.qx 11/8/99 2:20 PM Page vi

From Global Knowledge At Global Knowledge we strive to support the multiplicity of learning styles required by our students to achieve success as technical professionals. As the world's largest IT training company, Global Knowledge is uniquely positioned to offer these books. The expertise gained each year from providing instructor-led training to hundreds of thousands of students worldwide has been captured in book form to enhance your learning experience. We hope that the quality of these books demonstrates our commitment to your lifelong learning success. Whether you choose to learn through the written word, computer based training, Web delivery, or instructor-led training, Global Knowledge is committed to providing you with the very best in each of these categories. For those of you who know Global Knowledge, or those of you who have just found us for the first time, our goal is to be your lifelong competency partner. Thank your for the opportunity to serve you. We look forward to serving your needs again in the future. Warmest regards,

Duncan Anderson President and Chief Executive Officer, Global Knowledge

vi

74_FM.qx 11/8/99 2:20 PM Page vii

Contributors Sean Wallbridge (MCSE+i, MCSD, MCT, MCDBA, MSS, MCP+i, MCP+sb, Compaq ASE, Novell CNA and Vinca VCE) is a Senior Consultant/Trainer for NexGen Technologies based in Hamilton, Bermuda. As a consultant, Sean provides turnkey networking solutions and takes great pride in creating satisfied customers. Sean has co-authored seven other books and technical publications. When not on the beach or in front of a computer, Sean spends his time with his wife Wendy, Murphy- the-Bassett-Hound, and their two cats. Martin Weiss (MCSE, MCP+I, CNA, CIBS, A+, Network+) is a Senior Information Management Specialist with ACS Government Solutions Group, a provider of broad-based information technology solutions for client organizations. Marty lives in New England with his wife Gin and son Kobe. You can contact Martin via e-mail at [email protected]. Ralph Crump (MCSE, CCNA, and a CNE 3.x, 4.x, and 5.x, with a Master CNE in Integrating Windows NT) manages a team responsible for a large scale Windows NT and Novell NetWare infrastructure for a major telecommunications company in Atlanta, Georgia. He specializes in Windows NT and BackOffice applications as well as Novell Netware solutions. He is currently working in cooperation with Microsoft on Windows 2000 Rapid Deployment projects. Cameron Brandon (MCSE, CNE, CNA, MCSE+Internet, A+, Network+) is a Network Engineer/Administrator in Portland, Oregon. He specializes in Windows NT with BackOffice Integration and helped work on Intel Corporation's large-scale migration at its Oregon facility to Windows NT. He completed his MCSE, CNE, CNA, MCPS:Internet Systems, and A+ certifications in five months’ time, proving once again that you can achieve those things to which you set your mind.

vii

74_FM.qx 11/8/99 2:20 PM Page viii

Adam Quiggle (Master CNE, MCSE, CCNA) is a senior level network engineer for Metamor Worldwide. In his most recent role, he served as remote access project leader for one of North Carolina's largest state government agencies, utilizing Windows NT Terminal Server, Metaframe and Cisco Access Servers. He is president of the Research Triangle Park chapter of the Cisco Professional Association Worldwide. Holly Simard (MCSE, MCP+I) is a networking specialist in Victoria, BC. Along with providing turnkey solutions for her clients, Holly also delivers online instruction in her spare time. Holly lives with her husband Hervey, who works as a multimedia developer, their springer spaniel Hubert, and their cat Daisy. Paul Shields (Certified MCSE) currently works as a network engineer for a major telecommunications company. He has been working with, supporting, and writing about Windows NT for the last five years. His current projects revolve around the design and implementation of enterprise-class servers in a mixed platform environment. He is also working on the rollout of Windows 2000 to the corporate desktop. Paul can be contacted at [email protected]. Erik Sojka is a system administrator and trainer currently working for a major software company. He is an MCSE and has a BS in Information Science and Technology from Drexel University. Eriq Oliver Neale is a technology strategist with Nortel Networks, researching new technology solutions for inclusion in the designer workplace. He has worked in the computer support industry for eleven years and in that time has contributed to several computing technology publications. When not writing, he and his wife try to keep up with seven cats, two dogs, and a plethora of tropical fish. Jay Tomlin works as a server-based computing software specialist for Citrix Systems, Inc. in Fort Lauderdale. His primary duty is training the Citrix Technical Support organization worldwide. Prior to joining Citrix, Jay studied Mathematics and Music Theory in college and graduate school. He can be reached at [email protected]. viii

74_TOC.qx 11/8/99 1:25 PM Page ix

Contents

CHAPTER 1 The Windows 2000 System Administration Migration Path

1

Brief Overview of Windows 2000 Server Windows 2000 System Administration Overview Increased Reliability, Availability, and Scalability Core Operating System Services Fault Tolerance Disaster and System Recovery Reliable Storage Avoiding Crashes and Reboots High-Availability Solutions Improved Scalability Easier Management and Lower Costs Integrated Directory Services Comprehensive Management Solutions Comprehensive File, Print, and Web Services Comprehensive Internet and Application Server Application Services Communications and Networking Services Why the Change? Migrating to Windows 2000 Server Getting Ready Streamlining Planning Architecture Costs Plan of Action

2 5 6 6 7 8 9 10 11 12 13 13 14 15 17 17 19 20 23 24 25 26 27 28 29

ix

74_TOC.qx 11/8/99 1:25 PM Page x

x

Contents

Timeline Testing Deployment Setting Up Windows 2000 Server Installing Windows 2000 Server Upgrading to Windows 2000 Server Summary FAQs

CHAPTER 2 Overview of Windows 2000 Administration Introduction to Network Administration Designing and Setting Up the Network Managing the Network Protecting the Network Documenting the Network Microsoft Management Console Introduction to Active Directory Key Concepts Directory Service Domains Namespace Global Catalog Organizational Units Groups Name Features and Benefits of Active Directory Simplified Management Added Security Scalability Replication of Information Extended Interoperability Integration with DNS Beyond Active Directory Volume Management Disk Quotas Defragmentation Backup and Recovery Hierarchical Storage Management

30 31 31 32 32 35 37 40

43 44 45 46 46 48 51 56 56 57 57 60 61 62 62 64 65 66 67 70 70 71 72 72 72 73 74 75 76

74_TOC.qx 11/8/99 1:25 PM Page xi

Contents

File Service Management Distributed File System Using Windows 2000 Help Summary FAQs

CHAPTER 3 Setting Up User Accounts Defining an Acceptable Use Policy Template: Acceptable Use/Security Policy Purpose Interpretation Definitions Responsibility Introduction to User Accounts Requirements for New User Accounts Default User Account Settings Creating a Domain User Account Active Directory Users and Computers Creating User Accounts Setting Password Requirements Security Templates Loading Security Snap-ins into the MMC Loading the Security Templates Changing Account (Password) Policies Setting Properties for User Accounts Modifying User Accounts General Address Account Profile Telephones/Notes Organization Dial-in Managing User Accounts Deleting User Accounts Changing User Passwords Enabling an Account Disabling an Account

76 77 79 81 83

87 88 90 90 90 90 91 95 96 97 99 99 100 103 103 104 105 106 110 110 111 112 113 115 116 118 119 121 122 122 123 123

xi

74_TOC.qx 11/8/99 1:25 PM Page xii

xii

Contents

Other Active Directory Users and Computers Functions Moving User Accounts Mapping a Certificate to a User Best Practices Using Active Directory Users and Computers Advanced Features Filters Administrative Logon Account (Password) Policies Summary FAQs

123 125 125 128 129 129 129 130 132 132 133

CHAPTER 4 Using Groups to Organize User Accounts

135

Introduction to Groups Group Type Security Groups Distribution Lists Group Scope Domain Local Global Universal Implementing Group Strategies Why Use Groups? Structuring Groups Implementing Groups Preparing to Create Groups Information Needed to Create a Group Creating a Group Assigning Users to a Group Adding Users through the Group Setting Adding User through the User Settings Configuring Group Settings General Members Member Of Managed By Object

136 139 139 139 140 140 140 140 142 142 143 144 144 144 145 147 147 149 151 152 153 153 154 154

74_TOC.qx 11/8/99 1:25 PM Page xiii

Contents

Security Managing Groups Changing a Group’s Scope Finding a Group Deleting a Group Implementing Local Groups Preparing to Create Local Groups Creating a Local Group Implementing Built-in Groups Built-in Domain Local Groups Built-in Global Groups Built-in Local Groups Built-in System Groups Built-in Group Behavior Best Practices Managing Groups Using Universal Groups Switching Modes Summary FAQs

156 157 157 158 159 160 160 161 162 162 163 163 164 164 168 169 169 170 172 172

CHAPTER 5 Administering File Resources

175

Introduction Using Microsoft Windows NT File System (NTFS) Permissions NTFS Folder Permissions NTFS File Permissions How Windows 2000 Applies NTFS Permissions Access Control Lists Combining NTFS Permissions Permissions Are Cumulative File Permissions Override Folder Permissions Deny Overrides All Other Permissions Permission Inheritance Assigning NTFS Permissions Planning NTFS Permissions Managing NTFS Permissions Special Access Permissions

176 176 176 177 178 178 179 179 179 180 180 181 181 182 185

xiii

74_TOC.qx 11/8/99 1:25 PM Page xiv

xiv

Contents

Take Ownership Change Permissions Other Special Permissions Using Special Access Permissions Setting the Special Access Permissions Taking Ownership of Files and Folders Changing NTFS Permissions Copying and Moving Files and Folders Copying Files Moving Files Sharing Resources Securing Network Resources Shared Folder Permissions Creating Shared Folders Developing a Shared Folder Strategy Shared Applications Shared Data Sharing Folders Administrative Shares Creating a Shared Folder Assigning Permissions to a Shared Folder Managing Shared Folders Connecting to a Shared Folder NTFS Permissions and Shared Folders Troubleshooting Access Problems Solving Permission Problems Typical Permission-Related Access Problems Solving Permission-Related Access Problems Best Practices Avoiding Permission-Related Access Problems Guidelines for Managing Shared Folder Permissions Summary FAQs

CHAPTER 6 Administering User Accounts Managing User Profiles User Profiles Overview Types of User Profiles

185 187 187 188 188 190 191 192 192 193 196 196 197 198 198 199 200 200 201 202 204 206 208 211 213 213 213 214 214 215 216 217 218

221 222 222 223

74_TOC.qx 11/8/99 1:25 PM Page xv

Contents

Contents of a User Profile All Users Settings Saved in a User Profile Local User Profiles Roaming User Profiles Creating Individualized Roaming User Profiles Mandatory Profiles Setting Up a Roaming User Profile Assigning Customized Roaming Profiles Creating Home Folders Home Directories and My Documents Creating Home Directories Introduction to Group Policies Applying Group Policy Order of Application Filtering Policy Based on Security Group Membership Blocking Policy Inheritance Enforcing Policy from Above Best Practices Allowing for Different Hardware Configurations Combining the Power of Profiles and Policies Tightening Security on Home Directories Summary FAQs

CHAPTER 7 Administering Printer Resources Introduction to Administering Printers Terminology Planning the Print Environment Dedicated vs. Non-dedicated Print Servers Local, Remote, and Network Printers Creating the Print Environment Installing a Local Printer Installing a Network Printer Installing a Printer from Another Server Other Types of Network Printers Loading Printer Drivers

223 224 225 226 227 228 229 230 231 235 235 236 239 240 240 241 241 241 242 242 242 243 244 244

247 248 248 248 249 250 250 250 254 256 257 259

xv

74_TOC.qx 11/8/99 1:25 PM Page xvi

xvi

Contents

Printer Properties General Sharing Ports Advanced Security Device Settings Managing Printer Permissions Security/Sharing Permissions Printer Ownership Managing Printers Assigning Forms to Paper Trays Assigning Separator Pages Creating a Printer Pool Specifying Printer Priorities Redirecting a Printer Removing Printer Drivers Managing Documents in a Print Queue Setting Priority, Notification, Printing Time Administering Printers by Using a Web Browser Best Practices Organize Printers by Business Function or Geographic Location Put Print Devices on a Separate Network Allow Clients Access to Web Printing Interfaces Restart Print Spool Service Periodically FAQs

CHAPTER 8 Managing Storage Data Managing Data Compression Compressing Files and Folders Determining Compression Status Disk Space Requirements Compression State Compression Rules Copying and Moving Compressed Files and Folders

261 261 262 262 263 263 265 265 266 268 269 269 270 272 273 274 275 276 277 278 281 281 282 282 283 283

285 286 286 289 291 292 292 292

74_TOC.qx 11/8/99 1:25 PM Page xvii

Contents

Managing Disk Quotas Encrypting Data File Encryption Decryption of Files Storing Encrypted Files on Remote Servers Accessing Encrypted Data Moving and Renaming Encrypted Data Decrypting Data The Recovery Agent Using Disk Defragmenter Analyzing a Drive Viewing Reports Defragmenting NTFS File System Partitions Troubleshooting Data Storage Best Practices FAQs

CHAPTER 9 Monitoring Event Logs Introduction to Monitoring Event Logs Viewing Event Logs Monitoring Security Events Auditing Files and Folders Auditing Registry Entries Analyzing Security Events Managing Event Logs Best Practices Summary FAQs

CHAPTER 10 Backing Up and Restoring Data Introduction to Backing Up and Recovering Data Types of Backups Normal Backup Daily Backup Copy Backup Incremental Backup Differential Backup Necessary Permissions and User Rights

297 305 308 308 308 309 309 309 310 311 314 315 316 317 318 319

321 322 325 336 342 347 353 354 359 360 361

363 364 367 367 367 368 368 369 370

xvii

74_TOC.qx 11/8/99 1:25 PM Page xviii

xviii

Contents

System State Data Emergency Repair Disk Back Up and Restore Options Advanced Options Backing Up Data Back Up Files to File or a Tape Scheduling Using Batch Files Restoring Data Restore Files from a File or Tape Restore System State Data Authoritative Restore Maintaining Media Best Practices Summary FAQs

371 372 373 378 380 382 384 387 389 389 390 391 393 394 396 397

CHAPTER 11 Advanced Administration of Windows 2000 399 Administering Windows 2000 Microsoft Management Console Windows 2000 System Administration Computer Management Console Event Viewer License Manager Performance Windows 2000 Network Administration Adapters and Protocols Configuring Adapters and Protocols DHCP Manager DNS Management Windows Internet Naming Service (WINS) Terminal Services Quality of Service Routing and Remote Access Remote Access Service Dial Out Virtual Private Networks Demand Dial Routing Network Address Translation (NAT)

400 400 402 402 406 406 407 410 410 412 415 419 424 425 429 430 437 440 443 445

74_TOC.qx 11/8/99 1:25 PM Page xix

Contents

Internet Authentication Service Connection Manager Administration Kit Customizing Windows 2000 Tools for Your Environment Creating Custom MMC Consoles Using the Task Scheduler Understanding the Logon Process Logon Authentication Secondary Logon Services Windows 2000 Resource Kit Direct X Diagnostic Utility Command Line Kill Sysprep Setup Manager Sysdiff Dependency Walker Shutdown Netdiag Summary FAQs

CHAPTER 12 Administering Active Directory Introduction to Administering Active Directory Active Directory Concepts Directory Namespace Naming Conventions Schema Global Catalog Replication Client Software Active Directory Components Objects Site Domain Trees and Forests Using Active Directory Management Utilities

447 450 452 453 458 460 460 461 462 462 463 463 464 465 466 467 467 467 467

469 470 471 471 472 474 476 477 479 481 482 482 484 485 485 486

xix

74_TOC.qx 11/8/99 1:25 PM Page xx

xx

Contents

DCPromo Active Directory Users and Computers Active Directory Domains and Trusts Active Directory Sites and Services Publishing Objects in Active Directory Sharing Resources Locating Objects in Active Directory Controlling Access to Objects User Authentication Object-based Access Control Active Directory Permissions Delegating Administrative Control of Objects Delegation of Control Wizard Overview of Active Directory Service Interface (ADSI) Best Practices Summary FAQs

CHAPTER 13 Implementing Group Policy Introduction to Windows 2000 Group Policy Group Policy Structure Types of Configurations Computer Configuration User Configuration Configuration Subfolders Type of Group Policies Software Deployment Software Policies Desktop File\Folder Management Scripts Security Group Policy Objects Group Policy Containers Group Policy Templates GPT Contents GPT.INI

486 493 496 498 503 503 506 508 509 509 512 512 513 515 516 517 521

523 524 525 526 526 526 526 530 530 530 531 531 531 531 532 532 533 534

74_TOC.qx 11/8/99 1:25 PM Page xxi

Contents

How Group Policy Is Applied in Active Directory Order of Inheritance Creating a Group Policy Object Group Policy and Slow Networks Filtering the Scope of GPO Modifying Group Policy Inheritance Modifying Group Policy Group Policy Tab Group Policy Editor Adding Administrative Templates Using the Group Policy Management Snap-in Group Policy Configuration Example Delegating Administrative Control of a Group Policy Object Creating a Group Policy Object Modifying a Group Policy Object Managing a Group Policy Object Link to a Site, Domain, or Organizational Unit Guidelines for Implementing Group Policy Best Practices Summary FAQs

CHAPTER 14 Managing User Environments Using Group Policy Introduction to Managing User Environments Types of Group Policy for Managing User Environments Group Policy Snap-In for the Microsoft Management Console Using Administrative Templates Assigning Registry-Based Policies Creating Custom Administrative Templates Adding Administrative Templates Using Scripts Assigning Script Policies to Users and Computers Folder Redirection FAQs

536 536 538 540 541 542 543 544 546 548 549 549 550 552 554 555 557 560 562 565

567 568 569 570 573 576 579 585 586 588 590 593

xxi

74_TOC.qx 11/8/99 1:25 PM Page xxii

xxii

Contents

CHAPTER 15 Managing Software by Using Group Policy

595

Introduction Introduction to Managing Software Deployment Deploying Software Creating Software Packages Creating a Non-Windows Installer Package File Managing Software Maintaining Software Upgrading Software Removing Software Summary FAQs

596 596 597 599 601 605 615 621 623 624 625

CHAPTER 16 Administering User Accounts and Groups

629

Introduction to Administration of User Accounts and Groups Creating Multiple User Accounts Migrating Users from an NT 4.0 Domain Creating New Active Directory Users in Bulk How Does the Script Work? Importing Users from Novell Directory Services (NDS) Administering Logon Names Lockout Settings Password Requirements Configuring Account Policies Using Group Policy Troubleshooting User Logon Problems Unable to Find a Domain Controller Unable to Load the User Profile Missing Computer Account Redirecting User Data to a Network Share Setting Up Accounts for Mobile Users Multilink and Bandwidth Allocation Protocol (BAP) Using Universal Groups Windows NT 3.x and 4.x Groups Types Windows 2000 Group Types Best Practices

630 631 632 634 634 636 636 636 639 641 646 646 648 650 651 655 658 660 660 661 663

74_TOC.qx 11/8/99 1:25 PM Page xxiii

Contents

Summary FAQs

CHAPTER 17 Implementing Security in a Windows 2000 Network Introduction to Securing a Windows 2000 Network Applying Security Policies The Security Settings Extension to Group Policy Order of Precedence Creating, Modifying, and Analyzing Security Configurations Security Configuration and Analysis Snap-in SECEDIT.EXE Configuring an Audit Policy Audit Event Types Analyzing Security Configurations Security Configuration Templates Implementing Public Key Security Components of Public Key Services Certificates Certificate Authority Group Policies Hardware Add-ons Using Public Key Services Enabling and Administering File Encryption Encrypted File System Architecture Encryption and Decryption Data Recovery Using the Encrypted File System Guidelines for Using EFS Best Practices Summary FAQs

CHAPTER 18 Sharing File Resources by Using DFS Introduction to DFS Setting Up a Fault-Tolerant DFS Root Setting Up a Stand-Alone DFS Root

665 666

669 670 671 672 674 675 675 677 679 682 683 685 687 688 688 689 691 692 693 702 703 703 704 705 709 710 712 715

717 718 722 730

xxiii

74_TOC.qx 11/8/99 1:25 PM Page xxiv

xxiv

Contents

Setting Up Child Nodes Configuring Child Nodes as Replica Sets Administering DFS Connecting to an Existing DFS Root Command-Line Administration Removing DFS Roots and Nodes Removing a Child Node Removing a DFS Root Forced Removal of DFS Information Client Interactions with DFS Security Concerns Best Practices Summary FAQs

736 738 741 742 743 745 745 746 747 748 748 749 750 750

CHAPTER 19 Implementing Disaster Protection

753

Introduction Protecting a Windows 2000 Network from Disasters Backing Up Data The Recovery Console Advanced Startup Options Recovering from a System Failure Repairing and Restoring Active Directory Authoritative Restore Summary FAQs

754

Index

754 758 765 766 768 771 779 779 780

783

74_sysad_01.qx 11/8/99 9:18 AM Page 1

Chapter 1

The Windows 2000 System Administration Migration Path

Solutions in this chapter: ■

Brief Overview of Windows 2000 Server

■

Windows 2000 System Administration White Paper

■

Migrating to Windows 2000 Server

■

Setting Up Windows 2000 Server

1

74_sysad_01.qx 11/8/99 9:18 AM Page 2

2

Chapter 1 • The Windows 2000 System Administration Migration Path

Brief Overview of Windows 2000 Server Windows 2000 Server is the next-generation operating system from Microsoft that replaces Windows NT 4.0 Server. Information technology professionals, managers, and users will immediately appreciate the improvements in the operating system. Windows 2000 is designed to improve the way you work by providing you with more control over your network. Windows 2000 server provides administrators with improved central control over users’ desktops and with a more reliable and manageable operating system. Whether you plan to deploy Windows 2000 Server or are already using it, this section will acquaint you with the powerful features of Windows 2000 Server and its effect on the organization as well as on administrators. Windows 2000 Server presents a radical change from its predecessor by greatly improving upon the shortcomings in NT 4.0. It appears that, in designing Windows 2000, Microsoft has tackled the primary concerns of organizations and the networking professionals responsible for maintaining the system. The primary areas of concern that Windows 2000 addresses are: ■

Increased reliability, availability, and scalability

■

Reduced costs through simplified management

■

Powerful and robust Internet and application server

Windows 2000 Server actually encompasses a family of servers to meet the specific needs of organizations (see Figure 1.1). The various flavors are now based upon the Active Directory service, which is probably the most important change. Active Directory simplifies management, extends interoperability with applications and devices, and improves security. The entry-level and most commonly used edition is Windows 2000 Server. The other editions are Windows 2000 Advanced Server and Windows 2000 Datacenter Server. Table 1.1 summarizes the three types of Windows servers.

74_sysad_01.qx 11/8/99 9:18 AM Page 3

The Windows 2000 System Administration Migration Path • Chapter 1

Figure 1.1

Windows 2000 Server comes in three varieties to fulfill different needs.

Windows 2000 Server

Windows 2000 Datacenter Server

Windows 2000 Advanced Server

Windows 2000 Server is Microsoft’s mainstream server operating system, and is well suited for small to midsize deployments. The importance of Active Directory cannot be overstressed. The Active Directory adds many new features that greatly improve the operating system; in addition, it helps the administrator by making it simple to navigate and manage network resources. Windows 2000 Advanced Server contains all the features and benefits of the Standard Edition, but includes support for larger deployments. Advanced Server is an excellent candidate for large SQL Server databases, for high-end Web servers, and for meeting the demands of high-end, critical file and application services.

3

74_sysad_01.qx 11/8/99 9:18 AM Page 4

4


Table 1.1

Windows 2000 Server Family Features

Edition

Description

Features

Replaces

Windows 2000 Server

Designed for small to medium-sized deployments. Powerful, multipurpose server. Ideal for workgroup and departmental servers. Designed for intensive enterprise applications. Provides further availability and scalability.

—Up to fourway SMP support —Active Directory —Kerberos security —Enhanced Internet and Web services

Windows NT Server

—All Windows 2000 Server features —Up to eightway SMP support —Supports up to 64 GB of memory —Network load balancing —Component load balancing —Enhanced Application fail-over clustering

Windows NT Enterprise Edition

Designed for massive enterprise solutions and most mission-critical server systems. Most powerful high-end server.

—All Windows 2000 Advanced Server features —Up to 32-way SMP support —Increased Advanced Clustering

Windows 2000 Advanced Server

Windows 2000 Datacenter Server

Windows 2000 Datacenter Server is Microsoft’s top-of-the-line model. In addition to having all the features of the Standard Edition

74_sysad_01.qx 11/8/99 9:18 AM Page 5


and Advanced Server, Datacenter Server supports more processors and larger amounts of main memory. Windows 2000 Datacenter Server is ideal for extremely large-scale deployments and the most demanding needs, such as high-end clustering, data warehousing, and Internet Service Providers. Finally, Windows 2000 Datacenter Server can support more than 10,000 simultaneous users.

For IT Professionals Only

What Is Scalability? Scalability is the ability of a hardware or software system to adapt to increased demands. For example, a scalable operating system can adapt to the doubled (four) processors on the server, providing increased throughput in applications. A scalable network can start with just a few nodes and grow to thousands of nodes. Scalability is important because it allows you to invest in a system that you will not outgrow.

Windows 2000 System Administration Overview Windows 2000 Server was designed with the administrator and other key customers in mind. Microsoft’s network operating systems have become increasingly popular over the past several years. Windows NT has found its way into many government agencies, businesses, and other organizations. With its increasing success, expectations have also increased. Users of the operating system have been demanding more from their network operating systems. Windows 2000 is a powerful and robust network operating system that features many changes, enhancements, and improvements over earlier versions. In designing Windows 2000 Server, Microsoft has addressed several areas that are critical to administrators, including

5

74_sysad_01.qx 11/8/99 9:18 AM Page 6

6


improving the system’s overall reliability and scalability, providing a powerful Internet and application server, and providing a powerful end-toend management solution, while reducing total cost of ownership.

Increased Reliability, Availability, and Scalability Reliability, availability, and scalability are important parameters of network operating systems. An operating system should be able to work 24 hours a day, seven days a week, and the administrator should not be required to perform a reboot after every configuration change; in addition, the operating system should be able to correct itself when problems occur. Finally, an operating system should be able to grow in order to meet the demands of expanding businesses. Reliability is the measure of the consistency with which a computer runs its applications and services. Windows 2000 Server provides many reliability solutions, including: ■

Core operating system services

■

Fault tolerance

■

Disaster recovery

■

System recovery and updates

■

Reliable storage

■

Avoidance of outages and reboots

Core Operating System Services Windows 2000 Server provides these core operating system services: ■

Error handling and protected subsystems

■

Recoverable file system

■

Automatic restart

The operating system is designed to correct itself by managing errors without crashing the entire computer. The operating system

74_sysad_01.qx 11/8/99 9:18 AM Page 7


ensures that a fault in one program will not affect other running programs, by using protected subsystems that isolate programs in memory. Windows 2000’s new NTFS 5.0 file system logs all disk I/O operations as individual, unique transactions, so the system provides fault tolerance by undoing or redoing transactions after a system is brought back up after having suffered a disk failure. It is to be hoped that your system will never have to restart itself after a system failure; however, if a failure does occur, Windows 2000 Server can be set to restart itself automatically. This capability is important if no administrators are present when the system crashes. Because many servers have enormous amounts of RAM, dumping the contents of RAM could take quite a while, thus increasing downtime. Fortunately, Windows 2000 is designed to restart more quickly than it was able to do in earlier versions, thanks to a new “Write kernel information only” dump option.

Fault Tolerance Windows 2000 Server increases fault tolerance by providing: ■

Support for various RAID levels

■

Distributed file system (Dfs)

Windows 2000 supports the various levels of RAID that administrators may require; it includes support for disk mirroring or disk duplexing (RAID level 1), and disk striping with parity (RAID level 5). Windows 2000 Server also supports RAID level 0, which is striping without Parity; however, this offers no data redundancy. Another feature, the Distributed file system, improves fault tolerance by providing increased data availability and load balancing when it is integrated with Active Directory. Dfs makes finding and managing information much easier by implementing a single namespace for miscellaneous file system resources, which allows shares to be maintained redundantly among multiple servers.

7

74_sysad_01.qx 11/8/99 9:18 AM Page 8

8


Disaster and System Recovery Windows 2000 Server provides methods for disaster and system recovery: ■

Tape backup and UPS support

■

Repair Command Console

■

Safe mode boot

■

System File Protection

Windows 2000 includes an enhanced and powerful tape backup utility, and also includes support for uninterruptible power supplies through a UPS service, which sends alerts in the event of a power failure. In addition, the service is capable of safely shutting down the system before the battery power in the power supply is depleted. Another useful utility allows access to the NTFS file system for authorized users in case the server becomes inaccessible. Using the boot floppies, you can access this utility, called the Repair Command Console. Before Windows 2000, many administrators would resort to installing a parallel copy of Windows NT into a different directory in order to gain access to the files system. The other option was to install NT on a FAT partition so access could be gained to the file system through the use of a Windows 98 boot disk. Fortunately, the Windows 2000 Repair Command Console provides an alternate way to safely and efficiently gain access to the file system. Windows 2000 Server incorporates great features from operating systems such as Windows 98, by allowing a computer to be started in Safe mode. Often a computer will not start because of a bad or misconfigured driver. In the past, administrators often relied upon the “Last known good configuration” menu selection; however, this did not always work. With the ability to boot into Safe mode, the system can be started with the minimal number of drivers loaded, which allows you to make modifications or remove the faulty driver. Windows 2000 also avoids file version mismatches, through the System File Protection (SFP) system. SFP monitors protected files

74_sysad_01.qx 11/8/99 9:18 AM Page 9


and keeps a cache of original system files in case it becomes necessary to restore one of them. SFP tracks the proper file versions and stores this information in catalogs with a .cat extension. The system performs a check of these catalog files, and if any of the files are missing or corrupted, SFP will pull the good file from its cache, or ask the original media to restore the file.

Reliable Storage Windows 2000 also increases reliability by providing enhancements to the storage system such as: ■

Remote Storage Server

■

Dynamic volumes

■

Disk quotas

Remote Storage Server (RSS) works with the Hierarchical Storage Management (HSM) system, which allows different types of media to be part of the file system. RSS can automatically monitor the amount of space available on a local disk and is capable of moving data if free disk space drops below a specified level to secondary storage devices. Reparse points exist on the primary storage so that the migrated files can easily be retrieved from secondary storage. Windows 2000 also increases reliability by the use of dynamic volumes. Dynamic volumes function much like partitions; however, volumes are not limited to only four, as partitions are. In addition, an administrator can create, extend, and mirror volumes without rebooting the system. Finally, Windows 2000 increases storage reliability by providing disk quotas, a much desired feature found in other network operating systems. By using quotas, an administrator has control over the amount of data that is allowed on NTFS volumes by users. Windows 2000 provides quota management at the volume level and does not support quotas on directories; therefore, you will need to acquire a third-party utility if you need to limit directories.

9

74_sysad_01.qx 11/8/99 9:18 AM Page 10

10


Avoiding Crashes and Reboots An operating system with increased reliability and availability makes the lives of administrators less hectic. Microsoft provides many new solutions for frustrating problems, including crashes and frequent system reboots, that once plagued NT administrators. These solutions have been implemented into Windows 2000 Server: ■

Fewer reboots

■

Fewer memory leaks and “blue screens”

Server reboots may not yet be a thing of the past, but the number of times you will have to reboot your Windows 2000 server has been dramatically reduced. More than 90 percent of the situations that once required a reboot no longer do so. Table 1.2 outlines various administrative tasks, and specifies whether or not the system will require a reboot.

Table 1.2

Administrative Tasks that Require No Reboot

Administrative task

Reboot

Configuring Plug and Play devices Increasing the PageFile MaxSize Adding a new PageFile Adding and removing network protocols Changing an IP address Configuring audio and video drivers (including attribute changes) Installing SQL Server 7.0 Installing Microsoft Exchange Iincreasing disk space on NTFS Font changes Service pack installations Machine name change Domain membership change

No No No No No No No No No Yes Yes Yes Yes

74_sysad_01.qx 11/8/99 9:18 AM Page 11


Memory leaks have often been the cause of system crashes or the dreaded “blue screen of death.” In fact, many administrators have often resorted to setting up a schedule to automatically reboot the server because of these leaks. Because third-party drivers have often been the source of system crashes, Microsoft has implemented several initiatives to contribute to the development of better-quality third-party device drivers such as enhanced driver testing and driver signing. Drivers now undergo a rigorous test process, and drivers that pass Microsoft’s high-quality labs will be digitally signed. In addition, Windows 2000 includes Driver Verifier. This verification process can locate errors in kernel mode drivers, and is able to react to the unstable driver without disrupting the system.

High-Availability Solutions Windows 2000 provides protection against network, application, hardware, and environmental failures. Availability is the measure of the proportion of time when a system is up and available. Both Advanced Server and DataCenter Server provide high-availability solutions. A solution is highly available if it is available at least 99.9 percent of the time. To achieve this level of availability, Microsoft provides these features: ■

Cluster Services

■

Support for multihomed systems

Both Windows 2000 Advanced Server and DataCenter Server integrate Microsoft Cluster Services. Clustering protects against failures to provide higher levels of availability. Cluster Services provide a graphical management console that allows for simple and intuitive administration. In addition, the service monitors applications and services, and is able to recover data from various types of failures almost immediately. Multihomed computers allow for the use of multiple network interface cards on a single machine. Windows 2000 Server support

11

74_sysad_01.qx 11/8/99 9:18 AM Page 12

12


for this feature increases availability by preventing a NIC from acting as a single point of failure.

Improved Scalability Overall, Windows 2000 Server increases system and application scalability, which is directly related to the specific product chosen from the Windows 2000 Server family. The server family is capable of scaling a range of systems, from small workgroups to large enterprise deployments. Windows 2000 DataCenter Server provides native support for up to 32 processors. Most important, however, are the improvements that have been made in the Symmetric Multiprocessing (SMP) code, which provides fast performance by making multiple processors available to complete individual processes simultaneously. In addition, Windows 2000 integrates network and application load balancing with the new multiprocessor optimizations, including: ■

Enhanced memory allocation removes contention across the many processors.

■

The use of “fibers,” which are lighter than “threads,” increases overall throughput.

■

Contention is reduced by an increase in the maximum file system cache from 512 MB to 960 MB.

Other Windows 2000 features that increase reliability, availability, and scalability are Plug and Play support, I2O support, and network and COM+ load balancing. Plug and Play support has been available on Microsoft’s other operating systems, such as Windows 98, but it is now natively available with Windows 2000 Server. In addition, Windows 2000 Server supports I2O hardware. I2O architecture, also called Intelligent I/O, is an industry initiative to eliminate I/O bottlenecks and to promote the interoperability of I/O subsystems. Finally, Windows 2000 Server integrates Component Load Balancing and Network Load Balancing. Network Load Balancing is primarily responsible for balancing the load of incoming TCP/IP

74_sysad_01.qx 11/8/99 9:18 AM Page 13


traffic; whereas Component Load Balancing allows applications to be built, using COM+ components to be distributed across several servers, and is ideal for those applications deemed mission critical.

Easier Management and Lower Costs Another key goal of Windows 2000 Server’s design was to simplify system management, ultimately lowering organizations’ overall computing costs, also referred to as the total cost of ownership (TCO). Microsoft achieves this goal while providing a set of powerful and complete management services, including: ■

Integrated directory services

■

Comprehensive management solutions

■

Comprehensive file, print, and Web services

Integrated Directory Services The Active Directory, which is new to Windows, stores information about the various resources on a network, much as a telephone directory stores information about people and businesses with telephones. Active Directory takes this concept a bit further; it not only stores directory information, but also provides the services that make this information available and useful. This is a major design feature of Windows 2000, which seeks to simplify and improve management while reducing the total cost of ownership. Active Directory contributes to Microsoft’s design goals by providing these advantages: ■

Simplified management

■

Strengthened security

■

Extended interoperability

Active Directory provides a single repository for managing users, groups, and network resources, eliminating redundant tasks by providing a single-point of management. An administrator can easily

13

74_sysad_01.qx 11/8/99 9:18 AM Page 14

14


deploy applications, find network resources, and even delegate administrative tasks and privileges easily and quickly. In addition to centralizing management, Active Directory improves security because of its tight integration with various security features, including a number of authentication mechanisms and Internetsecure protocols. Finally, Active Directory serves as a key integration point for application and system integration through such standard interfaces as the Microsoft Management Console (MMC). Windows 2000 Server improves management and lowers overall costs through its directory service by providing a focal point for securing network resources, reducing the number of places where administrators need to manage information, and making it possible to integrate with other systems.

Comprehensive Management Solutions Windows 2000 Server includes a broad range of solutions designed to assist administrators. Using the management infrastructure and the many tools provided, administrators can provide a broad range of services both quickly and reliably; they can better manage the network, while increasing server availability through these improvements: ■

Management infrastructure

■

Change and configuration management

■

Storage management

The management infrastructure of Windows 2000 Server includes the presentation services, among them the Microsoft Management Console (MMC), which provides a consistent user interface. Windows 2000 management infrastructure also includes scripting services, which give administrators the flexibility to automate processes. For example, the Windows Scripting Host (WSH) allows scripts to be run either on the desktop or from the command prompt, using an ActiveX scripting architecture. Windows 2000 includes scripting engines for JavaScript and Visual Basic Script,

74_sysad_01.qx 11/8/99 9:18 AM Page 15


and additional languages, such as Perl, TCL, and Python, can be incorporated through the use of third-party scripting engines. Also part of the management infrastructure are the directory service, security services, and group policy services, which are tightly integrated with the Active Directory. Finally, terminal services can be used to administer a Windows 2000 Server remotely. Windows 2000 also provides added management solutions by incorporating change and configuration tools such as IntelliMirror, which is designed to lower the total cost of ownership and uses caching and centralized synchronization to mirror network users’ desktop settings as well as applications and data. Table 1.3 outlines the standard Change and Configuration Management features of IntelliMirror. IntelliMirror can also be used in conjunction with the storage management features included in Windows 2000 such as the Hierarchical Storage Management System. This combination, along with data archiving services and the improved backup and recovery utility, makes protecting users and the organizations’ data easier and more manageable.

Comprehensive File, Print, and Web Services In addition to the support for disk quotas and volume management, Windows 2000 Server also seeks to improve management and lower costs by providing this broad set of file, print, and Web services: ■

Improved file system

■

Faster printing

■

Integrated Web services

The file system that Windows 2000 Server is built upon is a new version of the NT File System (NTFS), which provides added flexibility. Organizations are now able to migrate data to less expensive forms of media through use of Hierarchical Storage Management, yet the migrated data is still available to users because of pointers, which remain in the original location. The Windows 2000 Server file

15

74_sysad_01.qx 11/8/99 9:18 AM Page 16

16


Table 1.3 IntelliMirror feature User Computer Settings Management

Software Installation and Maintenance

User Data Management

Change and Configuration Management Features Supporting technologies

Benefit

Theme

Allows environment settings for users and computers to be centrally defined and managed, as well as supporting mirroring of user settings to the network. Allows software installations, removal, repairs and updates to be centrally managed. This includes applications, service packs, and operating system updates. Allows user data to be mirrored to the network, as well as local caching of network data.

My preferences follow me.

Active Directory, Group Policy, Offline Folders, Roaming User Profiles, and enhanced Windows shell.

My applications follow me.

Active Directory, Group Policy, Windows installer service, and enhanced Windows shell.

My documents follow me.

Active Directory, Group Policy, Offline Folders, Synchronization Manager, enhanced Windows shell and Disk Quotas.

system also increases file system and data availability through features such as Dynamic Volume Management and the distributed file system (Dfs). Both of these reduce downtime, which provides a definite added cost benefit to organizations. Windows 2000 Server also supports the new UniDrive5 driver standard, which makes printing faster while improving its quality.

74_sysad_01.qx 11/8/99 9:18 AM Page 17


In addition, the management of printers is simplified because of both Plug and Play support and support for the Internet Printing Protocol (IPP). IPP is an application-level protocol that can be used for distributed printing on the Internet, and it allows the management of printers through Uniform Resource Locators (URLs). Finally, Windows 2000 Server is packaged with an updated version of Internet Information Server (IIS). IIS 5.0 makes it easy to share and publish information and documents across a company intranet or on the Internet. IIS is tightly integrated with Active Directory and the Windows 2000 security features, and it supports Active Server Pages (ASPs), Windows Media Services, CPU throttling, and HTTP compression.

Comprehensive Internet and Application Server In order to meet the needs of expanding businesses, and to adapt to the explosive growth of the Internet and electronic commerce, Windows 2000 Server offers an improved Internet-aware and application-enabled operating system. Windows 2000 provides a complete set of application development and communication options, to meet the needs of organizations across many networking environments. In order to build and deploy powerful component-based Web applications, Windows includes application, terminal, communications, and networking services. Not only does Internet Information Server provide easier management of Web sites, but it is also one of the most important Internet technologies incorporated into the operating system. IIS 5.0 was designed to meet all of Microsoft’s objectives by increasing reliability and scalability, simplifying management, and making Windows 2000 Server a viable option as an Internet server.

Application Services Windows 2000 Server provides both a platform to deploy applications and integrated application services for custom development. An advantage of Windows 2000 Server over other operating systems

17

74_sysad_01.qx 11/8/99 9:18 AM Page 18

18


is the support from the many available independent software vendors (ISVs). Already there are thousands of solutions available for Windows 2000, and Microsoft is working closely with vendors to ensure Windows 2000 compatibility. In addition to using the operating system’s broad support available from ISVs, companies can easily build and deploy applications using the Microsoft Component Object Model (COM), which allows programmers to develop objects that can be accessed by any COM-compliant application. Windows 2000 Server component services include support for load balancing, transactions, advanced data access, and asynchronous communication. Component Services, along with scripts and HTML, can be combined with Active Server Pages to create dynamic Web applications. Because all the application services are Internet ready, both intranet and Internet applications can be developed and deployed. Table 1.4 outlines the many features available.

Table 1.4 Simplify Application Development Common APIs COM+ Microsoft Transaction Services Microsoft Message Queuing BackOffice Integration Microsoft Visual Studio Other thirdparty tools

Features to Help Build Integrated, Componentbased, Web-aware Applications Web-enabled Applications

Extend the Reach of Applications

Active Server Pages

Terminal services Network and communication services Integrated multimedia and data networking services

74_sysad_01.qx 11/8/99 9:18 AM Page 19


Communications and Networking Services Windows 2000 Server provides standards-based solutions that can be implemented with minimal cost and resources to provide network connectivity. Windows 2000 Server provides Virtual Private Network (VPN) support that can allow organizations to securely connect with other partners or allow mobile users to easily connect to the network. A VPN basically provides a secure and costefficient way to connect mobile users, corporate networks, partners, and organizations to each other utilizing the free public wires already in existence, such as the Internet. Windows 2000 includes dial-up networking, which lets remote users connect through VPN connections, and Remote Access Service (RAS), which offers VPN access over various supported protocols. Windows 2000 supports several VPN protocols, such as Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and IPSec protocol. Figure 1.2 illustrates the way two separate networks are connected through the use of a VPN instead of expensive leased lines. In addition to the support for a VPN solution, Windows 2000 provides built-in routing services that provide local area network routing across local and wide-area networks, as well as on the Internet. Finally, Microsoft has recognized the growing need for organizations to integrate data networks with voice services and networks, thus Windows 2000 Server provides integrated multimedia and data networking services. Because Windows adheres to standards, it can quickly take advantage of developing technologies. For example, Windows 2000 Server provides support for such standards as H.323, an approved standard that defines how audiovisual conferencing data is transmitted across networks. Table 1.5 lists eight broad communication features provided by Windows 2000 Server, as well as the individual services that make up each

19

74_sysad_01.qx 11/8/99 9:18 AM Page 20

20


category. For more information about each feature, Microsoft offers various communication and networking services white papers, available for download from its Web site.

Figure 1.2

A VPN can be used to connect two networks using the Internet as the medium for transporting data.

Internet

Virtual Private Network

Logical Equivalent

Why the Change? Information technology is one of the fastest-growing industries, if not the fastest. Companies are using new technology successfully to gain a competitive edge, thus creating a chain reaction in which every company must change in order to stay competitive in today’s fast-paced economy. As advances are made, companies are utilizing them to their advantage to increase productivity, lower costs, and provide better services to their customers, ultimately increasing

74_sysad_01.qx 11/8/99 9:18 AM Page 21


profits. Even not-for-profit organizations need to change to keep up with demand and to improve their overall performance. If you understand the features and benefits that Windows 2000 Server provides, you can be ready for the challenge of implementing new technologies in your organization. Windows 2000 Server, which includes many new or improved features, is a massive change from the previous generation.

Table 1.5

Communication and Networking Features to Help Set Up and Connect Networks

Network Protocols

Security, Encryption, and Authentication

Naming and Address Management

Enhanced TCP/IP

CHAP, MS-CHAP, PAP

Active Directory

Point-toPoint Protocol (PPP) H.323

Extensible Authentication Protocol (EAP)

Dynamic DNS

Smart Card Support (EAP-TLS)

DHCP

IEEE 802.1p Prioritized LANs

IPX/SPX

RC4 Encryption Services

RSVP

AppleTalk

RADIUS Client Internet Authentication Service (IAS) RADIUS Server IP Packet Filtering IPX Packet Filtering

Information Locator Service (ILS) WINS

Quality of Service Differentiated Quality of Service (Diffserv) Admission Control Service (ACS)

continued

21

74_sysad_01.qx 11/8/99 9:18 AM Page 22

22


Security, Remote encryption, Access and Service and authenticatio VPN

Extensibility and Open APIs

Administration and Ease of Use

Network Address Translator (NAT)

Remote Access Service (RAS)

Generic Quality of Service (QoS) API

Connection Manger Administration Kit

Internet Group Management Protocol (IGMP) Version 2 Routing Information Protocol (RIP) for IP Versions 1 and 2 Open Shortest Path First (OSPF) DNS Proxy

Dial-up Networking

Traffic Control API

Phone Book Administrator

Local Policy Management (LPM) API

Connection Point Services

Routing APIs

Plug and Play

Routing Protocols and Gateway Services

DHCP Relay Agent

RIP and SAP for IPX Static Routing

Management and User Interface APIs Microsoft Management Console (MMC) Snap-ins Connection Sharing Selectable VPN Protocols Dynamic Bandwidth Allocation Auto-Dial and Auto-Logon Dial RAS Restartable File Copy

74_sysad_01.qx 11/8/99 9:18 AM Page 23


Migrating to Windows 2000 Server Windows 2000 Server provides an abundance of added features and enhancements that will benefit the IT foundation of your organization. Considering the many added features, as well as the radical structural change largely due to Active Directory, just figuring out where to start in the migration process can be a daunting task. Fortunately, Windows 2000 was designed to operate with earlier versions of Windows NT. Operating in such a mixed environment will not provide you with the complete set of benefits and functionality that Windows 2000 provides; however, this interoperability provides administrators with the flexibility to perform upgrades to servers in increments and to implement certain Windows 2000 services. Organizations will still gain many of the performance and other benefits provided by Windows 2000 Server by performing such an incremental upgrade; in fact, Microsoft recommends that this is how organizations should migrate to Windows 2000. Microsoft also offers a licensed version of software by Mission Critical Software Inc., which allows you to easily migrate your current NT Server domains to Windows 2000, using the Domain Migrator. Many organizations will need to run NT 4.0 and Windows 2000 in parallel rather than making the move all at once. The Domain Migrator tool provides support for running both operating systems concurrently, and it also provides rollback capabilities. The Domain Migrator will ease the migration by providing wizards that present a logical path to migration, modeling capabilities that allow you to see what your directory structure will look like, and “prune and graft” technologies that help you reduce the number of domains in your network. Microsoft has also met the needs of those operating with the widely used Novell NetWare by introducing a new Directory Service Migration Tool, which helps migrate NetWare Domain Services (NDS), as well as the older NetWare binderies. The migration tool migrates the NetWare data into an offline database, which then

23

74_sysad_01.qx 11/8/99 9:18 AM Page 24

24


allows the administrator to adjust the account information before actually saving it to Active Directory.

Getting Ready Migrating to Windows 2000 is a big move that is best accomplished in a series of steps. You should first understand the benefits and feature set of Windows 2000, because these features will enable your organization to better perform its mission. You probably understand the benefits of increased reliability, availability, scalability, simplified management, and lower total cost of ownership, but it is the sum of properly implemented features in Windows 2000 Server that enables organizations to realize these benefits to their maximum. Armed with this information, you must take a couple of preliminary steps before you begin the migration process, including: ■

Acquiring management/executive approval

■

Involving personnel at all levels

More than likely, moving to Windows 2000 Server will not be a simple overnight task, but a large project. As is the case with most large projects, gaining the support of upper management and executives is critical. Because of the changes in the Windows 2000 Server networking infrastructure, migration will often require a lot of planning, and possibly several teams. Along with executive sponsorship, a clear statement of purpose should be formulated that will be of assistance later in the planning and deployment phases. Information systems exist to support the organization. Now, more than ever, information technology plays a crucial role in the success of an organization. An understanding of your organization’s shortterm and long-term business goals will assist you in the deployment of Windows 2000, because this infrastructure will help your organization reach its goals. An awareness of an organization’s goals is often the responsibility of upper management and executives; therefore, these people will be of greatest assistance in helping you to align information technology with the goals of the organization.

74_sysad_01.qx 11/8/99 9:18 AM Page 25


In addition, personnel at all levels should be involved in the project from start to finish. Everyone should be educated about the benefits that will result from the project. At the least, this will prepare them for the change and ease their transition to the new system. To get them started in the process, discuss not only how the system will benefit the organization, but also how it will benefit them individually. Many enhanced server and workstation features will improve employee efficiency, including: ■

Simplified and faster access to data, even for those who must log on from multiple locations or those who work in remote locations

■

Improved disaster recovery methods that will insure the safety of their data, and possibly their workstations

■

Reduced number of times they must log on when they roam applications and resources on the network

Users will quickly begin to appreciate what this new system will do for them, and they will provide you with the support you need to begin implementing the systems. More important, personnel throughout your organization can provide valuable insight into the present system, and the ways it can be improved. Before beginning the migration process, informing, educating, and seeking the support of the various levels of personnel in your organization will help ensure that your migration to Windows 2000 is a success. Keep in mind that success does not just mean that you were able to deploy Windows 2000 without any major glitches or downtime; a successful Windows 2000 deployment will benefit your users and your organization as a whole.

Streamlining Each organization is unique and should devise and plan the comprehensive migration path that will best suit its specific needs. Before you even begin the planning process, however, there are measures you can take now to help ensure a smooth and easy

25

74_sysad_01.qx 11/8/99 9:18 AM Page 26

26


migration, including streamlining and bringing your current systems up to date. Several simple and easy tasks can be performed almost immediately without regard to the planning that will be involved in migrating your systems. First, go through your user accounts and eliminate any duplicate or unused accounts. Next, get rid of any unnecessary files lingering on your machines, and ensure that you have enough disk space. While you are doing this, it may be a good idea to perform any hardware upgrades that need to be done in order to support the greater demands of Windows 2000 Server. If you do not already have the resources to perform the necessary hardware upgrades, this will be an important issue later on during the planning process, as this directly relates to your organization’s budget. You may also consider switching to TCP/IP if you are not already using it. In order to take advantage of DNS and Active Directory integration, Windows 2000 Server requires TCP/IP; in addition, you will also need to standardize your domain and host names using proper DNS character-naming conventions. For more information on standard DNS characters, refer to Request for Comments (RFC) 1123 and RFC 2044. Because Windows 2000 Server relies heavily on TCP/IP and DNS, it is a very good idea to start using short and proper naming conventions, and it will help ensure a smooth migration to Windows 2000.

Planning It is essential that you plan properly in order to maximize the benefits available from Windows 2000. Before you begin the actual testing, installations, or upgrades, you should create a plan that includes these objectives: ■

Design new architecture

■

Create task lists

■

Determine costs

■

Create a timeline

74_sysad_01.qx 11/8/99 9:18 AM Page 27


Architecture Windows 2000 Server is vastly different from earlier versions of NT, especially in regard to architectural differences. Because of this you will need to produce design documents that include technical specifics and diagrams of the new system. You should consider many key elements. Active Directory, for example, provides a new model that is completely different from those in earlier versions of NT. Some of the elements you must consider in order to be able to plan the design of your new system architecture are: ■

Your organization’s key business objectives

■

The importance of administrative responsibility throughout your network

■

Future growth, acquisitions, and mergers

■

Security

■

Your existing environment

As you examine and consider these elements, you will be in a better position to design your network. Consider, for example, the determinations you will need to make because of DNS. Windows 2000 Server uses the DNS naming service, so the Active Directory namespace will become an extension of the DNS namespace. Because of this, you will need to determine the number of domains that your organization requires, as well as the way you will organize and name your domains. During this stage, as you diagram and draft what your overall system will look like, you should also be able to determine what hardware and software will be needed. The hardware requirements for Windows 2000 Server will vary, depending upon how you use the server. You will need to adjust processor speed, RAM, and hard disk space, depending on the server’s use. You should keep this information in mind while you plan so that you may budget for it later.

27

74_sysad_01.qx 11/8/99 9:18 AM Page 28

28


Costs Undoubtedly, migrating to Windows 2000 will cost you money, and, depending upon the size of your migration, the costs may be extremely high. Before you deploy Windows 2000, you will need to create a budget. When you do this, there are many factors to consider. For example, you may need to upgrade hardware to support the increased demands of Windows 2000, or you may even need to purchase entirely new systems. Other cost factors include the cost of software, most notably Windows 2000; project management software; and upgraded third-party utilities. Finally, there may be other miscellaneous costs such as training, overtime for employees, or the costs associated with hiring consultants or contractors. These costs primarily relate to the direct costs associated with migrating to Windows 2000; however, even after Windows 2000 is implemented within your organization, you will continue to incur both direct and indirect costs because of other important concerns, including: ■

Total cost of ownership (TCO). This describes the actual cost of one or more systems, taking into consideration such factors as original costs, maintenance, technical support, and training.

■

Return on investment (ROI). This forecasting tool describes a rationale for making investment decisions, and it is a means for projecting the future value of an investment.

Both TCO and ROI are important cost-related factors that should be included in your plan as you migrate to Windows 2000. Figure 1.3 illustrates a sample measurement of server operating costs based on six baseline costs. To help in determining TCO and ROI, Microsoft has made available for free a TCO and ROI calculator available for download from its Web site. Windows 2000 is designed to help lower costs. Lowering costs and increasing an organization’s ROI are the primary motivators for migrating to Windows 2000.

74_sysad_01.qx 11/8/99 9:18 AM Page 29


Figure 1.3

This sample pie chart illustrates the total cost of ownership per year. $440,000

$365,000

Initial systems purchase price Systems installation, integration and staff training Cost of technical support and upgrades Application development and maintenance labor

$13,000

System and network upgrades $25,000 $10,300

System and network management labor

$390,000 Total annual TCO: $1,243,300 Number of servers: 30 Number of users: 925 TCO per server: $41,449 TCO per user: $1,345

Plan of Action After you have defined your current architecture, and have a clear picture of where you want to go, you should create plans using checklists or step-by-step lists that map out the actions required to perform a required task. It is a good idea to create plans of various depths. For example, one plan may give a broad overview of the steps that need to be taken to migrate the entire organization, whereas another plan may give a detailed list of the step-by-step procedures you need to follow in order to upgrade your NT 4.0 Primary Domain Controller to Windows 2000 Server.

29

74_sysad_01.qx 11/8/99 9:18 AM Page 30

30


Timeline Now that you have created task lists for required procedures, and have acquired a large budget for the project, it is time to go beyond conceptualization and start developing a timeline for the tasks that need to be performed. Taking into consideration unexpected delays, create a timeline. Be sure to consider tasks that can be performed simultaneously and tasks that are dependent upon a previous task’s being completed. You may wish to consider using project management software such as Microsoft’s Project Software (see Figure 1.4), which is a powerful program that lets you build customized planning solutions; in addition, it is quite flexible, and is designed to be beneficial to both novice planners and professional project managers.

Figure 1.4

Microsoft Project can be used as a management tool for building customized planning solutions.

74_sysad_01.qx 11/8/99 9:18 AM Page 31


Testing Proper testing is another major part of the migration to Windows 2000. Unfortunately, not everything in the IT world goes as planned, and not every piece of software peacefully coexists with every other, so it is vitally important that the project team create a test environment in which parts of the overall system can be tested. The goal of creating the test environment is to create realistic scenarios that will be predictive of your production systems. These labs can be used to accomplish necessary tasks; assumptions can be verified or disproved, unforeseen problems can be uncovered, and the system can be optimized. In addition, administrators can benefit from both direct and indirect training. Testing a system before deployment offers you room to experiment and evaluate what works best without risk to your organization’s network, and ultimately should save you from downtime during and after the actual deployment.

Deployment You should now be ready to deploy Windows 2000. How you actually conduct the deployment depends upon the previous steps and the plan of actions you created. For example, a small business may wish to migrate its systems all at once; whereas a large corporation may initially upgrade only its primary domain controllers, and then continue to perform incremental upgrades over a period of months. You can take many approaches to the actual migration. Some organizations deploy Windows 2000 only on member servers while continuing to develop a plan for deploying Active Directory. Finally, be sure to take a look at the checklists, provided with the Windows 2000 Help system, that provide walkthroughs for such common tasks as configuring TCP/IP, migrating from NetWare, and installing and configuring a PPTP server. No matter how you decide to deploy Windows 2000, you will still need to conduct further tests once each part of the system is deployed, and then evaluate the success of the deployment. It is important to always be prepared for disaster, in case you need to restore your system to the way it was before the deployment. More

31

74_sysad_01.qx 11/8/99 9:18 AM Page 32

32


than likely, however, your deployment will be a stunning success (with a few minor glitches at the most), and you will begin to reap the rewards of a more robust and more easily managed system. Meanwhile, your organization will enjoy improvements in its overall mission while reducing the total cost of ownership.

Setting Up Windows 2000 Server This section demonstrates how to set up a single machine installation; however, larger sites that need to install Windows 2000 Server on many systems over a large network may find that performing an automated unattended setup is a more viable alternative. The primary method of automating the Windows installation is to use an answer file. For more information about automating the setup process by using an answer file, consult the Microsoft Windows 2000 Server Resource Kit, or visit Microsoft’s Web site and download its guide for automating the Windows 2000 installation. When you set up Windows 2000 Server, either you will perform a clean installation, or you will upgrade from an existing version of Windows NT Server.

Installing Windows 2000 Server Before installing Windows 2000 Server, you should first read the readme text files located on the Windows CD. Next you should be sure that your system meets the minimum system requirements (see Table 1.6). After you determine that your computer has enough juice to power Windows 2000 Server, review the Hardware Compatibility List (HCL), which is available as a file named Hcl.txt located on the Windows 2000 CD. For the most up-to-date HCL, consult Microsoft’s Web site. If your hardware is not listed on the HCL, you should contact your vendor to request a Windows 2000–compatible driver. Before you run setup, you should decide whether the server will join a domain or a workgroup. If you choose to join a workgroup, setup will install your computer as a stand-alone server, but if you choose to join a domain, setup will install your computer as a member server.

74_sysad_01.qx 11/8/99 9:18 AM Page 33


Table 1.6

Minimum and Recommended Requirements

Hardware

Memory CD-only install Floppy and CD install Network install

Optional

Minimum

Recommended

166-200 MHz Pentium microprocessor VGA or higher resolution monitor VGA or higher resolution monitor Keyboard 2 GB hard disk with a minimum of 900 MB of free space 2 GB hard disk with a minimum of 900 MB of free space 64-128MB El Torito Compatible CDROM Drive High-density 3.5-inch disk drive and CD-ROM drive Network adapter and access to the network share containing the setup files Mouse or other pointing device

200 MHz Pentium or higher microprocessor

Keyboard

128-256MB El Torito Compatible CDROM Drive High-density 3.5-inch disk drive and CD-ROM drive Network adapter and access to the network share containing the setup files Mouse or other pointing device

During setup you will have the option to select advanced setup options from the Advanced Settings screen, including: ■

Change the default location of the source and destination files.

■

Copy all installation files from the CD to the hard drive.

■

Select another partition to install Windows 2000 Server.

■

Create a set of startup disks.

The Windows 2000 Server Setup wizard will walk you through the rest of the process. Before beginning, you should have necessary

33

74_sysad_01.qx 11/8/99 9:18 AM Page 34

34


information, such as network settings. As usual, you will have to accept the licensing agreement, and the wizard will next gather information about your computer such as regional settings, computer name, administrator password, date/time settings, and network settings. After setup has collected all the needed information about your computer, it will begin the actual installation. Finally, the system will verify the hardware and configure the system. Once the installation has completed the last step, you will be able to log on Windows 2000 Server, and you will then be prompted to complete the configuration of the server through the Windows 2000 Configure Your Server interface, which walks you through common tasks (see Figure 1.5). Table 1.7 illustrates the components on the lefthand side of the Configure Your Server screen, such as Web services or File Services, that can be selected to easily configure the server, and it lists the elements that can be configured from each of the choices. The Configure Your Server interface will appear each time you log on as an administrator, if you do not clear the check box to remove it at startup. In addition, you can start the wizard at any time by selecting Server Configuration from the Administrative Tools folder.

Figure 1.5

The Configure Your Server Wizard makes it simple to perform common tasks.

74_sysad_01.qx 11/8/99 9:18 AM Page 35


Table 1.7

Options for the Configure of Your Server Wizard

Name

Details

Active Directory

Set up properties to maintain security and track user information: user and group accounts, policies, domain server roles, and permissions. Set up shared folders and resources. Set up printers, queues, and other related printing functions.

File Server Print Server Web/Media Server

Set up Web sites, FTP sites, and related intranet/Internet information.

Networking

Set up network protocols, remote access, and routing.

Application Server

Set up message queuing and support for applications distributed across the network.

Advanced

Set up Terminal Server, Certificate Authority, Remote Installation Services, and any optional components not selected during Windows 2000 Server setup.

Upgrading to Windows 2000 Server You can upgrade directly to Windows 2000 Server from any of these operating systems: ■

Windows NT Server 4.0

■

Windows NT Server 3.51

■

Windows NT Server 4.0 Terminal Server

You cannot upgrade directly to Windows 2000 Server if you are using versions of Windows NT Server earlier than 3.51. In order to deploy Windows 2000 Server on these versions, you must first upgrade to either Windows NT Server version 3.51 or 4.0. An upgrade to Windows 2000 Server installs files into the folder that contains your previous operating system, and retains all your existing users, groups, and other settings. The upgrade will also keep

35

74_sysad_01.qx 11/8/99 9:18 AM Page 36

36


intact your applications that are Windows 2000 compatible. For the most part, the setup process for upgrading to Windows 2000 Server is similar to that used in a clean installation. The Setup wizard will walk you through an intuitive setup. Performing an upgrade will likely change your current server roles. The Windows 2000 Server roles are: ■

Stand-alone

■

Member server

■

Domain controller

A stand-alone server is not part of a domain, although it can be part of a workgroup. On the other hand, a member server is a server not loaded down with domain controller responsibilities, and it is typically used as an application server. Stand-alone servers are rarely used except in organizations that need an extremely secure server, and they often require additional resources to maintain, since only users with accounts on a given server can maintain it. When you choose to upgrade to Windows 2000, setup will automatically upgrade an NT primary domain controller (PDC) to be a domain controller (DC). You will choose to have a backup domain controller (BDC) become either a domain controller or a member server, and a stand-alone or member server will become either a Windows 2000 member or a stand-alone server. Before you upgrade to Windows 2000 Server, perform a backup on the servers, verify that your system meets the minimum requirements, and be certain that you have enough drive space. You must first upgrade the primary domain controller before upgrading any other servers. After this server has been upgraded to a Windows 2000 domain controller, it is backward compatible and appears as a Windows NT 4.0 PDC to other non–Windows 2000 servers and clients. After ensuring that your new domain controllers are running properly, you may begin the upgrade on your BDCs. When you have finished upgrading all your servers to Windows 2000 Server domain controllers, you can switch from Mixed mode to Native mode by opening the Domain Properties dialog box and selecting Change Mode (see Figure 1.6). Once you make the switch from Mixed mode to Native

74_sysad_01.qx 11/8/99 9:18 AM Page 37


mode, you cannot undo the change. Mixed mode allows Windows NT domain controllers to be present; but Native mode allows only Windows 2000 Server domain controllers to exist in the domain.

Figure 1.6

Use domain properties to change from Mixed mode to Native mode.

Summary This chapter introduced the Windows 2000 Server family, and provided the necessary knowledge to assist you in planning a migration to Windows 2000. In order to successfully migrate to Windows 2000, you must understand the different types of server operating systems that Microsoft provides based on an organization’s needs, as well as on the critical areas that Windows 2000 Server addresses. These systems make migrating to Windows 2000 a viable project. Microsoft offers various types of servers to meet the needs of specific organizations. For small to medium-sized deployments, Windows 2000 Server will suffice. This edition is ideal for workgroup and departmental servers. When you must meet the needs of intensive applications and deployments, you may wish to consider

37

74_sysad_01.qx 11/8/99 9:18 AM Page 38

38


Windows 2000 Advanced Server, which provides increased support, including the ability to support more memory and processors than the standard edition. Windows 2000 Datacenter Server not only provides all the features of the other versions, but also supports advanced clustering, as well as up to 32-way symmetric processing. Windows 2000 Server provides many reasons to migrate from other previous versions of Windows or other network operating systems. Windows 2000 provides increased reliability, availability, and scalability; reduced costs through easier end-to-end management; and a powerful and robust Internet and application server. When you plan the migration to Windows 2000 Server, it is important that you understand how the operating system provides these three features. To successfully implement a Windows 2000 network, you should become familiar with the features Windows 2000 Server provides, and with your organization’s requirements. Windows 2000 Server improves reliability, availability, and scalability by incorporating many features into the operating system, which can be broken down into these broad categories: ■

Core operating system services

■

Fault tolerance

■

Disaster recovery

■

System recovery and updates

■

Reliable storage

■

Avoidance of outages and reboots

Next, Windows 2000 Server helps to simplify administrative tasks while improving an organization’s investment in the operating system by lowering total cost of ownership. Windows 2000 Server makes managing the network easier by providing a complete set of powerful tools and management services within these categories: ■

Integrated directory services

■

Comprehensive management solutions

■

Comprehensive file, print, and Web services

74_sysad_01.qx 11/8/99 9:18 AM Page 39


Finally, the Windows 2000 Server operating system is a comprehensive Internet and application server. The operating system can easily and powerfully deploy applications to meet demanding business needs, as well as bringing applications to the Web. It also allows deployments to be made across various networking environments by providing both application services and communication and networking services. Migrating to Windows 2000 will be much easier and will provide more favorable results when you understand how the operating system can help your organization. To assist in the actual migration process, Microsoft has included tools such as the Domain Migrator tool to help move your domains into the new Windows 2000 domain structure and a Directory Service Migration tool to help migrate organizations with existing directory services from other vendors. Migrating to Windows 2000 Server in larger organizations requires a large amount of preparation and planning. In large deployments, personnel at all levels should be involved. Getting others involved will help you align IT goals with business goals, which will provide the groundwork for a successful migration. After you have gained executive approval and assistance, you should take several steps before you perform any of the actual planning groundwork for Windows 2000. You should clean up your existing environment and start preparing for what is to come, deleting unnecessary files and users, switching to TCP/IP, and updating all your present systems. Proper planning is imperative. Depending on the size of your organization, the planning process can be quite extensive. You should design the new architecture, create tasks lists of varying degrees of depth, determine costs, and create a timeline, specifying who will do what. After everything has been planned, it is important that labs be set up to test the systems. You should create realistic test scenarios that will be predictive of your planned systems. When thorough plans have been devised and the various systems have been tested, you may start deploying your new systems.

39

74_sysad_01.qx 11/8/99 9:18 AM Page 40

40


Each organization is different and has its own unique needs, so you should devise your own phases of migration. What has been provided is just a recommended framework. Some degree of planning is required for an organization of any size. Microsoft has worked with many large organizations to assist in the deployment of Windows 2000 Server and has made these case studies and guides available on its Web Site. Finally, this chapter discussed the necessary procedures for performing an installation or upgrading to Windows 2000 Server. Before installing the new operating system, you should review the files on the Windows 2000 Server CD-ROM, and be sure that your system meets the system requirements and hardware compatibility. The system has a Setup wizard that will walk you through the entire installation project. Many organizations will find it necessary to migrate to Windows 2000 Server in order to keep up or move ahead, especially considering the pace at which information technology is moving. When it is deployed and managed properly, Windows 2000 helps organizations increase productivity, lower costs, and provide better services to their customers.

FAQs Q: What is Microsoft Windows 2000 Server? A: Windows 2000 Server is the successor to the Windows NT 4.0 operating system. It provides networking, application, communications, and Web services with increased reliability, scalability, and manageability.

Q: Why should I migrate my NT 4.0 domains to Windows 2000? A: Windows 2000 Server allows you to remain competitive in a dynamic industry by having an advanced system that lowers costs, and it is adaptable to change. In addition, Windows 2000 server allows you to perform tasks that were not possible with NT 4.0. For example, you can now delegate administrative tasks.

74_sysad_01.qx 11/8/99 9:18 AM Page 41


Q: How does Windows 2000 Server differ from the others in the 2000 Server family?

A: Within the Windows 2000 Server family, there are three different versions: Windows 2000 Server, Windows 2000 Advanced Server, and Windows 2000 Datacenter Server. Windows 2000 Server is the primary product aimed at small to medium deployments. Windows 2000 Advanced Server (formerly known as Windows NT Server 4.0, Enterprise Edition), is much more powerful than Windows 2000 Server. Advanced Server is more scalable, and can support memory up to 64 gigabytes. Windows 2000 Datacenter server is the high-end version of Windows 2000, and it supports up to 32-way symmetric multiprocessing (SMP) and also 64 gigabytes of memory. This edition is geared to very large deployments.

Q: What are the hardware requirements for Windows 2000 server? A: This varies according to your specific use of the server. For example, Windows 2000 Server will be able to run successfully on a Pentium 166 MHz with 64 megabytes of RAM. (For a production server, see Table 1.3.) Microsoft developers are recommending a Pentium II processor, 128 megabytes of RAM, and a 2 GB hard drive, and, depending on the server’s use, you may need at least 256 MB RAM and a much larger hard drive.

Q: We are still running archaic versions of NT and never upgraded to Microsoft Windows NT 3.51 or to a later version. Can we still upgrade to Microsoft Windows 2000 Server?

A: Yes, but you should first upgrade to either version 3.51 or version 4.0. Windows 2000 Server does not support direct upgrades from versions of NT earlier than 3.51.

41

74_sysad_01.qx 11/8/99 9:18 AM Page 42

42


Q: How does Windows 2000 Server compare with other network operating systems?

A: Choosing a network operating system is a strategic and important process. Organizations require a system that can meet the demands to support their business objectives. Operating systems can be compared in many ways. Most major computer publications publish comparison lab tests. In addition, Microsoft offers on its Web site detailed papers that compare Windows 2000 Server to other major network operating systems.

74_sysad_02.qx 11/8/99 9:47 AM Page 43

Chapter 2

Overview of Windows 2000 Administration

In this chapter, you will be presented with an overview of Windows 2000 administration.


Introduction to Network Administration

■

Microsoft Management Console

■

Active Directory and Beyond

■

Using Windows 2000 Help

43

74_sysad_02.qx 11/8/99 9:47 AM Page 44

44

Chapter 2 • Overview of Windows 2000 Administration

Introduction to Network Administration Computer systems within an organization must be managed with a goal of maximizing the productivity of those using the systems, thus allowing the organization to compete and move ahead. More than likely you are reading this book because you now are or soon will be in a position to provide information systems management services based upon Windows 2000 systems. These systems are vital to the success of any organization. Organizations vary greatly in the assignment of the various administrative roles; nevertheless, it is important to understand the underlying fundamental responsibilities of a network administrator. Network administration is a challenging profession. As an administrator you must learn about hardware, software, servers, workstations, printers, various utilities, and much more. You may find that your responsibilities are growing every day. Your tasks generally fall into one of the following categories: ■

Designing and setting up the network

■

Managing the network

■

Protecting the network

■

Documenting the network

In addition to performing these tasks, you will also have to develop your interpersonal skills. As a network administrator, you will most likely respond to the various problems users experience on the network. The last thing users want, after they have been unable to connect to the printer again for the third time, is an insulting administrator with a bad attitude. If you maintain a positive attitude and a courteous manner, users will be fascinated by your knowledge, and you will gain great personal satisfaction from being helpful and courteous to them. Many years ago, I worked with an administrator who had outstanding interpersonal skills. He was not only a great database and network administrator but also a mentor who inspired everyone who worked around him. The interpersonal

74_sysad_02.qx 11/8/99 9:47 AM Page 45

Overview of Windows 2000 Administration • Chapter 2

skills you develop will create trust and respect among your peers, and they will also be critical when you must deal with irate, frustrated, and confused users. You should be prepared both to handle various technical problems and to be in control of the unique interaction you will have with others.

Designing and Setting Up the Network This encompasses many tasks, some of which can range from evaluating users’ needs and designing a directory structure to configuring routers. At a minimum, you may be concerned with setting up servers, workstations, and associated networking hardware. In addition, you must ensure that users have access to directories for storing their data. Finally, you must ensure that each user’s workstation can connect to the network. Your server is definitely one of the most important pieces of equipment on your network, and in many cases you may be required to install a server. It is therefore important that you understand the various features common on most servers: ■

Support for large amounts of memory. Servers must be able to accommodate the need for more RAM. Some servers even support RAM into the gigabytes!

■

Support for multiple processors. Through SMP (symmetric multiprocessing), Windows 2000 Server is able to utilize more than one processor, thus increasing server performance.

■

RAID support. Windows 2000 Server supports RAID (Redundant Arrays of Inexpensive Disks) technology. It is designed to store large amounts of information, as well as providing increased performance and fault tolerance. Fault tolerance can be increased by the use of uninterruptible power supplies and error-correcting memory.

You may also be required to install and configure applications on the server as well as on users’ workstations, and in rare instances you may also be required to configure the network. Although you

45

74_sysad_02.qx 11/8/99 9:47 AM Page 46

46


may be solely responsible for the installation of a small network, larger networks usually require the support of additional personnel. If additional people install or make changes to your network, it is important that you pay attention to everything they do. After all, it is your network, and as it changes, you must be able to reconfigure it, or at least to know how to hire someone to make modifications.

Managing the Network It is the network administrator’s responsibility to manage the network on a daily basis. A server, for example, can quickly outgrow itself. It is important that you constantly manage the various resources by monitoring such areas as disk storage and memory. Before requesting more resources, be sure that you have properly managed your existing resources. The only way to do this is through proper monitoring. In addition, you may be required to manage domains, organizational units, groups, user accounts, printers, data storage, and policies. You must also be prepared to manage file resources by assigning appropriate permissions and creating shared folders. Finally, you will need to manage data in various ways, including compression, encryption, and disk quotas. These are only the basics of managing the network. As you become more involved as an administrator, and as your network grows, you will be required to perform more advanced functions. Overall, as an administrator, you have the goal of ensuring that the network runs smoothly.

Protecting the Network The quickest way to lose your job as a network administrator is to fail to protect the data on your network properly. This is a big responsibility, and it requires that you follow various procedures, many of which are discussed here. Your data is susceptible to all sorts of disasters. Some possible problems can arise when uneducated users unknowingly delete files or compromise security by creating passwords that are easy to guess. Hackers and crackers are

74_sysad_02.qx 11/8/99 9:47 AM Page 47


another threat—for example, users who decide to use the company’s network to practice and improve their skills, or malicious crackers, either internal or external, who decide they want to destroy or steal information. Viruses are another common threat that can easily be introduced into the network. Viruses are commonly introduced through e-mail with program attachments, or disks that users share between home and work. Finally, natural disasters can quickly destroy an entire infrastructure. Hurricanes, tornadoes, fires, and floods can devastate your organization’s information systems with little or no advance warning. To protect your network, be prepared to train your users as well as management about the importance of security. Users often feel inconvenienced by security procedures, and often do not see their importance. Instead, they see an overreacting administrator. How many times have you seen users become frustrated because they must change their password every 90 days, and then become even more frustrated when they discover they cannot use the same password they used 180 days ago? Training your users, and taking the time to explain to them the importance of security, are the first steps in decreasing users’ frustration, as well as in getting them actively involved in helping to maintain a secure network. In addition to training your users, you can take various other steps to protect your data. Your first and most important line of defense is to have proper backups! It is imperative that as a network administrator, you back up your data at least on a daily basis. Unfortunately no one will appreciate your efforts in properly backing up data until disaster strikes. However, when the CEO deletes a critical file, or when your hard disk crashes, and you are able to successfully recover the data, you will be the hero! Finally, be sure to utilize the tools provided with Windows. Audit resources when necessary, and view the security log in the Event Viewer. By auditing, you can use Windows 2000 to record various types of security events. Successful and unsuccessful attempts to perform a certain action can be audited. For example, auditing can be used to track the users who log on the system, or it can record a user’s attempts to read a certain file.

47

74_sysad_02.qx 11/8/99 9:47 AM Page 48

48


You can take various other steps to protect your data, such as restricting user access, having virus software with updated signature files, and keeping abreast of the latest news, events, and patches available for your software. In addition, be sure that you have uninterruptible power supplies (UPS) to provide your servers with a backup power source so you have time to safely shut your equipment down in case of a power failure. Although there is little you can do to prevent a hurricane from destroying your building, you can take measures to absorb the devastating effects, such as maintaining a set of backups offsite, as well as having a contingency plan in case disaster does strike. For instance, you may have a physical location somewhere else where you can quickly relocate your operations temporarily.

For Managers Only

Understand the Risks of Not Supporting Security

It is pertinent, even vital, that upper management and the network administrator both understand the importance of security on the computer network. A security policy should be devised. It is your job to help create the policy and, most important, to enforce it. Users are often inconvenienced by measures taken by the administrator to improve security; therefore, you must take an active role in enforcing security policies yourself as well as backing up (pun not intended) the network administrator.

Documenting the Network Proper documentation is important and can prove critical at times. Although you may be the only person in your organization that manages your network, your documentation must be available on hard copy. Many administrators document the network only in their own heads, and this practice almost guarantees problems later. You should document information about the directory tree, including its design and content, the rights of users to use the various resources, and

74_sysad_02.qx 11/8/99 9:47 AM Page 49


security decisions. Proper documentation about past problems and the solutions will prove handy later on, as will a thorough documentation of all computer equipment, including such items as serial numbers, model numbers, locations, and hardware and software configurations. Perhaps you have found yourself in the following situation (I know I have): A problem develops on your network, and you spend a great amount of time troubleshooting and fixing the problem. Unfortunately, you do not document the situation, because you are too lazy or because you figure that this scenario is not likely to happen again. However, later you or a colleague run into the same situation, and although you remember having had this problem, you do not remember the solution. A good practice is to keep a manual log of problems or to utilize problem-tracking software such as Bridge 99 from Kemma Software, which allows you to easily track problems and maintain a knowledge base (see Figure 2.1).

Figure 2.1

Software can be used to track problems and solutions.

49

74_sysad_02.qx 11/8/99 9:47 AM Page 50

50


Proper and thorough documentation about your network will eventually be needed; if not by you, definitely by new employees during or after your tenure. This information will serve as an effective training aid and resource for these new employees, and it can ease the burden of turning over the network to your successor. The popular Visio Professional program, which is designed to document information systems, can be used to help you document your network. Figure 2.2 illustrates the use of this software to document a server room. This is just one example of the many areas of your network that need to be documented.

Figure 2.2

Software can be used to document your network.

As a network administrator, you will be called upon to perform many tasks. If you have a solid understanding of the various responsibilities and tasks of a network administrator, you will better understand the network itself, and you will thus be able to provide

74_sysad_02.qx 11/8/99 9:47 AM Page 51


the users with a network that operates smoothly, giving them what they want without sacrificing the security of the network. In addition, you will be better prepared when the time comes for the network to grow and increase its capacity.

Microsoft Management Console Microsoft Windows 2000 Server comes with a set of powerful and flexible administrative tools to help manage the network. An administrator now has the ability to use the standard tools that come with Windows 2000, or a custom administrative console can be created by the use of snap-in components with the Microsoft Management Console. The MMC is a core part of Windows 2000, as well as of the future of Microsoft’s management strategy. This console provides a way for administrators to perform most of their tasks while using a similar interface. The Microsoft Management Console is simply the framework for the many administrative tools within Windows 2000 (see Figure 2.3). The MMC by itself does nothing except provide an extensible, common framework; however, with the use of snap-in management applications, it becomes a highly customizable tool for a single point of administration. A powerful feature of the MMC is that it enables administrators to create custom tools to delegate specific administrative tasks to users or even groups. To do this, simply snap in the

Figure 2.3

A blank Management Console provides the framework for snap-ins.

51

74_sysad_02.qx 11/8/99 9:47 AM Page 52

52


desired tools, and then the console can be saved as a Management Saved Console (MSC) file named My Administrative Tools, or whatever name you desire, of course. Figure 2.4 shows the Add Snap-in box, where you can choose the various components that you wish to add to your management console. Figure 2.5 shows an example of what the console would look like if you added the Computer Management snap-in. In this example, there is an expanded Device Manger, which was not available in Windows NT 4.0.

Figure 2.4

Snap-ins can be added to the Microsoft Management Console.

Although many snap-ins can be used with the MMC, and there are many more to come, the Active Directory snap-ins that you will commonly use are: ■

Active Directory Users and Computers administer and publish information in the directory.

■

Active Directory Domains and Trusts administer domain trusts and user principal name suffixes, and change the domain mode.

74_sysad_02.qx 11/8/99 9:47 AM Page 53

Overview of Windows 2000 Administration • Chapter 2 ■

Active Directory Sites and Services administer the replication of Active Directory data, including information about domain controllers, sites, replication between sites, and replication of network services’ configuration.

■

Active Directory Schema modify and administer the Active Directory schema. (If it is not available, it can be located in the resource kit found on the CD.)

The Microsoft Management Console also allows for more advanced customization. You can combine as many different snap-ins as required and create customized interfaces tailored to the tasks you perform most often. You also have the ability to hide toolbars as well as to lock the console, so that you can provide an administrative tool so a user or group can perform a specific task, while you prevent the user from having access to anything else. Figure 2.6 shows how the view menu can be used to hide the toolbars from a user. In addition, Figure 2.7 demonstrates how you can open a new window to create a new MMC with only a specific function available.

Figure 2.5

This is an example of the MMC with the Computer Management snap-in.

53

74_sysad_02.qx 11/8/99 9:47 AM Page 54

54


Figure 2.6

Toolbars can be hidden to create limited use consoles.

Figure 2.7

Right-click to create a new console with only a specific function available.

74_sysad_02.qx 11/8/99 9:47 AM Page 55


By selecting Options from the Console menu, and choosing the Console tab, you can change the Console Mode by selecting User Mode-Delegated Access, Single Window from the drop-down list (see Figure 2.8). If you make this selection, a user will be unable to change the console in any way. From the same tab, you can also give the new console a different name and associate it with an icon before distributing the customized console to others. Distributing customized consoles to other administrators is simple because they can be transported. For example, they can be posted to a shared location on the network or e-mailed.

Figure 2.8

Control how delegated Management Consoles behave.

The Microsoft Management Console can function as a powerful and flexible central-point administrative tool. The MMC has the ability to create unique consoles for other administrators or workgroup managers. Its various possibile applications provide the interface that allows you to administer Windows 2000 and the Active

55

74_sysad_02.qx 11/8/99 9:47 AM Page 56

56


Directory. The MMC has brought together many of the Windows 2000 Server administrative functions, and you will be using this tool often as you progress through the rest of this book.

Introduction to Active Directory The Active Directory is one of the most important new features of Windows 2000 Server. In order to use Windows 2000 effectively and to appreciate its value, you will need to gain a firm grasp of Active Directory. It is a central component of the operating system, and as an administrator of Windows 2000 Server, you will be interacting with it quite often. Active Directory is a scalable directory service that stores information about networking components, and makes this information easy for administrators and users to find and utilize. A directory is a listing of objects that uses a hierarchical structure to store information about objects such as users, groups, computers, and applications. This structure is often referred to as a tree, as it starts with a root and develops from there. Active Directory acts as the central authority for security, and it brings together various systems as well as management tasks.

Key Concepts Before going any further into the many ways Active Directory is beneficial to the administrator, we will examine the following concepts that make up Active Directory and Windows 2000 administration: ■

Directory service

■

Domains

■

Namespace

■

Global Catalog

■

Organizational units

■

Groups

■

Name

74_sysad_02.qx 11/8/99 9:47 AM Page 57


Directory Service A directory service stores information about the various networking objects such as files, printers, and users. It also records different types of information for each object. A directory service provides a consistent way to name, locate, access, and secure information about the various networking objects. Active Directory is the name given to Microsoft’s implementation of a directory service in Windows 2000, and it plays a vital role in an organization’s network. A directory service provides the fundamental functions of the network operating system, and can be thought of as the main switchboard for the system. As an administrator of Windows 2000 Server, you need to understand how a directory service works, because it is such a big part of your daily tasks. The directory service defines and maintains the structure of your network, increases scalability, and allows you to perform system administration tasks with ease.

Domains If you have worked with past versions of Windows NT, you need to forget about the domains that you have come to know. The meaning of the term domain in Windows 2000 differs from its meaning in earlier versions of the operating system. In Windows NT 4.0, domains and trusts were an integral part of administration, and for the most part they made up the network. In Windows 2000, however, domains are only part of the larger picture. Active Directory replaces the earlier Windows domain structures; the term domain is still used, but it refers to only a portion of the network’s namespace. Domains, which are now a part of Active Directory, define security boundaries of which all items within the domain are part. Active Directory may contain many domains, or it can simply be made up of only one domain, which will also simplify administration. Again, each domain defines security boundaries; therefore, each domain can have its own policies, as well as its own security relationships with other domains. Although having only one domain will greatly simplify

57

74_sysad_02.qx 11/8/99 9:47 AM Page 58

58


administrative overhead, multiple domains do provide many benefits. By utilizing multiple domains within the directory, you are able to reflect your organization’s structure on the network. In addition, multiple domains do not pass security polices and settings, such as rights and access control lists, to each other. Finally, multiple domains allow for easy delegation of administrative responsibility.

Domain Trees The first domain in a tree is referred to as the root of the tree; additional domains in the same tree are called child domains. A child domain can also be a parent domain. Figure 2.9 illustrates this parental naming convention.

Figure 2.9

This shows the hierarchical structure of domains in a parent/child relationship.

Microsoft

Child of Microsoft

Support

Parent of Support and MSDN

MSDN

Child of Microsoft and Parent of Design

Child of MSDN and grandchild of Microsoft

Design Not only are the concepts of domains different with Windows 2000, but trusts have changed also. You can forget everything you learned about trusts in pre–Windows 2000 environments. There are no more one-way trusts in the native mode of Windows 2000. Domains within a tree are joined automatically with a bi-directional,

74_sysad_02.qx 11/8/99 9:47 AM Page 59


transitive trust. Because trusts are now transitive, this means that if Domain A trusts Domain B, and Domain B trusts Domain C, then there is automatically an implicit trust between Domain A and Domain C. Figure 2.10 demonstrates this bi-directional, transitive trust. Each domain you add will automatically have a trust established with all other domains in the tree. Therefore, with the proper credentials, users can log on and be granted access to the entire network.

Figure 2.10

Domain A

Trusts are transitive and bi-directional in Windows 2000.

Explicit trust

Domain B

Explicit trust Implicit trust

Domain C

Forests Continuing with the nature metaphor, when one or more trees exist, you have what is called a forest, which consists of trees that do not share a common root, and are referred to as being disjointed. They

59

74_sysad_02.qx 11/8/99 9:47 AM Page 60

60


do however, share the same Active Directory information, are organized as peers, and are connected by two-way, transitive trust relationships between the root domains of each tree. For example, if Microsoft and America Online (AOL) were to merge; rather than combining the two existing yet completely separate trees into one, and creating the domain name aol.microsoft.com, you could simply bring the two together as a forest and still retain the separate domain names, as shown in Figure 2.11.

Figure 2.11

A company merger creates a forest with two trees. Trust

microsoft.com

support.microsoft.com

msdn.microsoft.com

aol.com

webs.aol.com

ads.webs.aol.com

Namespace A namespace is basically a directory. An example of a common namespace is a telephone book, which provides a namespace for resolving names to telephone numbers. In the Windows 2000 environment, Microsoft uses the term namespace to refer to any collection of domains with a common DNS root name. A common example of this namespace is the Internet. DNS is the common namespace used on the Internet to resolve fully qualified domain names to IP addresses. Without this feature, a long numerical IP address would have to be remembered, rather than simply microsoft.com, for

74_sysad_02.qx 11/8/99 9:47 AM Page 61


example. Again, use the telephone book as an example: would you rather use the phone book to resolve company names to telephone numbers, or remember all the numbers? Active Directory itself is a namespace that resolves the names of the objects in the network to the actual objects themselves. Within Active Directory, namespaces can be contiguous or disjointed. All domains within a single domain tree share a hierarchical naming structure and thus share a contiguous namespace. An example of domains sharing a common root would be microsoft.com and support.microsoft.com. Domains that are interrelated with each other, but do not share a common root, are said to be disjointed namespaces.

Global Catalog Active Directory introduces a service called a Global Catalog, which contains the names of the objects from the directory server, as well as many of the properties associated with each object. This catalog can be used as an address book to locate information within the tree or across forests, so long as the user conducting the search has the proper access rights. The Global Catalog is a great source for finding resources located on the network. It provides much more functionality than was provided in earlier versions that relied upon the Find Computer application and Network Neighborhood. By simply using the Find command located in the Start menu, you can easily locate resources. Figure 2.12 illustrates an example of a search of the entire directory for a color printer that has a resolution of at least 600 dpi.

61

74_sysad_02.qx 11/8/99 9:47 AM Page 62

62


Figure 2.12

Use the Global Catalog to find resources in the organization.

Organizational Units Organizational units are simply containers. They can be thought of as folders that hold objects such as users, groups, and printers. Organizational units are often used to organize objects to reflect an organization’s logical structure. For example, an organizational unit may exist to be the container for each department within a company, such as marketing, sales, production, and so on. Organizational units improve administration within Windows 2000 because administration can easily be delegated. An administrator can be delegated administrative control of a specific organizational unit, and would not need to have authority over any other unit within the domain.

Groups Although Active Directory groups are similar to groups in earlier versions of Windows, there are several new features. Groups are computer objects that can contain users, contacts, computers, and other groups. Note that groups can now be nested within each

74_sysad_02.qx 11/8/99 9:47 AM Page 63


other. Within Active Directory, groups are used to manage user and computer access to resources. Groups can also be used to filter group policy and to create e-mail distribution lists. It may appear that groups and organizational units are similar, but keep in mind that the two differ because of the way they are applied to domain boundaries. Groups of various types can contain objects from a local server, a single domain, a domain tree, or a forest, but the collection of objects within an organizational unit applies only to a single domain, and cannot contain objects from other domains. In Windows 2000, groups are used primarily to maintain backward-compatibility. Fortunately, the use of groups allows rights to be spread across organizations, but for the most part everything should be related to an object’s location in the directory tree. Organizational units in the future may become the basis for allocating rights to resources, as Microsoft eliminates the group concept. Windows 2000 Server has three types of user groups: ■

Universal Groups can contain users and other groups from anywhere in the forest.

■

Global Groups can contain users and groups from the same domain.

■

Domain Local Groups can contain users and groups from other domains, but they can utilize the access control lists only within the same domain.

Because Universal Groups can contain users and other groups from anywhere in the forest, these are the most commonly used groups. Universal Groups are replicated outside the domain and appear in the global catalog. Although Global Groups are listed within the Global Catalog, their membership list does not leave the domain. Domain Local Groups cannot be replicated outside of the domain and are not listed in the Global Catalog.

63

74_sysad_02.qx 11/8/99 9:47 AM Page 64

64


Name When Active Directory is used, a name is used to identify each object. There are two different types of names: ■

Distinguished names (DN)

■

Relative distinguished names (RDN)

The distinguished name identifies the complete and unique path of an object in the hierarchy. Figure 2.13 illustrates this typical distinguished name: O=Internet, DC=COM, DC=Microsoft, CN=Users, CN=William Gates The O stands for organization; DC stands for domain-component, which identifies a DNS domain; and CN stands for container.

Figure 2.13

A distinguished name can be represented in the tree hierarchy. Internet

gov

org

net

com

Cisco

Microsoft

Support

Users

William Gates O=Internet, DC=COM, DC=Microsoft, CN=Users, CN=William Gates

74_sysad_02.qx 11/8/99 9:47 AM Page 65


As you have probably noticed, a distinguished name can become quite long. In order to simplify this, a relative distinguished name (RDN) can be used. In the example in Figure 2.13, the user’s RDN is simply CN=User Name; whereas the RDN of the user name’s parent is CN=Users. For this to be a valid identifier however, the context must already be known. Those who have experience with Novell’s Directory Service will find this quite similar; for example, a user can log in as User Name, so long as the user is in the correct context or proper hierarchy. While there are obvious benefits to such a structure, it often presents the user with problems. I have witnessed many times on older Novell networks occasions when users would become frustrated trying to log in to the network from a computer other than their own. Because they were trying to log in to a computer with the default context set to something other than theirs, they were unable to access the network, unless of course they changed context. Unfortunately, most users were not aware of their proper context; rather, they became accustomed to putting a log-on name into a screen where the context was automatically set to a specified default. To simplify all this for users, Microsoft has created a user principal name, which provides an e-mail address as the logon, such as [email protected]. In fact, as soon as the user enters the @ symbol, the domain drop-down list will gray out, indicating that the user principal name has provided enough information. Such a name also saves users from having to remember their context; in addition, an administrator can feasibly change a user’s context while the principal name can stay the same.

Features and Benefits of Active Directory Active Directory is an enterprise-ready directory service based upon Internet standards such as the TCP/IP transport protocol, the Kerberos and X.509 security models, DNS, and the Lightweight Directory Access Protocol version 2 and version 3 (LDAP). It is very much the central point in Windows 2000 that brings systems

65

74_sysad_02.qx 11/8/99 9:47 AM Page 66

66


together and consolidates administrative functions. In Windows 2000, Active Directory stores data within the directory and makes this data available to both administrators and users. One of the most complex yet much improved changes is in the domain structure that Active Directory brings to a Windows 2000 environment. Besides improving greatly the domain structure of Windows NT 4.0, Active Directory provides many added benefits and features: ■

Simplified management

■

Added security

■

Scalability

■

Replication of information

■

Extended interoperability

■

Integration with DNS

Simplified Management Active Directory simplifies the administrative responsibilities of those managing the network, while reducing the total cost of ownership. Groups, users, and other resources can now be managed from a central point. The hierarchical structure of Active Directory allows for this single point of administration. This eases administration by also allowing the administrators to manage containers or groups instead of managing individual objects. Administrators often spend much of their time making trips to users’ desktops to install and configure software, but Active Directory simplifies this task by providing a method for automatically distributing software. Users in the past could have roaming profiles; their desktop preferences would follow them even if they logged on a computer other than their own. With the addition of Active Directory and tools such as IntelliMirror, users can have their assigned applications automatically installed, no matter where they actually log on. Active Directory also allows for the delegation of management. Through administrative delegation, an organization will be better

74_sysad_02.qx 11/8/99 9:47 AM Page 67


able to maximize its resources. Not only can sections of the network be delegated for administration, but also certain tasks can be delegated. For example, suppose you have several departments grouped in separate containers, and you wish to allow an individual in each department to perform simple administrative tasks such as resetting user passwords. It is possible to give administrative rights to only reset passwords or to perform other similar simple tasks to someone in marketing, finance, human resources, and so on. This allows network administrators to maximize their existing resources and gives them more time to concentrate on complex tasks. Another benefit of Active Directory that greatly simplifies management, as well as making the network easier to use, is Windows 2000’s extensive query capabilities, using the Global Catalog. Users and administrators can simply query the directory to find resources quickly. In the example of a user’s conducting a search for a printer within the tree, because the directory stores attributes about the various objects, the user would be able to query the capabilities of various devices. In the case of the printer example, the user could query precise locations as well as various attributes such as color and stapling capabilities, paper size, resolution, and speed. Active Directory not only simplifies management but also reduces time-consuming tasks, while maximizing available resources. Administrators will find that various management tasks have been simplified; in addition, upper management will appreciate the reduced total cost of ownership resulting from this benefit of Active Directory. On the other hand, no matter how much a system improves and simplifies administrative functions, it is not worth the time saved if security suffers. Fortunately, another benefit of Active Directory is improved security.

Added Security The security of a network is essential to an organization, and Active Directory provides a security model that increases the security protection of networks. Access control is associated with each container and object, as well as with the object’s attributes. Active Directory

67

74_sysad_02.qx 11/8/99 9:47 AM Page 68

68


serves as a central authority for authenticating users and for providing access to resources. Security concerns have recently gained more interest not only among IT personnel, but also among the public. Organizations that conduct business over the Internet will very much appreciate the improved advanced security controls. Windows 2000 Server supports many additional security benefits. In addition to simplifying administration, Delegated Administration also provides added security. Because you can delegate administrative roles on the basis of specific objects or subtrees, you can minimize the amount of people who have complete administrative control over the entire network. Active Directory supports various authentication mechanisms for gaining access to Windows 2000 and its resources, including smart cards and Kerberos, which is an authentication protocol based on Internet standards. Kerberos is provided in Windows 2000 as the native authentication method. It uses a ticketing system; the user is issued a ticket upon authentication, and uses this ticket to get access to various resources, just as you purchase a ticket at an amusement park and then have unlimited access to the rides. The Kerberos protocol provides added security because it not only validates the user to the resources, but it also validates the resources to the client. Every domain controller functions as a Key Distribution Center (KDC), which issues the tickets to users. Upon authenticating to a KDC, a user will be issued a Ticket-Granting Ticket (TGT). This can be compared to gaining general admission to an amusement park. Next, the user presents the TGT to the domain controller when he or she needs access to a network resource. Then the user is issued a Service Ticket (ST) that can be used to gain access to the resource. For subsequent uses, the user simply presents the Service Ticket received earlier. This is analogous to receiving, after admission to the amusement park, a ride bracelet that is used to gain access all the rides, without the need to go back and buy more tickets. Figure 2.14 illustrates this simple process.

74_sysad_02.qx 11/8/99 9:47 AM Page 69


Figure 2.14

Kerberos protocol is used for user authentication and access. User authenicates KDC issues TGT

3. 1. 6.

User

2. KDC

4.

User wants to print. Presents TGT to KDC

5.

KDC provides service ST

User provides ST to resource. Gains access For subsequent uses,user presents ticket Resouce

Support for smart cards in Windows 2000 is important because of the increasing need for this method of authentication. A smart card is a small electronic device approximately the same size as a credit card, and it contains memory and in some cases a microprocessor. In addition to being used to store digital cash or medical records, for example, smart cards are being increasingly used for authentication on networks. Smart cards are much more secure than passwords. Smart cards have a personal identification number (PIN) attached to them; therefore, a user must have both the physical card and knowledge of the PIN. The smart card can then authenticate the user to the system using the Kerberos protocol. Active Directory also ensures desktop functionality by improving the methods by which users’ workstations are locked down. On the basis of their needs, users are provided with extensive capabilities for adjusting the configurations of their desktops. In addition,

69

74_sysad_02.qx 11/8/99 9:47 AM Page 70

70


Security Templates are provided that allow an administrator to modify security settings within a single management console that once required various tools. Security Templates is an MMC snap-in, and is similar to the Group Policy tool in Windows NT 4.0. Included with Windows 2000 Server are predefined templates that you can use straight out of the box or customize to meet your organization’s needs. These templates are stored in the \systemroot\security\templates\ directory, and have an .inf extension. By using the Security Templates snap-in, you can easily modify these templates.

Scalability Active Directory is actually based on Microsoft Exchange 4.0. Exchange’s directory structure and storage engine allow for massive scalability within Windows 2000 Server. Objects within the directory do not necessarily need to have a value for each property, but Active Directory allows for the support of many different properties. Active Directory will perform well on a single computer with only a few hundred objects as well as on a large enterprise environment with millions of objects. Active Directory is capable of scaling more than one million users in a single domain, and can scale even larger in a forest. For each domain, Active Directory creates a copy of the directory store that holds the objects that belong to that domain only. When multiple domains are created, they are built in to the tree structure. Therefore, each domain within the tree will have its own copy of the directory store that contains only that domain’s objects, and it will have the ability to locate all other copies within the tree.

Replication of Information A replication component is included within Active Directory. The replication process ensures that information and the various services are always available. Active Directory uses multimaster replication, which can send updates to any Active Directory server, thus increasing performance and availability. Changes made are

74_sysad_02.qx 11/8/99 9:47 AM Page 71


automatically replicated throughout the network; whereas singlemaster replication makes all changes to a single and authoritative directory replica. Because updates can occur on any Active Directory server, each server requests only the necessary information it needs by keeping track of what it has already received. Active Directory servers also can resolve collisions that are created if updates to the database are made simultaneously. Multimaster replication is obviously a great benefit, as well as a big improvement over the single-master replication in which a single server failure could cease to provide updates to the NT domain database.

Extended Interoperability Active Directory ensures interoperability with many other applications and devices. Most organizations use various technologies that must operate as a cohesive unit in order for the organization to successfully perform its mission. While interoperability has always been important, Active Directory improves upon it for Windows 2000. Most organizations will quickly notice how Active Directory has been incorporated into Microsoft Exchange. The Microsoft Active Directory Connector is used to synchronize exchange information with Windows 2000, thus allowing for the integrated management of Windows user accounts and mailboxes. In addition, a set of standard interfaces allows developers to adjust the behavior of applications, depending on which user is using the product. Also included is native support for various protocols and interfaces, which allows vendors to easily integrate their products. Native support is provided for such things as Lightweight Directory Access Protocol (LDAP), which defines how clients and servers exchange information about a directory, as well as Active Directory Services Interface (ADSI), which allows applications to easily interact with the directory service.

71

74_sysad_02.qx 11/8/99 9:47 AM Page 72

72


Integration with DNS Windows 2000 is very much integrated with DNS (Domain Name System), and Active Directory relies heavily upon DNS to find objects within the directory. DNS is widely known for providing name resolution between Internet names and IP addresses. Because Active Directory relies on DNS to find objects, both Windows 2000 domains and Internet domains are completely compatible with each other. Windows 2000 makes use of Dynamic DNS, which can automatically register necessary changes, whereas static DNS servers must be manually administrated. While static DNS will work, Dynamic DNS should be used to maximize the benefits of Active Directory. If Dynamic DNS is used, zone transfers are not necessary. Instead, data is replicated to each DNS server when Active Directory’s replication is used. Redundancy and fault tolerance can also be provided when other domain controllers are configured as DNS servers and make changes to the DNS information.

Beyond Active Directory Active Directory is one of the most important new features of Windows 2000 Server. If you are going to administer Windows 2000 effectively, you will need a solid understanding of the various components that make up Active Directory. There are, however, more administrative features that will be an important part of your administrative duties. These features deal with the file system and with storage management.

Volume Management Windows 2000 Server supports a feature called dynamic volumes. Dynamic volumes are more practical than partitions and logical drives. Volumes are not limited to only four per hard disk, as are partitions; moreover, you can configure volumes without having to reboot the system. Another benefit of dynamic volumes is that disk administration can be performed remotely over the network.

74_sysad_02.qx 11/8/99 9:47 AM Page 73


In order to perform such tasks as administrating volumes, stripe sets, and RAID, the Computer Management snap-in is used, in conjunction with the Microsoft Management Console, as is the case with most Windows 2000 administrative tasks. This snap-in allows for the complete management of disks, while providing a consistent user interface.

Disk Quotas It is now possible to provide disk quotas in Windows 2000. Those familiar with UNIX or Novell probably know this feature quite well already. Many administrators have faced the problem of users’ taking up too much disk space on the network. In fact, I have witnessed users who back up their entire systems to the network! Fortunately, Windows 2000 Server disk quotas will provide a mechanism for preventing this. Disk quotas specify the maximum amount of disk space a user can take up (see Figure 2.15). In addition, disk quotas can be placed upon groups as well as users. This feature will not only be helpful in limiting the amount of space individual users on a network consume, but it will also provide a means for Internet service providers to provide more reliable hosting. Quotas can only be set if the drive is formatted with NTFS, and they can exist only on volumes and not directories. To manage quotas, use the Windows Explorer, and select a drive and view the properties. In addition to the already familiar tabs such as Sharing and Security, you will find a Quota tab. When you establish quotas, depending upon the circumstance, you can establish thresholds or limits. When thresholds are enabled, an event will be added to the Event Log, to notify you when the quota you set has been met. The system will, however, continue to allow users to consume more drive space, and it is your responsibility to alert users when they have exceeded their limit. Limits, on the other hand, do not allow users to continue using drive space once they have met the quota. They will be unable to store more information, until other files are deleted and more room is made. Obviously, this method would require the

73

74_sysad_02.qx 11/8/99 9:47 AM Page 74

74


least administrative effort on your part; however, it is important to keep in mind that there may be circumstances in which some users cannot afford disruptions and possible loss of work when a limit is being set. Chapter 8, “Managing Data Storage,” provides further information on managing disk quotas.

Figure 2.15

Quotas can be set to limit the amount of disk space used.

Defragmentation If you have used earlier versions of NT Server, you are probably aware that Microsoft did not provide a utility to defragment your hard drive. Fragmentation occurs naturally when files are divided into pieces scattered across the disk. Although this does not create a problem for accessing files, it does degrade performance because a search must be performed on the disk to piece together a single file.

74_sysad_02.qx 11/8/99 9:47 AM Page 75


To solve this problem, most administrators were forced to rely on third-party utilities. Windows 2000 Server’s Defragmentation utility is a welcome improvement, but it is somewhat limited. For example, it can only be used locally on one system at a time. Administrators will still have to seek out a third-party utility if more capabilities are desired. The Microsoft Management Console is used with the Disk Defragmenter snap-in, which is further discussed in Chapter 8.

Backup and Recovery Microsoft’s included backup utility is a great improvement upon the one provided with earlier versions of its operating system. Before you rush out and purchase third-party programs to handle your backups, take a look at Microsoft’s included utility,which is capable of performing backups even for large organizations. In addition to tape drives and hard drives, data can be backed up to a variety of magnetic as well as optical storage devices. Of course, it supports all the standard backup features such as the ability to perform full, differential, and incremental backups. It also includes a Disaster Recovery Preparation Wizard to back up system files and repair information that might not otherwise be backed up. In addition, when you use the Disaster Recovery Preparation Wizard in conjunction with the repair and recovery options of Windows 2000 Server setup, you can recover a computer that will not start by using the Automated System Recovery (ASR). With ASR, it is possible to save a complete state of a system, which can later be restored. To access the backup utility, select it from the Accessories group in the Start menu. The backup and recovery software is not a Microsoft Management console snap-in. The actual utility was developed by Seagate Technology, Inc., and was not coded to be a snapin module, although it may become a snap-in module in future versions. It’s still a fairly intuitive and robust utility.

75

74_sysad_02.qx 11/8/99 9:47 AM Page 76

76


Hierarchical Storage Management Seagate Technology, Inc., also provides a utility called Remote Storage Services (RSS), which allows different types of media to be a part of the same file system and makes it possible to increase disk space on a server without adding more hard disks. For example, you can configure RSS to monitor the amount of space on a hard disk and automatically move files to remote storage as needed. The directory and property information is still kept intact, and although files may have been moved to remote storage such as a tape, it can easily be retrieved when requested (naturally there may be some delay). In addition to providing an expandable file system, this can also reduce the cost of storage, since other forms of media are often less expensive than hard disks. Like other utilities, Remote Storage Services can be accessed in several ways. It uses an intuitive interface via the Microsoft Management Console, and can be accessed when you view the properties of a file or directory.

File Service Management With Windows 2000 Server, the creation of shares as well as the management of connections on local and remote computers can easily be administered. Replacing the Server Manager from Windows NT 4.0 is a new file service management snap-in called Shared Folders, which also uses the Microsoft Management Console. Not only does it perform all the share functions of the earlier Server Manager, but it also contains some new features that allow you to modify permissions, view connections on shares, and view the use of files. This tool also provides added functionality when it is used in conjunction with the Distributed File System (DFS), which allows shares to be maintained redundantly between multiple servers.

74_sysad_02.qx 11/8/99 9:47 AM Page 77


Distributed File System The Distributed File System (Dfs) allows administrators to keep network users connected to data. Using Dfs, an administrator can create logical views of directories and files that make it easy for users to connect to the information they need, no matter where the files are physically located on the network. In addition to providing this capability, Dfs also provides fault tolerance of the network storage resources. If your network consists of only a few shares, the benefits of Dfs will not be realized. However, in larger environments, Dfs simplifies the management of shares, as well as making it easy for users because they can now access files anywhere on the Dfs directory tree automatically and transparently. In order to gain a better understanding of Dfs, consider how users utilized file-sharing in earlier versions of Windows. The most common method of connecting to shared directories was to use Network Neighborhood, or to create individual drive mapping, utilizing the uniform naming convention (UNC) to a computer and its share. While these methods work, Dfs provides much more flexibility. For example, a user can connect to a single share, and from there connect to all the resources that the administrator has made accessible through Dfs. Figure 2.16 shows a sample Dfs tree. The Dfs paths to each volume are shown in bold, while the actual network paths, which can be located on different servers, are shown in italics. Upon setting up a Dfs volume, a Dfs root must be created to serve as the share point on the network. Subdirectories beneath the root are not actually true subdirectories but rather placeholders. Therefore, once a user connects to a subdirectory beneath the Dfs root, the user’s computer will connect to the actual share, which might actually reside in another physical location. All this is done transparently to the user.

77

74_sysad_02.qx 11/8/99 9:47 AM Page 78

78


Figure 2.16

This is a sample Dfs tree structure. \\HR\dfs \\HR\dfs

\\HR\dfs\benefits

\\benefits\information \\HR\dfs\insurance

\\insurance\public \\HR\dfs\health

\\HR\health\public \\HR\dfs\reports

\\finance\public\reports

Bold: Dfs Path Italics: Shared Directory

\\HR\dfs\pressrelease

\\news\public\release

When Dfs is integrated with Active Directory, administrators can achieve the additional benefits of fault tolerance and load balancing. When Dfs is used with Active Directory, the Dfs root can be shared across multiple servers that can host and provide fault tolerance for the given Dfs root. Furthermore, this distributes the load placed upon Dfs because it is shared across many servers. Dfs can be implemented across NTFS and FAT volumes. The Distributed File System Manager is available as a snap-in to the Microsoft Management Console. When the Dfs Manger is initialized the first time, a Dfs root needs to be created. Microsoft provides a New Dfs Root Wizard that will walk you through the steps to

74_sysad_02.qx 11/8/99 9:47 AM Page 79


either create a fault tolerant Dfs root or stand-alone root. The Distributed File System, a key feature for sharing file resources in Windows 2000 Server, is discussed in detail later, in Chapter 20.

Using Windows 2000 Help The Windows 2000 Help system has an updated user interface that utilizes HTML (HyperText Markup Language) to display information (see Figure 2.17). Windows 2000 Help is useful because it enables you to use hyperlinks to go to the Web for additional or updated information.

Figure 2.17

This is the Windows 2000 Server Help System main window.

The Help system makes it simple to find information. It utilizes an integrated table of contents, an index, search capabilities, as well a Favorites tab, which you can use to bookmark previously visited topics for easy return. Once you find a topic utilizing the Contents,

79

74_sysad_02.qx 11/8/99 9:47 AM Page 80

80


Index, or Search tab, click the Favorites tab and simply select Add. The topic you selected will be added to the Topics list, and you can now select the bookmark to display the topic. Besides providing a catalog of various help topics, the system also provides quick links to common concerns many administrators will have. Examples include a Best Practices section, a listing of New Features included in Windows 2000 Server, ways to do tasks familiar from Windows NT 4.0, checklists for various tasks (see Figure 2.18), as well as information on performing better searches and finding additional resources.

Figure 2.18

A Help system checklist can be used to add a new disk.

The Windows 2000 Help system is quite comprehensive, and it provides an abundance of useful information as well as a Web Help button, which makes it simple to find additional resources on the Web. From the Help system, you can quickly link up to Microsoft Product Support Services on the Web, and search the vast collection of articles from the Knowledge Base, Frequently Asked Questions, and troubleshooters.

74_sysad_02.qx 11/8/99 9:47 AM Page 81


Summary This chapter gives an overview of Windows 2000 administration as well as a general introduction to network administration. Those who are responsible for one or many Windows servers are more than likely already serving in some capacity as a network administrators. Network administration is a broad term covering a number of responsibilities. Generally, network administration can be broken down into the following categories: designing and setting up the network, managing the network, protecting the network, and documenting the network. Each is important to the life of a network, and can be further broken down into other categories. You may be solely responsible for all of these tasks, or you may be part of a larger team in which each individual is assigned a specific area of responsibility. Active Directory and key terms and concepts associated with it are also introduced in this chapter. Active Directory, which is the foundation of Windows 2000 distributed networks, plays a key role in the administration of Microsoft’s operating system. Active Directory is a directory service that puts your users, groups, applications, printers, and other information into one central directory. Before the features and benefits of Active Directory are discussed, key concepts are introduced that are important for dealing with Microsoft’s Active Directory. Microsoft Windows 2000 Server introduces many new terms, as well as familiar names from earlier versions of Windows that now have a different meaning. These terms and concepts include directory service, domains, namespace, Global Catalog, organizational units, groups, distinguished names, and relative distinguished names. Active Directory changes the way in which Windows 2000 is administered and provides a complete set of administrative tools that function as snap-in components to the Microsoft Management Console. Active Directory provides simplified management, added security, scalability, extended interoperability, and integration with DNS. Undoubtedly, the simplified, central-point administration provided by Active Directory is the most visible change in this version

81

74_sysad_02.qx 11/8/99 9:47 AM Page 82

82


of Windows. Besides providing the intuitive central point of administration, Active Directory simplifies management in many other ways, providing the administrator with the ability to delegate administrative tasks as well as to distribute software and provide extensive query capabilities. As security becomes a growing concern, Windows 2000 Server meets these concerns with added security features built in. Active Directory’s security model increases the overall protection of your network. Windows 2000 Server also meets the needs for scalability by designing Active Directory based on Microsoft Exchange’s architecture and using many Internet-based standards. In order to meet organizations’ need to use various technologies that must operate as a cohesive unit, Active Directory provides extended interoperability that ensures integration with other applications and devices. Finally, Active Directory integrates with DNS, making Windows 2000 domains and Internet domains completely compatible. Microsoft uses dynamic volumes to improve partitions and logical drives, and to most administrators’ delight, Windows 2000 Server now has the ability to set quotas on drive space. Quotas are set by setting thresholds or setting limits. Thresholds will send an event to the event log to alert the administrator that a quota has been exceeded; the user or group will still be able to create files, but a limit will not allow the creation of more files on the drive for which a quota has been specified. Windows 2000 also includes a backup and recovery tool that is actually a robust utility that can be used in an enterprise environment. This tool does not function as a snap-in to the MMC; nevertheless, it is still intuitive and simple to use, and improves greatly upon the backup utility provided with Windows NT 4.0. Microsoft’s Remote Storage Services allow various types of media to be used as part of the same file system. The RSS provides an expandable file system while reducing total cost of ownership. Finally, Windows 2000 Server provides improved file service management. The Windows NT 4.0 Server Manager has been replaced with a snap-in to manage the shares and connections on systems. In addition, added functionality is provided with the Distributed File System, which allows users to connect to data without having to worry about its physical location. Dfs is primarily designed for large

74_sysad_02.qx 11/8/99 9:47 AM Page 83


organizations that have large file sharing needs, or for those organizations that require fault-tolerance and load balancing for their file system. This chapter concludes with a discussion of the overhauled Windows 2000 Help system. Using an HTML interface similar to that used with Microsoft Internet Explorer 5, the Help system makes finding needed information easy. It has a table of contents and an index, as well as the capability to conduct a search. Finally, a new button provides immediate access to various resources located on the World Wide Web.

FAQs Q: Where do I begin in deciding on how to design my directory structure?

A: A good place to start is with the organizational charts for your company, department, or the groups for which you will be designing the directory.

Q: Can I still use my High Performance File System (HPFS) partitions with Windows 2000 Server?

A: No. HPFS partitions, which are used to provide compatibility with OS/2, are not supported and must be converted to NTFS before Windows 2000 Server is installed.

Q: Does Active Directory support inheritance? A: Absolutely. Inheritance is concerned with how access control information at higher levels flows down to lower-level objects. In Windows 2000 Server, any new object created will inherit the Access Control List of its container.

83

74_sysad_02.qx 11/8/99 9:47 AM Page 84

84


Q: Although Microsoft’s DNS Server provides many advantages, must I use it?

A: No. Static DNS servers work just as well, but they do not provide the advantages that Microsoft’s DNS server will provide, such as automatically creating records in the system. Although other types of DNS servers support dynamic update, not all of them do. It is best that you find out whether the version you wish to use supports RFC 2136.

Q: Is WINS gone forever with Windows 2000? A: No. Clients using Windows 2000 Professional do not need to use the familiar NETBIOS naming convention from earlier versions of NT; however, WINS is still provided for downlevel clients such as Windows NT 4.0 and Windows 98 to use the NETBIOS namespace.

Q: What options do I have for recovering my system if it fails? A: Microsoft Windows 2000 includes the Recovery Console, which can be run from Setup using the Windows CD or boot disks; in addition, you can create an entry in the boot.ini file by running WINNT32 /CMDCONS from the platform directory of your Windows 2000 CD.

Q: As I will still need to utilize WINS to support my downlevel clients, has WINS been improved for Windows 2000 Server?

A: Yes. WINS now operates as a snap-in to the Microsoft Management Console, and includes many new features. For example, replication connections can now be kept open, and clients can select from as many as 12 WINS servers; only two were allowed previously.

74_sysad_02.qx 11/8/99 9:47 AM Page 85


Q: I think I have used the Microsoft Management Console before. Is this new to Windows 2000 Server?

A: No. The Microsoft Management Console is only the framework for snap-ins, and it will run even on an NT 4 machine. In fact, it was included in the NT 4.0 Option Pack to administer the Internet Information Server.

Q: Where can I find more information about the Kerberos Protocol that Windows uses to authenticate users?

A: Kerberos was developed at MIT, and is defined in Internet Engineering Task Force (IETF) RFC 1510.

85

74_sysad_02.qx 11/8/99 9:47 AM Page 86

74_sysad_03.qx 11/8/99 9:50 AM Page 87

Chapter 3

Setting Up User Accounts User accounts are one of the fundamental building blocks in configuring a Windows 2000 server. The user account on a local server or the user object in Active Directory form the basis of the assignment of access rights to network resources. Administrators must have a thorough knowledge of how to create and manage user accounts in Active Directory before they can start building groups of users and creating shared resources.


Defining an Acceptable Use Policy

■

Introduction to User Accounts

■

Requirements for New User Accounts

■

Creating a Domain User Account

■

Setting Password Requirements

■

Setting Properties for User Accounts

■

Managing User Accounts

■

Best Practices 87

74_sysad_03.qx 11/8/99 9:50 AM Page 88

88

Chapter 3 • Setting Up User Accounts

Defining an Acceptable Use Policy Before creating a single user account, you should develop an acceptable use guide. The rules included in this guide not only should cover password guidelines and account properties, but also should include information about network services for which the account is intended. The policy should include statements about sharing accounts and passwords, about trying to gain access to servers without permission, and about trying to acquire other users’ passwords without their consent. Make the acceptable use policy part of your employee manual that everyone receives on his or her first day. It should be clear that the rules are enforced and violations will be dealt with in an appropriate manner. Be sure to involve your HR department when you develop these policies to ensure that they comply with the necessary legal requirements. The goal is to remind users of the importance of proper security and the effects of hackers who compromise mission-critical systems.

For Managers Only

Developing Secure User Accounts

Developing an effective user-management strategy is vital to establishing and maintaining a secure network environment. Most administrators fail to understand the importance of a good account policy and often implement systems with major security holes. When you develop a user account strategy, you should take into consideration: ■

Standardized naming convention

■

Unique account for each user

■

Rules governing password settings

■

Defined acceptable use policy

■

Defined audit policy and response criteria Continued

74_sysad_03.qx 11/8/99 9:50 AM Page 89

Setting Up User Accounts • Chapter 3

A standardized naming convention effectively maps user logon names to an owner. When you look through log files, audit trails, and access control lists, you should be able to easily identify to whom each account belongs. Never allow users to share accounts. Shared accounts are a security nightmare. No matter how extensive your security and monitoring policies, allowing users with shared accounts makes it impossible to track a security violation to a single user. Define a set of password rules that are effective without being a hindrance to the user. Administrators often get a little overzealous when they define password rules. If the rules are too strict, users may write down their passwords and leave them in obvious places, such as their day timers or under keyboards. Do not forgo password rules altogether; rather, define a set of rules that prohibit most common dictionary words and proper names. The best option is to require some combination of letters and numbers. Also, force users to change passwords on a regular basis. Despite warnings, many users will often share their passwords with others. The options within Windows 2000 provide little value if your organization lacks a comprehensive policy statement and/or guidelines on acceptable use of network accounts and computers. The final step is to develop an audit policy that detects security breaches and an action plan to address them. The extensive auditing capabilities of Windows 2000 include the ability to monitor network activity, file system activity, printer activity, and just about every other Active Directory object. Identify your most critical resources and monitor the activities relevant to that type of server (attempts to crack passwords, attempts to block TCP/IP ports, attempts to access files and folders for which the user does not have permissions, and so on). The audit policy should specify not only the systems that will be monitored but also responses to security violations.

89

74_sysad_03.qx 11/8/99 9:50 AM Page 90

90


Template: Acceptable Use/Security Policy This template may not cover all your needs, but it should get you started. Remember to review your policy on a regular basis to ensure that it still meets your needs.

Purpose This procedure is intended to address the requirements related to computer and communication system security. The need to exercise greater caution in protecting information from unauthorized access is heightened due to increased intra- and inter-enterprise network connectivity.

Interpretation Responsibility for interpretation of this procedure rests with the vice president, Corporate & Systems Security.

Definitions ■

Computer means any programmable electronic device that can be used to develop, store, access, or transport information or software.

■

Data Repository means any stored information database, data warehouse, or Web site.

■

External Access means the ability to access information or services from outside the network perimeter. This includes access through private or public network connections, the latter including Internet, cellular, or wireless networks, or public switched telephone service.

■

Managed Access means preauthorized access to a computer system where the user has access only to the functions and information granted.

74_sysad_03.qx 11/8/99 9:50 AM Page 91

Setting Up User Accounts • Chapter 3 ■

Masquerading occurs when a person uses another person’s identification and/or User Authentication to access corporate electronic systems, services, or facilities.

■

User Authentication means the three levels of User Authentication used: 1. Numeric Authentication is the weakest and most easily defeated authentication method, typically referred to as a Personal Authentication Code (PAC) or Personal Identification Number (PIN). The numeric string identifier is approved only for voice mail, and Human Resources (HR) self-service applications, due to telephony technology limitations. Generally, Numeric Authentication used alone should be limited to nonbusiness-critical systems. 2. Single-Factor Authentication is a medium-strength authentication method that consists of a string of characters, numbers, and/or special characters known only to the user. 3. Two-Factor Authentication is the highest level of User Authentication and calls for the provision of two authentication factors: something known (PIN, PAC, or password) and something possessed (smart card or private key certificate or a biometric identifier).

■

User ID means the identification assigned to a user, which the user is required to provide when requesting access to information systems or services.

Responsibility Each department/employee has the responsibilities as outlined below. These responsibilities are critical to ensuring the success of the corporate security policy.

91

74_sysad_03.qx 11/8/99 9:50 AM Page 92

92


Service Provider 1. It is the responsibility of all Service Providers to ensure compliance with the four principles outlined below. The Service Provider shall also be responsible for ensuring its service provides capability for appropriate User Authentication services, and that it is optimized for global, enterprise-wide deployment. In this latter regard, consideration will be given to conformance to corporate standards, operational performance, and accessibility. 2. All system hardware and software components, application program and network-based applications (for example, electronic mail) will be subject to security practices developed on the following four principles: a. The use of fail-safe defaults, ensuring that the default option of any application or system is the most secure b. The assignment of minimal privileges, as a means of limiting a user’s access to information or capabilities to what is required to perform his/her duties c. Discretionary access control, recognizing the need for multiple degrees of security measures, reflecting the value of what is being protected d. The ability to be audited, the requirement for an audit trail as a means to track security breaches or fraudulent use of facilities or services

Managers It is the responsibility of each manager to ensure that all employees and authorized contractors and affiliates are aware of and follow this procedure.

Information Services The Information Services (IS) function shall provide a mechanism for authenticated and secure access to the corporate information

74_sysad_03.qx 11/8/99 9:50 AM Page 93


systems resources. That mechanism shall include Corporate & Systems Security, which shall perform periodic reviews of information systems and data repositories in order to ensure that User Authentication services and information protection measures employed by the LOBs reflect the nature and classification of the information.

Employees All computer and communication systems support staff, all persons who have access to computer and communication systems, and the managers of such persons are to follow this procedure.

Process Computer/Communications Systems Security ■

The use of unregistered IP addresses shall be considered a violation of the acceptable use policy. All network control centers and centralized computing facilities must maintain records of all hardware equipment and configurations. This shall include the recording and tracking of all system equipment in an inventory management system. A minimum configuration required to support critical applications and/or services in the event of a disaster must also be identified.

■

Any equipment deemed to be easily removable must be protected from loss or theft. This may include attaching locking cables or pads. Control processes must be in place to track authorized removal of equipment for off-site use, with the exception of personally assigned laptops.

■

All maintenance activities and configuration changes (hardware and software) shall be scheduled and tracked. History records must be maintained for audit purposes.

■

Documented controls are to be defined and in place to protect customer, supplier, and employee data from being compromised or altered during transmission.

93

74_sysad_03.qx 11/8/99 9:50 AM Page 94

94

Chapter 3 • Setting Up User Accounts ■

Regular backups shall be carried out according to the frequency with which data changes.

■

Users shall not reconfigure networks or monitor traffic unless they are authorized to do so. In addition, users shall refrain from using communications systems to access systems for which they are not explicitly authorized.

■

All Internet Protocol (IP) addresses must be assigned for use and shall be registered in the corporate database.

Software ■

All users of licensed and proprietary software must adhere to the licensing agreement’s terms and conditions, as stated by the developing vendor.

■

Where software is made available through public bulletin board systems or networks, an employee must make every effort to ensure that a software package is indeed in the public domain before using it. Where there is any doubt, the software may not be used unless the software’s author has been contacted for written permission.

■

All software must be checked to ensure that it is free of contaminants (virus, worm, Trojan horse, and so on) before its use.

■

The use of non-approved licensed software violates corporate procedures relating to use of third-party software and is, therefore, prohibited. Violators may be subject to disciplinary action up to and including dismissal.

■

Software approved by IS shall be used on systems to detect and eradicate viruses.

Privilege Management ■

A request to change or to be assigned a new User ID requires an authorization process to be completed.

■

Where a specific User ID exists on more than one system, all appearances of that User ID shall be registered to the same individual, except for system maintenance functions.

74_sysad_03.qx 11/8/99 9:50 AM Page 95


User IDs and User Authentication are issued on an individual basis and shall not be shared.

■

Masquerading is not permitted and constitutes a security breach. Any user found masquerading must be reported.

■

All system access privileges shall be immediately revoked upon the termination of employment of any employee. The manager of the terminating employee is responsible for ensuring that these privileges are withdrawn.

■

All system and network access passwords must, at a minimum, comply with password standards.

■

Users shall refrain from attempting to access information for which they are not explicitly authorized.

■

Users shall not leave unattended a terminal that is logged on and not access-protected, or that does not include a timeout re-authentication feature.

■

All desktop and portable systems must be equipped with an approved access control product.

Security Breaches

■

Users shall promptly report any suspected security problems to management, who shall report it to Corporate & Systems Security.

■

Corporate & Systems Security shall review all such reports received. Security investigations shall be undertaken where necessary.

■

Corporate & Systems Security may, from time to time, request that any user or group of users change their access passwords if a security compromise is suspected.

Introduction to User Accounts A user account is an individual’s unique identifier on the Windows 2000 network. Windows 2000 uses the domain account to validate a

95

74_sysad_03.qx 11/8/99 9:50 AM Page 96

96


person’s identity and grant access to shared resources. Each user needs a unique ID with an associated password, which the user maintains as private information. When a Windows 95/98/NT/2000 user uses a logon ID and password, a domain controller validates the ID/password and supplies the user with an access token. When the user accesses any network resource, the access token is compared to the access control list to determine what level of access the user should have to the resource. With Windows 2000, Microsoft introduces the concept of an Active Directory, which is a repository for all user and computer account information. Creating and managing user accounts is now done through the Active Directory Users and Computers snap-in to the Microsoft Management Console (MMC). This application replaces Windows NT 4.0 User Manager for Domains. Active Directory Users and Computers also replaces the functions of Server Manager for creating computer accounts.

Requirements for New User Accounts Before user accounts are created, it is important that an effective naming scheme be developed. Each user will require a unique account name. One common account naming policy is a combination of the first and last name such as jsmith for John Smith. When a second J. Smith needs an account, you may elect to include the middle initial or the second letter from the first name such as jasmith for Jane Smith or jhsmith for John Henry Smith. When you develop a naming convention, avoid meaningless names like emp1234 or random numerical ID assignments like 101245, which make it difficult to identify to whom the ID belongs when you look through log files and permissions sets. Such IDs are also hard for the user to remember. A mnemonic of a user’s name is much easier to remember. Be careful when creating accounts not to use slang or a word that may be offensive to certain cultures.

74_sysad_03.qx 11/8/99 9:50 AM Page 97


Keep user ID length somewhere between four and ten characters. This allows enough length for uniqueness but keeps the ID short and easy to remember. In some organizations, administrators have had success in allowing users to pick their own IDs. Most provide guidance by suggesting a mnemonic of the first and last name, but in the end they leave it up to the user. This can work, although you may want to limit the user’s choices to make it easier to administer the accounts.

Default User Account Settings The next step is to decide on the default settings for each account. The settings for which you must make a decision are: ■

Initial password

■

User must change password on next logon

■

User cannot change password

■

Password never expires

■

Account disabled

Initial password The initial password is the one you will assign when you create the account. The user will use it to log on the first time. You can elect to use a standard set of passwords or to randomly assign each user a unique one.

User must change password on next logon This setting is checked by default, and it is a good idea to leave it that way. When you set the initial password, both you and the user know what it is. If users are forced to change it at next logon, they must choose a new, personal, and private password that neither you nor anyone else will know. If you uncheck this option and use a standard set of passwords, you may quickly find yourself with a community of users who all have the same password.

97

74_sysad_03.qx 11/8/99 9:50 AM Page 98

98


User cannot change password This option is off by default and should remain that way in most situations. There are times, such as with specialized administrative or application accounts, when this option will be useful, but in most situations, it can do more harm than good. Checking this option prevents users from changing their password themselves and makes them reliant on the administrator if someone else finds out their password.

Password never expires This option is also unchecked by default. This is another setting designed for specialized accounts and is not applicable to most user accounts. Forcing users to select a new password on a regular basis provides a safeguard against the sharing of passwords that is common in many environments despite the warnings and efforts of the network administrator.

Account disabled This option is also unchecked by default and for most new accounts will remain that way. This option is useful for administering user accounts for a variety of tasks. First, you can set a password policy that automatically disables an account when the user tries the wrong password too many times. Another use is for employees who are on vacation or other leave of absence. You can disable the account without deleting it to ensure that no one logs on using the ID. When the user returns, you re-enable the account, and the user has retained access to any shared resources. This method also works for transferring ownership of an account when an employee is replaced. You can disable the account when the old employee leaves and re-enable it when the new employee starts. The new employee will immediately have access to all the right data to do the same job.

74_sysad_03.qx 11/8/99 9:50 AM Page 99


NOTE The default administrator account cannot be disabled. This is why most administrators elect to change the ID to something less obvious than Administrator. Even changing the name does not completely hide it from hackers, but learning the account’s name is one more step they must take before getting into your system. The password on the Administrator account is critical to protecting the integrity of your system. Choose a password with both alphanumeric and non-alphanumeric characters to make it even more difficult to break.

Creating a Domain User Account A domain account is an account that is accessible by any domain controller, member server, or trusting domain for defining access control. Only domain user accounts can be stored in Active Directory. This is in contrast to member servers and stand-alone servers, which can have local accounts in addition to using the domain accounts.

Active Directory Users and Computers You can access the Active Directory User and Computers manager by choosing it from the Start menu. Select: Start—Programs— Administrative Tools—Active Directory Users and Computers. You can also access many of the administrative tools from the Configure Your Server Wizard, which launches when you log on the server as an administrator. To access the Active Directory Users and Computers manager, click Active Directory on the left-hand frame. Next, click the Manage User and Computer settings in the main window (see Figure 3.1).

99

74_sysad_03.qx 11/8/99 9:50 AM Page 100

100


Figure 3.1

Configure Your Server is the default interface for accessing the various administrative tools in Windows 2000.

Creating User Accounts When the Active Directory Users and Computers application is open, click the Domain name to expand it (see Figure 3.2). The Domain contains four predefined groups of objects: ■

Built-in. The built-in (default) system administration users and groups created by Windows 2000 during install

■

Computers. A list of all computers’ account objects defined by the administrator

■

Domain Controllers. The domain controllers for Active Directory

■

Users. The default location for user and groups accounts created by the administrator

74_sysad_03.qx 11/8/99 9:50 AM Page 101


Figure 3.2

This is Active Directory Users and Computers.

Each of these is referred to as an organizational unit (OU) and is a logical grouping of objects. Administrators can create additional organizational units to further subdivide and manage the users and computers on their network. Organizational units can also be used to define various security policies based on need. 1. Click Users. On the right-hand side you will see a complete list of current users and groups defined in Active Directory. To create a new user, click the New User icon on the toolbar, or right-click Users and select New—User. A window titled Create new object—(User) appears. 2. Fill in the information for the user’s first and last name. 3. Select a user logon name. The remaining fields will auto-fill with the appropriate domain information (see Figure 3.3). 4. Click Next.

101

74_sysad_03.qx 11/8/99 9:50 AM Page 102

102


Figure 3.3

Create New Object—(User) is the first step in creating a new user account.

5. The next step is to set an initial password and decide which options to set. Most administrators elect to check the User must change password at next logon option. This forces users to change the password to something only they will know (see Figure 3.4). Click Next. 6. The object wizard provides a summary of the object properties, including the account name, and options for confirmation. If everything looks as expected, click Finish. The account is created, and the Active Directory Users and Computers display is updated. At this point, users can log on Active Directory. They may not be able to access any resources, because we have not assigned the user permissions.

74_sysad_03.qx 11/8/99 9:50 AM Page 103


Figure 3.4

The second step in creating a user account is to specify an initial password and account settings.

Setting Password Requirements With Windows 2000, setting password requirements such as password length, expiration, and lockout after failed logon are known as account policies. Account policies are stored under the System Configuration and Analysis tool, which provides a centralized administrative interface to all security settings. To help with the configuration of these policies, a series of security templates are included in Windows 2000. Two Microsoft Management Console (MMC) snap-ins are provided for managing user and group security under Windows 2000: Security Templates and Security Configuration and Analysis.

Security Templates Microsoft provides several security templates as examples. Administrators can choose to use one of the provided templates directly, or they can duplicate one of these templates and use it as a building block. The templates provide examples of both secured and

103

74_sysad_03.qx 11/8/99 9:50 AM Page 104

104


unsecured domain controllers, workstations, and servers. This gives administrators the ability to define different security profiles for each server they administer.

Loading Security Snap-ins into the MMC The security snap-ins are optional components of the MMC that administrators must load into a personal MMC console. To create your own MMC security console: 1. Select Run from the Start menu. 2. Type MMC and click OK. 3. From the Console menu, select Add/Remove Snap-ins (see Figure 3.5). (Your list of available snap-ins may be different.) 4, Click Add.

Figure 3.5

The Add/Remove snap-ins window allows you to customize the MMC.

74_sysad_03.qx 11/8/99 9:50 AM Page 105


5. Add both the Security Templates and Security Configuration and Analysis Tools (see Figure 3.6). 6. Click Close. 7. Click OK to close the Add/Remove Snap-ins window.

Figure 3.6

The list of optional components for the MMC is extensive, and snap-ins can be added and removed as administrative needs dictate.

Loading the Security Templates After you have created a new template, or have selected an existing one, you must load it into the Security Configuration and Analysis Snap-in database. Creating a Security Configuration database is relatively simple once the template is defined. To create a Security Configuration database: 1. Right-click the Security Configuration and Analysis snap-in. 2. Select Open Database.

105

74_sysad_03.qx 11/8/99 9:50 AM Page 106

106


3. Give the database an easily recognized name (for example, dcsecure) and click Open. 4. Select a template to use for the Security Configuration database. 5. To activate the Security Configuration database, right-click the Security Configuration snap-in and select Configure Server Now. 6. Follow the prompts to save a log file. 7. After the configuration is complete, right-click on the Security Configuration and Analysis snap-in and select Analyze Server Now. 8. Follow the prompts to save a log file. A summary of security options will appear in the right pane.

TIP You may get a warning about potential conflicts with the default domain group policy. The default domain policy overrides the Security Configuration database. To administer the domain group policy, you must use the Group Policy snap-in, which can also be accessed via the MMC.

Changing Account (Password) Policies It is possible to make changes to the active Security Configuration database, but the recommended strategy is to make changes to the template first and then reload the template. To import/reload a template: 1. Open or create a MMC console containing the Security Configuration and Analysis snap-in. 2. Right-click the Security Configuration and Analysis node. 3. Open or create a working database. 4. Select Import Configuration.

74_sysad_03.qx 11/8/99 9:50 AM Page 107


5. Select a configuration file and click Open. 6. Repeat the previous step for each template you want to merge into the database. 7. Right-click the Security Configuration and Analysis node, and click Configure System Now. This ensures that the template and the active configuration are in synch, which minimizes confusion when future updates are made to a template and it is reloaded, thus overwriting changes that were made directly to the active database. The Account Policy section contains three subcategories: ■

Password Policy. Settings for passwords such as enforcement, and lifetimes

■

Account Lockout Policy. Settings governing when and for how long an account will be locked out of the system

■

Kerberos Policy. Kerberos is the method Windows 2000 uses to authenticate a User ID and password. The options let you control the security level of that protocol.

To modify Account Policies: 1. Open or create an MMC console with the Security Template snap-in configured. 2. Click Security Templates to expand the selection. 3. Continue the expansion until the Account Policy of the security template to be modified is expanded. 4. Click Password Policy to see a list of configuration controls on the right-hand side of the window (see Figure 3.7). 5. To modify a particular parameter, double-click it to open a new window. Make the appropriate changes and click OK. 6. Use the same process for the Lockout Policies.

107

74_sysad_03.qx 11/8/99 9:50 AM Page 108

108


Figure 3.7

Security templates offer access to the account policy setting used to control various password options.

Account Policy options include: ■

Enforce password uniqueness by remembering. This option keeps a user from cycling through two or three passwords.

■

Maximum Password Age. The amount of time before a user must change a password. After the specified number of days, the user will be forced to change the password.

■

Minimum Password Age. The amount of time that must pass before the user can change a password. Setting a minimum password age keeps a user from cycling through enough passwords to overcome the Enforce password uniqueness controls and get back to their original password within a few minutes.

74_sysad_03.qx 11/8/99 9:50 AM Page 109


Minimum Password Length. The shortest acceptable length for a password. A minimum length of six characters is recommended, although many administrators insist on a minimum of eight characters.

■

Password must meet complexity requirements. Forces the user to use a mix of upper- and lowercase letters along with a mix of alphanumeric characters. Although user IDs are not case-sensitive, passwords are.

■

User must log on to change password. This forces the user to log on the network before changing a password.

Account Lockout Policy options include: ■

Account lockout count. The number of failed logons before an account is disabled automatically. Most administrators will set this number between three and seven. This gives the user enough tries to figure out that the Caps Lock is activated, but is small enough to frustrate hackers trying to work around the system or waiting for an account lockout to expire.

■

Lockout accounts for. The amount of time an account remains locked out after the account lockout count has been reached. Generally this option is disabled to prevent the account from automatically becoming re-enabled. The biggest problem with letting accounts re-enable automatically is that the administrator is unable to track the frequency of accounts’ being disabled. Hackers could be slowly knocking at the door, trying a few passwords, letting the accounts reset, and trying again. With enough patience, a hacker could eventually get into your system.

■

Reset account lockout count after. The amount of time to wait before resetting the failed logon count. If a value is set too low, a hacker can try a few passwords and wait the allocated time for the counters to reset before trying again.

109

74_sysad_03.qx 11/8/99 9:50 AM Page 110

110


After all the Account Policies are set, you can load the security template and select Configure server now from the Action menu of the Security Configuration and Analysis snap-in.

Setting Properties for User Accounts All account property management is done from the Active Directory Users and Computers application. This is the same interface that is used to create the original account. To change the properties of an account, open the Active Directory Users and Computers application and click the domain that you want to administer. A list of current users and groups in the domain appears when the user’s or appropriate organizational unit (OU) folder is selected. To change the properties on the account, right-click on the user’s name and select Properties.

Modifying User Accounts The user property window contains these tabs (see Figure 3.8): ■

General

■

Address

■

Account

■

Profile

■

Telephones/notes

■

Organizations

■

Member Of

■

Dial-in

Some of the tabs are for tracking general information, and others affect the behavior of the account. Filling in the general user information fields is a good idea, because it lets you store information about your users in a central repository accessible by other applications.

74_sysad_03.qx 11/8/99 9:50 AM Page 111


Figure 3.8

The user property window offers several tabs for configuring user accounts.

General The General tab contains these fields (see Figure 3.9): ■

First Name. Supplied during account creation

■

Last name. Supplied during account creation

■

Display name. A combination of the first and last names

■

Description. A short entry describing the account

■

Office. Location information

■

Telephone number of the user

■

E-mail address of the user

■

Home Page. URL Web address

111

74_sysad_03.qx 11/8/99 9:50 AM Page 112

112


The General tab is for setting generic information about the user such as a description, office location, phone number, or e-mail. None of this information affects the behavior of the account.

Figure 3.9

This is the General tab of the user properties window.

Address The Address tab includes these fields (see Figure 3.10): ■

Street

■

P.O. Box

■

City

■

State/Province

■

Zip/Postal Code

■

Country/Region

74_sysad_03.qx 11/8/99 9:50 AM Page 113


The Address tab allows the administrator to track more detailed information about the user. From a system administrator’s perspective much of this information may seem extraneous, but it all becomes part of Active Directory, where it can be combined with other applications like Exchange/Outlook, LDAP servers, or HR systems.

Figure 3.10

This is the Address tab of the user properties window.

Account The Account tab contains these settings (see Figure 3.11): ■

User logon name

■

Down-level logon name

■

User must change password at next logon

■

User cannot change password

113

74_sysad_03.qx 11/8/99 9:50 AM Page 114

114

Chapter 3 • Setting Up User Accounts ■

Password never expires

■

Save password as encrypted clear text

In addition to these properties, which are available during the account creation process, the Account tab provides access to several other properties including Logon Hours, Logon To, and Account Expires.

Figure 3.11

■

The Account tab allows you to reconfigure the account behavior, along with several other options.

Logon Hours. This option lets administrators define a set of rules that govern when a user can log on. This is useful in a tightly controlled environment where administrators want to ensure that certain users log on only during specified times. It can also be used as the basis for building a backup window if no users are logged on with open files during backups.

74_sysad_03.qx 11/8/99 9:50 AM Page 115


Logon To. Allows an administrator to specify exactly which machines the user can access. This ensures that users only log on their own or another designated machine.

■

Account Expires. A useful option for use with temporary ID or personnel. An account can expire automatically so that the administrator does not have to track whether the employee is still there. If the employee or account is still required, then it can be re-enabled with a new expiration date.

Profile The Profile tab is a fundamental user property tab that contains many of the most common administrative settings. The settings in the Profile tab include: ■

Profile Path. Allows the administrator to specify a profile for the user’s account. This is similar to the Roaming profile concept that exists in Windows NT 4.0 whereby a user has a single profile for use on every machine (see Figure 3.12).

■

Logon Script. The script executed when the user logs onto the network. Commonly used to configure security settings, install applications, or control system configuration.

■

Home Directory. The home directory can be on the user’s local drive, or it can be a mapped drive to a server share. If you specify a directory that does not exist, Windows 2000 will attempt to connect to the machine and create the directory. As a shortcut, you can use the system variable %USERNAME% to reference the user’s ID.

■

Network Path. This field allows an administrator to define a network folder as a Universal Naming Convention (UNC) path that contains documents shared with other members of a group or project team. The concept is similar to a home directory for a group or project team.

115

74_sysad_03.qx 11/8/99 9:50 AM Page 116

116


Figure 3.12

The Account Profile tab of the user properties window provides settings for logon scripts, home directories, and shared documents.

Telephones/Notes The Telephones/Notes tab contains these fields (see Figure 3.13): ■

Home

■

Pager

■

Mobile

■

Fax

■

IP Phone

■

Comments

74_sysad_03.qx 11/8/99 9:50 AM Page 117


For those users with a large number of contact numbers, Microsoft has provided an Other button that takes you to a list entry dialog box where you can enter multiple numbers.

Figure 3.13

The Telephones/Notes tab of the user properties window is another general information tab.

NOTE One unfortunate thing about the user property window is the lack of coordination between the various tabs. For example, the phone number from the General tab does not carry over to this tab. Also, the E-mail entry on the General tab does not pick up the data from the Account tab. Administrators may find it frustrating to double-enter some of this data.

117

74_sysad_03.qx 11/8/99 9:50 AM Page 118

118


Organization The Organization tab contains more general information, and it can link to another user as the person’s manager. Once a manager is selected, you can switch to the manager’s account effortlessly. For organizations with a lot of movement, this information may not be trivial to track with the assistance of a Human Resources tool. The Organization tab provides these fields (see Figure 3.14): ■

Title

■

Department

■

Company

■

Manager

Figure 3.14

This is the Organization tab of the user property window Members Of.

74_sysad_03.qx 11/8/99 9:50 AM Page 119


The Member Of tab corresponds to the group concept of Windows NT 4.0 (see Figure 3.15). A list of all group memberships is in this window, with the option to add or remove groups as needed. To add additional groups, click Add. Select the group and click Add, then click OK to close the Add group window (see Figure 3.16). The Primary Group option is available only to Macintosh clients. The Primary Group should be set to the group with which the user most commonly shares data. It is used for permission associations when a Macintosh client creates a new folder or file.

Figure 3.15

This is the Members Of (groups) tab of the user property window.

Dial-in The Dial-in tab lets an administrator specify who can connect remotely and how they will connect (see Figure 3.17).

119

74_sysad_03.qx 11/8/99 9:50 AM Page 120

120


Figure 3.16

Add the user account to additional groups.

Figure 3.17

The Dial-in tab of the user properties windows lets an administrator control who can connect remotely when RAS is enabled.

74_sysad_03.qx 11/8/99 9:51 AM Page 121


Managing User Accounts All account administration can be done through the Active Directory Users and Computers snap-in of the MMC (Figure 3.18). Over time, most administrators will find themselves adding numerous snap-ins to the MMC and doing most administrative functions from there. The convenience of a single interface is compelling. Administrators can save MMC configurations as .MSC files. The files can be copied to other machines or carried on a disk, allowing the administrator to develop a completely customized interface that they can use from any Windows 2000 machine.

Figure 3.18

The Microsoft Management Console (MMC) provides convenient access to a number of administrative tools, including the Active Directory Users and Computers snap-in.

To run the MMC: 1. From the Start menu, select Run. 2. Enter MMC and click OK.

121

74_sysad_03.qx 11/8/99 9:51 AM Page 122

122


Deleting User Accounts NOTE To delete a user account, after clicking the user, you can also use the Delete button on the toolbar or the Delete key.

To delete an account: 1. In the console tree, click Users. 2. Right-click the user account, then select Delete. 3. Click Yes to confirm.

TIP The best practice is to disable an account and leave it disabled for a few days/weeks while you determine if the account is still needed. This saves you the trouble of having to re-create it if a new employee joins the organization and assumes the previous employee’s job and responsibilities.

Changing User Passwords Follow these steps to reset a user password (see Figure 3.19): 1. In the console tree, click Users. 2. In the Results pane, right-click on the user. 3. Select Reset Password. 4. Type the new password and confirm it. 5. If you want to require the user to change this password at the next logon, select User must change password at next logon check box.

74_sysad_03.qx 11/8/99 9:51 AM Page 123


Figure 3.19

The Reset Password dialog box allows you to change a user’s password.

Enabling an Account To enable a disabled user account: 1. In the console tree, click Users. 2. In the results pane, right-click on the user. 3. Select Enable Account from the Action menu.

Disabling an Account To disable an account: 1. In the console tree, click Users. 2. In the results pane, right-click on the user. 3. Select Disable Account from the Action menu (see Figure 3.20).

Other Active Directory Users and Computers Functions To find a user account in Active Directory: 1. Open or create a MMC console with the Active Directory Users and Computers snap-in configured.

123

74_sysad_03.qx 11/8/99 9:51 AM Page 124

124


Figure 3.20

This is the Action menu for user accounts from the Active Directory Users and Computers application.

2. Right-click the domain node and select Find. 3. If you know which organizational unit the user is in, rightclick the OU and select Find to narrow the search. 4. Type the name of the user you want to find in the Name on the Users, Contacts, and Groups tab. 5. Click Find Now (see Figure 3.21).

Figure 3.21

Use the Find Users, Contacts, and Groups program to find a user account in Active Directory.

74_sysad_03.qx 11/8/99 9:51 AM Page 125


Moving User Accounts To move a user account: 1. In the console tree, click Users. 2. In the details pane, right-click on the user and select Move. 3. In the Move pane, select the domain. 4. Select the domain and folder belonging to the place where you want to move the user account. Click OK (see Figure 3.22).

Figure 3.22

Move a user between organizational units in a domain.

Mapping a Certificate to a User In Windows 2000 you can map a certificate that has been issued to a user to the user’s account. A server can then use public key technology to authenticate the user via this certificate. To log on a system, the user’s certificate is authenticated. The end result is the

125

74_sysad_03.qx 11/8/99 9:51 AM Page 126

126


same as if user had provided a user ID and password, yet the process is more secure. Traditionally, computer systems have used a centralized accounts database to manage users. This technique works well and is well understood by most administrators. However, as systems become more complex, with hundreds of thousands of users, such a centralized database can become difficult to manage. Public key certificates have the potential to help simplify these problems. Certificates can be widely distributed, issued by numerous parties, and verified by simply examining the certificate without having to refer to a centralized database. The problem with certificates is that few existing operating systems and administration tools understand how to deal with them. One solution that maintains the advantages of both certificates and user accounts is to create a mapping between a certificate and a user account. This allows the operating system to continue using accounts while introducing certificates for those systems that understand them. When using certificates to log on, a user presents the certificate to the system, which determines the user account that should be logged on. In most cases, a certificate is mapped to a user account in one of two ways: a single certificate is mapped to a single user account, or multiple certificates are mapped to one user account. ■

UPN Mapping. UPN or User Principle Name Mapping is a special case of one-to-one mapping. UPN mapping is only available via Active Directory. Enterprise certification authorities place an entry into each certificate called a UPN. The UPN looks very much like an e-mail name. The UPN is unique within a Windows 2000 domain. With UPN mapping, the UPN is used to find the user’s account in Active Directory, and that account is logged on.

74_sysad_03.qx 11/8/99 9:51 AM Page 127


One to One. One-to-one mapping is the mapping of a single user certificate to a single user account. You can either issue certificates to each of your employees from your own certification service, or you can have your employees get certificates from a certification authority approved by your organization. You then take these user certificates and map them to the employee’s user account.

To map a certificate to a user account in Active Directory: 1. Log on as an Administrator. 2. Open Active Directory for Users and Computers. 3. Right-click on the domain name you want to administer, click View, and check Advanced Features. 4. Double-click the domain name, click Users, and, in the details pane, locate the user to which you want to map a certificate. 5. Right-click the user name, click Name Mappings, and select Add. 6. Type the name and path of the .cer file. Click Open. 7. Do one of the following: ■

To map the certificate to one account, ensure that both Use Issuer for alternate security identity and Use Subject of alternate security identity are checked.

■

To map a certificate with many accounts, uncheck Use Issuer for alternate security identity and leave Use Subject of alternate security identity checked.

8. Click OK (see Figure 3.23).

127

74_sysad_03.qx 11/8/99 9:51 AM Page 128

128


Figure 3.23

Map a user to a security certificate using the Security Identity Mapping window.

NOTE An important note about one-to-one mapping: You cannot map the same certificate to multiple accounts using one-to-one mapping. The result will be that no account will be associated with the certificate, and any attempt to use the certificate as a user credential will fail.

Best Practices Managing users can be a tedious task. Fortunately, the Active Directory for Users and Computers plug-in provides a number of shortcuts and other tools for finding and managing users.

74_sysad_03.qx 11/8/99 9:51 AM Page 129


This section also contains some tips on granting and using administrative rights, along with some additional advice on creating an effective password policy.

Using Active Directory Users and Computers You can change the manner in which objects display in the Active Directory Users and Computers application by selecting items from the Console—View menu. Administrators can toggle on/off features such as the console tree, description bar, status bar, and large/small icons.

Advanced Features When you start Active Directory Users and Computers and expand the domain, several folders appear. The folders that display by default are: ■

Built-In

■

Computers

■

Domain Controllers

■

Users

When you select Advanced Features from the View menu, two more folders appear in the console: ■

Lost And Found

■

System

Filters Filter options allow you to control the display of objects using object attributes and LDAP queries (see Figure 3.24).

129

74_sysad_03.qx 11/8/99 9:51 AM Page 130

130


Figure 3.24

Filter the Active Directory Users and Computers <program name> Objects displayed.

Administrative Logon Never log on with administrative rights. This is a common mistake that many administrators make, mostly for the sake of convenience. Running Windows 2000 as an administrator makes the system vulnerable to Trojan horses and other virus/security risks. The simple act of loading a Web page can damage the system. An unfamiliar Internet site may have Trojan horse code that can be downloaded to the system and executed. If you are logged on with Administrator privileges; a Trojan horse could reformat your drive, delete files, or create a new user with administrative access. Keeping the administrative account separate also forces you to explicitly log on as the administrator, being more careful about your actions. Users constantly logged on as administrators tend to make costly mistakes in system configuration that can affect system stability.

74_sysad_03.qx 11/8/99 9:51 AM Page 131


With Windows 2000, Microsoft has introduced the Run As command. Log on as a normal user and use Run As to perform administrative tasks. To use the Run As command: 1. In Windows Explorer, click the program you want to open. 2. With the Shift key pressed, right-click the program and select Run As. 3. Click Run the program as the following user. 4. Type the user name, password, and domain of the administrator account (see Figure 3.25).

Figure 3.25

The Run As command allows you to run a command as an administrator or as another user.

You can also use Run As from the command line. The syntax is: runas /user:[email protected] "notepad \'my file.txt\'"

You will be prompted to enter a password.

131

74_sysad_03.qx 11/8/99 9:51 AM Page 132

132


NOTE Some applications such as Windows Explorer, the “Printers” folder, and desktop items, are launched indirectly. You will not be able to start them with the Run As command.

Account (Password) Policies Do not configure account policies for organizational units (OU) that do not contain any computers. An OU with only users will always receive account policy from the domain. When you set account policies, keep in mind that Windows 2000 only allows one Domain Account Policy, the one that sits at the root of Active Directory. The result is that the domain account policy becomes the default account policy of any Windows 2000 workstation or server that is a member of the domain. The exception is computers that are a member of an organizational unit (OU). By placing a computer account in an OU, you can assign an alternate to the default domain policy. This is useful for defining groups of machines that need different security rules applied to them on the basis of their use of security requirements.

Summary The user object is one of the fundamental building blocks of a domain, and the Active Directory. Administrators use user objects to control access to resources and track activity in a domain. When building a domain with shared resources, the first step is developing and implementing a user management policy. Without such a policy and process, it is impossible to create a secure server environment that supports the sharing of data and ideas. An effective user management policy includes naming conventions, password control restrictions, and account settings.

74_sysad_03.qx 11/8/99 9:51 AM Page 133


Administrators should be prepared to develop a user management policy, and have the skills needed to implement and manage it. The next step in managing user accounts is to group users on the basis of common access requirements. Managing individual access to resources can become a burden with thousands of users. By grouping them, administrators can make broad changes in access permissions with a single set of steps.

FAQs Q: Is there a limit to the length of a user logon account name? A: Yes, the limit for logon account names in Windows 2000 is 20 characters. If a user uses the [email protected] form of the ID to logon, the domain.com part is grayed out and is not included in the length limit.

Q: Are Windows 2000 domain users compatible with previous versions of Windows including Windows 95/95 and NT?

A: Yes. Any existing Windows network client can log on to a Windows 2000 domain and be granted access to Windows 2000 resources.

Q: Can there be more than one password/account policy for a domain?

A: No, each domain has one default domain and group policy. There can only be one account/password policy for the entire domain as part of the default domain policy. If you want to set different account/password policies for different users, you will need to create additional domains.

133

74_sysad_03.qx 11/8/99 9:51 AM Page 134

74_sysad_04.qx 11/8/99 9:41 AM Page 135

Chapter 4

Using Groups to Organize User Accounts

This chapter introduces the concept of groups and shows you how to group user accounts to make administration tasks easier. It will also provide you with the skills and knowledge necessary to implement domain, local, and the Windows 2000 built-in groups.


Introduction to Groups

■

Implementing Group strategies

■

Implementing Groups

■

Implementing Local Groups

■

Implementing Built-in Groups

■

Best Practices 135

74_sysad_04.qx 11/8/99 9:41 AM Page 136

136

Chapter 4 • Using Groups to Organize User Accounts

Introduction to Groups Groups provide a means of organizing the accounts of users who have similar responsibilities and need access to common resources on the network. Managing access to resources with thousands of users in an Active Directory is cumbersome and prone to producing errors. An administrator who creates groups of users can make broad changes in access rights with a minimum effort. Windows 2000 enhances the functionality of groups by integrating them into the Active Directory. As objects in the Active Directory, groups are accessible to other applications such as Microsoft Exchange, and they are accessible across a broader scope of machines.

For Managers Only

Managing Access Control Groups are an extremely powerful tool for managing both users and their access to resources. The fundamental problems that exist with managing access to resources at a user level significantly increase administrative overhead. Administrators find themselves constantly changing or adjusting access control lists so that users have access to the data they need. The increased overhead that results from managing access to resources at a user level comes primarily from the time spent tracking access rights and changing them. In a relatively common but simple scenario, if a user leaves an organization, the most common first step an administrator takes is to disable or delete that user’s account. If another employee replaces the first user, a common administrative shortcut is to rename the old account and assign it to the new user. This works for transferring access to the new employee, but it also has several limitations. Renaming an Continued

74_sysad_04.qx 11/8/99 9:41 AM Page 137

Using User Groups to Organize User Accounts • Chapter 4

account does not work well in the case of an employee who moves on to another job within the company and is replaced by someone new who needs access to the same resources as the previous user. Removing the old employee’s access and granting access to the new employee is not trivial if you have to examine the permissions of every shared object to determine if any changes are needed. Potential privacy issues are created when an account is renamed. New employees may accidentally gain access to personal data of former employees, violating their privacy rights. When new accounts are created for each employee and groups are used for all access permissions, employees have access only to the resources specifically granted to those groups to which they belong. If you use groups to establish a general process for managing access control, you will dramatically reduce the workload and enhance security. The key components to a group management strategy include: ■

Understanding the built-in groups

■

Using and managing both domain and local groups

■

Adding and deleting users from groups

Windows 2000 offers several built-in groups with predefined security roles. Many of these groups are used for administrative functions such as managing shares, servers, users, security, backups, remote access, and other functions. Before making any groups, you should understand the capabilities and rights of the built-in groups. Some of these existing groups may already meet many of your common needs. Once you understand the roles and capabilities of the built-in groups, start thinking about your user community and developing a group management strategy. You will also need a clear picture of your server strategy and the resources to which users require access. The group characteristics, including members and types, will become obvious once you determine the resources to which users need access and the location of those resources. For most servers, you will the Continued

137

74_sysad_04.qx 11/8/99 9:41 AM Page 138

138


power of domain, local, and global groups to control access to resources. The final component of managing groups is moving users in and out of the groups. If all resources access control is done via groups, then providing or disabling users’ access is as simple as adding or removing them from the appropriate groups. If users need access to the data of another department for a temporary project, you can add them to the appropriate groups and remove them when the project is complete. While managing permissions at the user level may seem easier at first, it is full of potential pitfalls and limitations. Network administrators have a responsibility to ensure that access control meets the needs and rights of the users. Effective access control management requires the use of groups.

Groups are objects in the Active Directory that contain users, contacts, computers, and, potentially, other groups. Groups provide a method for logically organizing other objects in the Active Directory. You can then use these logical groups of objects to assign access to resources or control privileges on your network. Administrators use groups to: ■

Manage access to shared resources such as Active Directory objects and their properties, network shares, files, directories, printer queues, and so on.

■

Filter group policy.

■

Create e-mail distribution lists.

When assigning permissions for resources, administrators should assign permissions to a group rather than to individual users. The permissions are assigned once to the group, instead of several times to each individual user. Each account added to a group receives the rights and permissions defined for that group. Working with groups instead of with individual users helps simplify network maintenance and administration.

74_sysad_04.qx 11/8/99 9:41 AM Page 139


Groups can be used to filter group policy, grant user rights, or distribute e-mail. Groups are distinct from organizational units because of the domain boundaries. They can contain users, computers, or shared resources on a local server, single domain, domain tree, or forest. Organizational units represent a collection of objects within a single domain.

Group Type At some times you want to be able to group users for security purposes, while at other times you may want to group users only for distribution or high-level management purposes. Windows 2000 offers two types of groups: security groups and distribution lists. Each type of group has a specific purpose, and administrators of large complex environments will use a combination of the two to accomplish all their administrative tasks.

Security Groups Security groups function much as domain groups did under Windows NT. The security group is a collection of domain users used by administrators to grant access to network resources, and it is used extensively throughout networks to control access to resources.

Distribution Lists A distribution list is a collection of users in the Active Directory that applications can use. The most common example of an application that uses distribution lists is Microsoft Exchange server. Administrators can maintain distribution lists for notifying users of problems. Distribution lists may also be used to send out corporate bulletins. Distribution lists are only used for nonsecurity purposes and cannot be used to grant access to a network resource.

139

74_sysad_04.qx 11/8/99 9:41 AM Page 140

140


Group Scope When defining a group, the administrator also has control over the scope of the group. A group’s use can be confined to the local domain controller, or it can be made available to other servers in the domain or to the entire network. The three types of groups are: domain local, global, and universal.

Domain Local A domain local group is a collection of domain user accounts that can be used only to set access permission to resources in the domain. The characteristics of the domain local group are: ■

Open membership. You can add user accounts from any domain.

■

Access to resources in local domain only. You can use a domain local group to control access only to a resource in the same domain.

Global A global group is a collection of accounts that can be used by any server in the domain to set access permissions. The characteristics of a global group are: ■

Limited membership. The global group can contain accounts only from the domain in which it was created.

■

Access to resources in any domain. Global groups can be assigned permissions to gain access to resources in any domain.

Universal A universal group is accessible by any server on the network. Universal groups are most often used to assign permissions across domains. The characteristics of universal groups include:

74_sysad_04.qx 11/8/99 9:41 AM Page 141


■

Open membership. Any account from any domain can be added to a universal group.

■

Access to any resource in any domain. Administrators can use universal groups to assign permissions to any resource in any domain.

■

Native mode only. Before you can use universal groups, you must convert the domain to a native Windows 2000 domain. Universal groups are not available as an option for security groups when Windows 2000 is run in non-native mode. For more information on the advantages of Native Mode, refer to the “Best Practices” section of this chapter.

Group scope also defines the membership rules for a group. The membership rules define the types of accounts that can be placed in the group. Table 4.1 provides a summary of membership rules based on the group scope.

Table 4.1 Membership Rules Based on Group Scope

Scope

Group Can Contain

Domain local

User accounts, universal groups, and global groups from any domain

Global

Universal

Group Can Be a Member of Domain local groups in the same domain

Domain local groups from the same domain User accounts and global groups from the same domain

Universal and domain local groups in any domain

User accounts, universal groups, and global groups from any domain

Global groups in the same domain Domain local or universal groups in any domain

141

74_sysad_04.qx 11/8/99 9:41 AM Page 142

142


Implementing Group Strategies Effective use of groups requires you to develop a plan for using the different group scopes. The approach you take will depend on the type of Windows 2000 environment you have. For a single domain, you can use a combination of global and local groups to manage access to resources. For a domain tree, global and universal groups are generally more powerful and flexible.

Why Use Groups? Groups are more effective than user accounts for managing resource access. Often more than a single user will need access to a given set of data, and specifying individual access to each account is difficult to manage. By grouping the users with similar access requirements, the administrator goes from having to make multiple changes in permissions to making a single change. In an environment with multiple servers and hundred of resources, setting permissions on individual accounts consumes the majority of an administrator’s time. Groups also provide an advantage for adding or deleting users. When a new employee joins the company, the administrator can create an account and place that user in the appropriate groups in a single step. By adding the user to groups that already have the needed permissions on shared resources in the company, the administrator eliminates the need to connect the user to each server. When employees leave the company, the administrator can simply remove them from their groups and eliminate their access in a single step. This also works when employees change positions internally. The administrator can remove them from their old groups and place them in the new groups, thus changing the resources to which they have access.

74_sysad_04.qx 11/8/99 9:41 AM Page 143


Structuring Groups Before you create any user accounts or groups, it is best to develop your group strategy. The best strategy for most environments is to use a combination of global and domain local groups. When planning your group strategy, use these steps: 1. Identify the users on your network with similar job responsibilities. Add these accounts to a global group. An example would be placing all the Sales people in a global Sales group. 2. Determine the resources or groups of resources to which users will need access. Create a domain local group for each of these resources. An example of a common shared resource might be a customer database, for which you would create a customers domain local group. 3. Identify the global groups that will need access to a particular resource and place these global groups in the domain local group you created for the resource. For example, you would place the Sales global group in the customers domain local group. 4. Finally, assign access permissions to the domain local group. For example, you might assign read and write permissions to the customers domain local group for the customer database folder. Structuring groups in this fashion gives the administrator control over building and managing groups on the domain server, while also allowing the administrator to combine multiple global groups from different domains into a local group of a stand-alone server. The amount of administrative overhead is minimized as the network grows, because user accounts are still maintained at a domain level instead of on each individual server.

143

74_sysad_04.qx 11/8/99 9:41 AM Page 144

144


Implementing Groups The process of creating groups is similar to that used for creating users. To create groups, you use the Active Directory Users and Computers snap-in for the Microsoft Management console (MMC).

Preparing to Create Groups Before you begin trying to create any groups, determine if you have the required permissions in the desired domain. By default, members of the Administrators and Account Operators groups have permission to create groups. The Windows 2000 built-in groups are discussed later in this chapter. An administrator can give a user permission to create groups either in the domain or in a specific Organizational Unit (OU).

Information Needed to Create a Group Before creating a group, you need to collect the following information ■

Group Name. Every group in a domain needs a unique name. A naming convention that includes some indication of the grouping and security level is the most useful. Examples might include: accounting_readonly, accounting_readwrite, or accounting_noaccess. Such names clearly indicate the group’s purpose.

■

Group Scope. The group scope defines which servers inside and outside the domain can see and use the group.

■

Group Type. There are two types of groups: security groups and distribution lists. Security groups are used for assigning access to network resources. Distribution lists are used by applications such as Exchange to generate bulk e-mails.

74_sysad_04.qx 11/8/99 9:41 AM Page 145


Creating a Group Domain groups are created in the Active Directory database using Active Directory Users and Computers. To create a group: 1. Open Active Directory Users and Computers or the Active Directory snap-in of the MMC (see Figure 4.1).

Figure 4.1

The MMC uses a snap-in to offer access to user and group data in the Active Directory.

2. Click the Users folder of the domain to see a list of current users and groups. 3. Right-click the Users folder and select New—group (see Figure 4.2), or use the New Group icon in the toolbar. 4. Fill in the group name. The downlevel name will autofill to match the group name. 5. Select the group type.

145

74_sysad_04.qx 11/8/99 9:41 AM Page 146

146


Figure 4.2

Use the action menu for the Users folder to create new groups.

6. Select the group scope (see Figure 4.3). 7. Click OK to create the group.

Figure 4.3

Creating a new group is a simple one-step process.

74_sysad_04.qx 11/8/99 9:41 AM Page 147


Assigning Users to a Group Users can be assigned to a group through either the group settings or the user settings. When a group is created for the first time and multiple users are added to the group, the group setting interface will be easier to use. When an individual account is added to a group at a later date, it may be easier to use the user settings.

Adding Users through the Group Setting To add multiple users to a group: 1. Open the group settings by double-clicking the group (see Figure 4.4).

Figure 4.4

The Group Settings window provides access to the configuration parameters of the group.

2. Click the Members tab (see Figure 4.5). 3. Click the Add button (see Figure 4.6).

147

74_sysad_04.qx 11/8/99 9:41 AM Page 148

148


Figure 4.5

This is the Members tab of the Group Settings dialog box.

Figure 4.6

The Add User windows allow you to select users from the Active Directory.

74_sysad_04.qx 11/8/99 9:41 AM Page 149


4. Double-click a user to add that user to the group list (see Figure 4.7). 5. Click OK to close the Add User window. 6. Click OK to close the Group Settings window.

Figure 4.7

This is the Add User window with a user selected.

Adding User through the User Settings You can also add a user to a group from the User Settings window. To add the user to a group, follow these steps: 1. Double-click the User to open the settings window (see Figure 4.8). 2. Click the Member Of tab (see Figure 4.9). 3. Click Add. 4. Select the group by double-clicking it (see Figure 4.10). 5. Click OK to close the Add Groups window. 6. Click OK to close the user settings window.

149

74_sysad_04.qx 11/8/99 9:41 AM Page 150

150


Figure 4.8

This is a User Settings window.

Figure 4.9

The Member Of tab of the user settings.

74_sysad_04.qx 11/8/99 9:41 AM Page 151


Figure 4.10

A user is added to a group with the user account settings.

Configuring Group Settings There are several options available to administrators for configuring groups. Group configuration is done via the Group Settings window. Group settings are changed using Active Directory Users and Computers. To open the Group Settings window: 1. Open Active Directory Users and Computers. 2. Expand the Domain and select the Users folder. 3. Double-click the group you want to administer (Figure 4.11). The Group Settings window offers tabs for the following parameters: ■

General

■

Members

151

74_sysad_04.qx 11/8/99 9:41 AM Page 152

152


■

Member Of

■

Managed By

■

Object

■

Security

Figure 4.11

This is the Group Settings window.

General Most of the information in the General tab is for reference purposes and does not affect the group’s behavior. The General tab contains the following fields: ■

Description. A short description of the group’s purpose

■

Downlevel Name. Name in lower-level trees in the Active Directory

■

E-mail. E-mail address of the user

■

Group Type. The type of group (not modifiable)

74_sysad_04.qx 11/8/99 9:41 AM Page 153


■

Group Scope. The scope of the group (not modifiable)

■

Comments. Open field for comments or notes

Members The Members tab, shown in Figure 4.12, is a list of the current members of the group. You can add or remove members from the group from this tab.

Figure 4.12 This is the Members tab for the group settings.

Member Of Groups can be members of other groups in certain situations. For a complete summary of the groups that can be members of other groups, see Table 4.1. To make a group a member of another group, click the Add button (see Figure 4.13). From there you can select the groups to add.

153

74_sysad_04.qx 11/8/99 9:41 AM Page 154

154


Figure 4.13 This is the Member Of tab for the group settings.

Managed By The Managed By tab shown in Figure 4.14 allows you to change the users who have permission to modify the group settings. By default, the administrator has full control over the account, but they can delegate management to another user. When you click Change, a window appears that allows you to select a user from the domain. When you select a user, Windows 2000 will automatically fill in the other properties, using the information supplied in the user settings. You cannot modify the other settings from this window.

Object The Object tab (see Figure 4.15) provides complete details on the group object in the Active Directory database. The properties listed include:

74_sysad_04.qx 11/8/99 9:41 AM Page 155


■

Object Pathname

■

Object class

■

Created

■

Modified

■

USN created

■

USN modified

The administrator cannot directly modify any of these properties. The Unique Sequence number (USN) information is used for Active Directory synchronization.

Figure 4.14

This is the Managed By tab for the group settings.

155

74_sysad_04.qx 11/8/99 9:41 AM Page 156

156


Figure 4.15 This is the Object tab for the group settings.

Security Figure 4.16 shows the Security tab, which is where an administrator defines the privileges the various built-in groups have over the object. Each group can be specifically allowed or denied the rights for these tasks: ■

Full Control

■

Read

■

Write

■

Create All Child Objects

■

Delete All Child Objects

■

Send To

■

Read Phone and Mail Objects

■

Write Phone and Mail Objects

74_sysad_04.qx 11/8/99 9:41 AM Page 157


Figure 4.16 This is the Security tab for the group settings.

Managing Groups Like users, administrators often find that they want to change some aspect of a group’s characteristics, such as the group’s scope. Administrators will also find that they want to search for a group within their domain or delete a group that is no longer needed. Many of these tasks parallel their equivalent user functions (see Chapter 3, “Setting Up User Accounts.”

Changing a Group’s Scope At times it may be necessary to change the scope of a group. Administrators most commonly change the scope to one that has broader membership capabilities. For example, an administrator may change a domain local group to a global group so that users from other domains can be added to the group.

157

74_sysad_04.qx 11/8/99 9:42 AM Page 158

158


NOTE You can change a global group to a universal group only if the global group is not a member of another global group. You can change a domain local group to a universal group only if the group being converted does not contain another domain local group.

To change a group’s scope: 1. Open Active Directory Users and Groups. 2. In the console tree, expand the domain node. 3. Click the folder that contains the group. 4. In the Details pane, right-click the group to display the Action menu. 5. Click Properties to display the group properties. 6. Click the General tab. 7. Change the scope.

WARNING You cannot change the scope of a universal group because all other groups have more restrictive membership rules than do universal groups.

Finding a Group When you work with large domains or with managing multiple domains from the MMC, it may be difficult for you to keep track of where users and groups are located. You can use the Find feature shown in Figure 4.17 to search for groups within or across domains. To find a group:

74_sysad_04.qx 11/8/99 9:42 AM Page 159


1. Open Active Directory Users and Computers. 2. In the console tree, right-click the domain node and click Find. 3. Type the name of the group in the Name: box on the Users, Contacts, and Groups tab. 4. Click Find Now.

Figure 4.17 Use the Active Directory to find a group.

Deleting a Group To delete a group: 1. Open Active Directory Users and Computers. 2. In the console tree, expand the domain node. 3. Click the Built-in or organizational unit folder that contains the group. 4. In the Detail pane, right-click the group and select Delete from the Action menu. 5. Click Yes to complete the operation.

159

74_sysad_04.qx 11/8/99 9:42 AM Page 160

160


NOTE Local groups provided automatically by Windows 2000, such as Administrators and Account Operators, are in the Builtin folder. Common global groups such as Domain Admins and Domain Users are in the Users folder. New groups can be added or moved to any folder.

Implementing Local Groups A local group is a collection of user accounts created on a specific machine. You can use a local group to assign permissions to resources on that specific machine only. Local groups reside in the local security directory of the machine rather than in the Active Directory of the domain. Local groups are used on individual Windows 2000 Professional workstations and stand-alone servers to control access to resources on the local machines’ hard drives.

Preparing to Create Local Groups Local groups have a scope that is confined to the specific server on which they were created. This limit in scope also influences the functionality of the local group. Before creating a local group, you should be aware of these guidelines: ■

You cannot create a local group on a domain controller. A domain local group is not the same as a local group on a member server. All account and group information for a domain controller is stored in the Active Directory and is thus shared with all machines in the domain.

■

You can use a local group on the computer only where you created it. While you can use a local group to assign permissions to resources, this breaks down the concept of centralized management of all accounts and resources. Local groups are not in the Active Directory and therefore cannot be administered centrally.

74_sysad_04.qx 11/8/99 9:42 AM Page 161


These are the membership rules for local groups: ■

Local groups can contain local user accounts from the computer on which they were created. They can also contain domain users, domain local groups, and global groups from the domain (and other trusted domains) of which the server or workstation is a member.

■

Local groups cannot be members of any other group, local or domain.

Creating a Local Group You can use the Local Users and Groups snap-in of the MMC to create and manage local groups. To create a local group: 1. In the Local Users and Groups snap-in, click the Groups folder. 2. Select Create Group from the Action menu. 3. File in the group name, description, and members. Table 4.2 provides a list of fields and a short description of each. 4. Click Create to create the group.

Table 4.2

Local Group Options

Option

Description

Name Description

A short descriptive and unique name for the group An open entry field for entering a description of the group's purpose, rights, or other information Allows you to add users from the local security database or the domain to the local group

Add Remove

Deletes the selected user from the group

161

74_sysad_04.qx 11/8/99 9:42 AM Page 162

162


Implementing Built-in Groups Windows 2000 includes an extensive list of built-in groups with predefined security roles. The number and capabilities of the built-in groups go well beyond those included with earlier versions of Windows NT. Before creating any groups, you should understand the scope and role of the built-in groups. Windows 2000 contains four types of predefined groups: local, domain local, global, and system. Windows builds these predefined groups during the install process and assigns the appropriate rights to them. You do not need to create these groups or set their user rights. When using the Active Directory Users and Computers tool, predefined domain local groups appear in the Builtin folder and domain global groups appear in the Users folder.

Built-in Domain Local Groups Windows 2000 creates the domain local groups with predefined user rights and access permissions. These accounts are designed to administer various aspects of the domain and the Active Directory. When you add an account or global group to one of these built-in groups, it will automatically inherit the rights and permissions of the built-in groups, which include: ■

Account Operators

■

Administrators

■

Backup Operators

■

DnsAdmins

■

Guests

■

Print Operators

■

RAS and IAS Servers

■

Replicator

■

Server Operators

■

Users

74_sysad_04.qx 11/8/99 9:42 AM Page 163


Built-in Global Groups The built-in global groups created by Windows 2000 during install have no inherent user rights or permissions. Administrators can assign rights and permissions to built-in global groups as needed. The commonly used built-in global groups include: ■

Domain Admins

■

Domain Computers

■

Domain Controllers

■

Domain Guests

■

Domain Users

■

Enterprise Admins

■

Group Policy Admins

■

Schema Admins

Built-in Local Groups Built-in local groups are present on all stand-alone servers, member servers, and computers running Windows 2000 Professional. The built-in local groups have user rights and permissions to perform specific tasks on individual computers. The local groups are visible under the Groups folder in the Local Users and Groups MMC snapin. The local groups include: ■

Users

■

Administrators

■

Guests

■

Backup Operators

■

Power Users

163

74_sysad_04.qx 11/8/99 9:42 AM Page 164

164


Built-in System Groups Administrators cannot directly modify the Windows 2000 built-in system groups. These groups are used internally to track various states and may represent different sets of users at different times. Even though you can administer the system groups, you can still assign them rights and access to resources. Most Windows 2000 system groups are determined by the way the computer is being accessed. The common built-in system groups include: ■

Everyone

■

Authenticated users

■

Creator owner

■

Network

■

Interactive

■

Anonymous logon

■

Dialup

Built-in Group Behavior By default, every user account created in a domain is automatically added to the Domain Users global group. The Domain Users group represents all the user accounts created in the domain. For example, if you wanted all the users in a domain to have access to a shared resource such as a printer or shared folder, then you would assign permissions for the resource to the Domain Users group. Alternatively, you could put the Domain Users group into a domain local group that has permissions to access the resource. By default, the Domain Users group in a domain is also a member of the Users group in the same domain. The Domain Admins global group represents those users who have broad administrative rights in a domain. Windows 2000 Server does not place any accounts in this group automatically, but if you wanted an account to have sweeping administrative rights in a

74_sysad_04.qx 11/8/99 9:42 AM Page 165


domain, you would place that account into Domain Admins. Unlike Windows NT 4.0, Windows 2000 Server offers administration and delegation of authority capabilities; you will generally not have to grant such broad administrative rights. By default, the Domain Admins group in a domain is a member of the Administrators group in the same domain. The Domain Guests global group is a member of the Guests group in the same domain and automatically contains the domain’s default Guest user account. To secure a Windows 2000 environment, most administrators will disable the Guest account and not use the Guest groups of a domain. The better solution is to organize your domain structure so that the appropriate trusts are in place to facilitate the needed resource sharing. The built-in domain local groups of a domain are primarily used to assign default sets of permissions to users who will have some administrative control in the domain. For example, the Administrators group in a domain has a broad set of administrative rights over all user accounts and resources in the domain. Table 4.3 provides a summary of some of the more common rights, along with a description of those rights, and the accounts to which the rights are granted. You can assign the same rights to other domain accounts as well as adding or removing rights from the existing built-in groups.

Table 4.3

Common User Rights Groups Assigned This Right by Default

User Right

Allows

Access this computer from the network

Connect to the computer over the network

Administrators, everyone

Backup files and folders

Backup files and folders with the right to override the file and folder permissions

Administrators, backup operators

Continued

165

74_sysad_04.qx 11/8/99 9:42 AM Page 166

166


Groups Assigned This Right by Default

User Right

Allows

Bypass traverse checking

Move between folder to access files even if the user does not have permissions to the parent file folders Set the time for the internal clock of the computer This right currently has no effect Debug low-level OS objects such as threads Shut down a computer remotely

Everyone

Boost the execution priority of a process Install and remove devices drivers Log on the computer from the local keyboard

Administrators, power users Administrators

Change the system time Create a pagefile Debug programs Force shutdown from a remote system Increase scheduling priority Load and unload devices drivers Log on locally

Manage auditing and security log

Modify firmware environment variables

Profile single process Profile system performance

Specify the types of resources to be audited and be able to view and clear the security log Modify system environment variables stored in nonvolatile RAM on computers that support such configurations Perform profiling (performance monitoring) on a single process Perform profiling (performance monitoring) on the entire system

Administrators, power users Administrators Administrators Administrators

Administrators, power users, backup operators, everyone, guests, and users Administrators

Administrators, power users

Administrators, power users Administrators, power users Continued

74_sysad_04.qx 11/8/99 9:42 AM Page 167


Groups Assigned This Right by Default

User Right

Allows

Restore files and folders

Restore backed-up files and folders. This right overrides or supersedes file and folder permissions.

Administrators, backup operators

Shut down the system Take ownership of files and other objects

Shut down Windows 2000 Take ownership of any resource on the system. This right supersedes any permission on the object.

Administrators, power users Administrators

To view the current User Rights, use the Security Configuration and Analysis snap-in of the MMC (see Figure 4.18). To change the User rights, use the Security templates snap-in to define the rights, then Import the template into the Security Configuration and Analysis snap-in.

Figure 4.18

Current User Rights are viewed using the Security Configuration and Analysis snap-in.

167

74_sysad_04.qx 11/8/99 9:42 AM Page 168

168


To view the details of a particular User Right: 1. Open the MMC. 2. Expand the Security Configuration and Analysis tool. 3. Expand Local Policies. 4. Click to select the User Right Assignments. 5. A list of User Rights will appear on the right. 6. To view the detail, double-click one of the User Rights (see Figure 4.19).

Figure 4.19

The User Rights Assignment window is used for the Log on locally privilege.

Best Practices Here are some of the most important things to remember when using groups to organize user accounts.

74_sysad_04.qx 11/8/99 9:42 AM Page 169


Managing Groups When you add users to a group, remember these guidelines: ■

Users can be members of multiple groups.

■

There is no limit to the number of groups to which a user can belong. The group object contains only a pointer to the user object, and thus multiple groups can point to the same user.

■

Groups can be placed in other groups as members.

■

Nesting of groups is allowed. You can place multiple domain groups inside the local group of a server, easing the administrative tasks. One example might be your sales force. Each individual product sales team has a group for controlling access to its project resources. You could combine these individual sales groups into a master sales group that contains the individual groups. When you want to assign a resource to all the sales people, you need to assign permissions only to the master group.

■

Minimize the number of levels of nesting.

■

While nesting is a powerful tool, it can also become a nightmare to manage if it is overused. It can be difficult to track group membership with several levels of nesting.

Using Universal Groups Here are a few points to keep in mind if you decide to use universal groups: ■

Use universal groups only to give users access to resources spread across multiple domains. You can assign permissions to a universal group for any resource in any domain.

169

74_sysad_04.qx 11/8/99 9:42 AM Page 170

170


■

Try to keep the membership of universal groups static. Universal groups are distributed throughout the domain tree. Changes to a universal group may cause a significant increase in network traffic, because the change must be replicated across multiple domain controllers. Frequent changes to the universal groups increase the overall traffic significantly.

■

Use universal groups as you would domain local groups, by adding global groups to the universal group and then assigning permissions to the universal group. The difference between the universal and domain local groups is that the universal group can be applied to any resource in any domain. When you use a similar strategy for both types of groups, it is easier to keep track of the overall security configuration of your environment.

Switching Modes Windows 2000 offers two modes of operation: mixed and native. The default mode is mixed to allow backward compatibility with Windows NT 4.0. You can switch the mode to native at any time. Doing so makes the universal scope option for security groups available to you. Table 4.4 provides a summary of the differences between mixed and native modes.

Table 4.4

Mixed and Native Modes under Windows 2000

Mixed Mode

Native Mode

Domain controllers can run Windows NT 3.5, 4.0 or Windows 2000. Universal groups are not available. Only one level of nesting, adding a global group to a domain local group, is allowed.

Only Windows 2000 domain controllers are allowed. Client computers can run any version of Windows NT or Windows 2000. All group scopes, including universal groups, are available. Multiple levels of nesting are available, along with more nesting options.

74_sysad_04.qx 11/8/99 9:42 AM Page 171


Use these steps to change the mode: 1. Open Active Directory Users and Computers. 2. Right-click the Domain and select Properties from the Action menu (see Figure 4.20).

Figure 4.20

The Active Directory property window allows you to change the domain mode.

3. Click the Change button. 4. Click Yes to confirm the change. 5. Click OK to close the Active Directory property window. 6. Click OK to acknowledge the reboot requirement. 7. Reboot your domain controllers.

171

74_sysad_04.qx 11/8/99 9:42 AM Page 172

172


WARNING Once you convert a domain to native mode, you cannot convert it back. Native mode domains are not compatible with Windows NT domain controllers and should not be used until you are ready to convert entirely to Windows 2000.

Summary This chapter covered the entire process of planning and creating groups. As an administrator you should now be ready to establish a group structure within your environment and start assigning permissions. There are various types of groups, their scope, and the role of built-in groups. Each type of group plays an important part in an overall group structure. Windows 2000 offers a lot of flexibility in defining groups that administrators should consider carefully before dismissing any one feature. Careful planning will significantly reduce your administrative overhead and will improve overall network security.

FAQs Q: When I try to create a group, I cannot select a scope of universal with a group type of Security. What is the problem?

A: Universal groups can be used as security groups only if you convert your Windows 2000 environment to native mode. For information on converting your environment to native mode, refer to the sections on configuring Active Directories later in this book.

74_sysad_04.qx 11/8/99 9:42 AM Page 173


Q: Can local groups be shared between servers if they are members of the same domain?

A: No; local groups can be used to assign permissions to resources only on the machine where they were created. Domain local, global, and universal groups can all be shared between servers because the groups exist in the Active Directory. Avoid using local groups, because they defeat the purpose of centralizing administration and have several limitations that make them less useful than the domain-based groups.

Q: Is there a limit to the number of levels groups can be nested? A: In mixed mode the limit is one level of nesting. You can place a global group in a domain local group. With native mode, there is no limit to the number of levels you can nest groups. You also have more options when you nest the groups.

Q: If I want to give an associate permission to create and manage user accounts, should I just place them in the Administrators group?

A: No. Windows 2000 offers several ways to delegate authority to administrative tasks. If you want to grant the user the right to create or modify any account in the Active Directory, you should make that user a member of the built-in domain local group, Account Operators. If you want the user to administer accounts for a small section of your users only, you can create an Organizational Unit (OU) and delegate the authority to that unit.

Q: If I do a lot of administration on my domain servers, should I just place my account in the Administrators group?

A: No. That can create a security risk. It is much better to create a special administration account or to use the built-in account. Force yourself to log on with a separate account when you do server administration. By always using an account with administrator privileges for day-to-day activities, you open your servers to viruses, Trojan horses, and other malicious activity.

173

74_sysad_04.qx 11/8/99 9:42 AM Page 174

174


Q: I created a series of Universal security groups to grant access to resources on servers spread across multiple domains. I now realize that I want to restrict the use of these groups to specific domains. When I try to change the scope of the groups, I cannot. What is the problem?

A: You cannot change the scope of a Universal group because the other groups have more restrictive membership controls. Refer to Table 4.1 for complete details on the membership capabilities of the various group scopes. These kinds of mistakes are indicative of poor planning on the administrator’s part. Before creating groups, determine what resources they will need. Consistently creating universal groups is a lazy way to avoid vital planning.

74_sysad_05.qx 11/8/99 9:55 AM Page 175

Chapter 5

Administering File Resources


Using Microsoft Windows NT File System (NTFS) Permissions

■

How Windows 2000 Applies NTFS Permissions

■

Assigning NTFS Permissions

■

Copying and Moving Files and Folders

■

Sharing Resources

■

Creating Shared Folders

■

NTFS Permissions and Shared Folders

■

Troubleshooting Access Problems

■

Best Practices 175

74_sysad_05.qx 11/8/99 9:55 AM Page 176

176

Chapter 5 • Administering File Resources

Introduction The purpose of creating users and groups is to secure your environment and facilitate the sharing of data. Managing file resources and creating shared resources are two of the most common administrative tasks you will perform. This chapter provides an overview of administering file resources and shared folders. When you have read this chapter, you will have an understanding of how NTFS file permissions work, how permissions are applied when files are moved or copied, and how sharing permissions are combined with NTFS permissions to create a robust and secure environment.

Using Microsoft Windows NT File System (NTFS) Permissions Windows NTFS permissions are used to assign access rights to files and folders. These access rights define who can access the files and folders and what they can do with the contents. NTFS permissions are only available when NTFS volumes are used and are not available with alternative file systems such as FAT or FAT32. The types of access you can assign to a folder are different from the options available for files.

NTFS Folder Permissions NTFS folder permissions are used to assign access controls to a folder. Table 5.1 is a summary of folder permissions and the access control they provide. A user or group can have one or more folder permissions.

74_sysad_05.qx 11/8/99 9:55 AM Page 177

Administering File Resources • Chapter 5

Table 5.1

NTFS Folder Permissions

Folder permission

Allows

Read

Users can see the files and subfolders in the directory. They can also view the ownership, attributes, and permissions on the file. Users can create new files and subfolders, and can change the folder's attributes and view ownership and permissions. Users can see the names of files and subfolders in the folder. Users can browse through the folder, opening folders to which they may not have explicit access. They also have Read and List Folder Contents on the files and subfolders. Users can delete the folder in addition to the actions provided by the Write and Read & Execute permissions. User can perform the actions of all other permissions, and can take ownership, change permissions, and delete files and subfolders.

Write

List folder Contents Read & Execute

Modify

Full Control

NTFS File Permissions NTFS file permissions are applied to the files contained in the folders. NTFS file permissions may be more restrictive or more lenient than the permissions on the folder that contains the file and thus may alter the user’s effective access permissions. Table 5.2 is a summary of access permissions and the restrictions they enforce.

177

74_sysad_05.qx 11/8/99 9:55 AM Page 178

178


Table 5.2

NTFS File Permissions

File permission

Allows

Read

Users can view the ownership, permissions, attributes, and contents of a file. Users can change the file's attributes or overwrite the file completely, and can view the file's ownership and permissions. Users can perform the actions provided by Read, and can execute the file if it is an application. Users can perform the actions provided by the Write and Read & Execute permissions, and can modify or delete the file. Users can perform the actions provided by all other permissions, and can change permissions and take ownership.

Write

Read & Execute Modify

Full Control

How Windows 2000 Applies NTFS Permissions Only an administrator, the owner, or a user with Full Control permissions can change the NTFS file and folder permissions. Before trying to adjust the permissions on a folder, ensure that you have the right access privileges.

Access Control Lists Windows NTFS uses an access control list (ACL) to define who can access a file or folder and the type of access they have. An ACL is composed of multiple access control entries (ACEs). Each ACE corresponds to the access permissions for a single user or group. When a user attempts to access a file or folder, that user’s ID and group membership list are compared to the file’s or folder’s ACL. If there is a match, then the user has the permissions defined by the ACE. If the requested action matches those allowed by the assigned permission, then the action will be completed.

74_sysad_05.qx 11/8/99 9:55 AM Page 179


Combining NTFS Permissions A user may have multiple ACEs that define that user’s access permissions. For example, a user may have been assigned specific permissions, and one or more of the user’s groups may also have been provided access permissions. In order to understand the behavior of NTFS file permissions, you need to understand the rules governing the combination of permissions and the inheritance rules of NTFS. Many common permissions-related problems occur when administrators do not understand the rules.

Permissions Are Cumulative When determining a user’s access to a specific resource, Windows 2000 calculates the user’s effective permissions. The effective permissions are the sum of all access permissions defined in the ACL. If multiple entries match the access the user has been granted—for example, Read for the user’s specific account ID and Write for a group of which the user is a member—then the effective permissions are Read and Write.

File Permissions Override Folder Permissions When determining access to a resource, Windows 2000 will let file permissions override folder permissions. A user may not have any access permissions to a folder, but may have full control access to a file contained in that folder. The user would not see the file in a folder listing but could use a full Universal naming convention (UNC) path—for example, \\servername\project\restricted\ sales.doc—to gain access to the file. This lets administrators and users essentially create hidden, editable files. Users browsing the network will not see the files, but those who know that those files exist can access and update them. This is an extreme example. More commonly, an administrator might create a folder to which no one has Write access, and then specifically provide Write access to one or more files to certain users.

179

74_sysad_05.qx 11/8/99 9:55 AM Page 180

180


Deny Overrides All Other Permissions The Deny permission completely overrides any other access permissions a user may have. This contradicts the cumulative rule, but provides a powerful means to ensure that a folder is properly secured. An administrator or user with appropriate permissions can specifically deny a user or group access to a file or folder. This ensures that no groups of which the user is a member can gain access to the file or folder. When used with a group, the Deny permission applies to all members of the group.

TIP While the Deny permission is a powerful security tool, it can be extremely difficult to use in environments with complex group interrelations. In environments where users are members of every group or where there is heavy nesting of groups, administrators may find it difficult to use the Deny permission without blocking out more people than were intended.

Permission Inheritance By default, permissions are inherited from the parent folder. This makes it easier to administer a shared folder environment by ensuring that any new files and folders created in the folder have the same access control lists as the parent. Users need not worry about adjusting the permissions on new folders and files. It is possible to disable this behavior in Windows 2000. Stopping permission inheritance is like stopping a progression of events at a given time and resetting the clock before starting again. If you stop the inheritance on a given folder, you can set its permissions to something different from those of the parent. Any new folders or files will inherit the permissions, unless the permissions are otherwise configured by the user.

74_sysad_05.qx 11/8/99 9:55 AM Page 181


Assigning NTFS Permissions Permissions should be assigned after careful planning. Administrators should grant NTFS permissions strictly on the basis of user need. Adding users or groups to the ACL without careful planning may result in users’ obtaining access to data they should not have. There are three stages to assigning permissions: ■

Planning NTFS permissions

■

Managing permissions

■

Assigning special access permissions

Planning NTFS Permissions If you take some time to plan a strategy for using NTFS permissions carefully, you will find them easy to use, flexible, and extremely powerful. When you develop your strategy or plan, keep these points in mind: ■

Group files according to their type. Separate applications from public and project-related data. Assign each user a home directory for storing personal information.

■

Centralize the data as much as possible, and always store it on a partition that is separate from the operating system. This makes OS upgrades and system repairs easier to manage.

■

Assign permissions to folders instead of to files.

■

Assign only the access permissions a user needs to complete a specific job.

■

Create groups and assign permissions to them. Assign permissions to user accounts only when it is absolutely necessary.

181

74_sysad_05.qx 11/8/99 9:55 AM Page 182

182


■

Use the Deny permission only when it is absolutely needed. The overuse of Deny permissions can often create confusion when users are unable to access folders and files.

■

Teach users how to use access permissions to control access to files. NTFS permissions are a powerful tool for both protecting and sharing data.

Managing NTFS Permissions When an NTFS file system is created, the default permission is for the Everyone group to have Full Control. You should take some time to change the permission sets and inheritance on critical folders. To change the NTFS permissions of a file or folder: 1. Right-click the object and select Properties. 2. Click the Security tab (see Figure 5.1). 3. From here you can see the access permissions of each user or group by clicking on its name. Adjust the permissions as needed.

Figure 5.1

This is the Security tab of the Folder Properties Window.

74_sysad_05.qx 11/8/99 9:55 AM Page 183


To add a user: 1. From the Security tab, click the Add button. 2. Select the user or group by double-clicking on its name. You can add multiple groups simultaneously (see Figure 5.2). 3. Click OK to close the Add window. 4. Select the group in the Security tab and set the desired permissions.

Figure 5.2

Use the Add User window to add users and groups to the access control list (ACL) of a file or folder.

To prevent the inheritance of permissions from the parent folder: 1. Right-click the file or folder and select Properties. 2. Click the Security tab. 3. Uncheck the Allow Inheritable permissions from parent to propagate to this object.

183

74_sysad_05.qx 11/8/99 9:55 AM Page 184

184


4. You will be prompted to choose from copying the previously inherited permissions, removing the inherited permissions, or aborting the operation (see Figure 5.3). 5. Select the one of the options:

Figure 5.3

When you remove the inherited permissions option, you must choose whether to copy or delete the previous permissions.

■

Copy will copy over the inherited permissions from the parent folder.

■

Remove will remove all inherited permissions; retaining only those permissions you have explicitly selected (see Figure 5.4).

■

Cancel aborts the operation.

6. Click OK to close the Properties window.

74_sysad_05.qx 11/8/99 9:55 AM Page 185


Figure 5.4

Inheritance has been turned off, with the option to remove all previously inherited permissions.

Special Access Permissions Windows 2000 provides 12 special access permissions that give you additional capabilities beyond the normal access permissions of the ACL. Two useful special access permissions are Take Ownership and Change permissions.

Take Ownership Every object (whether in the Active Directory or in an NTFS volume) has an owner. The owner controls how permissions are set on an object. When an object is created, the creator automatically becomes its owner. Administrators will create and own most objects in Active Directory. Users will create and own data files in their home directories and on network servers.

185

74_sysad_05.qx 11/8/99 9:55 AM Page 186

186


Using the Take Ownership special access permissions is one way to transfer ownership of a file or folder from one user to another. A user can be granted the right to take ownership. Administrators always have the right to take ownership of a file or folder. The rules governing the Take Ownership permissions include: ■

The current owner of the file or folder, or any user with Full Control permissions on the file, can either assign Full Control or take Ownership permissions to another user or group, allowing them to take ownership of the file or folder.

■

Administrators can always take ownership of a file or folder, regardless of the permissions on the file. When an administrator takes ownership, the administrator group becomes the owner. Any member of the administrator group can then assign either Full Control or Take Ownership permissions to another user or group.

NOTE Ownership of files and folders cannot be assigned under Windows 2000. You must use the take Ownership permissions to transfer the ownership of a file from one user to another. In some cases this may be a two-step process in which the administrator takes ownership of a file and assigns the Take Ownership permission to another user, who then takes ownership. The most common use of the Take Ownership permission occurs when one employee assumes responsibility for a project and the associated data files from another employee. Either the current owner or the administrator must assign the Take Ownership privilege to the new owner, who can then use these privileges to assume ownership of the data. This method of assigning Take Ownership permissions and having the new owner explicitly take ownership of the data has advantages over other systems in which ownership of objects and files can simply be changed. First, this method ensures that the previous owner of the data does not lose ownership without explicitly granting someone else the rights to take it. Second, it lets the new owner choose which data to own. Someone cannot assign ownership of data or any Active Directory object without the knowledge of the new owner.

74_sysad_05.qx 11/8/99 9:55 AM Page 187


Change Permissions The Change Permissions special access permission lets you give other users the ability to change permissions on a file without giving them full control. This gives the users some flexibility in defining the permissions on the files without completely opening the access to the object. One situation in which such a feature might be useful is a large project that involves several teams. The project leader might create a master directory for the entire project and then create subfolders for each team. In order to allow a team leader some flexibility in managing access to individual folders, the project manager might grant the team Change Permissions access. The project manager may not want to grant full control, to prevent the team leaders from changing the directory structure. Granting Change Permissions allows the team leader some flexibility in defining access to the files on an as-needed basis without giving them complete control over the entire directory structure.

Other Special Permissions Table 5.3 is a complete list of special access permissions, along with a short description. Special access permissions provide administrators with flexibility in controlling access to resources on the network and should be a part of every administrator’s tools.

Table 5.3

Special Access Permissions and Their Functions

Special Access Permission Description Traverse Folder/Execute File Browse folder contents or open an application (Execute). List Folder/Read Data See the contents of a folder or file (List Folder Contents/Read). Read Attributes View the attributes of a file or folder. Read Extended Attributes View the extended attributes of a file or folder. Continued

187

74_sysad_05.qx 11/8/99 9:55 AM Page 188

188


Special Access Permission Description Create Files/Write Data Create a new file (Write). Create Folders/Append Data Create a subfolder or append data to a file (Write). Write Attributes Modify the attributes of a file or folder. Write Extended Attributes Modify the extended attributes of the file. Delete Subfolders and Files Delete files and folders from a directory. Read Permissions View permissions of a file or folder. Change Permissions Modify the permissions of a file or folder. Take Ownership Take ownership of a file or folder.

Using Special Access Permissions The special access permissions allow you to define access to folders and files in more detail, along with granting permission to Take Ownership or Change Permissions. Windows 2000 combines multiple special access permissions to form the regular permissions set.

Setting the Special Access Permissions The special access permissions are accessed much as are regular permissions. They can be thought of as advanced security settings. To set the special access permissions: 1. Right-click the folder or file for which you want to change the permissions and select Properties. 2. Click the Security tab. 3. Click the Advanced button to open the Access Settings dialog box (see Figure 5.5). 4. Ensure that the Permissions tab is selected. 5. Select the user for whom you want to change the permissions and click View/Edit (see Figure 5.6). 6. Adjust the permissions and click OK. 7. Click OK to close the Advanced Settings window. 8. Click OK to close the Properties window.

74_sysad_05.qx 11/8/99 9:55 AM Page 189


Figure 5.5

This is the Advanced Security Setting window.

Figure 5.6

This is the special access permission window for a particular user.

189

74_sysad_05.qx 11/8/99 9:55 AM Page 190

190


TIP You can use the option “Apply these Permissions to Objects and/or Container Within This Container Only” to specify whether subfolders and files contained in the folder inherit the special permissions from the folder. When you check this box, the permissions will propagate. Clear this check box to prevent inheritance.

Taking Ownership of Files and Folders Once you have granted special access permission to take ownership, the user can follow a similar series of steps to take ownership of the files. To take ownership of a file or folder, follow these steps: 1. Right-click the folder or file for which you want to change permissions and select Properties. 2. Click the Security tab. 3. Click the Advanced button. 4. Select the Owner tab (see Figure 5.7). 5. In the Change Owner To: field, select the user you want to designate as the new owner. 6. Check the Replace Owner on Subcontainer and objects to change the owner on all subfolders and files. 7. Click OK to close the Access Control Settings window.

74_sysad_05.qx 11/8/99 9:55 AM Page 191


Figure 5.7

The Owner tab of the Access Control Settings allows you to take ownership of a folder and its contents.

Changing NTFS Permissions When you change the permissions on an object, the new permissions apply when the object is subsequently accessed. If a user has the object open at the time when the permissions are changed, the user is allowed access according to the permissions that were in effect when the object was opened. Explicit permissions on an object can be directly changed by user action, but inherited permissions cannot be changed directly. Thus, to change permissions on a file whose permissions are inherited, you can do either of the following: ■

Change the permissions on the parent object, and specify that the changed permissions should be propagated.

191

74_sysad_05.qx 11/8/99 9:55 AM Page 192

192


■

Add permissions to an object that has inherited permissions, giving the object a combination of both explicit and inherited permissions. For example, if a file inherits Read and Write permissions from its parent, and then you add Delete permission to the file, the file now has the cumulative permissions of (Read and Write) and (Delete).

Copying and Moving Files and Folders When files are copied or moved, the permissions on the file may change. Understanding the rules that govern when the permissions will change is critical to managing access to your data. Administrators and users often set the access permissions of a file or folder and then move or copy the object without realizing that the permissions may have changed.

Copying Files Table 5.4 shows what happens to file and folder permissions during a copy. Copying files will always affect the permissions on the file, because Windows treats the copied file as a new file. In order to copy files between NTFS partitions or between folders on the same partition, you must have Write permissions to the destination. You will also become the creator-owner of all copied objects.

Table 5.4

Effects on Permissions of Copying a File or Folder

Action

Effect on Permissions

Copy a file or folder to another location on the same NTFS partition. Copy a file or folder to a location on a different NTFS partition. Copy a file or folder to a FAT partition.

The file or folder will inherit the permissions of the folder to which it is being copied. The file or folder will inherit the permissions of the folder to which it is being copied. All permissions are lost.

74_sysad_05.qx 11/8/99 9:55 AM Page 193


WARNING When files are copied to FAT partitions, all NTFS permissions are lost. FAT partitions have no way of storing or understanding NTFS permissions.

Moving Files Table 5.5 shows what happens to file and folder permissions during a move. When files or folders are moved, the permissions do not always change. The specific exception is when you move a file or folder from one location on an NTFS partition to another location on the same partition.

Table 5.5

Effects on Permissions of Moving a File or Folder

Action

Effect on permissions

Move a file or folder to another location on the same NTFS partition. Move a file or folder to a location on a different NTFS partition. Move a file or folder to a FAT partition.

The permissions will remain the same.

The file or folder will inherit the permissions of the folder to which it is being copied. All permissions are lost.

The reason for this difference in the behavior of permissions is subtle but critical. When you move a file on the same partition, Windows 2000 simply updates the file pointers and structures to reference the file’s new location. When you move a file to a different partition, Windows 2000 actually copies the file from the old partition to the new one and then deletes the original file. The file on the new partition is essentially a new file, and new files always inherit the permissions from the parent folder.

193

74_sysad_05.qx 11/8/99 9:55 AM Page 194

194


WARNING When you move a file or folder to a FAT partition, all NTFS permissions are lost.

When you move a folder within an NTFS partition: ■

The folder or file will retain all NTFS permissions currently defined.

■

You must have Write permissions to the destination folder.

■

You must have Modify permissions on the original folder, because Windows 2000 will delete the source folder once it has written the data to the new location.

■

You will become the creator-owner of the file or folder.

When you move a file or folder between NTFS partitions, these rules apply, but the files or folders inherit the permissions of the destination folder.

For Managers Only

Building Sharer Friendly Networks and Servers

The reason we build networks of computers is to create environments where users can share ideas, collaborate on projects, and gain access to additional information resources. Sharing resources on your network will become an everyday occurrence and eventually will be a critical part of your business development process. When you build network and server infrastructures, keep these ideals of collaboration in mind. The key components to an effective information sharing strategy are: ■

A robust infrastructure

■

Effective tools and resources to facilitate sharing of ideas Continued

74_sysad_05.qx 11/8/99 9:55 AM Page 195


Windows 2000 provides the starting point for building a robust server and network environment. It offers solutions that can vary in scale from small workgroups to large enterprises. The Active Directory provides a central repository for storing all user account, group, shared resources, and computer objects. Using Active Directories lets Windows 2000 scale across multiple sites and geographical regions. Yet all this power is not lost on the small workgroup in which the supplied tools minimize the administrative overhead. With server environments like Windows 2000 and Active Directories, network administrators can build an extensive and robust environment to facilitate the sharing of data and ideas between users. By creating a mix of public and project-related folders designed to meet user needs, the administrator creates a natural environment where users store the relevant data in locations accessible by everyone on the project. Without centralized shared resources, users would be forced to use the point-to-point file sharing built in to Windows NT and 95/98. This model is potentially feasible in small environments, but it is full of problems. First, there is no centralization of user account information. With Windows NT Workstation or Windows 2000 Professional, user may quickly fall into the habit of creating local user accounts. In a Windows 95/98 environment, users can only assign a Read or Write password. The next problem is the potential complexity of configuring the shared folders. Many users may be overwhelmed by the complexity of configuring shared folders under Windows 2000 or NT. To avoid the complexities they will leave the permissions wide open, with everyone having Full Control permissions. This makes it impossible to enforce any kind of universal security on critical business data. Finally, one of the worst problems is the scattering of data all over the network, with no logical organization or layout. This makes it difficult for new users to find the data. They may have to search through multiple servers located all over the company looking for bits and pieces of the project data. Continued

195

74_sysad_05.qx 11/8/99 9:55 AM Page 196

196


Investment in the time and effort needed to plan a shared data strategy will pay off in several ways. It will significantly reduce the amount of administrative overhead by concentrating the administration to a smaller number of servers. Centralization will improve the overall security of your environment, because things will be managed under a single set of rules in a centralized environment. Finally, the increases in the productivity of users who are able to collaborate with colleagues will be tremendous.

Sharing Resources Sharing folders (see Figure 5.8) over the network makes the contents of the folders accessible to other users on the network. Shared folders offer another level of security to control access to the files and folders on a computer. Shared folder access permissions apply not only to NTFS partitions but also to FAT and FAT32 partitions.

Figure 5.8

This is a shared folder in Windows 2000.

Securing Network Resources Windows Explorer uses a folder with a hand underneath to represent a shared folder. To control access to shared folders, you assign the shared object access permissions. Table 5.6 lists the permissions you can assign to a shared folder.

Table 5.6

Shared Folder Permissions

Share Permissions

Actions Allowed

Read

See folder names, file name, data, and attributes, run applications. Perform all the actions of the Read permissions; create files and folders, change files, append to files, delete files and folders, and change file attributes. Perform all the actions allowed by Change permissions; change permissions and Take Ownership.

Change

Full Control

74_sysad_05.qx 11/8/99 9:55 AM Page 197


While shared folders do offer an extra layer of security, there are issues to keep in mind when you develop a strategy for sharing data over the network. These include: ■

Shared folder permissions apply only to folders. You cannot share files individually. Shared folder permissions generally allow less detailed control over access than do the native Windows NTFS permissions.

■

Shared folder permissions do not apply to users who have gained physical access to the machine and logged on locally.

■

The Default permissions on a shared folder are Full Control for the Everyone group.

You can allow or deny any of the shared folder permissions to both users and groups. The best practice is to assign Allow permissions to groups and generally avoid denying permissions except when you specifically need to lock out a user who is a member of a group with access permissions. If you deny users access, it will override any access permissions granted to groups of which they are members.

Shared Folder Permissions As with NTFS permissions, there are a series of rules and guidelines to follow in applying shared folder permissions. Many of the guidelines are the same, but there are a few new ones with shared folders. When applying shared folder permissions, keep in mind: ■

Permissions are cumulative. If a user is a member of multiple groups, each with unique access permissions, the user’s effective permissions will be the combination of all the group access permissions.

■

Deny overrides all other permissions. As with NTFS permissions, Deny overrides any other permissions assigned to the user or any group of which the user is a member.

■

On NTFS volumes, the user must have access via the NTFS permissions in addition to the shared folder permissions. On a FAT volume, shared folder permissions are the only

197

74_sysad_05.qx 11/8/99 9:55 AM Page 198

198


security control that determines the user’s access to the data in the folder. On an NTFS partition, the user must have the appropriate permissions in order to access the files and folders in the shared folder. ■

When a shared folder is copied or moved, it is no longer shared. This is true no matter where it is copied or moved.

Creating Shared Folders While it is easy to just jump right in to Windows 2000 and begin creating shares, as with most administrative tasks, planning a strategy can significantly reduce the amount of overhead involved in managing shares across your network. Develop a strategy that takes into account the types of data you want to share (project or individual) and who will have access to the data. Once you have a strategy in place, the process of creating and managing shares is relatively quick and easy.

Developing a Shared Folder Strategy The best way to reduce the administrative overhead of creating and managing shared folders is to plan a strategy. The first step is to identify what types of files and folders you want to share. You can share out both applications and data. The benefit of shared applications is that you can ensure that every user is running the same version of an application, or you can upgrade every user to a new version simultaneously. Having shared data allows users to collaborate on projects. Almost no one works in an isolated environment anymore. Most business activities require a high degree of coordination and collaboration among individuals and teams. Without a strategy that clearly defines what resources will be shared and who can access them, you will find yourself constantly adjusting share permissions or moving data around trying to accommodate the business processes in your environment.

74_sysad_05.qx 11/8/99 9:55 AM Page 199


Shared Applications Shared applications are the easier of the two types of shared folders to create. Shared application folders are created on a network server and contain network-runnable versions of the applications. Even with the application on the network, often some customization or settings data still is stored on each machine. Before beginning the process of sharing applications, ask each vendor how that vendor’s application will work in such an environment. Each application will work slightly differently and may require some slight adjustment. When creating shared folders for applications: ■

Try to organize all your shared applications under a single folder. This makes it easier to manage installs and upgrades. It also makes it easier for users, because you only have to point them to one place for all their applications.

■

Assign Read permissions to the Users group or some other group that you have created for this purpose. This ensures that the users you create will have access to the applications folder.

■

Remove the Everyone group from the access list. This keeps out users you have not specifically placed in a group that has access. Also, the Everyone group has Full Control permissions, which grant the right to delete or change files in shared folders.

■

Add a group to the access list with Full Control privileges. This can be the built-in Administrators group or some other group you have designated as the one you want to do the administrative tasks.

■

If needed, you can add additional groups with Change privileges who can update applications or troubleshoot user problems, depending on the size of your organization and its specific needs.

199

74_sysad_05.qx 11/8/99 9:55 AM Page 200

200


Shared Data Data folders are used for sharing both public and project-related data. Project data is shared by small workgroups or teams working on a specific task. Public data requires more general access by the entire community of users. You will probably have a mix of public and project data on your servers. For best performance and ease of administration, keep shared data on a separate volume from the operating systems and applications. This makes it easier to clearly identify the data that needs regular backups. As always, an effective data management strategy makes backups and restores an essential component. When you build shared data folders: ■

Centralize the data as much as possible and as reasonably supported by your server infrastructure. This makes it easier to administer and back up.

■

Ensure that the administrator group or an equivalent has Full Control access to the folders for maintenance purposes.

■

Create separate folders for each major project or class of information.

■

Use group access permissions to assign the appropriate groups the access levels they need to each folder (Read, Change).

Sharing Folders In Windows 2000 the following built-in groups have the user rights to create shared folders: administrators, server operators, and power users (Windows 2000 Professional edition). To determine on which machines these groups have the right to create a shared folder, use these rules: ■

In a Windows 2000 domain, the administrators and server operators can create a shared folder on any machine in the domain. Since Power Users is a local group, the members can only create shares on the server or workstation where the ID exists.

74_sysad_05.qx 11/8/99 9:55 AM Page 201


■

In a workgroup situation, the Administrator and Power Users groups can create shared folders on the server or workstation that they reside on.

■

Before creating a share on an NTFS partition, you must ensure that you have at least Read access to the folder.

Administrative Shares Depending on the configuration of the computer, some or all of the special shares may appear when Windows 2000 presents a list of shared resources. Special shares are created by the system and should not be deleted or modified. Windows 2000 creates several administrative shares by default. These shares are used for remote administration and are normally hidden from the nonadministrative users. All administrative shares end with a $. Table 5.7 provides a list of administrative shares and their use.

Table 5.7

Administrative Shares and Their Use

Share name

Purpose

$, e.g., C$ or D$

A share that allows administrators to connect to the root directory of a storage device. For example, D$ is a share name by which drive D might be accessed by an administrator over the network. For a Windows 2000 Professional computer, only members of the Administrators or Backup Operators group can connect to these shares. For a Windows 2000 Server computer, members of the Server Operators group can also connect to these shares. A resource used by the system during remote administration of a computer. The path of this resource is always the path to the Windows 2000 system root, for example, C:\Winnt.

ADMIN$

Continued

201

74_sysad_05.qx 11/8/99 9:55 AM Page 202

202


Share Name

Purpose

IPC$

A resource sharing the named pipes used for communication between programs. It is used during remote administration of a computer and when viewing a computer's shared resources. This resource is created by the system when a Windows 2000 Server computer is configured as a replication export server. This resource is used only by Windows 2000 Servers that are configured as replication export servers. Used by the Net Logon service of a Windows 2000 Server computer while processing domain logon requests. This resource is used only by Windows 2000 Server. This share is created the first time you install a printer and points to the systemroot\System32\ Spool\Drivers folder. The administrator, server operators, and print operators have Full Control permissions. The Everyone group has Read privileges. This share is used to distribute printer drivers to users when they install a printer from the server.

REPL$

NETLOGON

PRINT$

TIP You can create additional hidden shares by appending a $ to the end of the share name. Users can access the folder only if they know the name of it and have the proper permissions.

Creating a Shared Folder When you configure a shared folder, you have a number of options: ■

Share name

■

Description

74_sysad_05.qx 11/8/99 9:55 AM Page 203


■

Limit the number of users who can connect

■

Set permissions

TIP You can share the same folder a number of times with different names and access privileges.

To create a shared folder: 1. Right-click the folder you want to share and select Sharing (see Figure 5.9)

Figure 5.9

This is the Sharing tab of the Properties window.

2. Click Share this folder. 3. Configure the sharing options (see Table 5.8). 4. Click OK to close the Property window.

203

74_sysad_05.qx 11/8/99 9:55 AM Page 204

204


Table 5.8

Options for a Shared Folder

Option

Purpose

Share Name Comment

The name users will use to access the shared folder. An optional description of the contents of the folder. User will see the comments when browsing the server with the View options set to Details mode. You can limit the number of users accessing the shared folder concurrently. Under Windows 2000 Professional, the limit is set to 10 concurrent users. With Windows 2000 Server, you can support an unlimited number of users, within the limits of the number of Client Access Licenses you own. Allows you to define the permissions on a shared folder. By default, the Everyone group has Full Control permissions. Settings used for offline access to the shared folder.

User Limit

Permissions

Caching

Assigning Permissions to a Shared Folder Once you have created a shared folder, you need to assign access permissions to the folder. By default, the Everyone group has Full Control permissions. When you work with shared folders on NTFS partitions, you must also consider the NTFS permissions. (See “NTFS Permissions and Shared Folders.”) To assign permissions to a shared folder: 1. Open the Sharing tab of the Properties window by rightclicking on the shared folder and selecting Sharing. 2. Click the Permissions button (see Figure 5.10). 3. Click the Add button to open the Select Users, Computers, or Groups window (see Figure 5.11). 4. Double-click the users and groups you want to add to the share permissions of the folder. 5. Click the Add button. 6. Select each user you added and click the share setting you want to either allow or deny to them. 7. Click OK to close the Properties window.

74_sysad_05.qx 11/8/99 9:55 AM Page 205


Figure 5.10

The Permissions window is used for setting shared folder permissions.

Figure 5.11

The Add Users, Computers, or Groups window is used for adding users and groups to the access permissions of a folder.

205

74_sysad_05.qx 11/8/99 9:55 AM Page 206

206


NOTE To add users from other domains, click the Look in drop-down list of the Add Users, Computers, or Groups window to display a list of domains. You can search the entire Active Directory by selecting Entire Directory from the list.

Managing Shared Folders Shared folders are managed completely from the Share tab of the Folder Properties window. From this window you can start or stop sharing on a folder, limit the number of users, share the folder under another name, or modify its permissions. When managing shares: ■

If you stop sharing on a folder while a user has files open, the user may lose data. Be sure to disconnect all users using the share before you stop the share.

■

When you click Do Not Share This Folder while a user is connected, Windows 2000 will display a warning dialog (see Figure 5.12). You will need to confirm stopping the share.

To view a list of shares, sessions, or open files: 1. Open Computer Management from the Start-ProgramsAdministrative menu (see Figure 5.13). 2. In the console tree, click Shares, Sessions, or Open Files.

NOTE Files opened by other users are displayed, but files opened by you are not.

74_sysad_05.qx 11/8/99 9:55 AM Page 207


Figure 5.12

The Confirmation dialog is used to stop folder sharing while users are connected to the folder.

Figure 5.13

Computer Management interface is used for viewing shares, sessions, and open files.

NOTE When you are administering another computer remotely, your connection appears as an open named pipe. It cannot be closed.

207

74_sysad_05.qx 11/8/99 9:55 AM Page 208

208


Connecting to a Shared Folder There are three ways in which users typically connect to a shared folder: through the run command, through mapping a drive, or through using My Network Places browser (Network Neighborhood under Windows NT and 95/98). Each method is perfectly valid, and the one you select will depend on need and user technical skill. The Run command is most often used when users know the Universal Naming Convention (UNC) path of the files or folder they want to access. A typical UNC path has the syntax \\<server>\ <share>\\…\. An example would be \\ wallace\public\hrforms\hiring.doc, which is a reference to a Word document called “hiring.doc” on the server “wallace” in a share called “public” in a folder called “hrforms.” A user who does not know the full UNC path but knows the domain and server name may choose to use the My Network Places or the Network Neighborhood to browse for the machine on the network, using the Graphical User Interface. The interface is easy to navigate, allowing the user to double-click the server and its shared folders in search of the desired file. Finally, mapping a drive is a method often used when the administrator wants to simplify the interface for the user or when an application must work with a logical drive reference instead of with the network-based UNC paths. When you map a drive to a network folder, Windows 2000 creates a new drive letter within the My Computer folder that takes you directly to the network folder when it is double-clicked. To connect using the Run command: 1. Click the Start menu and select Run. 2. Type the Universal Naming Convention (UNC) path into the Open field (see Figure 5.14). 3. Click Run.

74_sysad_05.qx 11/8/99 9:55 AM Page 209


Figure 5.14

The Run command is used with a UNC to open a shared folder.

TIP The Run command offers a useful and powerful shortcut capability. When a UNC is entered, the Run command has the ability to look ahead inside the directory specified to provide a list of subfolders. This is extremely helpful when you forget the exact folder name. You can enter part of the name, click the arrow, and the Run command will present a list of subfolders (see Figure 5.15).

Figure 5.15

As you enter a UNC path, the Run command looks ahead inside the server and share directories to display a list of subfolders.

209

74_sysad_05.qx 11/8/99 9:55 AM Page 210

210


To connect to a shared folder using the drive-mapping wizard shown in Figure 5.16: 1. Right-click the My Network Places icon on the desktop and select Map Network Drive. If you test from a Windows NT or 95/98 machine, use the Network Neighborhood icon. 2. Select a drive letter. Windows 2000 will by default select the first open letter. 3. Enter the UNC path of the shared folder. 4. Click the Finish button to create the mapped drive.

Figure 5.16

This is the drive-mapping wizard.

You can also map a drive using the Net Use command from the command line in Windows 2000. Net Use maps a drive letter to a share name. When it is used with no command line options, it will display a lst of all current network connections. The syntax for Net Use is: Net use Net use h: \\wallace\public\

74_sysad_05.qx 11/8/99 9:55 AM Page 211


One powerful option under the Net Use command is the ability to specify an alternative username and password. By adding the /user flag, you can specify a different username than the currently active logon name. This allows a user to connect as an alternative ID without having to log off and log on. For those that want to use a graphical interface to browse the network and locate a server, Windows 2000 offers the My Network Place interface, an update of the Network Neighborhood found in earlier versions of Windows. To use My Network Place: 1. Double-click the My Network Place icon on the desktop. 2. Locate the server that contains the shared folder. 3. Double-click the shared folder to open it.

NTFS Permissions and Shared Folders When folders are shared on FAT partitions, the shared folder permissions are the only permissions in effect. When you share folders on an NTFS partition, you can use both the NTFS and sharing permissions to control access to the folders. When you combine shared folder and NTFS permissions, the more restrictive permissions are always the effective permissions for the user. Table 5.9 provides an example of both share and NTFS permissions, along with the effective permissions each user needs in order to access the folder over the network. In this case, listed users are not members of any listed groups and there are no other access control Entries besides those listed. One effective permission that stands out is that Kathy Jones cannot access the folder over the network despite the fact that she is the owner of the file on the NTFS partition. If she were to access the file by sitting at the server and logging on, she would have Full Control.

211

74_sysad_05.qx 11/8/99 9:55 AM Page 212

212


Table 5.9

User/Group Jsmith "John Smith" Testers Engineers Adminstrator Kjones "Kathy Jones"

Combining Share and NTFS Permissions to Determine Effective Permissions NTFS Permission

Share Permission

Effective Permission

No Access

Full Control

No Access

Full Control Full Control Full Control Full Control (Owner)

Read Change Full Control No Access

Read Change Full Control No Access

NTFS permissions offer administrators more flexibility in defining access control to both files and folders. Share permissions offer fewer options and apply only at the folder level. One common strategy for managing the combination of shared and NTFS permissions is to leave the default Everyone with Full Control shared permission. NTFS permissions are then used to control access to subfolders and files.The other advantage of this strategy is that NTFS permissions apply both locally and over the network. This ensures that users who gain access to the machine and log on locally have no greater access to data files than if they had connected over the network. This combination of permissions is often one of the most confusing aspects of access control for new Windows 2000 administrators. Each set of permissions, shared and NTFS, is cumulative. When permissions are combined, the more restrictive set of permissions becomes the user’s effective permission.

74_sysad_05.qx 11/8/99 9:55 AM Page 213


Troubleshooting Access Problems Troubleshooting access problems can be tedious at times, and as an administrator you must take some time to fully understand the interaction between NTFS and share permissions. One of the most common mistakes administrators make is to actively grant Full Control access to users to overcome file permission problems that cannot be resolved. This slowly erodes the security of your server, and everyone on the network winds up with Full Control access to every piece of data. There are a few easy steps you can follow to develop a strategy for managing NTFS permissions and shares that can dramatically simplify the process of assigning and troubleshooting access permissions.

Solving Permission Problems The types of problems administrators and users encounter are small but can often have one of many possible causes and solutions. Don’t assume, if two people are having the same problem, that the root cause is the same.

Typical Permission-Related Access Problems The three general categories of problems presented here are the most common; users either have too few or too many access rights, or you are not getting the expected behavior when you configure permissions. ■

Users cannot access a file or folder.

■

You add a user account to a group with access permissions, but the user still cannot access the file or folder.

■

Users with Full Control access to a folder can delete files and subfolders to which they do not have access.

213

74_sysad_05.qx 11/8/99 9:55 AM Page 214

214


Solving Permission-Related Access Problems Troubleshooting permission problems is just like troubleshooting any other administrative problem. It is necessary to follow a series of specific steps to narrow the realm of possible causes, in order to find the root cause; then methodically apply solutions to determine which one has the desired result. When you fix permissions problems, be careful not to start with solutions that open up broad access on the affected shared or folder. This creates a new problem without really resolving the initial problem. ■

If a user loses access to a file or folder that was recently copied or moved to a new location, the folder probably inherited an ACL that has no ACE for the user or a group to which the user belongs.

■

When a user account is added to a group, the user must either log off or disconnect from the server before it will pick up the group membership change. Have the user log off and log back on.

■

The Full Control permission includes the special access permission Delete subfolders and files. You have two options; either lower the permissions the user has to the folder or, through the Special Access Permission dialog, remove the user’s ability to delete subfolders and files.

Best Practices Effective administrators understand permissions enough to avoid permission problems from the start. They know how to properly design and implement a shared folder and NTFS permissions set that guarantees security while accommodating the needs of their users. Once you master these skills, you should find that a share, once created, will require minimal administration over time.

74_sysad_05.qx 11/8/99 9:55 AM Page 215


Avoiding Permission-Related Access Problems ■

Always use NTFS partitions on your Windows 2000 Server. FAT partitions do not offer the access control features of NTFS and pose a potential security risk.

■

Assign the most restrictive access permissions that still lets users get their work done.

■

Assign permissions at the folder level. Group related files into separate folders and restrict access to the folders. This reduces the number of objects for which you have to manage access permissions and reduces the possibility that a file will get less restrictive permissions than the folder it is in. File permissions override folder permissions.

■

Ensure that users have Read & Execute permissions only for executable applications. This prevents applications from becoming damaged by virus or malicious user activity. The administrator should retain change permissions so that the the application can be updated when needed.

■

Use the Creator Owner built-in system group to improve security and flexibility. Give the creator-owner Full Control access while limiting others to the needed permissions. This ensures that a user who creates a subfolder or file has access to modify and delete it and, for files and folders created by other users, will have only the access granted via either inherited permissions or those specifically set by the creator of the file.

■

Assign rights as high in the container tree as possible. You gain the greatest breadth of effect with the least effort.

■

Apply inheritance to propagate rights through the container tree.

215

74_sysad_05.qx 11/8/99 9:55 AM Page 216

216


Guidelines for Managing Shared Folder Permissions Managing shared folder permissions can be a time-consuming task if it is done haphazardly. To ease administration of shared folders and improve security: ■

Determine the resources you will make available over the network

■

Identify the groups that need access to each resource and the type of access they need.

■

Assign permissions to groups instead of to users. This makes it easier to manage access and determine who has access.

■

Grant the minimum level of access required to get the job done. If a group only needs to be able to read the contents of the files, then assign only Read permissions.

■

Use intuitive names for shared folders, keeping in mind the client platforms that will require access to the shared folder.

NOTE Windows 2000, NT, and 95/98 have a length limit of 12 characters when they display shared folder names in the network neighborhood graphical interface. DOS and Windows 3.11 clients are limited to eight character share names, Longer share names can be accessed using the Run command or by using the mapped drive functions.

74_sysad_05.qx 11/8/99 9:55 AM Page 217


TIP While Windows 2000 offers the ability to create 8.3 filename equivalents, these names are generally not intuitive. If you will be supporting DOS and Windows 3.11 clients, create share names that meet the limitations of these platforms.

Summary With a thorough understanding of both NTFS and shared permissions, you are ready to start building a network server environment that is both secure and encourages the collaboration of your users. NTFS permissions offer the administrator a lot of flexibility and control for securing individual servers and workstations. You should carefully plan and implement NTFS permissions as a standard across all critical network servers. With shared folders, users can share project ideas and store critical business data on servers where the administrator can guarantee that the data is backed up reliably. When you combine NTFS and shared permissions you get the best of both worlds. Your servers and workstations are secure if someone gains access to the machine and logs on locally, and still share out data without feeling like the security has been compromised in any way.

217

74_sysad_05.qx 11/8/99 9:55 AM Page 218

218


FAQs Q: I have configured a shared folder so that a user has Change permissions. The user can connect and can open files but is unable to make any changes to the file. What is the problem?

A: Check the NTFS permissions on the folder on the server. The access permissions may be set to something more restrictive, preventing the user from being able to write to the folder.

Q: I want to create a shared folder but don’t want users to be able to browse to it. Can I create a shared folder and supply the share name to users who will need to connect to the folder?

A: You can create hidden shares by adding a $ to the end of the share name. This hides the share and makes it accessible only to a user who knows the exact share name and has the appropriate permissions.

Q: When users create a file or folder in a shared public directory, they do not have enough privileges to delete the folder. How can I assign permissions so that they can delete the folders they create?

A: Use the built-in system group Creator Owner with access permissions of Full Control. Any new files that users create will have an access control entry that lists their user account with Full Control permissions. With Full Control permissions, users can delete the files they create.

74_sysad_05.qx 11/8/99 9:55 AM Page 219


Q: I have a shared folder in which I assigned the Users group Change permissions. I have also verified that the group has Change permissions for the folder on the NTFS partition. Users are still not able to access all the files in the folder. What is the problem?

A: Two problems here. First, file permissions always override folder permissions. Check to see if your file permissions are more restrictive than the folder permissions. Second, the file permissions are probably different because you have managed to run off inheritance. If you want all the files and subfolders to have the same permissions as the parent directory, ensure that inheritance is turned on.

219

74_sysad_05.qx 11/8/99 9:55 AM Page 220

74_sysad_06.qx 11/8/99 9:59 AM Page 221

Chapter 6

Administering User Accounts


Managing User Profiles

■

Creating Home Folders

■

Introduction to Group Policies

■

Best Practices

221

74_sysad_06.qx 11/8/99 9:59 AM Page 222

222

Chapter 6 • Administering User Accounts

Managing User Profiles User profiles are an extremely powerful tool, and Microsoft has done a lot to improve their Windows NT predecessors. Before you start Managing User Profiles, it is important that you understand their role in administering your servers. Once you understand how user profiles fit into an overall administrative strategy, you can begin to tap their real power.

User Profiles Overview On computers running Windows 2000, user profiles are the desktop settings for each user’s work environment on the local computer. A user profile is created when each user logs on a computer for the first time. User profiles can be used on computers running Windows 95/98, but they must be enabled before they are available. User profiles provide several advantages: ■

Several users can use the same computer, and each receives desktop settings when he or she logs on.

■

When users log on their workstation, they receive the desktop settings as they existed when they logged off.

■

Customization of the desktop environment made by one user does not affect another user.

■

User profiles can be stored on a server so that they can follow users to any computer running Windows 95/98, Windows NT 4.0, or Windows 2000 on the network.

As an administrative tool, user profiles provide these options: ■

You can create a default user profile that is appropriate for the user’s tasks.

■

You can set up a mandatory user profile that will not save changes made by the user. Users can modify the desktop settings of the computer while they are logged on, but none of these changes is saved when they log off. The mandatory profile settings are downloaded to the local computer each time the user logs on.

74_sysad_06.qx 11/8/99 9:59 AM Page 223

Administering User Accounts • Chapter 6 ■

You can specify the default user settings that will be included in all the individual user profiles.

Types of User Profiles A user profile defines customized desktop environments, which include individual display settings, network and printer connections, and other specified settings. You or your system administrator may define your desktop environment. Types of user profiles include: ■

Local user profiles. A local user profile is created the first time you log on a computer, and it is stored on the computer’s local drive (the default location for user profiles is C:\Documents and Settings\<username>). Any changes made to your local user profile will be specific to the computer in which you made the changes.

■

Roaming user profiles. A roaming user profile is created by your system administrator and is stored on a server. This profile is available every time you log on any computer on the network. Any changes made to your roaming user profile will be updated on the server.

■

Mandatory user profiles. A mandatory user profile is a roaming profile that can be used to specify particular settings for individuals or for an entire group of users. Only system administrators can make changes to mandatory user profiles.

Contents of a User Profile Every user profile begins as a copy of Default User, which is a default user profile stored on each computer running Windows 2000. The NTuser.dat file within Default User displays configuration settings from the Windows 2000 registry. Every user profile also uses the common program groups, contained in the All Users folder. Table 6.1 summarizes the links to various desktop items contained in profile folders.

223

74_sysad_06.qx 11/8/99 9:59 AM Page 224

224


Table 6.1 Contents of the Profile Folder User profile folder

Contents

Application data

Program-specific data. Program vendors decide what data to store in the User Profile folder. Desktop items, including files, shortcuts, and folders Shortcuts to favorite locations on the Internet Shortcuts in My Network Places items User documents User picture items Shortcuts to printer folder items Shortcuts to the most recently used documents and accessed folders Shortcuts to document handling utilities Shortcuts to program items User template items

Desktop Favorites NetHood My Documents My Pictures PrintHood Recent SendTo Start Menu Templates

NTuser.dat file The NTuser.dat file is the registry portion of the user profile. The registry key defined in the Ntuser.dat file overrides the current registry settings of the local machine. (Detailed registry information is beyond the scope of this book.) For additional information on the contents of the registry, refer to Technet or the Microsoft Knowledgebase. Both resources are available online at Microsoft’s Web site (microsoft.com) or via CD-ROM subscription.

All Users Although they are not copied to user profile folders, the settings in the All Users folder are used to create individual user profiles. Windows 2000 supports two program group types: ■

Common program groups are always available on a computer, no matter who is logged on.

74_sysad_06.qx 11/8/99 9:59 AM Page 225


Personal program groups are private to the user who creates them.

■

Common program groups are stored in the All Users folder under the Documents and Settings folder. The All Users folder also contains settings for the Desktop and Start menu.

TIP The My Documents, My Pictures, Favorites, Start Menu, and Desktop folders are the only folders displayed in Windows Explorer by default. The NetHood, PrintHood, Recent, and Templates folders are hidden and do not appear in Windows Explorer. To open Windows Explorer, select Start➔Programs➔Accessories➔Windows Explorer. To view these folders and their contents in Windows Explorer, select Folder Options from the Tools menu, select the Views tab, and click the Radio button to show hidden folders.

Settings Saved in a User Profile A user profile contains configuration preferences and options for each user: a snapshot of a user’s desktop environment. Table 6.2 describes the settings in a user profile.

NOTE On computers running Windows 2000 with the NTFS file system, only members of the Administrators group can create, delete, or modify the common program groups.

225

74_sysad_06.qx 11/8/99 9:59 AM Page 226

226


Table 6.2 Options Available in User Profile Settings Source

Parameters Saved

Windows Explorer My Documents My Pictures Favorites Mapped network drive My Network Places Desktop contents Screen colors and fonts Application data and registry hive Printer settings Control Panel Accessories

All user-definable settings for Windows Explorer User-stored documents User-stored picture items Shortcuts to favorite locations on the Internet Any user-created mapped network drives Links to other computers on the network Items stored on the Desktop and Shortcut elements All user-definable computer screen colors and display text settings Application data and user-defined configuration settings Network printer connections All user-defined settings made in Control Panel All user-specific program settings affecting the user's Windows environment, including Calculator, Clock, Notepad, and Paint Any program written specifically for Windows 2000 can be designed so that it tracks program settings on a per-user basis. If this information exists, it is saved in the user profile. Any bookmarks placed in the Windows 2000 Help system

Windows 2000-based programs

Online user education bookmarks

Local User Profiles The local user profile is the user profile stored on the computer under the user name in the Documents and Settings folder. Windows 2000 will create a user folder the first time a user logs in if no preconfigured server-based roaming user profile exists. The contents of Default User folder are copied to the user’s profile folder. The user profile, along with the common program group settings in the All Users folder, creates the user’s desktop. When the user logs off, any changes made during the session are saved to the user profile folder.

74_sysad_06.qx 11/8/99 9:59 AM Page 227

Administering User Accounts • Chapter 6

If the user has multiple accounts on the local workstation or in the domain, then a unique local user profile is created for each account. When the user logs off, changed settings are saved to only one user profile, the one used to log on. User profiles display this behavior: ■

When users log on a computer, they always receive their personal settings, including desktop configuration and installed applications.

■

Local user profiles are stored in the system partition root\Documents and Settings\<username> folder. For most systems where the C drive is the system root partition, this will be C:\Documents and Settings\<username>. The username is the account name the user used to log on.

■

The user profile contains the My Documents folder, the default location for storing files and other data.

■

Users have complete control over their own profiles. They can make changes to the Desktop or Network connections, and they can add files to the My Documents folder. These changes are saved each time users log off the system. The next time they log on, Windows 2000 will restore these saved settings.

Roaming User Profiles To support a user who moves among multiple machines, you can configure a roaming user profile. With roaming user profiles, users can log on any Windows 2000 computer within their domain and have the same settings restored, just as with a local user profile on a specific machine. The roaming user profile stored on the server is copied to the local machine restoring all of the user’s settings and documents that are stored on the server in the roaming user profile. If you assign a user a roaming profile by entering a profile path into that user’s domain account, a copy of the user’s local user profile is saved both locally and on the server specified in the profile path location when the user logs off. The next time that user logs on, the user profile in the user profile path location is compared to

227

74_sysad_06.qx 11/8/99 9:59 AM Page 228

228


the copy in the local user profile folder. The most recent copy of the user profile is used to restore the user’s settings. The local user profile becomes a roaming user profile because of the centralized domain location and is available wherever the user logs on, as long as the server is available. If the server is not available, the local cached copy of the roaming user profile is used. If the user has not logged on the computer before, a new local user profile is created. In either case, if the centrally stored user profile is not available at logon, it is not updated when the user logs off. The next time the user logs on, he or she must specify which profile to use.

Creating Individualized Roaming User Profiles To create a roaming profile, you should follow the basic steps of creating a local user profile by logging in and configuring the various settings. After creating the local user profile, you can copy it to a centralized location and reference it from the user account settings. An alternative way to create a new individualized roaming profile is to grab users’ local profiles off their primary desktop machines. To do this, specify the share location where the profile is to be stored in each user’s account settings. The next time they log on and then log off, Windows will copy their local profiles to the server location. This is an efficient way of converting an existing Windows network environment from local profiles to roaming profiles without having to visit each machine. The advantages of creating an individualized roaming profile for each user are: ■

Providing users with a consistent and complete work environment. You can ensure that each profile is properly configured with the needed tools and any extraneous applications or settings are removed.

■

Providing a standardized desktop for a department or team whose members all need access to the same tools and network resources.

74_sysad_06.qx 11/8/99 9:59 AM Page 229


Potentially simplifying troubleshooting by establishing a base configuration across all machines on the network.

■

Combining them with group policies to create an environment that is secure and easy to manage (see “Introduction to Group Policies”).

TIP While it would be possible to customize the local user profile, it would be very inefficient. Roaming profiles offer a convenient centralized configuration point that is applied everywhere the user logs on. Local user profiles are just that, local to each machine. You would need to configure the local user profile on each machine, which would be a time-consuming task.

Mandatory Profiles A basic roaming profile still allows users to customize settings and save those settings back to the profile on the server when they log off. A mandatory profile is a read-only version of the roaming profile. Users still get the same setting at every machine where they log on, but Windows 2000 does not save any changes they make to the settings back to the profile on the server. The profile will be the same every time they log on. The biggest advantage of a mandatory profile is that you can assign one profile to multiple users and ensure that they always have the same configuration. When you need to make changes, just change the mandatory profile settings, and they are pushed to every user at the next logon. This is good for environments like data entry or manufacturing, where the job responsibilities are narrow and well defined. To turn a profile from roaming into mandatory, you only need to change the name of the hidden Ntuser.dat file located in the profile folder to Ntuser.man. Windows 2000 sees the name change and behaves accordingly.

229

74_sysad_06.qx 11/8/99 9:59 AM Page 230

230


Setting Up a Roaming User Profile After configuring roaming profiles on a server, Windows 2000 will copy the local user profile to the roaming profile path the next time the user logs on. On subsequent logons at other machines, Windows will copy the roaming profile to the local user profile of the machine. When you configure roaming profiles, make sure you put them on a server that gets regular backups. Losing the configuration data is not critical, but losing the contents of the My Documents folder may be a disaster for some users. Ensure that the server on which you place the profiles has enough resources to handle the load of users downloading the profiles. At busy times, like first thing in the morning, the load on the server may get quite high and potentially may have a negative impact on the performance of other services running on the server. To configure a roaming user profile: 1. On a server in your domain (member server or domain controller), create a shared folder with an intuitive name like “profiles” or “user_profiles.” 2. Using the Active Directory Users and Computers application, open the Property Windows of a User account 3. Select the Profile tab and fill in the Profile Path field using a Universal Naming Convention reference (for example, \\servername\user_profiles\jerry). In the example shown in Figure 6.1, the servername is wallace and the %username% system variable is used to reference the user’s network logon name. 4. Click the OK button to close the window and save the changes.

74_sysad_06.qx 11/8/99 9:59 AM Page 231


Figure 6.1

Set the Profile Path in the User Account Properties dialog box.

TIP Windows 2000 provides a number of system variables that can be used as shortcuts when user accounts and other settings are configured. One of these is %username%, which is a system variable that references the current user’s log-on account name. You can use this system variable instead of typing out each name. When you rename an account the reference is automatically updated, minimizing the administrative work.

Assigning Customized Roaming Profiles If you have a group of users who need the same settings and access to common resources, you can create a customized roaming profile that they all share. The best way to do this is to create a template with all the settings that you then assign to each user.

231

74_sysad_06.qx 11/8/99 9:59 AM Page 232

232


To create a template: 1. Create a user account in the domain such as marketing or manufacturing. 2. Log on a machine in the domain using the account you created. 3. Configure the machine with the settings you want, including desktop settings, network configuration, shortcuts, and Start menu items, and remove anything you do not want. 4. When you log off the machine, Windows will save the profile into the standard location, which on most systems will be C:\Documents and Settings\<username>. This will become the profile you use as a template. To assign the profile to users: 1. Log on as an administrator to a machine in your domain. 2. Open the System Properties dialog by right-clicking the My Computer icon and selecting Properties. 3. Click the User Profile tab (see Figure 6.2).

Figure 6.2

Use the System Properties window to make a list of user profiles on a machine.

74_sysad_06.qx 11/8/99 9:59 AM Page 233


4. To copy the template profile to a server, select it from the list and click the Copy To button (see Figure 6.3).

Figure 6.3 Copy to Window.

5. To assign the profile to users or groups, click the Change button to open the Choose User window (see Figure 6.4).

Figure 6.4

Select the users who may have access to the roaming profile.

6. Select the user or group you want to assign to the profile and click Add.

TIP

7. Click OK.

If you assign a single roaming profile to multiple users, you may want to make the profile mandatory (read-only). This will prevent one user from making changes that affect all the users assigned the profile.

233

74_sysad_06.qx 11/8/99 9:59 AM Page 234

234



User Profile Advantages Your goals are to reduce your administrative overhead and to improve user productivity. Effectively managing user accounts and tapping some of the power of user profiles is one of the best ways to achieve these goals. User profiles offer you the capability to reduce administrative costs by: ■

Standardizing user configurations

■

Improving troubleshooting of account configuration issues

■

Improving user productivity

User profiles let you develop a single standard default configuration for every user on your network. Many administrators don’t like the default profile that Windows 2000 provides, and many users feel the default configuration lacks the tools and utilities they need to get their work done. When you create a new customized roaming profile for all your users, you have the chance to add and remove things from the configuration to make the standard profile fit the needs of your company. You have two choices here; you can create a unique roaming profile for each user, or you can allow the whole community to share the same profile. If each user has a separate profile, all users can make changes to the settings and have the changes appear on any machine when they log on. You should consider making a shared roaming profile a mandatory profile. You wouldn’t want users modifying a shared profile; this would cause confusion. User profiles make troubleshooting easier because they allow the administrator to make the user revert to a known working profile, which lets the administrator determine whether the problem is profile related or some other kind of Continued

74_sysad_06.qx 11/8/99 9:59 AM Page 235


problem. With mandatory profiles, the user only has to log off and then back on. With standard roaming profiles, existing profiles can be replaced with a template. Finally, standardized profiles, mandatory or not, improve productivity, because the administrator can define an environment tuned to each user’s needs. Users no longer need to fiddle with their machines trying to make them connect to a network resource or add standard shortcuts. They can focus on their jobs and not the administration of their machine. Group Policy extends this concept further by letting the administrator define a series of user and computer configuration parameters. If you choose not to use profiles and group policies, you are only hurting yourself and your users.

Creating Home Folders In addition to the My Documents folder that is part of the user’s profile, Windows 2000 also offers Home Directories. Home Directories are another location, generally on a server, where users can store their important documents.

Home Directories and My Documents Home directories and My Documents make it easier for an administrator to back up user files and manage user accounts by collecting all of a user’s files in one location. In Windows NT 4.0, an assigned home directory became a user’s default folder for the Open and Save As dialog boxes, for command prompt sessions, and for all programs without a defined working folder. An assigned home directory can be a local folder or a shared network resource. Like profiles, home directories can be assigned to an individual user or to many users. In Windows 2000, the My Documents folder is an alternative to the home directory but does not necessarily replace it. When a user tries to save or open a file, most programs determine whether to use the home directory or My Documents in one of two ways. Some first look in the home directory for files that match the type of file being opened or saved. If a file with that extension is found, the program

235

74_sysad_06.qx 11/8/99 9:59 AM Page 236

236


opens the home directory and ignores My Documents. If a file of that type is not found, the program opens My Documents. In other programs, the home directory is ignored, whether or not the home directory contains any files.

TIP Store home directories and all shared folders on NTFS partitions. NTFS partitions allow you to combine the power and flexibility of using both NTFS and share permissions to control access to the data. There are two advantages to home directories: ■

Users can access their home directory from any computer on the network without having to share folders from each PC.

■

Backup and document administration is centralized, improving reliability and reducing administrative costs.

TIP Using the Group Policy, you can link users’ local My Documents folders to their home directories. This eliminates the users’ confusion about where to store their data. If they store it in the My Documents folder, it automatically gets stored in their network home directory. This is especially helpful because many user manuals and help guides reference the My Documents folder when specifying where users should save their data.

Creating Home Directories To specify a home directory: 1. Create a shared folder on a server in your domain. The home directories will be subfolders underneath this shared folder.

74_sysad_06.qx 11/8/99 9:59 AM Page 237


2. To secure the folder, remove the Everyone group from the Access Control List (ACL) and add either the Users group or another group that contains the users who will need access to the folder. 3. Open Active Directory Users and Computers. 4. Right-click the user you want to configure, and select Properties. 5. Under the Home Directory, select Connect To (see Figure 6.5).

Figure 6.5

Set the drive mapping and location of the user’s home directory.

6. Select a Drive Letter and specify the UNC for the home directory.

TIP If you use the %username% variable, Windows 2000 will create the home directory on the server and assign the user Full Control permissions. Windows will also remove all other users, including the administrator, from the access control list.

237

74_sysad_06.qx 11/8/99 9:59 AM Page 238

238


When you configure home directories, remember: ■

Windows 2000 includes a desktop folder called My Documents, which is an alternative to the home directory but does not replace it. To determine the location of a user’s My Documents folder, log on as the user, right-click My Documents on the desktop, click Properties, and look at the location specified on the Target tab (see Figure 6.6).

Figure 6.6

This is the target location of the My Documents folder for the Administrator account.

■

A user can change the target folder location of his or her My Documents folder by right-clicking the desktop icon, clicking Properties, and then specifying a new location on the Target tab.

■

You can use Group Policy Editor to change the target folder location of any user’s My Documents folder, disable a user’s ability to change the target folder location, remove the My Documents icon from the desktop, and choose whether programs use My Documents or a different folder as a default location.

74_sysad_06.qx 11/8/99 9:59 AM Page 239


If no home directory is assigned here, the system assigns the default local home directory to the user’s account.

■

To specify a network path for the home directory, you must first create the network share and set permissions that allow the user access.

Introduction to Group Policies Group policies define the various components of the user’s desktop environment that a system administrator can manage. Examples of this are the programs that are available to users, the programs that appear on the user’s desktop, and Start menu options. To create a specific desktop configuration for a particular group of users, you use the Group Policy snap-in (see Figure 6.7). Group Policy settings you specify are contained in a group policy object, which is in turn associated with selected Active Directory objects—sites, domains, or organizational units.

Figure 6.7

This is the MMC with the Default Domain Group Policy snap-in expanded.

239

74_sysad_06.qx 11/8/99 9:59 AM Page 240

240


Group Policy includes User Configuration settings, which affect users, and Computer Configuration settings, which affect computers. Using Group Policy and its extensions, you can: ■

Manage Registry-Based Policy through Administrative Templates. Group Policy creates a file that contains registry settings written to the User or Local Machine portion of the registry database. User profile settings that are specific to a user who logs on a given workstation or server are written to the registry under HKEY_CURRENT_USER (HKCU), and computer-specific settings are written under HKEY_LOCAL_MACHINE (HKLM).

■

Assign scripts (such as computer startup and shutdown, and logon and logoff).

■

Redirect Folders from the Documents and Settings folder on the local computer to network locations.

■

Manage Applications (assign, publish, update, or repair). To do this, you use the Software Installation extension.

■

Specify security options.

Applying Group Policy User policy is obtained when a User logs on. Computer policy settings are located under Computer Configuration and are obtained when a machine boots. Users and Computers are the only Active Directory objects that receive policy. No policy is applied to Security Groups. Instead, Security Groups can be used to filter the policy via an Apply Group Policy ACE (Access Control Entry).

Order of Application Policies are applied in the following order: 1. NT 4 style policies (NTConfig.pol) 2. The unique local group policy object

74_sysad_06.qx 11/8/99 9:59 AM Page 241


3. Site group policy objects, in administratively specified order 4. Domain group policy objects, in administratively specified order 5. OU group policy objects, from largest to smallest OU (parent to child OU), and in administratively specified order at the level of each OU

Filtering Policy Based on Security Group Membership A Security Group Access Control Entry (ACE) on a group policy object can be set to Not configured (no preference), Allowed, or Denied. Denied takes precedence over Allowed.

Blocking Policy Inheritance Policies that would otherwise be inherited from higher site, domain, or organizational units can be blocked at the site, domain, or organizational unit level.

Enforcing Policy from Above Policies that would otherwise be overwritten by policies in child OUs can be enforced at the group policy object level.

TIP Enforced policies cannot be blocked.

These settings represent the basics of Group Policy. Group Policy offers administrators a lot of power compared to the System Policy Editor of Windows NT. For more information on Group Policy, refer to the chapters later in this book.

241

74_sysad_06.qx 11/8/99 9:59 AM Page 242

242


Best Practices Developing a universal user or group policy is difficult in large enterprises where there are thousands of users with dramatically different needs. There are a few things you can do to accommodate these needs whether they are hardware or software based. The other thing to consider is that while independently profiles and policies both ease administrative tasks, together they provide complete control over the entire user environment. Using one without the other is like tying one arm behind your back.

Allowing for Different Hardware Configurations Since user profiles are accessible on various types of client computers, you should keep in mind that these client computers can have different hardware configurations, particularly different video cards and displays. The user profile determines screen placement and size of windows; therefore, the type of display hardware affects how well the user profile works. For example, the window setup in a user profile created for a computer with a Super VGA monitor might not look correct if it were loaded on a computer with a regular VGA monitor. When you create or edit a user profile for a single user, use a computer with the same type of video hardware as the computer the user typically uses. When you create a mandatory user profile for several users, create a single user profile for the whole group of users only if they all use computers with the same type of video hardware.

Combining the Power of Profiles and Policies To get the most out of Windows 2000 from an administrator’s perspective, you need to consider implementing both roaming or mandatory profiles and group policy. The capabilities of these two features overlap in ways that allow administrators to gain complete control over each user’s environment. This allows you to make

74_sysad_06.qx 11/8/99 9:59 AM Page 243


configuration decisions that both dramatically improve the user’s productivity and enhance your administrative control. You can set mandatory profiles to guarantee that the user can always revert to a configuration that has been tested and certified to work with the configuration of your environment. Users can still make changes to their settings while they are logged on, but those changes are lost when they log off. This does two things. It forces users to focus on getting their work done instead of fiddling with the settings to make them work, and it lets your support staff force users back to a known working profile if they make a configuration change that affects their ability to access resources. You can set a user’s home directory in the user’s account settings and then use Group Policy to prevent that user from saving files anywhere on the local drive. This forces the user to save all files to the server, where they will be backed up.

Tightening Security on Home Directories One of the biggest concerns with creating home directories is security. Suddenly all the data that was stored locally on a single machine is potentially accessible to every machine on the network. Either because of a fundamental misconfiguration of access permissions, or by hacking a user’s account, some user may be able to gain access to another user’s home directory. One way to counter this is to make the top-level home directory share a hidden share. To make it hidden, use the $ after the share name. To enhance it further, you can create a unique share for each user on the network. Also, if you allow Windows 2000 to create the share when you specify it in the user account settings, instead of creating them in advance, the shares will have extremely tight access controls. Only the owner of the home directory will have access to it. These measures keep users from browsing your servers looking for holes in access permissions. As always, effective security policies require administrators to be vigilant and monitor systems for any suspicious behavior.

243

74_sysad_06.qx 11/8/99 9:59 AM Page 244

244


Summary This chapter introduced the concept of user profiles, home directories, and group policies. Each of these features of Windows 2000 offers the administrator flexibility in implementing a secure and robust network infrastructure. User profiles allow administrators to standardize the configuration of each user’s account, include desktop settings, network connections, shortcuts, and the Start menu, in an effort to increase user productivity and reduce administrative overhead. Roaming profiles ensure that users always have the same configuration, no matter what machine they use to log on. Home directories offer administrators an option to replace the My Documents folder with a centralized network resource containing a home directory for every user. Applications can be configured to default all Open and Save dialogs to this directory. The centralization helps administrators manage backups and makes the information available from any machine on the network. The Group Policy is a powerful configuration tool that gives administrators total control over the configuration of user account and computers.

FAQs Q: I have created a roaming profile for my users, but they keep making changes to the profile that affect their ability to connect to some of our network servers. What can I do to prevent users from changing their profiles?

A: Roaming profiles do allow users to customize their settings by default. What you really want is a special kind of roaming profile called a mandatory profile, which is a read-only version of the roaming profile. Users can still make changes to the profile, but the changes are not saved. If users start having problems related to a change in settings, you can direct them to log off and log back on to get the standard profile. If you decide to switch to mandatory profiles, make sure the profile provides the access

74_sysad_06.qx 11/8/99 9:59 AM Page 245


and configuration settings users need to get their jobs done. Otherwise, users will be forced to reconfigure their environment every time they log on. Consider using Group Policy to lock down certain features that you want to keep unchanged.

Q: I configured my users with roaming profiles several months ago. Now when they log on using some machines they get their profile, but when they log on using others they get the default profile. What is the problem?

A: Check to make sure that the shared folder containing the profiles is still accessible across the network. The users may be getting a cached profile on machines where they have previously logged on, but getting the default profile on those machines where they never logged on before.

Q: Can I create a mandatory profile that is local to the machine? A: No. A mandatory profile is a read-only roaming profile. Before making a profile mandatory, you must first make it a roaming profile.

Q: Can users have a roaming profile for some machines and a local profile on other machines?

A: No. Since the roaming profile is part of the configuration of their domain account, it will follow them to every machine where they log on with that account. If they log on with a different domain account or a local account, then they could have a separate roaming or local profile.

Q: Can other users on the network access a person’s home directory?

245

74_sysad_06.qx 11/8/99 9:59 AM Page 246

246


A: If you let Windows 2000 Server create the home directory, it will assign permissions so that only the owner can access the directory. Permissions can be assigned either to the home directory or to one of its subfolders (the recommended way) that lets other users in to share files. You can also set these permissions if you create the home directories manually.

Q: Can a user with a roaming or mandatory profile log on using multiple machines simultaneously?

A: Yes. The one problem for users with roaming profiles concerns making changes to the profile while they are logged on. Every time you log off, the changes are copied back to the server. If a user logs on using two machines (A and B), makes changes to the profile on A, logs off A, and then shortly thereafter logs off B, the changes will be lost.

74_sysad_07.qx 11/8/99 10:18 AM Page 247

Chapter 7

Administering Printer Resources

This chapter discusses the use of Windows 2000 Server to provide printing services to a network, including the basic techniques necessary to establish and maintain a stable and efficient network-printing environment.


Introduction to Administering Printers

■

Printer Properties

■

Managing Printer Permissions

■

Managing Printers

■

Managing Documents in a Print Queue

■

Administering Printers by Using a Web Browser

■

Best Practices

247

74_sysad_07.qx 11/8/99 10:18 AM Page 248

248

Chapter 7 • Administering Printer Resources

Introduction to Administering Printers This section covers basic information about Windows 2000 printing services, including terminology, steps for printer configuration, and planning the printing environment and additional printing technologies.

Terminology Any discussion about Windows 2000 printing issues must first clarify a few terms: ■

Print device is the hardware that actually does the printing. It is connected to the print server by direct cable connection or across the network.

■

Print server is a computer that manages printing on the network. A print server can be a dedicated computer hosting multiple printers, or it can run as one of many processes on a non-dedicated computer.

■

Print driver is a software program used by other computer programs to connect with printers and plotters. It translates information sent to it into commands that the print device can understand.

■

Printer is the software interface between the document and the print device. This is the term used for the object that is created on the server and client workstation and that provides access to the configuration and print queue.

Planning the Print Environment A successful network-printing environment is one that has been carefully planned out. While a thorough discussion of a complete printing environment plan is beyond the scope of this chapter, a few suggestions are included here and in the “Best Practices” section at the end of the chapter.

74_sysad_07.qx 11/8/99 10:18 AM Page 249

Administering Printer Resources • Chapter 7

For Managers Only

Plan Ahead

Probably the most important aspect of establishing a successful print environment is to ensure that it makes sense to your customers. The latest technology is easily overshadowed in a poorly planned configuration. If the print environment is confusing to your customers, you and your team will spend more time responding to customer complaints than maintaining the environment.

Dedicated vs. Non-dedicated Print Servers One of the first questions to address is whether or not to set up a dedicated print server for the network. Small office or home office (SOHO) network administrators may find the best value in setting up printing services on an established Windows 2000 server. This is recommended if the number of workstations and printers is small and contained within a small geographic region. It also avoids the additional cost of a second server computer, another server software license, and the additional effort needed to set up and configure the second server. However, a large number of printers or a large number of print jobs on a non-dedicated server can have a direct impact on the server’s performance on other running processes. Setting up a dedicated print server is almost a requirement in an environment with a large number of heavily used printers. Even a dedicated print server can get bogged down by large numbers of print jobs submitted at once. There is no firm guideline for the maximum number of printers that can be set up on a print server. Server performance depends on the activity of the printing community as well as the speed of the printers being used.

249

74_sysad_07.qx 11/8/99 10:18 AM Page 250

250


Local, Remote, and Network Printers Unfortunately, this terminology can be a bit confusing. From a workstation perspective, a printer object can be created as either a local or a remote printer. A local printer is directly connected to the workstation, while a network printer is located on a print server. The same can be done on a print server. Its printer objects can be set as local, where the print server directly controls access to the print device, or remote, where the server points to a printer on another print server. The confusion comes in when a local printer is set up on a server. A local printer can be a local print device that is attached directly to the printer by parallel or serial cable, or it can be a network print device that is connected directly to the network. The distinction is that a local printer object on the server has direct control over the print device whether it is connected directly to the print server or across a network link. A remote printer object on a server points to a print object on another print server.

Creating the Print Environment Once the printing environment has been planned out, it needs to be created on the print server or servers. This process involves setting up the print queues and configurations for each print device to be set up.

Installing a Local Printer Follow these steps to set up a printer that will be directly connected to the print server. 1. Open the “Printers” folder, double-click the Add Printer icon. 2. Select Local printer and click Next. (Windows 2000 can auto-detect a large number of printers that are connected directly. If you want to install a different driver for a printer, or if the printer has not been connected to the server yet, turn off the “Automatically detect my printer” check box (see Figure 7.1).

74_sysad_07.qx 11/8/99 10:18 AM Page 251


Figure 7.1

Select a local printer.

3. Select the correct printer port and click Next. 4. Select the printer manufacturer and the specific printer type from the scrolling menus. If you have alternate drivers for the printer, click Have Disk (see Figure 7.2).

Figure 7.2

Select the print device manufacturer and model.

251

74_sysad_07.qx 11/8/99 10:18 AM Page 252

252


5. Specify the name for the printer. This is the name that will appear locally on the print server. If this is not the first printer installed, an option to specify this printer as the default will appear in the dialog box (see Figure 7.3).

Figure 7.3

Specify the printer name.

6. Specify the share name of the printer. This is the name that will be advertised on the network for the printer (see Figure 7.4).

Figure 7.4

Specify the share name.

74_sysad_07.qx 11/8/99 10:18 AM Page 253


7. Fill in the location and comment fields as necessary. These can be left blank, but specifying location and other information can help easily identify the print device for usage or troubleshooting (see Figure 7.5).

Figure 7.5

Set the location and comment fields.

8. Review the summary information at the end of the Add Printer Wizard. If the information is correct, click Finish to close the wizard (see Figure 7.6).

Figure 7.6 Complete the wizard.

253

74_sysad_07.qx 11/8/99 10:18 AM Page 254

254


Installing a Network Printer Follow these steps to install a local printer that is not directly attached to the print server but is not configured on another print server. 1. Open the “Printers” folder and double-click the Add Printer icon (see Figure 7.7). Click the Create a new port: radio button and select the appropriate port type from the Type: popup list. Depending on the configuration of the server, you may find options for Appletalk Printing Devices, Local Port, LPR Port, and Standard TCP/IP Port, among others. This example will use the Standard TCP/IP Port selection.

Figure 7.7

Select the new port type.

2. Specify the IP address of the print device. The Port Name will automatically be entered as IP_ followed by the IP address entered in the Printer Name or IP Address field (see Figure 7.8). 3. Select the print device manufacturer and type from the scroll lists. 4. Specify the name of the printer and indicate whether it should be the default printer.

74_sysad_07.qx 11/8/99 10:18 AM Page 255


Figure 7.8

Set the port IP address.

5. Specify the share name of the printer. 6

Fill in the Location and Comment fields as desired.

7. Review the printer information and click Finish if the information is correct (see Figure 7.9).

Figure 7.9 Complete the wizard.

255

74_sysad_07.qx 11/8/99 10:18 AM Page 256

256


Installing a Printer from Another Server A Windows 2000 print server can also be configured to interface with a printer interface already set up on another print server. In Microsoft terminology, this is known as remote printing. The printer interface is set up on the local server, which manages print jobs as any other printer does, but print job information is sent to the remote print server instead of to a print device. Follow these steps to set up a remote printer: 1. Open the “Printers” folder and double-click on the Add Printer icon. 2. Click the Remote printer radio button. 3. Choose the method to use to locate the printer. If the printer is set up on a Windows 2000 server in the Active Directory, use the Find a printer in the Directory button. Otherwise, you can specify the path to the printer using the printer’s UNC path or URL if it is on a Web-enabled print server (see Figure 7.10).

Figure 7.10

Locate the remote printer.

4. Locate and load any print drivers, if necessary. 5. Review the printer information in the final wizard screen and click Finish if the information is correct.

74_sysad_07.qx 11/8/99 10:18 AM Page 257


Other Types of Network Printers The example showed how to use the Standard TCP/IP Port to connect with a network print device. This port type is always available with the standard Windows 2000 server installation. Other types of printer ports are available for use, but require additional Windows 2000 services to be installed. Two commonly used printer port interfaces are not installed by default with Windows 2000.

AppleTalk Printing Devices Before an AppleTalk print device can be set up on a Windows 2000 print server, the server must first have the AppleTalk protocol loaded in Local Area Connection Properties under Network and Dialup Connections. The server can also point only to an AppleTalk print device that is capable of advertising itself on the AppleTalk network. An administrator who provides printing services for AppleTalk print devices must decide whether the service is to control all access to the AppleTalk print device or whether the service will coexist with other printing services. Networked Macintosh computers can print directly to network-enabled print devices via either the AppleTalk or TCP/IP protocols, acting as their own print server. This approach depends on the printer’s managing the incoming jobs from multiple print sources. One advantage is that the client workstation has to spool the print job only once, directly from the computer to the printer. One disadvantage is that printing priorities cannot be set, since the print device is the sole arbiter of how incoming jobs are processed. Setting up the Windows 2000 print server to coexist with other direct-connect print clients only compounds this problem; any priority or job control settings configured for the printer on the print server only affect the jobs submitted to that print queue. The print device then sees the print server as only one of its many clients. Windows 2000’s print server can be configured to completely control access to the AppleTalk print device so that this

257

74_sysad_07.qx 11/8/99 10:18 AM Page 258

258


scenario does not play out. In effect, the print server talks to the print device and convinces it to respond to print requests only from the print server. The print device stops advertising its services on the network to every device except the print server. That way, all AppleTalk printing is routed through the Windows 2000 print server, allowing the administrator to assign any priorities and job controls deemed necessary. The downside is that if any problems occur with the print server, access to the AppleTalk printers is not released, preventing the Macintosh workstations from printing directly to the device during the downtime.

LPR/LPD Print Services LPR/LPD print services are commonly known as UNIX print services. The Windows 2000 implementation of this service behaves exactly like a UNIX print server. LPD services set up on the Windows 2000 print server enable a UNIX workstation to print to the same print queue as Windows- and Macintoshbased clients. The print server can also use an LPR configuration to communicate with network-interface print devices. While configuring a printer port as a Simple TCP/IP Port works well with printers that have intelligent network interfaces, setting up a printer with an LPR port can be advantageous because it works with a wider variety of network interfaces. Many print devices that support TCP/IP printing will support an LPR interface, but not all have an advanced network interface, like the JetDirect interface on many Hewlett-Packard printers. The main drawback is that a printer configured as an LPR device is not able to give an accurate status of the print device to the print server, as LPR communication is one-way, from the print server to the print device. It is critical with LPR printing that bi-directional printer communication be turned off in the printer driver. This option is found in the Ports tab of the Printer Properties dialog box, as illustrated in 7.15. Some printer drivers automatically acknowledge that bi-directional communication is not available in LPR

74_sysad_07.qx 11/8/99 10:18 AM Page 259


mode, and the option is grayed-out in the dialog. Other drives attempt to activate bi-directional communication regardless of the port type and must be turned off manually. Failure to turn this off can lead to print server hangs that can affect the entire print environment. The easiest way to set up either of these additional printing services is to install them at server install time. If a new server is going into a planned printing environment, these optional services can be set up automatically when the print server components are configured during installation.

Loading Printer Drivers Creating a printer on the print server automatically installs printer drivers on the server. While Windows 2000 and Windows NT workstations will rely on the print server for the correct printer driver, Windows 95 and Windows 98 workstations must have printer drivers installed locally. When the Windows 95 or Windows 98 client installs a printer from the print server, it attempts to download the appropriate printer driver from the server. Thus, it is necessary to load the printer driver for these platforms on the print server so that the drivers are available for download. Follow these steps to verify that the additional printer drivers are installed and to install them, if necessary: 1. Open the Printer Properties dialog box of an installed printer by right-clicking on the printer and selecting Properties from the pop-up menu, or select Properties from the File menu with the printer highlighted. 2. Click on the Sharing tab and then on Additional Drivers (see Figure 7.11). 3. Scroll through the list of drivers to see whether the driver for the desired platform has been installed. If it has not, click on the check box next to each platform and click OK (see Figure 7.12). 4. Follow the steps for locating the printer drivers to install them.

259

74_sysad_07.qx 11/8/99 10:18 AM Page 260

260


Figure 7.11

This is the Printer Properties Sharing tab for additional drivers.

Figure 7.12

Select additional drivers to load.

74_sysad_07.qx 11/8/99 10:18 AM Page 261


Printer Properties Important information is included in the Properties dialog for a printer object in Windows 2000 server. Though it is up to the printer driver to provide the specific information available in the Properties dialog, the basic elements are included for every printer. Even if the examples in this section do not exactly match your environment, you should be able to locate the correlating information quickly. All screen shots in this section were captured from a printer using the HP LaserJet 5Si/5Si MX PostScript driver.

General The General tab of the printer properties, shown in Figure 7.13, provides the basic advertising information about the printer: local printer name, location and comment information, printer model, and printer features where applicable. This tab also contains the Print Test Page function to confirm proper printer configuration and communication. The default printing preferences for this printer can be set from this tab with the Printing Preferences button.

Figure 7.13

This is the Printer Properties general tab.

261

74_sysad_07.qx 11/8/99 10:18 AM Page 262

262


Sharing The Sharing tab, shown in Figure 7.14, specifies whether the printer is shared, what the share name is, and whether the shared printer is listed in the directory. Additional printer drivers for the printer can be added here with the Additional Drivers button.

Figure 7.14

This is the Printer Properties sharing tab.

Ports The Ports tab, shown in Figure 7.15, provides the interface for setting or modifying the printer port. Server ports can be added, removed, and configured through this tab, and this is where printer pooling can be enabled. Bi-directional printer support can be enabled in this interface as well, if it is supported by the printer and the port.

74_sysad_07.qx 11/8/99 10:18 AM Page 263


Figure 7.15

This is the Printer Properties Ports tab.

Advanced The Advanced tab, shown in Figure 7.16, contains settings for the printer driver and the print priority for the queue. This is where printer availability and other settings can be specified. Default printing preferences, print processor specifications, and separator pages can be accessed through the buttons in this interface.

Security The Security tab, shown in Figure 7.17, is where the printer object’s permissions are specified.

263

74_sysad_07.qx 11/8/99 10:18 AM Page 264

264


Figure 7.16

This is the Printer Properties Advanced tab.

Figure 7.17

This is the Printer Properties Security tab.

74_sysad_07.qx 11/8/99 10:18 AM Page 265


Device Settings The Device Settings tab, shown in Figure 7.18, is specific to the print device, depending on the printer driver loaded. Installable printer options can be specified in this interface, and some of those settings, such as installation of a duplex for two-sided printing, will have an impact on the default printer settings elsewhere in the Printer Properties dialog.

Figure 7.18

This is the Printer Properties Device Settings tab.

Managing Printer Permissions Once the printer interfaces are set up and working on the print server, the focus of printer administration changes to management and maintenance. Management of the printer objects on the server involves many different aspects of administration, from securing printer access through security permissions to managing documents in the printer queues at the client’s request.

265

74_sysad_07.qx 11/8/99 10:18 AM Page 266

266


Security/Sharing Permissions Three basic security permissions apply to Windows 2000 printing: ■

Print allows an account to connect to a printer, print a document, and control that document in the printer queue.

■

Manage Documents includes Print permissions as well as the ability to control all documents in a queue and modify the job settings for those documents.

■

Manage Printers includes the permissions for Print and Manage Documents, as well as the ability to modify printer properties and permissions, modify a printer’s sharing setup, delete all documents in a print queue, and delete the printer from the server.

By default, the Everyone group is assigned the Print permission on all printers created on the server, as shown in Figure 7.19. The Creator Owner group is assigned the Manage Documents permission (see Figure 7.20). The Administrators, Print Operators, and Server Operators groups are given all three permissions on each printer on the server (see Figure 7.17).

Figure 7.19

These are the default printer permissions for the Everyone group.

74_sysad_07.qx 11/8/99 10:18 AM Page 267


Figure 7.20

These are the default printer permissions for the Creator Owner group.

Additional permissions can be set on a printer to limit access to the printer and its associated print device. For example, a purchasing department in a company may have a print device set up that uses a special form to generate purchase orders. Having a stray print job print on the print device would waste both time and forms, so access to the printer is limited to the purchasing department only. To do this, the administrator would add the Purchasing group to the printer and give that group the Print permission. In addition, the Everyone group would be removed from the security list so that accounts not belonging to the Purchasing group would not have access to the printer. As another example, the purchasing department has determined that its internal billing group has been sending invoices to the purchase order printer by accident and has asked the administrator to block that group from the printer. To achieve this, the administrator will add the

267

74_sysad_07.qx 11/8/99 10:18 AM Page 268

268


Billing group to the security list but will check the Deny box for the Print permission. This will prevent any member of the Purchasing group that is also a member of the Billing group from submitting any jobs to the printer. This example also illustrates why the Everyone group was not denied access to the printer in the first example. The Deny permission always overrides the Allow permission, so if the Everyone group had been set to Deny, no one on the server would have been able to print to the printer.

Printer Ownership The account that creates the printer on the server becomes the owner of the printer. Ownership of the printer gives all printing permissions to the associated account. Usually, this is an administrator account, but accounts that have been given permissions to create printers on a server will be given full control over the printer or printers created by the account. If the owner of a printer is no longer able to perform that role, resulting from a job role change or an individual’s leaving the company, ownership of the printer can be reassigned to another account. Ownership of a printer can be changed in the Access Control Settings dialog box, which is found by clicking the Advanced button on the Security tab of the printer properties. The ownership information is in the Owner tab and indicates which account is the current owner of the printer as well as which accounts can become the owner of the printer (see Figure 7.21).

74_sysad_07.qx 11/8/99 10:18 AM Page 269


Figure 7.21

These are current and potential owners for Printer1.

Managing Printers Information about more advanced printer management topics can be used to help fully customize the printing environment and perform advanced maintenance tasks.

Assigning Forms to Paper Trays Today’s high-capacity, feature-rich laser printers often come with multiple paper -source trays. These trays can be assigned specific forms in the printer setup on the print server when special paper will be used in the printer. One example would be using legal-size paper in one of the trays in a print device. If it were specified that legal paper is in Tray 3, any document sent to the printer with a legal paper size would automatically print out of Tray 3.

269

74_sysad_07.qx 11/8/99 10:18 AM Page 270

270


Depending on the printer type and accessories provided, a multitude of printer/paper combinations are possible. This results in a friendlier printing environment for your network clients. Printing forms can be added or customized in the Print Server Properties dialog. The Print Server Properties dialog can be opened by selecting Server Properties from the File menu in the Printer window. The Forms tab contains the information about the printer form types. Figure 7.22 shows how to set up Tray 3 for legal-size paper in a printer.

Figure 7.22

Change print forms for a specific printer tray.

Assigning Separator Pages Separator pages, also known as banner pages, are printed at the beginning or end of a print job to separate that printout from others on the same printer. This is highly advantageous in a large shared printing environment. Separator pages can also be used to switch modes on the print device. Many printers now support both the PCL and PostScript printer languages and can usually automatically

74_sysad_07.qx 11/8/99 10:18 AM Page 271


switch between them. Sometimes, however, it is beneficial to use a separator page to force the printer to use a specific language for a specific print job. By default, printers on Windows 2000 servers do not have separator pages turned on, but Windows 2000 does provide four different separator page scripts that can be used if separator pages are needed on the printer. The four scripts are: ■

Pcl.sep switches the language mode on HP-compatible printers to PCL and prints a separator page.

■

Pscript.sep switches the language mode on HP-compatible printers to PostScript and prints a separator page.

■

Sysprint.sep prints a separator page before each document and is compatible with most PostScript printers.

■

Sysprtj.sep is a Japanese-character version of Sysprint.sep.

The Separator Page dialog (see Figure 7.23) can be accessed from the Advanced tab of the Printer Properties dialog. The default separator scripts are located in the Windows 2000 system32 directory.

Figure 7.23

Set a separator page.

Since the separator page scripts contain only printer language commands, it is possible to set up customized separator pages for a particular print device or customer group. Only those who are intimately familiar with the specific printer language should attempt to customize or create a new separator page script.

271

74_sysad_07.qx 11/8/99 10:18 AM Page 272

272


Creating a Printer Pool Occasionally network printing will increase to such a level that a single printer is unable to keep up with the printing demands. The solution is, of course, to add another printer, but printing clients may become confused if they are instructed to use a new printer on the server for their print jobs. Through printer pooling, administrators can add printers to the network and lessen the demands on existing printers without adding more confusion. In order for printer pooling to work, all print devices in the pool must be of the same type, as they will be driven by the same printer driver. A printer port must be set up for each print device on the server, and then the printer must be configured to print to multiple ports. This configuration is done in the Ports tab of the Printer Properties dialog (see Figure 7.24).

Figure 7.24

Set printer pooling for Printer1.

74_sysad_07.qx 11/8/99 10:18 AM Page 273


When a printer is set up for a single print device, the Ports tab can only have one port checked at a time. To specify additional ports for the printer, the Enable printer pooling check box must be checked, and then multiple ports can be checked in the window. If a print server has two LaserJet 5Si printers connected to LPT1: and LPT2:, checking both these ports in the Ports tab will share that printer between the two print devices. When a print job comes into the queue, it begins spooling to the first available print device. This decreases the time a print job must wait before spooling to the print device. Network clients will be much happier when their one- or two-page memo doesn’t have to wait for a 600-page presentation to finish on a print device before going through.

Specifying Printer Priorities The printing environment can also be configured in the reverse way, in which two printers are set up to print to a single print device. One reason for setting this up is to create a fast track for critical documents to be printed quickly, even if other jobs had been printed earlier. This can be accomplished by setting up two printers for a print device and giving them different print priorities. One printer might be called Printer1 and assigned a priority of 1, and another called Printer1 Critical and assigned a priority of 99. Network clients would use Printer1 by default, with their print jobs being serviced on a first-come, first-served basis. If someone had a critical job to print out, they would then use the Printer1 Critical printer, and that job would be the next one printed out, since that printer has a higher priority than the Printer1 printer. Printer priority is set in the Advanced tab, as illustrated in Figure 7.25. The desired value is set in the Priority selector, with 99 being the highest priority, and 1 being the lowest.

273

74_sysad_07.qx 11/8/99 10:18 AM Page 274

274


Figure 7.25

Set the priority on Printer1.

Redirecting a Printer Sometimes printer maintenance cannot take place after business hours. There are times when the print device dies during the day, and it must be diagnosed or repaired right away. To keep printing chaos to a minimum, the printer can be redirected to another print device, and the clients can be told to pick up their printouts from the alternate print device without having to change their printing configuration. This only works, however, when the alternate printer is the same kind as the one that has been made unavailable. Redirecting a printer is as simple as selecting a different printer port in the printer configuration, provided that an identical printer exists on that port. This is done in the Ports tab of the Printer Properties. No configurations have to be changed on the client workstation after the change is made on the server. The server simply begins routing the print jobs to the new port.

74_sysad_07.qx 11/8/99 10:18 AM Page 275


Removing Printer Drivers In a highly dynamic printing environment where printers are added, removed, and changed on a regular basis, the print server can end up with a large number of unused printer drivers installed. In addition, the administrator might find a problem in a printer driver and would like to install a newer driver. In either case, removing the printer drivers is a good practice. Information about installed printer drivers is located in the Server Properties window (see Figure 7.26), not in the Printer Properties dialog. To access Server Properties, select Server Properties item from the File menu in the “Printers” folder. Click on the Drivers tab to manage the printer drivers. From this window, drivers can be added, removed, updated, and modified manually, ensuring that the administrator has full control over how the drivers are installed.

Figure 7.26

Printer drivers are loaded on Server1.

275

74_sysad_07.qx 11/8/99 10:18 AM Page 276

276


Managing Documents in a Print Queue The server administrator or printer owner will periodically have to perform basic maintenance over the printer queue and the documents in it. This does not happen very often, and usually only at a client’s request. Clients might ask for a job to be canceled on the printer because they printed to the wrong printer, or perhaps there was something wrong with the job or the print device. These are the document management actions (see Figure 7.27).

Figure 7.27

These are document control actions for Printer1.

■

Pause puts a print job on hold, either to allow another job to print or to fix a problem with the printer.

■

Resume continues processing of a print job that had been put on hold.

■

Restart halts current processing of a print job and starts over from the beginning of the document.

■

Cancel deletes the print job from the queue entirely.

Sometimes a print job will get hung in the queue and will continue to show in the queue even after being canceled. If other print jobs can continue to print around the stuck job, this is only a cosmetic problem. But if other jobs are being blocked from printing as a result, then action must be taken. In both cases, the stuck job will be removed by stopping and restarting the spool services on the server. To do this, open a command prompt and enter:

74_sysad_07.qx 11/8/99 10:18 AM Page 277

Administering Printer Resources • Chapter 7 net stop spooler

or net stop “print spooler”

followed by net start spooler

or net start “print spooler”

to restart the print spooler. This will remove the stuck job, but may also jumble the order of other jobs that are in the queues on the server. Only members of the Administrator group will be able to recycle the spooler service.

Setting Priority, Notification, Printing Time In addition to setting a priority on a printer object, individual print jobs within a queue can be prioritized. Each print job has its own properties, including priority, notification, and print time settings. The properties of a print job can be viewed by selecting the Properties item under the Document menu in the print queue window. The owner of the document, the owner of the print queue, and any server or printer administrator can modify the properties of a document. Figure 7.28 illustrates the Document Properties window. By default, the name of the account that created the print job is specified in the Notify box as the account to receive notification when the print job has completed. If an account other than the creator of the jobs needs to be notified when the job is complete, enter the name of the account. To change the priority of the print job relative to the other jobs in the queue, move the Priority slider to the desired priority level, 1 being the lowest and 99 being the highest. Or to specify a specific time for a job to print, make the necessary changes in the Schedule fields in the Document Properties window.

277

74_sysad_07.qx 11/8/99 10:18 AM Page 278

278


Figure 7.28

These are the document properties.

Administering Printers by Using a Web Browser Not all administration of a printer must be done on the print server or an authorized workstation, or on a PC for that matter. Windows 2000 allows the server administrator to enable Web administration of the printers on the server. Internet Information Services (IIS) must be installed and running on the print server to make Webbased administration possible. An authorized individual can access the printer properties from a computer with a Web browser that can connect to the printer server computer. The URL to use to access the printer information is http://servername/Printers where servername is the domain name or IP address of the print server. The Web server will authenticate the client by asking for a username and password combination, and when access is authorized, the client will see the printer configuration as illustrated in Figure 7.29.

74_sysad_07.qx 11/8/99 10:18 AM Page 279


Figure 7.29

This is the Web browser interface for printers on Server1.

In the main window, the client sees all the printers that are configured on the print server, the status of each printer, the number of jobs in the printer’s queue, and the location, model, and comment configured for the printer. The page will update and show any changes in status and number of jobs. Each printer name is a hyperlink that will load a page showing all the current documents in the printer queue. This is illustrated in Figure 7.30. In this page, the client sees all the jobs that are waiting to be printed in the queue, including the status, the owner, the number of pages in the printout, the file size, and the time the job was submitted. The client can then click a specific document in the list and manage the document with the actions in the left of the screen. The client can also perform actions on the printer itself from this screen,

279

74_sysad_07.qx 11/8/99 10:18 AM Page 280

280


Figure 7.30

This is the Web interface used to document a list for Printer1 on Server1.

including pausing the printer, resuming the printer, and canceling all jobs in the printer. Authorization prompts may be given if the initially authorized connection does not have permissions to perform the selected actions. The client can also select to view the properties of the current printer by clicking the Properties link on the left of the page. This is illustrated in Figure 7.31. In this page, the browser displays configuration information about the printer, but only in display mode. The actual configuration of the printer cannot be changed through the Web interface. However, by giving configuration information about the printer, a client would be able to more easily locate a specific printer that would suit his or her printing needs without having to contact the print server administrator or other designated contact. In addition, the Web interface is easier to navigate than the printer folder interface.

74_sysad_07.qx 11/8/99 10:18 AM Page 281


Figure 7.31

This Web interface shows properties for Printer1 on Server1.

Best Practices A well-planned printing environment is a successful printing environment. There are two areas to consider when you plan the printing environment.

Organize Printers by Business Function or Geographic Location Try to place print devices close to the customer base whenever it is possible. No one likes to walk halfway across a building to get to a printer if another one is closer, even if that printer is slower or belongs to a different department. In addition, having a printer close to high-volume customers will increase their productivity by cutting

281

74_sysad_07.qx 11/8/99 10:18 AM Page 282

282


down on the amount of time spent retrieving printouts. Try to keep printers closest to the groups that are paying for maintenance. If a department’s printer meets their needs, the members of the department will be less likely to use another department’s printers, avoiding a potential billing nightmare.

Put Print Devices on a Separate Network The more network-capable print devices there are in an organization, the more sense it makes to isolate them on a separate network segment. This will cut down on the traffic load on the other network segments, helping to avoid any future network bottlenecks. The print server should have two network cards, one to communicate with the public network and one to communicate with the printer network. The print server will end up acting as a bridge between the two network segments, and this must be taken into account when you plan for the load on the server. Isolating printers on a separate network can help avoid network address conflicts, especially in a TCP/IP printing environment. Clients are less likely to mis-configure the network interface on a PC and steal a printer’s address if the printer is on a separate network.

Allow Clients Access to Web Printing Interfaces Allowing your clients to access printing services through the Web will significantly cut down on customer calls for printing issues. Even restricting all clients to Read-only access to the printer queues from a Web browser can still be beneficial, as the customer is able to view the status of the print device and the print queue. In addition, enabling document owners to manage their documents through the Web gives your staff more time to focus on other issues. Also consider identifying one person within a department or other business group to be the administrator for a printer or set of printers within that department. That administrator can then be equipped to handle all initial issues with the printers, passing on to you only those issues that require action by your staff.

74_sysad_07.qx 11/8/99 10:18 AM Page 283


Restart Print Spool Service Periodically Periodically, printers will have a collection of stray, dead print jobs either in the queue or on the disk. These jobs can clutter the printer interface seen by the client and can also take up valuable disk space. There are several ways to clean up this clutter. One is to stop and restart printing services on a regular basis. Depending on the environment, once a month or once a week may be enough. Some support organizations restart printing services on a nightly basis to clean up the printer queues. Printing services should be shut down and restarted during a time when there is little or no printing activity. A script can be set to execute during these times, usually in the middle of the night, so no human intervention is needed. Print jobs will occasionally leave temporary files behind in the printer spooler directory. It is not necessary during every restart of printing services, but the spool directory should be cleaned out regularly as well. This should be done while the print service is offline to avoid interference with active print jobs.

FAQs Q: I’ve set up the printer queue and the printer is on, but when I print a test page nothing prints on the print device.

A: The printer might have the wrong port selected, and the test page is going to another printer. Also, the wrong print driver might be loaded, and the printer is unable to process the job (such as sending PCL code to a PostScript printer).

Q: I keep getting a message that I can’t access the printer. A: The permissions on the printer may not be set correctly or the client may not be logged on the network (Windows 95/98 client).

283

74_sysad_07.qx 11/8/99 10:18 AM Page 284

284


Q: I’ve submitted a job, but it won’t print. I keep deleting and resubmitting, but it just sits in the queue.

A: The printer queue may be paused, either on the server or on the client workstation (Windows 95/98). The printer may also be set to Work Offline mode, a frequent occurrence with laptops.

Q: My document has been showing a status of “Printing—Printer Busy or Error” for the last half hour.

A: The printer may be processing another job from another server or queue, may be out of paper, many be jammed, and so on. This message usually comes up with printers set as LPR printers when the server cannot get status information back from the printer.

74_sysad_08.qx 11/8/99 10:08 AM Page 285

Chapter 8

Managing Data Storage

Managing data in Windows 2000 involves data compression, setting disk quotas, data encryption, and disk defragmentation. Proper management of data storage ensures that your computers run smoothly, efficiently, and with few problems. Data compression creates extra storage space on your volumes. By enforcing disk space limits, disk quotas ensure that users do not abuse disk space. Encryption ensures that data is not viewed by the wrong users, and disk defragmenting speeds processor time.


Managing Data Compression

■

Encrypting Data

■

Using Disk Defragmenter

■

Defragmenting NTFS File System Partitions 285

74_sysad_08.qx 11/8/99 10:08 AM Page 286

286

Chapter 8 • Managing Data Storage

Managing Data Compression Windows 2000 data compression is much like packing your summer wardrobe into one part of your closet until next season. Your summer clothes and shoes are spread out throughout your closet and dresser drawers, but at the end of the summer, you pack them away for the winter. When you pack them, you roll your clothes and pack your socks inside your shoes, and squish as much as you can into one part of your closet. The clothes have not changed in dimension, but they take up a smaller area. This is essentially what Windows 2000 data compression does. It takes the files and folders that you seldom use (your summer clothes) and compresses them into a smaller package (packing them more tightly so that they fit in a small part of your closet rather than being spread throughout your room). This way, they take up less space on your drive and leave more room for new files and folders (your new winter clothes). Data compression decreases the amount of disk space required for file storage so that you can add either more data or new applications. Data compression is available only for drives formatted with the NT file system (NTFS). Compression can be performed on files, folders, or whole NTFS volumes. After a file is compressed, when you want to access it, you don’t have to decompress it manually; it is decompressed automatically by Windows 2000 before it is available for use. The same thing happens after you are finished with a file and you save it. The file is recompressed automatically by Windows 2000.

Compressing Files and Folders To compress a file or folder, right-click it. Select Properties from the pop-up menu and then choose the Advanced button. There are four check boxes to choose from in the Advanced dialog box. Choose the “Compress contents to save disk space” check box and then click OK (see Figure 8.1). To uncompress a file or folder, simply remove the check mark from the check box and click OK.

74_sysad_08.qx 11/8/99 10:08 AM Page 287

Managing Data Storage • Chapter 8

Figure 8.1

This is the Advanced Attributes dialog box for a folder on an NTFS volume.

It is possible to compress a folder, but not the files and subfolders within it. You might want the files already in a folder to remain uncompressed, but you want new files to be compressed. There are two ways to do this. You can either compress every new file as you add it to the folder, or you can compress the folder so that all files added to the folder will be compressed automatically. When you are compressing a folder, the Confirm Attribute Changes dialog box will ask if you want the compression applied to the files and subfolders within the folder that you are compressing (see Figure 8.2).

Figure 8.2

In this case, the Confirm Attribute Changes dialog box confirms the compression attributes.

287

74_sysad_08.qx 11/8/99 10:08 AM Page 288

288


There are two options when you compress a folder: ■

Apply changes to this folder only. This option will compress only the folder, not any files or subfolders below it. It will pass on the changes in compression state to any files and subfolders copied into the folder in the future.

■

Apply changes to this folder, subfolders, and files. This option will pass down the changes in compression state to all the subfolders and files within it as well as to any files and subfolders copied into the folder in the future.

If you choose to change the compression status for the subfolders and files as well as for the folders, you will see a dialog box showing the compression status for each file and subfolder as it changes (see Figure 8.3). You can click Cancel if you decide that you no longer want to perform this action. If you cancel the action before the compression has been completely applied, the folders that already received the compression attribute will remain compressed, but unchanged files and/or folders will remain unchanged.

Figure 8.3

The Compression Status dialog indicates the time remaining.

When you want to change the compression state of a file or folder, you must have the proper permissions for that particular file or folder. To change compression status, you will need at least write permission for that file or folder.

74_sysad_08.qx 11/8/99 10:08 AM Page 289


Determining Compression Status There are several ways to determine if a file or folder is compressed. You can right-click the file or folder, select Properties and then the Advanced button, and view the attribute properties. Alternatively, you can configure the color scheme for compressed and uncompressed files and folders. Compression status is not displayed with an alternate color by default, but you can configure it in Windows Explorer. To change the color that indicates compression status, open Windows Explorer, choose the Tools menu, and then choose Folder Options. Click the View tab and select the “Display compressed files and folders with alternate color” check box (see Figure 8.4).

Figure 8.4

In Files and Folders you can choose to display compressed folders in an alternate color.

289

74_sysad_08.qx 11/8/99 10:08 AM Page 290

290


Click Apply or OK to apply the changes. Once you have done this, the compressed file and folder names will appear in blue, while the uncompressed file and folder names will remain in the system colors you have defined (see Figure 8.5).

Figure 8.5

In this Windows Explorer window, an alternate color is used to display only the compressed folders Inetpub and temp.

You can also compress an entire volume by going into My Computer or Windows Explorer and choosing the volume that you would like to compress. Right-click Volume and select Properties from the pop-up menu. From the General tab, you can configure Windows 2000 to compress the entire drive (see Figure 8.6). It is best to compress data that is accessed infrequently, to reduce system degradation.

74_sysad_08.qx 11/8/99 10:08 AM Page 291


Figure 8.6

You can compress an entire volume/disk from within the General tab of the Local Disk Properties dialog box.

Disk Space Requirements Disk space is allocated on the basis of the uncompressed size of files and folders, because when you want to view, edit, or move a compressed file, NTFS automatically uncompresses it, lets you use it while it is uncompressed, and then recompresses it when you are finished. Therefore, if you want to copy a compressed file to another drive, you need to make sure that there is enough room for the file when it is uncompressed; otherwise you will get an error message stating that there is not enough room for the file on the destination drive.

291

74_sysad_08.qx 11/8/99 10:08 AM Page 292

292


Compression State The compression state for a folder does not necessarily represent the compression state for the files and subfolders beneath it. For example, an uncompressed folder can contain several files that are compressed, or it can be compressed but contain several uncompressed files and subfolders. Consequently, when you are checking the compression status of your files and folders, you must check each individual file to determine its compression state. This is why the color differentiating for compressed and uncompressed folders is so helpful. If the color differentiating is enabled, you can see the compression state of each file and folder without having to go into the properties of each one.

Compression Rules Compressed files and folders cannot be encrypted. NTFS encryption and compression are mutually exclusive. Therefore, if you encrypt a file, you cannot compress it, and if you compress it, you cannot encrypt it. Windows 2000 also only supports compression for cluster sizes under 4 KB, because compression on larger clusters can cause performance degradation. If you try to compress data on a volume with a larger cluster size, you will notice that compression is not an option and is therefore not available for that particular volume. You cannot compress files on FAT partitions, because FAT partitions do not support Windows 2000 file compression.

Copying and Moving Compressed Files and Folders In Windows 2000, as in Windows NT 4.0, there are rules that determine the compression state when you move and copy files and folders within and between volumes. There are also rules that determine the compression state when you move and copy files and folders between FAT and NTFS partitions. Compression is a feature of NTFS volumes only and cannot be performed on a FAT volume.

74_sysad_08.qx 11/8/99 10:08 AM Page 293


Copying compressed files and folders can cause performance degradation, because Windows 2000 uncompresses the file, copies it to the new location, and then compresses the file again.

Copying a File within an NTFS Volume When a file is copied from one folder to another folder within an NTFS volume, the compression setting for the file changes to that of the target folder. Copying a file is like creating a new file in the target folder, so it will take on the attributes of the target folder. For example, if you copy an uncompressed file into a compressed folder, the file will be automatically compressed (see Figure 8.7).

Figure 8.7

When data is copied within an NTFS volume, the data inherits the compression attributes of the target folder.

Copy

Copy

Moving a File or Folder within an NTFS Volume When a file or folder is moved from one folder to another within an NTFS volume, the compression setting is retained. For example, if you move an uncompressed file into a compressed folder on the same volume, the file will remain uncompressed (see Figure 8.8).

293

74_sysad_08.qx 11/8/99 10:08 AM Page 294

294


Figure 8.8

When data is moved within an NTFS volume, the data retains its compression attributes regardless of the compression status of the target folder.

Move

Move Copying or Moving a File or Folder between NTFS Volumes When a file or folder is copied or moved from one folder to another on different NTFS volumes, the compression setting for the file changes to that of the target folder. Once again, this happens because when you copy or move a file from one volume to another, it has to create the file at the target and then delete it from the source, so it takes on the attributes of the folder in which it is created (see Figure 8.9 and Figure 8.10).

Figure 8.9

When data is copied between NTFS volumes, the data inherits the compression attributes of the target folder.

Copy

Copy

74_sysad_08.qx 11/8/99 10:08 AM Page 295


Figure 8.10

When data is moved between NTFS volumes, the data inherits the compression attributes of the target folder.

Copy

Move Moving or Copying a File or Folder from an NTFS Volume to a FAT Volume or to a Floppy Disk When a file or folder is moved or copied to a FAT volume, it is automatically uncompressed, because FAT does not support Windows 2000 file compression (see Figure 8.11). Floppy disks also do not support compression, as the information needed to support the NTFS file system cannot fit on a floppy, so floppies end up being FAT (see Figure 8.12).

Figure 8.11

When data is moved or copied from an NTFS volume to a FAT volume, the data is automatically uncompressed. Copy/Move

Copy/Move

295

74_sysad_08.qx 11/8/99 10:08 AM Page 296

296


Figure 8.12

When data is moved or copied from an NTFS volume to a floppy disk, the data is automatically uncompressed. Copy/Move

Copy/Move You cannot choose the color for compressed files to be viewed by default, but you can do so with a Microsoft utility called TweakUI (see Figure 8.13). TweakUI is a Windows NT Powertoy that provides access to many hidden registry keys in Windows 95/98/NT/2000. One feature of this utility allows you to set the compressed data color to a different color. Powertoys were developed by Windows developers in their spare time. They are not officially supported by Microsoft, although they work very well. You can find TweakUI by browsing http://www.microsoft.com/windows and looking for Windows NT or 2000 power toys.

74_sysad_08.qx 11/8/99 10:08 AM Page 297


Figure 8.13

The Explorer tab of the TweakUI utility includes the option to change the color of compressed files at the bottom of the dialog box.

Managing Disk Quotas Disk quotas are similar to credit card limits. When you have a credit card that has a limit of $3,000, you can spend up to and including $3,000. However, if you have reached your credit limit and you want to charge anything else to your credit card, you need to pay off some of the balance first. Disk quotas are used to manage the growth and size of file storage for each user or groups of users. They allow you to determine how much disk space each user or groups of users receive (credit limits) and ensure that they do not go over that limit or quota. Like compression, disk quotas can only be used with the NT file system (NTFS).

297

74_sysad_08.qx 11/8/99 10:08 AM Page 298

298


Disk quotas are managed through the Windows 2000 Disk Quota Manager (the credit card company). Through this utility, you can set disk quotas (credit card limits), send messages to users when they are approaching their quota, and disable further saving of data (any more charges to the card) until the users get back within their allotted quota (until some of the credit card bill is paid off). Windows 2000 Disk Quota Manager tracks disk usage for each user, no matter what folders their files are in or where the folders are stored on the network. Quotas are managed on each individual volume, not in combined volumes. Windows 2000 calculates disk usage based on the files and folders that each user owns. Windows 2000 “charges” the disk space against the user’s quota limit when the user creates or takes ownership of a file or folder. When Windows 2000 calculates hard disk space, it ignores compression, because files of different types can be compressed by different percentages, making it hard to predict the real size of the file; therefore, users are charged for each uncompressed byte. You can use disk quotas to set the disk quota limits for each individual user or for all users, determining how much disk space they can use and whether they can log an event. Once that is completed, you can set a disk quota warning so that users will receive a message informing them when they are approaching their limit. You can also set the consequences, determining what will happen when users reach their disk quota limit. For example, when users approach their quota limit, you can deny them any further disk space or you can let them continue using the resources. Once you set up disk quotas, Windows 2000 will begin collecting disk usage information for all users who own files and folders on each volume. This allows anyone in the administration group to monitor the disk quota levels on a per volume basis. To enable disk quotas, right-click the volume for which you would like to set disk quotas, select Properties, and then choose the Quota tab from the Disk Properties box. From here, several options can be configured, including the primary option, which enables quota management for this volume (see Figure 8.14).

74_sysad_08.qx 11/8/99 10:08 AM Page 299


Figure 8.14

Use the Quota tab to enable and disable disk quotas.

Select the first check box, “Enable quota management,” so that you can start using quota management. Once you select the check box, you can access the other options that were previously grayed out. The second check box is “Deny disk space to users exceeding quota limit.” Select this check box if you want users to be denied any further use of space once they exceed their quota limit. This is selected by default after you choose to enable quota management, so if you do not want to deny users disk space and would rather simply keep them informed when they are using more than they should, then you should uncheck this box. When this option is selected, users will receive an “Out of disk space” warning message when they save files, informing them that they have exceeded their quota and that they will have to decrease the number of their files and folders in order to continue. The next option configures the default quota limits for new users on the volume. These settings will define the default settings for any

299

74_sysad_08.qx 11/8/99 10:08 AM Page 300

300


new users who access that volume. You can either choose the “Do not limit disk usage” radio button or you can set the option to limit space. When you set the Limit Disk Space option, you can specify both disk space and warning level limits. The default is set not to limit disk space usage. The next section sets the logging options for the volume. There are two check boxes; one is used to choose whether to log an event when a user exceeds a quota limit, and the second is used to choose whether to log an event when a user exceeds the warning level. You can choose one, both, or neither of these check boxes, depending on how much information you want to have recorded in your event log. It is a good idea to log an event when users’ quota limits have been exceeded so that you can ensure that they get below their quota limit again as soon as possible. When you set the quota logging options, the information will be logged in the system log within the event viewer (see Figure 8.15).

Figure 8.15

Disk quota events are logged in the system log.

74_sysad_08.qx 11/8/99 10:08 AM Page 301


A quick way to determine the status of the disk quotas is to look at the traffic light in the top left-hand corner of the Quota tab. When the traffic light is green, the quota system is active and working; when the traffic light is yellow, it is rebuilding disk quota information; and when the traffic light is red, the quota system has been disabled. There is also a Quota Entries button on the Quota dialog box. Click this button to view all the quota entries for the disk that you have selected. You can use this area to set quota limits for specific users (see Figure 8.16). If you want to configure quotas for all users, you can do this in the Local Disk Properties dialog box.

Figure 8.16

This is the Quota Management console.

The Quota Entries dialog box monitors each user’s disk usage on the volume. It shows who has copied, saved, or taken ownership of files and folders on the drive. It can be used to determine how much disk space each user is using, as well as each user’s quota warning level and disk quota limit. A yellow triangle represents the users who are over their quota warning level, and a red circle signifies users who have exceeded their quota limit.

301

74_sysad_08.qx 11/8/99 10:08 AM Page 302

302


You can change the view of the Quota Entries dialog box so that you can view the items in the dialog box arranged by any of these parameters: ■

Folder

■

User Name

■

Logon Name

■

Status

■

Amount Used

■

Quota Limit

■

Warning Level

■

Percent Used

To change the method by which entries are displayed, choose the View menu, then the Arrange Items option, and then the view that you would like to use (see Figure 8.17).

Figure 8.17

You can use the Quota Entries text box to change the way quota entries are arranged.

74_sysad_08.qx 11/8/99 10:08 AM Page 303


To add a quota entry, select the Quota menu and then choose “New quota entry” from the drop-down box. A box then comes up, asking you from where you would like to select the user (see Figure 8.18). You can click the name and click Add, or you can doubleclick the name. Alternatively, you can type the name in the Name box and click Add. From there, you can click the Check Names button to ensure that the names you typed can be found and that the path to those names is set up. If the name cannot be found in any path, an Invalid Name text box pops up, prompting you to correct the name and search again or to remove the name from the name selections for the new quota entry.

Figure 8.18

Choose the users to whom to apply a new quota entry.

Then an Add New Quota Entry dialog box pops up, asking you to set the quota limit for the selected users. You can then choose whether to limit disk usage and what the limitations will be for the users. You can choose whether to limit disk space for the selected

303

74_sysad_08.qx 11/8/99 10:08 AM Page 304

304


users, just as you did when you set quotas for an entire volume. To limit the disk space for the users, simply click the Limit Disk Space To button and set the limit amount. Then set the warning level limit if you would like users to receive a warning before they reach their disk limit. You may need to delete the quota entries for a user who leaves the company. Before you do so, the files and folders that the user owned must no longer be owned by that user. Those files and folders must be moved onto another volume without having disk quotas set up for them, or else another user must take ownership of them. If this is not done, you will be unable to delete the quota entries for the user who left. To delete a quota entry for a user, simply choose the Quota menu and then click Delete Quota Entry from the dropdown box (see Figure 8.19). A dialog box will pop up, asking you if you are sure that you would like to delete that quota entry.

Figure 8.19

This is how a quota entry is deleted.

74_sysad_08.qx 11/8/99 10:08 AM Page 305


Encrypting Data Using data encryption is similar to using a secret code to record your most personal thoughts in a journal. You want to ensure that no one else will be able to read your journal, but you do not want to have to lock it up or hide it, so you invent your own secret code. Only you and one of your closest friends know how to unscramble the code to read what was written. Sometimes directory and share permissions are just not enough. This is where EFS comes in. EFS is the acronym for the Windows 2000 Encrypting File System. EFS allows users to encrypt data in selected NTFS files and folders so that it can be stored securely on the computer. EFS is quite simple to use, and is invisible to the user. It is also very difficult to attack because it is incorporated with the file system. Once a user decides what data to encrypt, a private key is created so that only the user will be able to unlock the code. Although encrypted files cannot be viewed by anyone other than the user who encrypted them, they can be deleted by anyone, just as a diary can have pages ripped out. EFS can be used only with data accessed by a single user and stored on that user’s local computer or on the server. It does not work with shared files and folders, nor can the user who encrypted the data give others encrypted access to the data. Using EFS, users can encrypt, decrypt, access, move, copy, and rename their files. EFS is set up by default so that users can automatically begin encrypting their files at any time. It automatically creates an encryption key pair for users when they encrypt their first file or folder as long as they do not already have one. Encryption is managed through Windows Explorer or the cipher command line utility. To encrypt a file or folder, simply right-click the file or folder and choose Properties from the pop-up menu. Click the Advanced button and then add a check mark to the “Encrypt contents to secure data” check box (see Figure 8.21).

305

74_sysad_08.qx 11/8/99 10:08 AM Page 306

306



Decrypting and Encrypting Data using the Cipher Command An alternative way to configure data encryption is to use the cipher command from a command line. To see the command line options for the cipher command, type “cipher /?” at a command line (see Figure 8.20). You can also decrypt a file by using the cipher command at a command line (see Figure 8.20). Figure 8.20 These are the cipher /? command line options.

If you are encrypting a folder, a Confirm Attribute Changes dialog box will pop up, asking you whether you would like to encrypt only the folder, or the files and subfolders within the folder as well. If you choose the latter option, any files and subfolders that you add to the encrypted folder will also be encrypted (see Figure 8.22). Keep in mind that compression cannot be combined with encryption. They are mutually exclusive.

74_sysad_08.qx 11/8/99 10:08 AM Page 307


Figure 8.21

Use the Advanced Attributes dialog box to select file and folder encryption.

If you choose to apply the changes to the files and subfolders within the folder, then an Applying Attributes box, similar to the compression status indicator, will appear. If you decide that you no longer want to apply the changes, you can click Cancel, but the changes will still be applied to those files and folders whose attributes have already been

Figure 8.22

The Confirm Attribute Changes dialog box confirms encryption attributes.

307

74_sysad_08.qx 11/8/99 10:08 AM Page 308

308


changed. This makes it difficult to determine what was actually encrypted and what was not. That is all the user sees of the encryption process, but there is a lot more going on in the background.

File Encryption Once you elect to encrypt a file, a unique file encryption key will be created that will be used later to decrypt the data as required. The file encryption key is encrypted also, to provide maximum security. Both the user’s public key and the public key of the recovery agent encrypt both the file and the encryption key. The user’s public key corresponds to the user’s EFS certificate, so that this user is the only one who can view the files. Folders do not get encrypted; only the files within the folders are encrypted, because the encryption key encrypts only files. Neither system files nor compressed files can be encrypted.

Decryption of Files Before a file can be decrypted, the file encryption key must be decrypted. This can take place only when the user’s private key matches the public key. The only person who can decrypt the file is the user who encrypted the file. The only exception to this rule is when the recovery agent is called upon to decrypt a file that can no longer be encrypted. This can be done by using the emergency recovery agent’s private key.

Storing Encrypted Files on Remote Servers Windows 2000 supports the storage of encrypted files on remote servers, but encrypted files are still limited to single users for decryption. Because encrypted data is not usually encrypted when it is being transported over the network, it is not as secure as it would be if it were stored on a local computer. A user can encrypt files that reside on a remote server only if the administrator first designates the remote server as “trusted for delegation.” This is not set up by

74_sysad_08.qx 11/8/99 10:08 AM Page 309


default, so you must remember to configure this if you need to have data encrypted while it is being transported. After this is set, all users can encrypt their files that reside on that server.

Accessing Encrypted Data Accessing encrypted data looks exactly the same to the end user as accessing regular data. EFS works transparently in the background, but only when the user who encrypted the file tries to access it. A user who did not encrypt a file or folder but who tries to access encrypted data will receive an “Access Denied” message, because that user does not have the correct private key that corresponds to the file’s or folder’s public key.

Moving and Renaming Encrypted Data When a user renames an encrypted file, the file retains its encryption state. For example, if you rename a file that is encrypted, it will still be encrypted after the name is changed. Similarly, when a user moves a file to another folder, the file retains its encryption state whether or not the destination folder is encrypted.

Decrypting Data Decrypting data is simple. All the user has to do is remove the check mark from the encryption check box in the file’s properties. Once a file is decrypted, it will stay unencrypted until a user encrypts it again.

309

74_sysad_08.qx 11/8/99 10:08 AM Page 310

310


The Recovery Agent Private keys are kept in a protective key store. If users lose their file encryption certificates and private keys, they can be recovered by using the recovery agent. The recovery agent, which can decrypt their files, is part of the recovery policy that is implemented when a user receives the first file encryption certificate. When the recovery agent receives the data recovery certificate, it should export it, store it in a safe place, and then delete the data recovery certificate from the system hard disk. This way only the person who has physical access to the data recovery certificate can recover the data. If a user loses a private key and you need to carry out data recovery, the data recovery certificate can be obtained by the recovery agent from the storage location and imported back into the system. Once the data recovery certificate is imported back into the system, the recovery agent can then use the data recovery certificate to perform the data recovery from the user’s encrypted files. When you complete the data recovery, the data recovery certificate should be deleted immediately from the system for security reasons, so that there is no chance that someone can access it after you are finished using it. There is no reason to export the data recovery certificate back to the safe storage area, because it is still stored there and can be imported over and over again. If you attempt to use the encrypted file system (EFS) on a Windows NT NTFS partition, Windows 2000 automatically upgrades the partition to Windows 2000 NTFS format so that you can encrypt the data.

TIP Compression and encryption are not compatible. If you specify both attributes for a file, encryption will override compression. This will only happen if you are using the cipher /? command line prompt. The Windows 2000 GUI interface simply toggles between encryption and compression.

74_sysad_08.qx 11/8/99 10:09 AM Page 311


Using Disk Defragmenter Disk file systems can become fragmented with heavy use. Fragmentation occurs when files are split into noncontiguous areas on the disk, because Windows 2000 saves files in the first available space on your hard drive, not necessarily in a place that can fit your entire file into one section. Fragmentation slows disk performance and can result in wear and tear on the disk, because the disk heads must jump to multiple areas of the disk trying to read or write data belonging to a single file. You can use the Windows 2000 disk defragmenter to defragment the files on your hard disks periodically (see Figure 8.23). This consolidates all the pieces of your files into a single space on the hard drive so that your computer can access the files more quickly and efficiently. To use the disk defragmenter, you must be a member of the administrator group. Without administrator group privileges, you will be unable to defragment the drive. The Windows 2000 disk defragmenter can defragment FAT, FAT32, and NTFS volumes.

Figure 8.23

This is the Windows 2000 Disk Defragmenter.

311

74_sysad_08.qx 11/8/99 10:09 AM Page 312

312


To use the disk defragmenter, you can right-click a drive in My Computer or Windows Explorer, choose Properties, and then the Tools tab. From there, you can choose to defragment the volume. Alternatively, you can go to the disk defragmenter by clicking the Start menu, choosing Programs, then Accessories, then System Tools, and finally Disk Defragmenter. Both ways display the disk defragmenter window, showing the disk status for all the volumes. There are two options in the Windows 2000 Disk Defragmenter. The first is the Analyze option, which analyzes the disk to see how fragmented it is. After it completes the analysis, it displays a band showing how fragmented the drive is (see Figure 8.24). From there, you can determine whether you want to use the Defragment option. The Defragment button defragments the disk and, once defragmentation is complete, displays a band representing the defragmented volume. The Disk Defragmenter window is divided into three areas. The top layer displays all the volumes that you can defragment, including information on the file system in use and how the space is distributed. This includes the capacity of the volume and the amount of free space available in MB as well as a percentage value. It also informs you of the status of the session. The second and third layers are graphical representations of the volume and its various fragmentation states. The first horizontal bar graph is called the analysis display. It displays the fragmented volume as it is initially analyzed. You should use the analysis display only for a general idea of how fragmented the volume is. You should use the analysis report for precise, numerical data. The second horizontal bar graph displays the drive as it is being defragmented. The bars are displayed this way so that you can compare them to see the improvement in fragmentation after you run the disk defragmenter. You can actually view a graphical representation of the defragmenting as it is taking place (see Figure 8.24).

74_sysad_08.qx 11/8/99 10:09 AM Page 313


Figure 8.24

This is the graphical representation of the volume analysis and defragmentation in process.

The volume being defragmented has different colors representing the various fragmenting conditions. There is a legend at the bottom of the disk defragmenter indicating the various color representations: ■

Red represents fragmented files

■

Blue represents contiguous files

■

Green represents system files

■

White represents free space

313

74_sysad_08.qx 11/8/99 10:09 AM Page 314

314


It is a good idea to analyze the volume before you defragment it so that you can check to see if it is necessary to defragment the drive. Analyzing the volume only takes a minute and prevents your wasting valuable time defragmenting a drive that is not fragmented. Although defragmenting a drive that is hardly fragmented at all does not hurt the drive, it uses up system resources unnecessarily. Sometimes, when you are viewing the disk defragmenter analysis bar graph, it looks as if there are system files on volumes other than the system and boot volumes, because the Master File Tables (MFT) and paging files appear as system files within the disk defragmenter. This occurs because they cannot be moved; they are opened for exclusive use by Windows 2000 at all times and therefore cannot be defragmented. Windows 2000 reserves a portion of free space on the beginning of the drive for the Master File Tables (MFT), which contain all the information necessary to retrieve files from the volume. The Master File Tables cannot be moved because there is no way for Windows 2000 to know where they have gone.

Analyzing a Drive To analyze a drive once it is in the disk defragmenter, click the Analyze button, or click the Action menu from the toolbar and choose Analyze. If you need to pause or stop the drive analysis once it is running, you can click the Stop or Pause button as required. Once the analysis is complete, a dialog box will pop up with the details of the analysis and recommendations as to whether or not you should defragment the drive (see Figure 8.25). If you would like more information on the volume analysis, click the View Report button.

74_sysad_08.qx 11/8/99 10:09 AM Page 315


Figure 8.25

This is the disk defragmenter Analysis Complete dialog box.

Viewing Reports If you click the View Report button after analyzing a volume, the disk analysis report will be displayed. In Figure 8.26, the disk is 17 percent fragmented, so disk defragmentation is recommended. When the average fragments per file is more than 1.02, the disk defragmenter will suggest that you defragment your volume. The analysis report is a text-based version of the analysis display. It includes volume information such as the volume size, the amount of free space, and the amount of fragmented files and folders. It also displays the average number of fragments per file. The average number of fragments per file is a good indicator of how fragmented the files on the disk are. This can be viewed if you scroll down in the Volume Information area. The best figure possible is 1.00, indicating that all or most files are contiguous. If the average number of fragments is 1.10, that means that 10 percent of the files are fragmented, which means that approximately 10 percent of the files are in two pieces instead of in one contiguous area. There is also a separate section including details about the most fragmented files: the path, the number of fragments, the file size, and the file names. Windows 2000 tells you whether you should defragment your drive and allows you to save or print the analysis. Once you are finished viewing the analysis report, click Defragment to start the defragmenting process or click Close to return to the disk defragmenter screen.

315

74_sysad_08.qx 11/8/99 10:09 AM Page 316

316


Figure 8.26

This is a disk drive analysis.

Defragmenting NTFS File System Partitions If it is recommended that you defragment your drive, click the Defragment button or choose the Action menu from the toolbar, followed by Defragment, and the defragmenting will start immediately. Once the disk defragmenting has been completed, a dialog box pops up informing you that Windows 2000 has finished defragmenting your drive (see Figure 8.27). From here, you can either view the defragmentation report or you can close that dialog box. The defragmentation report looks very similar to the analysis report. It lists the volume information, including the cluster sizes, used space, free space, and fragmentation percentage. It also lists the most fragmented files, including details about the number of fragments, the file sizes, and the file names. You can print, save, or close the defragmentation report when you are finished viewing it.

74_sysad_08.qx 11/8/99 10:09 AM Page 317


Figure 8.27

This is the Defragmentation Complete dialog box.

When files are moved about the volume, it causes the disk defragmenting process to be restarted, which slows down the process. The disk defragmenter can have an impact on performance, so it is best to run the disk defragmenter when the computer is not being used or is being used only minimally. You should defragment highly accessed volumes, such as file servers, more frequently than those hardly in use, such as extra workstations, because the more frequently a volume is accessed, the more fragmented it becomes.

Troubleshooting Data Storage If you find that your computer seems to be running more slowly than usual, or users are finding that gaining access to network resources has become slow, you should try defragmenting your drive. This often speeds up performance, because the disk heads will no longer have to jump to multiple areas of the disk to read and/or write data that belongs to a single file. Files will be much more contiguous after the drive is defragmented, so access times will be noticeably decreased. If you notice that the graphical analysis and the analysis report do not match, keep in mind that the resolution can affect the accuracy of the graphical analysis. You should use the graphical analysis for a general idea of how fragmented your volume is, and use the analysis report for a more detailed and accurate view of the volume state. If you suspect that unauthorized users are getting information from data that is supposed to be encrypted, ensure that both the

317

74_sysad_08.qx 11/8/99 10:09 AM Page 318

318


temp files and the folder that contains the encrypted data are also encrypted. This ensures that no unencrypted temp files with easy access are created in the process of viewing and or changing data. If you are unable to move or copy compressed data into a new folder, ensure that there is enough room for the data in the target folder when it is first uncompressed.

Best Practices Data compression can result in performance degradation and is not recommended for use on a server unless it is required. Servers are used to provide data to clients as quickly as possible. When data is compressed, it slows down the access time, because every time a client needs access to it, it has to go through the CPU and be uncompressed before it can be passed to the client. This increases the load on the CPU, which results in degradation of server performance. Therefore, you should only use compression on workstations or for data files that are seldom opened. You should set encryption at the folder level so that the temporary files created while you are editing files will also be encrypted. Users should also encrypt their temp folders so that when a program saves files to the temp folder, they are also encrypted. Finally, users should encrypt the “My Documents” folder so that all their data files are encrypted by default. Remember that folders themselves cannot be encrypted; only the files created within them can be encrypted. It is a good idea to analyze a drive for fragmentation before you install applications. Defragmenting the drive (if necessary) before installation increases the amount of contiguous free space, which will speed up the installation. When you set disk quotas, it is a good idea to set blanket disk quotas for all users and then define more specific disk quotas for users who need different quota levels later. This ensures that all users have some sort of quota limit and makes the process of assigning disk quotas much more efficient.

74_sysad_08.qx 11/8/99 10:09 AM Page 319


You should defragment each user’s computer once a month or on a regular schedule. It is a good idea to educate your users to do this on their own and just check up on them occasionally, and to be available to help with defragmenting when they are experiencing problems. Computers that are used frequently, such as file servers, should be defragmented often, as performance degradation occurs more quickly with high utilization.

FAQs Q: What will happen to the compression setting when you copy a file from one folder to another on the same NTFS partition?

A: The compression settings will be changed to that of the target folder, because a copied file is considered a new file created in the target directory. Therefore, it will inherit all the attributes of the folder.

Q: How often should you defragment a drive? A: Approximately once a month or on a schedule that meets your needs or requirements. You should defragment highly accessed computers/drives such as file servers more often. Ideally, you should defragment a drive when it is not being used, or is being used only minimally.

Q: What can you do if a user loses his or her private key and encryption certificate and needs to access encrypted files?

A: You can unencrypt the files with the recovery agent.

319

74_sysad_08.qx 11/8/99 10:09 AM Page 320

320


Q: How can you avoid having your account “charged” with the disk space Windows 2000 uses to install applications on your user’s computers?

A: You can either log on with the administrator account, which does not have disk quotas assigned to it, or you can remove the disk quota settings from your user account so that when you install applications for your users, you will not be charged with the disk space against your quota.

Q: The disk defragmenter analysis bar graph appears to have system files on volumes other than the system and boot volumes. Why would this happen?

A: The Master File Tables (MFT) and paging files appear as system files within the disk defragmenter, because they cannot be moved; therefore, they are also impossible to defragment.

Q: If you need more storage space on a volume, which data should you compress?

A: You should compress data that you are not going to use very often. A good example of data you should compress is archived data that you hardly ever use. This way, performance and disk degradation is kept to a minimum.

74_sysad_09.qx 11/8/99 10:14 AM Page 321

Chapter 9

Monitoring Event Logs


Introduction to Monitoring Event Logs

■

Viewing Event Logs

■

Monitoring Security Events

■

Analyzing Security Events

■

Managing Event Logs

321

74_sysad_09.qx 11/8/99 10:14 AM Page 322

322

Chapter 9 • Monitoring Event Logs

Introduction to Monitoring Event Logs Tracking the activity of each component in Windows 2000 is the job of the Event Log service. As the Windows 2000 operating system and its applications, devices, and services perform their tasks, they send information about their operation to the Event Log service, which, in turn, creates a log file of this activity. This log file (actually several small databases) can then be viewed later to determine if or when certain activities occurred. The Windows 2000 Event Log can also be configured to track securityrelated events such as user logon and file access. Not all applications write their log information to the Event Log service (Microsoft’s own Internet Information Server and SQL Server maintain separate logs), but most native Windows 2000 services and third-party applications do. Figure 9.1 shows the Event Log service process. As each component of the operating system, application, or service generates an event, it is sent to the Event Log service, instead of to its own separate log.

Figure 9.1 This is the Event Log service process. Operating System Eve

nts

Events

Services

Applications

Events

Windows 2000 Event Log Service

Event Logs

nts

Eve

74_sysad_09.qx 11/8/99 10:14 AM Page 323

Monitoring Event Logs • Chapter 9

The Event Log service is not intended to provide real-time management or monitoring of a system, but only to show historical activity. Not all activity for a certain component will be sent to the Event Log, only whatever the component’s programmers deemed important and hard-coded into their applications to be sent there. In general, an event is any activity that should be recorded or that requires that some action be taken. Compare this with a real-time monitoring system such as the Network Monitor, Performance Monitor, or an SNMP-based monitoring application. Specific pieces of performance information can be tracked and used to try to predict an impending component failure or to see if a setting needs to be tuned. These potential sources of information consist of specific counters, and the measurement of these counters as activity occurs can lead to real-time notification of potential problems. For example, all aspects of a disk system’s operation can be tracked in real-time, including: ■

Average read time

■

Average seek time

■

Number of disk read or write requests waiting to be processed

The values of these variables could indicate an impending disk failure. On the other hand, the Event Log service might track whether a service has started, the conditions under which a service starts, and certain checkpoint conditions that need to be tracked. For example, virus-scanning software installed as a service might send the following items to the Event Log: ■

A timestamp when the service starts

■

The software’s version

■

How recent its virus detection files are

■

A timestamp each time it starts or completes a scanning task

■

Which, if any, viruses were found during that scanning task

■

What action (clean, delete, and so on) was taken on an infected file

323

74_sysad_09.qx 11/8/99 10:14 AM Page 324

324


The Event Log service does not dictate which pieces of information need to be logged; it merely provides the services and storage space that another application can use to write its logs. Each service or application could write its own log file in its own proprietary format to separate log files, but the management of these logs could grow out of hand. An administrator would need to locate and open each of these different log files in separate applications in order to analyze them. Each log’s format might also be different, making summarization or consolidation of the logs nearly impossible. The Event Log service provides a single interface and storage location for these separate logs. These logs can be accessed from a single application, and their format will be consistent.

For Managers Only

Monitoring Event Log Information

Since the information available in the various Windows 2000 Event Logs covers a wide range of areas, an IT manager might want to formally restrict the Event Log information that is available to different members of an IT department. Many companies today have IT staffs large enough to allow one team to be in charge of day-to-day administration of servers, and another team to be in charge of network security. A server administrator’s daily tasks might include configuring shares and printers, managing backups, and creating user accounts. The tasks of a network security professional include setting written security policies, regulating access to sensitive information, and guarding company secrets. The security model used under previous versions of Windows NT did not allow for an easy separation of systems administration and security administration. Most if not all administration tasks required Full Control security permission over the object being administered. These permissions, while necessary to enable administrators to do their job, also invite Continued

74_sysad_09.qx 11/8/99 10:14 AM Page 325


potential abuse. Sensitive information can be contained in the Windows 2000 Event Logs, and a separate team of IT members should be assigned to manage the Event Logs, especially the Security Logs. Some systems administrators could very easily use their administrator privileges to view data they are not permitted to see (such as salary or budget information). Using those privileges, these administrators could erase portions of the Security Event Log to cover their tracks. A well-planned and -implemented security policy should include provisions for keeping an eye on those entrusted to run the network. The fact that an employee is given administrative privileges on a network should indicate that he or she is a trusted employee, but there will be times when an administrator needs to be monitored. The majority of security-related incidents and break-ins are the work of internal employees, and not external hackers.

Viewing Event Logs Event Log administration is performed from the Event Viewer snapin for the Microsoft Management Console (MMC). The snap-in can be loaded in one of these ways: ■

From the Start menu, point to Programs, then to Administrative Tools, then click Event Viewer. This loads a user-mode console containing the Event Viewer tools. This console file is located in %systemroot%\system32\eventvwr.msc.

■

From an author-mode console, click the Console menu, then click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears. Click Add. The Add Standalone Snap-in dialog box appears. Select Event Viewer from the list, and click Add.

For more information about the Microsoft Management Console, refer to Chapter 2, “Overview of Windows 2000 Administration.”

325

74_sysad_09.qx 11/8/99 10:14 AM Page 326

326


NOTE Not every Windows 2000 server will have all of these views or *.EVT files. The three default logs—Application, Security, and System—should be on every server. For example, if a server is not a Windows 2000 domain controller, it will not need to have a Directory Service log, but it will have the three standard logs. The Event Logs for a computer running Windows 2000 are stored in %systemroot%\system32\config and have an extension of *.EVT. When the Event Viewer snap-in starts, it examines each *.EVT file in this directory and creates a view in the left pane of the console. Each view then displays a list of all events in that file. Three default views and several optional views will be seen in the console, depending on which services are running. Table 9.1 lists these views.

Table 9.1

Event Log Views

View Name

File Name

Information Contained

Application Log Directory Service

AppEvent.EVT (Default View) NTDS.EVT

DNS Server

DnsEvent.EVT

File Replication Service

NtFrs.EVT

Security Log

SecEvent.EVT (Default View)

System Log

SysEvent.EVT (Default View)

Events from applications or programs are logged here. Events concerning Active Directory operations are logged here. Events concerning the Windows 2000 DNS server are logged here. Events from the File Replication Service are logged here. All security-related events are logged here. Security Event logging must be enabled in Group Policy to take effect. Windows 2000 operating System events are logged here.

74_sysad_09.qx 11/8/99 10:14 AM Page 327


TIP The Event Log database format of the EVT files hasn’t changed from NT4 and previous versions. You can use the NT4 Event Log viewer utility, eventvwr.exe, to view Event Logs on a Windows 2000 computer. Keep in mind that the NT4 event viewer will view only the System, Application, and Security Logs, and cannot view Windows 2000–specific EVT files such as the File Replication Service and Directory Service. The NT4 event viewer does not know to look for other EVT files.

Each event record in the Event Log has the fields shown in Table 9.2.

Table 9.2 Event Log Fields Field name

Description

Notes

Type

One of five categories of events. The categories enable an administrator to determine what action needs to be taken, based on the category. The date that the event occurred.

The types of events are described in Table 10.3.

Date

Time

The time that the date occurred.

The date and time used to timestamp events is based on the local system clock. Events will be recorded as happening at an incorrect time if the local system clock is set incorrectly or is out of sync with the rest of the domain. The date and time used to timestamp events is based on the local system clock. Events will be recorded as happening at an incorrect time if the local system clock is set incorrectly or is out of sync with the rest of the domain. Continued

327

74_sysad_09.qx 11/8/99 10:14 AM Page 328

328


Field name

Description

Source

The name of the service, driver, or application that logged the event. A subclassification of the Source field. Numerical lookup value assigned to the event by the application's programmers. The user account linked to an event. This will usually be the account that a service is running under, or an impersonated ID if a service performs an action under an impersonated ID. For Security events, this will be ID of the user performing the audited action. The computer where the event occurred. This will usually be the local computer, unless the Event Viewer console is configured to view the Event Log of a remote computer. A text description of the event that occurred, and if applicable, any actions necessary to correct a related problem. If necessary, other binary data might be included as part of the event. Not all events will have or require binary data to be stored in the event.

Category Event ID

User

Computer

Description

Record Data

Notes

Usually found only in the Security and DNS logs.

The text description for an event will be given in the locally set-up language.

The description field will indicate whether binary data is included in the Record Data field.

74_sysad_09.qx 11/8/99 10:14 AM Page 329


Five general types of events are logged in Table 9.3. To help you visually identify the type of event in the log view, each type of event is given a different icon.

Table 9.3 Event Types Type

Description

Information

A nonserious event that is recorded for checkpoint purposes, such as a service reporting that it has started correctly

Error

A serious problem, such as a service or connection failure An event, whose reported problem should be investigated and corrected, that might lead to an Error event An audited security access that was granted or successfully completed An audited security access that was denied or failed to complete

Warning

Success Audit Failure Audit

Icon

All fields except the Description and Record Data fields can be seen in the log view. To customize the log view, select Choose Columns from the View menu. The dialog box shown in Figure 9.2 appears. The default is to display all columns but the Description and Record Data. To remove a column from being displayed, select it and click Remove. To restore it and to have it be displayed again, select the field from the Hidden Columns box, and click Add. To change the order in which the columns display, select a field and click Move Up or Move Down. The order, from top to bottom, in which the fields appear in this dialog box will be the same order, from left to right, in which the fields will display in the log view. Click OK to apply the changes. These changes to the column order will take effect for all log views, not just the current one. In addition, you can click on any column head in the log view to sort by that column. This feature is similar to that in Windows 2000 Explorer when the details view is active for a group of files or

329

74_sysad_09.qx 11/8/99 10:14 AM Page 330

330


Figure 9.2

This is the Modifying event column display.

objects. The current sort field will be indicated by a small triangle to the right of the column being sorted. The triangle will point upward if it is sorting in ascending order and downward if it is sorting in descending order. The log views can display a useful summary of the events on a server, but without memorizing what each Event ID means you would never know what is specifically happening. In order to view the Description for each event, you need to display all the event’s fields, by double-clicking on the event. This displays a property sheet similar to the one in Figure 9.3. All the event fields, including the description and Record Data fields, are displayed. The description field could potentially contain several lines of information. If the description indicates that binary Record Data exists, it will be displayed on the Record Data tab. In this property sheet, you can move among records by clicking Previous and Next. This will cycle through the event records for the current view and sort order, so you won’t need to close the property sheet and then reopen it for subsequent events. If you try to cycle past the first or last events in the view, a message box will appear asking whether you want to cycle back to the beginning or end of the event records. Figure 9.4 shows this message box, which is displayed after an attempt to move the record before the first event record.

74_sysad_09.qx 11/8/99 10:14 AM Page 331


Figure 9.3

These are the event record detail properties.

In a marked improvement over previous versions of Windows NT, the event descriptions in Windows 2000 provide plenty of detail. In most cases, the description of an event will contain detail about the event as well as instructions for fixing the problem or preventing the event from occurring again. At times, the volume of information available in the Event Log makes it difficult to isolate one problem. By default, all events in a particular *.EVT file are displayed in the log view. What if you wanted to see only a subset of events? For example, what if you wanted

Figure 9.4

This is the way to view past the first record.

331

74_sysad_09.qx 11/8/99 10:14 AM Page 332

332


to see all virus scanner events in the Application Log? You would either have to sort the list of events by Source or Category to group related events together, or you would have to scan the entire list of hundreds or possibly thousands of events to find the one or two items you needed.

TIP You may be wondering why the Event Log service needs to categorize messages by both an Event ID and a description. The description would seem to be enough to describe a problem or milestone that occurs. The Event ID field allows the programmer to create the event messages, and Windows 2000 will keep a table that maps the Event ID to a description that is written in the local language. The programmer simply needs to create an arbitrary and unique (at least for that Source and Category) Event ID, and if the local server contains only French-language support, the Event Logs will display the appropriate messages in French.

The Windows 2000 Event Viewer makes it possible to filter an existing view, or to create a new view that filters an existing log. This allows you to create a virus scanner view that displays messages in the Application Log pertaining only to the virus scanner software. This new view would appear in the Event Viewer console and would display only events from the specified *.EVT file that match the filter that is applied. To apply a filter to an existing view, select the view, then select Filter from the View menu. The dialog box shown in Figure 9.5 appears. By selecting one or more values from this dialog box, you can have Event Viewer display only events that meet the selected criteria. To display only the events from a certain period of time, enter the starting and ending dates/times in the From and To sections. The default is to display all events in the log. To display only certain types of events, check or clear the desired event type from the Types

74_sysad_09.qx 11/8/99 10:14 AM Page 333


Figure 9.5

Apply a filter to the current event view.

section. To view events from a specific source or category, select the desired value from the drop-down box. To filter on the basis of a specific user, computer, or Event ID, type the desired values in the text boxes. The criteria selected then are ANDed together and displayed in the console. Above the column heads will be a message indicating that a filter is applied, and how many of the total events are listed as a result of applying the filter. Figure 9.6 shows the results of applying the filter from Figure 9.5 to the Application Log. Only Information Events from August 3 are displayed. Note that there would be 55 events displayed in the Application Log if no filter were applied, but there are 12 events that match the filter. Once a filter is applied to a view, it remains in effect until it is either changed (by making changes to the filter properties) or cleared completely (by selecting All Records from the View menu). You can create several views that contain different filters, all applied to the same *.EVT file.

333

74_sysad_09.qx 11/8/99 10:14 AM Page 334

334


Figure 9.6

This is the Application Log after the filter is applied.

To create a new view for an existing *.EVT file, select the Event Viewer container in the left pane of the console. Click the Action menu, click New, and then click Log View. The dialog box shown in Figure 9.7 appears. Two types of views can be added: Active and Saved. An active view opens another copy of an existing log (a *.EVT file), which can then be customized if you apply a filter. To create an Active view, select Active from the dialog box shown in Figure 9.7, and select the log from which the new view is to be created from the Log Type drop-down box. Enter a display name and click OK. The new view appears in the left pane of the Event Viewer console, and this new view can then be filtered. To create a Saved view, select Saved from the dialog box shown in Figure 9.7, and either type the full path or browse to the location where the existing *.EVT file is located. The file browsed to must have an *.EVT extension and must use the Event Viewer database format found in the default *.EVT files.

74_sysad_09.qx 11/8/99 10:14 AM Page 335


Figure 9.7

Add another log view.

In some situations you need to view the Event Log on a remote machine. You can do this by selecting Connect to another computer from the Action menu. The dialog box shown in Figure 9.8 appears. From this dialog box, you can either browse to the server whose Event Log you want to view, or reconnect to the local Event Log (if you selected a remote computer).

Figure 9.8

Connect to another computer’s Event Log.

335

74_sysad_09.qx 11/8/99 10:14 AM Page 336

336


Monitoring Security Events Security events are the first type of events that Windows 2000 audits. Security auditing is not enabled by default and must be turned on as part of the currently applied group policy. In previous versions of Windows NT, security auditing was a domainwide setting made in User Manager for Domains. Windows 2000 allows for a more granular application of security and other policies through group policies. In the example given here, Security auditing will be turned on for an entire domain, but the steps demonstrated can be applied to any container or object in Active Directory that can have a group policy applied to it. For more information about setting and applying group policies, refer to Chapter 13, “Implementing Group Policy.” Administrators keep track of various security-related events. Security on a network is similar to security in a building. A banking company might want to know which employees entered and exited the building at which times. If there were a sensitive area such as a vault within the building, the company might want to track access to it. It would be important to know not only who entered the vault, but also who even attempted to gain access to it (successfully or not). On a network, there might be sensitive information stored on a file server, such as payroll or budget files. Not every employee would need to have access to the payroll information for the entire company, so an administrator would want to log anyone who attempted to gain access to this information. Windows 2000 groups security events that it can audit into several categories, summarized in Table 9.4. Auditing for these categories can be turned on or off as part of the currently applied group policy. Once enabled, auditing of these events can occur for successful events, unsuccessful events, or both. For example, enabling Success auditing of user logons will write an event each time a user successfully logs on a server. Enabling Failure auditing of the same will write an event each time a user is unable to sign in for any reason. The Success events will give a picture of normal user access patterns, while the Failure events might point out a break-in attempt.

74_sysad_09.qx 11/8/99 10:14 AM Page 337


Table 9.4

Audit Policy Attributes

Attribute

What it Covers

Auditing user and service logons and logoffs Auditing changes to the Active Directory user and machine accounts database Audit Auditing access to Active Directory Directory schema and Service Access objects Audit Logon Auditing user and service Events logons and logoffs Audit Object Auditing when or whether Access certain objects (like files on an NTFS disk or printers) have been accessed Audit Policy Auditing when Auditing Change Policy has been changed, and by whom Audit Privilege Auditing when privileges Use are assigned to users and when those privileges are used

Notes

Audit Account Logon Events Audit Account Management

Audit Process Auditing processes, appliTracking cations, and threads. Usually used for debugging programs.

Audit System Events

Auditing any event that affects the entire system or the Event Log service itself

Privileges (Log on as a service, Act as part of the Operating System, and so on) are also assigned through Group Policies. Auditing Process Tracking has the capability of introducing severely high overhead to a server. It can also fill the Event Log quickly. This should be enabled only when this functionality is needed for troubleshooting purposes, and disabled when not needed.

337

74_sysad_09.qx 11/8/99 10:14 AM Page 338

338


Auditing is enabled as part of a group policy object (GPO). Group policies can be enabled when the properties of a domain or computer object are edited. In this example, a group policy will be enabled for a domain. A domain’s GPO is configured from the Active Directory Users and Computers console. Figure 9.9 shows this console for a domain named CORPORATION.COM.

Figure 9.9

This is the Active Directory Users and Computers snap-in console.

To view or edit the GPO for the domain, select the domain, then select Properties from the Action menu. The property sheet for the selected domain appears. To configure group policy for the selected domain, click Group Policy. Figure 9.10 shows which GPOs are applied to the CORPORATION.COM domain. To view the settings for a GPO, click Edit. This will open Group Policy Editor (gpedit.msc) in an MMC console. Figure 9.11 shows the Group Policy window.

74_sysad_09.qx 11/8/99 10:14 AM Page 339


Figure 9.10

Display group policies for the selected domain.

Figure 9.11

View group policy details.

339

74_sysad_09.qx 11/8/99 10:14 AM Page 340

340


The settings that configure auditing are in this location: Default Domain Policy/ Computer Configuration/ Windows Settings/ Security Settings/ Local Policies/ Audit Policy

In the Audit Policy container are the settings for the Audit Policy attributes listed in Table 9.4. Each attribute displays its configuration setting. As shown in Figure 9.12, the default setting for a group policy object is to have auditing not configured.

Figure 9.12

Change audit policy attributes in Group Policy Editor.

74_sysad_09.qx 11/8/99 10:14 AM Page 341


To enable auditing for one of these attributes, select the attribute and select Security from the Action menu. The dialog box shown in Figure 9.13 appears. For each attribute, the Audit Log can be set to audit successful or failed attempts at the specified access. Each event logged will appear in the Security Log with a Type of Failure Audit or Success Audit, a Source of Security, and a Category of the Audit Policy attribute name. You will need to enable each of the attributes shown in Figure 9.12 separately. After setting each of the audit policy attributes, Group Policy Editor displays the settings that have been saved, as shown in Figure 9.14.

Figure 9.13

Specify settings for currently selected Audit Policy attribute.

Enabling these audit categories is only the first step in enabling the Security Log. In order to track specific activities such as which user account is attempting or succeeding in getting access to the payroll files, you need to turn on auditing for those specific files and objects. To do so, select the object for which you want to set auditing, and then enable the activity that should generate an audit event. There are two areas in which an administrator can turn on auditing: Files and folders and the Registry.

TIP The settings made in a group policy object may be overwritten or blocked by a GPO with a higher precedence. If a GPO does not seem to have taken effect, verify the effective policy settings on the local server.

341

74_sysad_09.qx 11/8/99 10:14 AM Page 342

342


Figure 9.14

Audit policy attributes are set in Group Policy Editor.

Auditing Files and Folders File and Folder auditing creates an Event Log entry every time a user account accesses a file. The Event Log entry will indicate either of two types of occurrences: Success or Failure. A Success event indicates that a user account that has appropriate NTFS permissions succeeds in performing some action on a file. A Failure event indicates that a user account attempts to perform an action on a file for which it does not have the appropriate permissions. The operations that can be audited are listed in Table 9.5. The entries listed will have different meanings, depending on whether the auditing is applied to a file object or a folder object.

74_sysad_09.qx 11/8/99 10:14 AM Page 343


Table 9.5

File and Folder Auditing Entries

Audit Entry

Applied to a Directory

Traverse Audits when a user Folder/Execute account passes through a File folder intending to access a subfolder. List Audits when a user Folder/Read account attempts to list Data the contents of the specified folder. Read Audits when a user Attributes account tries to view the attributes (Read-only, Hidden, and so on) of a folder. The attributes covered in this audit entry are defined by NTFS. Read Audits when a user Enhanced account attempts to view Attributes the enhanced attributes of a folder. These attributes will be unique and will be defined by an application and not by NTFS. Create Audits when a user Files/Write account attempts to creData ate a new file object in the current folder. Create Audits when a user Folders/Append account attempts to creData ate a new folder object in the current folder.

Write Attributes

Applied to a File Audits when a user account attempts to execute a program. This permission has no effect on data files. Audits when a user account attempts to open a file and read data from it. Audits when a user account attempts to view the attributes (Read-only, Hidden, and so on) of a file. The attributes covered in this audit entry are defined by NTFS. Audits when a user account attempts to view the enhanced attributes of a file. These attributes will be unique and will be defined by an application and not by NTFS. Audits when a user account attempts to overwrite an existing file object.

Audits when a user account attempts to add data to the end of a data file, but will not audit the changing, deleting, or overwriting of existing data in the specified files. Audits when a user Audits when a user account account attempts to attempts to change an NTFS change an NTFS attribute attribute (Read-only, Hidden, (Read-only, Hidden, and so and so on) of the specified on) of the specified folder. file. Continued

343

74_sysad_09.qx 11/8/99 10:14 AM Page 344

344


Audit Entry

Applied to a Directory

Applied to a File

Write Extended Attributes

Audits when a user account attempts to change an applicationdefined attribute of the specified folder.

Audits when a user account attempts to change an application-defined attribute of the specified folder.

Delete Subfolders and Files

Audits when a user account attempts to delete a subfolder or file contained in the specified folder. Audits when a user account attempts to delete the specified folder. Audits when a user account attempts to read the NTFS permissions of the specified folder. Audits when a user account attempts to modify the NTFS permissions of the specified folder. Audits when a user account attempts to take ownership of the specified folder.

Not applicable

Delete

Read Permissions

Change Permissions

Take Ownership

Audits when a user account attempts to delete the specified file. Audits when a user account attempts to read the NTFS permissions of the specified file. Audits when a user account attempts to modify the NTFS permissions of the specified file. Audits when a user account attempts to take ownership of the specified file.

NOTE Only files stored on an NTFS volume can be audited, because the auditing mechanism is built in to the file system. Files on FAT, FAT32, and CDFS volumes cannot be audited.

To turn on auditing for a specific file or folder, select the file or folder object in Windows Explorer, then select Properties from the File menu. The File Property dialog box appears. Select the Security tab. Initially, the Security tab displays the accounts that have

74_sysad_09.qx 11/8/99 10:14 AM Page 345


permissions to the selected file or folder. To view or set auditing options, click Advanced. The Advanced Security Settings dialog box appears. Click Auditing to view current auditing settings. Figure 9.15 shows the Auditing dialog box.

Figure 9.15

These are Advanced NTFS security settings.

This dialog box shows existing auditing entries that have been previously made to this file or folder object. To edit an existing entry, select the entry and click View/Edit. To delete an auditing entry, select the entry and click Remove. To add a new entry, click Add. The dialog box shown in Figure 9.16 appears. Select a user or group from the list and click OK. After selecting a user, select the access activity that will generate an audit event. The dialog box shown in Figure 9.17 shows that all activity by any account in the Administrators group on the file HR Policies.txt will generate an audit. After making the access entries, click OK. Auditing entries are then summarized in the Advanced NTFS dialog box.

345

74_sysad_09.qx 11/8/99 10:14 AM Page 346

346


Figure 9.16

Select a user/group for NTFS audit settings.

TIP Auditing can be applied to multiple files or folders if you select the objects in Explorer and view the collective properties.

Figure 9.17

Specify NTFS audit settings.

74_sysad_09.qx 11/8/99 10:14 AM Page 347


Auditing Registry Entries Registry auditing creates an Event Log entry every time a user account accesses a specified portion of the Registry. The Success and Failure events that are generated are similar to those created for File and Folder auditing. The Registry access operations that can be audited are listed in Table 9.6. Registry permissions and auditing can be applied only to keys and hives, and not to individual values contained in those keys or hives.

Table 9.6

Registry Auditing Entries

Audit Entry

Audits

Query Value

Attempts to read a value from the selected subkey

Set Value

Attempts to set or modify a value from the selected subkey Attempts to create a new subkey in the selected subkey

Create Subkey Enumerate Subkeys Notify Create Link Delete Write DAC

Read Control Write Owner

Attempts to read existing subkeys of the selected subkey Notification events from the selected subkey Attempts to create a symbolic link to the selected subkey Attempts to delete an object from the Registry (keys or values) Attempts to write or modify a discretionary access control list (the permissions applied) of the selected subkey Attempts to read the DAC of the selected subkey Attempts to modify the owner of the selected subkey

347

74_sysad_09.qx 11/8/99 10:14 AM Page 348

348


NOTE Unlike the case with File and Folder auditing, Registry auditing will still occur regardless of the file system in use. Windows 2000 installed on a FAT or FAT32 partition will still allow an administrator to modify Registry security settings. To turn on auditing for a specific Registry key, select the key in the Windows 2000 Registry Editor, regedt32.exe, then select Permissions from the Security menu. A Security dialog box appears. To view or set auditing options, click Advanced. The Advanced Security Settings dialog box appears. Click Auditing to view current auditing settings. Figure 9.18 shows the Auditing dialog box. The key selected is: HKCU\Control Panel\Desktop

Figure 9.18

These are Auditing settings for selected Registry key.

74_sysad_09.qx 11/8/99 10:14 AM Page 349


This dialog box shows existing auditing entries that have been previously made to this Registry key. To edit an existing entry, select the entry and click View/Edit. To delete an auditing entry, select the entry and click Remove. To add a new entry, click Add. The dialog box shown in Figure 9.19 appears. Select a user or group from the list and click OK. The users/groups selected will appear in the Registry Key auditing dialog box, as shown in Figure 9.20. For the selected user or group, check or clear the check box for the event you wish to audit. The example shown in Figure 9.20 will audit all activity performed by members of the Domain Users group on the Desktop key and all included values.

Figure 9.19

Select a user/group for Registry audit settings.

349

74_sysad_09.qx 11/8/99 10:14 AM Page 350

350


Figure 9.20

Auditing is enabled for selected users.


The Registry

If you have used older 16-bit versions of Windows, you know that system configuration settings were stored in text files that had an *.INI extension (win.ini, system.ini, and so on) and could be edited by an administrator to make configuration changes, but that usually was not necessary. Most of the settings in these files were accessible via the Control Panel or other GUI applications. An administrator would need to edit the INI files manually only if a specific setting were not available through the GUI. Starting with the 32-bit versions of Windows (NT 3.x/Windows 95 and later), system configuration information Continued

74_sysad_09.qx 11/8/99 10:14 AM Page 351


is stored in a hierarchical database called the Registry. As was the case with the INI files, most settings in the Registry can be modified via the Control Panel or other GUI applications. However, since the Registry contains all configuration information, editing it directly can potentially cause serious system problems. In fact, Microsoft usually recommends never directly editing the Registry unless it is absolutely necessary, and even then it is not guaranteed that they will be able to support any issues that arise from applying incorrect settings. The Registry is divided into five major areas called hives. The five hives are: ■

HKEY_CLASSES_ROOT stores file association information

■

HKEY_CURRENT_USER stores user profile for currently logged-on user

■

HKEY_LOCAL_MACHINE stores systemwide hardware and software configuration

■

HKEY_USERS stores user-specific configuration

■

HKEY_CURRENT_CONFIG stores information about currently selected hardware configuration

Information in each hive is subdivided into keys, which are analogous to directories on a hard drive. Each key can contain other keys (called subkeys) or configuration entries called values, which are analogous to files or programs on a hard drive and must be given values to be of any use, much like a variable in a programming language. When a value is directed to be changed in the Registry, the entire path to the value must be given. For example: HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Control\Setup\pointer is a value that can be changed, and that will change the configuration of some portion of the Operating System: Continued

351

74_sysad_09.qx 11/8/99 10:14 AM Page 352

352


■

HKEY_LOCAL_MACHINE is the hive (hives are usually abbreviated to HKCR, HKCU, HKLM, HKU, and HKCC).

■

System\CurrentControlSet\Control\Setup is the series of keys and subkeys used to navigate to the selected value.

■

pointer is the name of the value whose value is to be read or changed.

The Registry can be directly edited using either of two applications provided by Windows 2000: %systemroot%\system32\regedt32.exe and %systemroot%\regedit.exe. Both versions allow a user to view and modify keys and values to which they have permission, but there are subtle differences between the two programs. Regedit.exe initially shipped with Windows 95 and therefore had no mechanism for controlling security settings. Windows 95 and 98 do not have the security subsystem that NT/Windows 2000 has, and anyone can directly modify any portion of the Registry. Regedt32.exe initially shipped with NT 3.1, and contains menu items that allow an administrator to restrict and log access to Registry settings. There are other differences, but the access to security settings is the difference that is important here. Buried deep inside the Registry are several pieces of information that Windows 2000 needs to operate, such as encrypted passwords, and performance data. If this information were freely available to any user to view, the security of a company’s network could be at risk. Furthermore, a user’s ability to change or delete certain portions of the Registry could cause a computer to crash or become unbootable, either accidentally or through maliciousness. It is imperative that access to the Registry be tightly controlled and that users’ attempts to access portions of the Registry be audited.

74_sysad_09.qx 11/8/99 10:14 AM Page 353


Analyzing Security Events Administrators should see several important security-related events that show user activity in the Security Logs. These events are summarized in Table 9.7. Logon and Logoff events will show which user logged on a system, and what mechanism was used to log on. The Logon Type field in the Events Description will have a value listed in Table 9.8. The Logon Type listed will indicate how the specified user account connected to the system.

Table 9.7

Important Security Event IDs

ID Number

Audits

528

The user account specified in the description field successfully logged on this server. Event 528 should be matched up with a corresponding Event 538.

529

The user account specified in the description field was unable to log on this server due to an unknown username or bad password supplied. The user account specified in the description field was unable to log on this server because the user account is currently disabled by an administrator.

531

535

537 538

560

562

The user account specified in the description field was unable to log on this server because its password has expired and must be changed. The user account specified in the description field was unable to log on this server because of an unspecified error. The user account specified in the description field successfully logged off this server. Event 538 should be matched up with a corresponding Event 528. The user account specified in the description field generated an object access audit. The Type field will indicate whether the user succeeded or failed in the access attempt. Success Event 560 should be matched up with a corresponding Event 562. The user account specified in the description field has closed the specified object and does not need to access it anymore. Event 562 should be matched up with a corresponding Success Event 560.

353

74_sysad_09.qx 11/8/99 10:14 AM Page 354

354


Table 9.8

Logon Types

Number

Logon T.ype

2

Interactive-account logged in to local server

3

Network-account logged on server via My Network Places or a mapped drive from another computer Batch-account logged on a server using the Log on as a batch job advanced user right Service-Account logged on server as a service Proxy-Account was invoked as part of another process or user ID Unlock Workstation-account logged into server in order to unlock a locked workstation

4 5 6 7

Event ID 560 will be generated when an object for which auditing was specified was accessed by a user account. Both Failed and Successful audits are logged with ID 560. The details of the access attempt will be given in the description field of the Event record. If a Failure Event is generated, the account is not granted the requested access to the object, and no further events will be generated. If a Success Event is generated, a handle (a way to programmatically refer to the object) to the object is returned to the application (usually Explorer), and the object is then opened. When the file is no longer needed, Event 562 will be generated, indicating that the file or object handle has been closed. There should be matching numbers of Success 560 events and 562 events.

Managing Event Logs Each of the Event Logs managed by Windows 2000 has several options that can be set by an administrator to manage the log’s size and growth. As your server operates, and as the number of events generated by your server grows, it is possible that the logging of these events could cause the Event Logs to grow until they fill all available disk space.

74_sysad_09.qx 11/8/99 10:14 AM Page 355


To set the log size options, select a log from the Event Viewer console, then select Properties from the Action menu. Figure 9.21 shows the property sheet for the Security Log.

Figure 9.21

View Event Log file properties.

The top half of the property sheet shows the current display settings for the log, including its location, current size, and timestamp. The bottom half shows current log size settings. The Maximum Log Size setting controls the maximum amount of disk space to which a log will be allowed to grow. The actions taken by Windows 2000 upon reaching this size are determined by the Event Log wrapping settings. The Event Log service can do three things if this happens: It can simply remove the oldest entries in the log in order to make room for new entries (Overwrite events as needed setting). It can remove log entries that are older than a few days in order to make room for new entries (Overwrite events older than XX days setting). It can never erase old entries; new events are never written to the log (Do not overwrite events setting).

355

74_sysad_09.qx 11/8/99 10:14 AM Page 356

356


Which wrapping setting should an administrator make? Unless you are constantly poring over the logs on a daily basis, or are employing a third-party event monitoring utility, there is no reasonable way to analyze all generated events as they happen. Therefore, it is not a good idea to have old events in the Event Log erased before they can be viewed. In most cases, an administrator should set the log size to a high value, so that under normal server operation, the maximum log size is never reached, and wrapping should be set to Clear events manually. If the logs are set to erase old events, there is a good possibility that a critical event such as an impending hard drive failure, or a missed Active Directory replication, could be missed. It will sometimes be necessary to clear an Event Log. To do so, select the log from the Event Viewer console, and then select Clear all events from the Action menu. Before the selected Event Log is cleared, you are given a chance to save the events to another file, as shown in Figure 9.22. Clicking Yes opens a dialog box similar to that shown in Figure 9.23. Navigate to the location where the saved Event Log entries are to be saved, and click Save. This dialog box allows you to save only events using the *.EVT extension. This means that the archived copy of the log you are creating is identical with the live versions of the logs. These saved logs can be opened from Event Viewer using the steps discussed in “Managing Event Logs.”

Figure 9.22

Save the selected Event Log before clearing.

74_sysad_09.qx 11/8/99 10:14 AM Page 357


Figure 9.23

Save the selected Event Log.

To export a log for analysis in a third-party application such as Microsoft Excel, select the log view from the left pane of the Event Viewer console, and then select Export List from the Action menu. This allows the selected log to be saved as either a tab-separated or comma-separated text file. Binary data stored in an Event Record (in the Record Data field) will not be exported and will be lost. If you save a log as an *.EVT file, the binary data will be kept. There is also a potential security risk with these settings and the Security Log. If the Event Log service were logging all Success and Failure audits for selected user accounts and objects, if the Security Log were allowed to fill up, any intruders’ access to sensitive files might not get logged if the Event Log were also set not to overwrite events. This would allow intruders to attempt to gain access to sensitive information without having their actions audited. If high security is a must in your environment, and all security-related events must be logged, Windows 2000 has the capability to shut itself

357

74_sysad_09.qx 11/8/99 10:14 AM Page 358

358


down if it can no longer log Security events. This is configured as a group policy setting. Figure 9.24 shows the group policy setting that, if configured, will force a Windows 2000 server to shut down. This GPO setting is found in this location: Default Domain Policy/ Computer Configuration/ Windows Settings/ Security Settings/ Local Policies/ Security Options/ Shutdown system immediately if unable to log security audits

Figure 9.24

Specify the group policy setting for system shutdown.

74_sysad_09.qx 11/8/99 10:14 AM Page 359


Best Practices It would be difficult to list all possible events generated by each component of Windows 2000 in this chapter. A reference of all possible events is a moving target at best, as the number, type, and detail level of the event messages will change with each major version or service pack of Windows 2000. In the Windows 2000 Resource Kit, there is an Access 97 database, NTEVNTLG.MDB, that contains descriptions of the messages found in the Event Log. This listing should be considered only a starting point. More up-to-date information about a certain Event ID can be found in Microsoft’s Knowledge Base. The (KB) is a listing of support articles, bug documentation, and FAQs that Microsoft publishes. The first step in troubleshooting any problem that occurs in the Event Log should be to search for the Event ID in the Knowledge Base.

NOTE The Windows 2000 Resource Kit is a set of advanced utilities and documentation that does not ship with Windows 2000. It is available for purchase from Microsoft Press, or most major bookstores. It ships as part of a TechNet subscription. Most portions of TechNet, the Knowledge Base, and the Resource Kit are available for free from Microsoft’s Web page. Refer to http://technet.microsoft.com for details.

Formalize your Event Log archiving policy. Archive Event Log files periodically and store on a separate file server for analysis. If you will be consolidating storage of Event Logs on a central server, devise a naming convention that will clarify which events from which server and which dates are contained in a file. After a period of time, archive older log files to a tape backup or burn them onto a CD Writer. These archived logs should be considered sensitive material and should be stored in a secured location. If you archive onto backup tapes, these tapes should be stored in the same location as other backup tapes.

359

74_sysad_09.qx 11/8/99 10:14 AM Page 360

360


Only turn on advanced logging when it is needed. Enabling Process Tracking and Object Access auditing has the potential to slow down a server’s CPU and disk system. The server will spend more resources logging access attempts than it will spend processing those attempts!

Summary The Event Log service handles the logging of events into a single centralized log database. The events that get logged can range from checkpoints such as a service reporting that it started without errors, to detailed tracking of user activity, and are determined by the programmer of the application in use. Management of the Event Logs is done using the Event Viewer snap-in for the Microsoft Management Console. Event Log operations include the viewing, saving, and clearing of the Event Log. In order to keep the Event Logs from growing large enough to take up all available disk space on a server, they must be kept at a manageable size. Security Events can be used to track the actions of user accounts and to determine whether users are snooping around in data they should not be seeing. Security auditing features can also be used by administrators to cover their tracks. Care should be taken, and a proper Event Log access and archiving policy set up, to ensure that all server activity can be recorded and saved for future analysis.

74_sysad_09.qx 11/8/99 10:14 AM Page 361


FAQs Q: Why don’t I see an event view for a certain service as I do with Distributed File System, Directory Service, Security, and so on?

A: A view will display only events from a certain service if it is either one of the default views in the Event Log (generated by the presence of a *.EVT file in the %systemroot%\system32\config directory) or a manually created view that filters only desired events.

Q: I enabled auditing in a group policy object. Why are there no events appearing in my logs?

A: It is possible that the changes to the GPO have not replicated to all servers yet or that the auditing settings in the GPO are blocked or overridden by another GPO.

Q: I’m trying to check my Security Logs to see whether the audit settings are working correctly. There seem to be too many 560 and 562 events for what should be a single file access. Why is this?

A: A series of steps occur for an account to access an object. If a high level of auditing is turned on, each interim access required to navigate via Explorer to the desired object will trigger an audit event. An administrator who enables this level of auditing will need to filter through more events to verify the event desired.

361

74_sysad_09.qx 11/8/99 10:14 AM Page 362

74_sysad_10.qx 11/8/99 10:23 AM Page 363

Chapter 10

Backing Up and Restoring Data


Introduction to Backing Up and Recovering Data

■

Backing Up and Restoring Data

■

Maintaining Media

■

Best Practices

363

74_sysad_10.qx 11/8/99 10:23 AM Page 364

364

Chapter 10 • Backing Up and Restoring Data

Introduction to Backing Up and Recovering Data Included in Windows 2000 Server is an enhanced backup and recovery utility. This utility is a great improvement over the software that was provided in previous versions of Windows. The Backup utility is designed to protect your systems from loss of data due to incidents such as hardware or media failure, or other damaging events. If data on your systems become lost or overwritten, the Backup utility allows you to easily restore the data from archived copies. The Backup utility makes it easier to perform backups, and provides many new powerful features. In addition to being able to perform backups to a tape drive, the Backup utility now supports the ability to back up to many other types of media, including logical drives, removable disks, and writeable CDs. Other enhancements include a user-friendly interface, backup and restore wizards, easier access to network resources, improved batch-initiated backup support, and full support for managing the System State data (which is discussed later). In addition, the utility is integrated with the Task Scheduler for creating scheduled jobs, and it is also integrated with Remote Storage, which is responsible for managing the storage devices and media. To use a tape storage device with the Backup utility, you will need to ensure that Remote Storage is installed (see Figure 10.1). Finally, the Backup utility includes a new Disaster Recover Preparation Wizard to back up data such as system and emergency repair information. The Windows 2000 Server Backup utility is located in the System Tools folder within the Accessories program group (see Figure 10.2). Unlike many of the other utilities included with Windows 2000, the Backup utility is not an MMC snap-in. It does, however, provide a simple graphical interface that allows Administrators to easily manage backups. Figure 10.3 shows the initial screen of the Backup utility. Notice how the utility provides wizards, which makes it easy to back up and restore data, as well as create an Emergency Repair Disk.

74_sysad_10.qx 11/8/99 10:23 AM Page 365

Backing Up and Restoring Data • Chapter 10

Figure 10.1

Remote Storage is integrated with the backup utility and needs to be installed in order to save backups to media such as tapes.

Figure 10.2

Access the Backup utility from the System Tools folder within the Accessories program group.

365

74_sysad_10.qx 11/8/99 10:23 AM Page 366

366


Figure 10.3

The improved Backup utility provides more robust features and an easy-to-use graphical interface.

The improved Backup utility packaged with Windows 2000 Server is definitely a great improvement over previous generations. While many Administrators previously had to resort to third-party backup programs to meet their organization’s backup needs, the Windows 2000 utility provides plenty of enhancements suitable for powering enterprise-level backups. Keep in mind, however, that many third-party utilities still do provide more features than what is packaged with Windows 2000. For example, Computer Associate’s Arcserve backup software includes many features not found in the Windows 2000 utility, such as the ability to automatically spool reports or send pager notifications. The included Backup utility in Windows may not be for everyone, but it definitely may be worth your time to evaluate it.

74_sysad_10.qx 11/8/99 10:23 AM Page 367


Types of Backups The Windows 2000 Server Backup utility supports five methods for backing up data on your systems. ■

Normal

■

Daily

■

Copy

■

Incremental

■

Differential

Each of these methods performs a certain desired function. Choosing the type or combination of backup depends upon your needs. For example, depending upon the type of backup chosen, you may need more or less storage space. In addition, the backup types provide varying levels of speed when a restore is needed. Finally, it is important to understand the archive attribute, which specifies whether or not a file has been backed up since its last change. To view a file’s archive attribute, view the properties for the selected file and click ADVANCED. Figure 10.4 shows a Word document that is marked as being ready for archiving. This means the file has not yet been backed up, or it has changed since its last backup, and it will be backed up during the next backup job.

Normal Backup A normal backup is often times performed the first time you create a backup set. A normal backup will copy all the files you select, and will clear the archive attribute. To restore the files, you only need the most recent copy of the normal backup.

Daily Backup A daily backup simply copies all of the selected files that have changed only on the day the daily backup is done, and it does not clear the archive attribute.

367

74_sysad_10.qx 11/8/99 10:23 AM Page 368

368


Figure 10.4

The Archive attribute is marked as ready for archiving, and the file will be backed up during the next backup.

Copy Backup Performing a copy backup does not affect any of the other types of backups. Since a copy backup copies the files you select, but does not clear the archive attribute, it is often used to back up data between your regularly scheduled backups.

Incremental Backup An incremental backup will back up all selected files, but only those that have been created or changed since the last normal or incremental backup. In addition, an incremental backup clears the Archive attribute. An incremental backup is often used with an initial normal backup. For example, if you perform a normal backup

74_sysad_10.qx 11/8/99 10:23 AM Page 369


on Sunday and incremental backups the rest of the week, the normal backup will back up all of the selected data, regardless of the archive attribute, while the incremental backup will only back up new or changed data. Thus, in the case of a complete data loss, you will require the last normal backup and all the incremental backups to restore all of the data. Using a combination of normal and incremental backups requires the least amount of space, and is the quickest because an incremental only backs up data that has been created or changed since the last incremental backup. Unfortunately, in the event you need to perform a restore, this method will take the longest because the backup set will likely be stored across several tapes.

Differential Backup A differential backup, like an incremental backup, will copy all files created or changed since the last normal or incremental backup; however, a differential backup does not mark the files as having been backed up by clearing the Archive attribute. A differential backup is often used with an initial normal backup. For example, if you perform a normal backup on Sunday and differential backups the rest of the week, the normal backup will back up all of the selected data, regardless of the Archive attribute, and the differential backup will back up new or changed data. However, because the Archive attribute is not cleared, the differential backup will continue to back up those files already copied on previous days by the differential backup. Therefore, only the last normal backup and the last differential backup are needed to restore your data. Using a combination of normal and differential backups requires more space and takes more time because the differential backup continues to back up created or changed data since the last normal backup. The advantage to this method, however, is that a restore is quicker and easier because the data is stored across fewer tapes. As you can see, the method in which you decide to back up your information depends upon your needs. Each method is appropriate for different situations. For example, suppose you have an extremely

369

74_sysad_10.qx 11/8/99 10:23 AM Page 370

370


large amount of data that changes frequently every day. In this case, a differential backup may not be feasible. Table 10.1 summarizes the five different types of backups.

Table 10.1

Summary of the Five Types of Backups

Backup Type

Backs Up

Clears the Archive Bit

Normal Daily

All selected files Selected files modified the day of the backup All selected files Selected files not yet backed up or files that have changed Selected files not yet backed up or files that have changed

Yes No

Copy Incremental

Differential

No Yes

No

Necessary Permissions and User Rights In order to perform backups, a user must have certain permissions or user rights. A user may be an Administrator or a backup operator. In addition, a user can perform backups on files and folders of which he or she is the owner, or have Read, Read and Execute, Modify, or Full Control permissions. An Administrator or a backup operator in a local group can back up data on the local computer, whereas an Administrator or backup operator on a domain controller can back up data on any computer in the domain. Additionally, given a two-way trust relationship, an Administrator or backup operator on a domain controller can back up data on any computer in another domain. To add a user to the backup operators group, simply open Local Users and Groups or Active Directory Users and Computers for Domain Controllers (you must be a member of the Administrators group to designate users as backup operators). Next, add the name of the user you wish to be a member. Additionally, you can prevent

74_sysad_10.qx 11/8/99 10:23 AM Page 371


access to backup files by selecting “Allow only the owner and the Administrator access to the backup data” in the Backup Job Information dialog box as shown in Figure 10.5. This option can only be selected if you are overwriting existing data or backing up data to a new tape or file. If you are appending to an existing tape or file, this option will be grayed out because the ownership has already been established.

Figure 10.5

Secure a backup so only the owner and Administrator have access to the data.

System State Data The various system components in Windows 2000 are known to the Backup utility as System State data. This data includes the following system components: ■

Registry

■

Component Services (COM+) Class Registration database

■

System startup files

■

Certificate Services database

■

Active Directory

■

SYSVOL directory

■

Cluster Service information

371

74_sysad_10.qx 11/8/99 10:23 AM Page 372

372


This data can be backed up and restored; however, you are not able to choose individual components of the System State data to back up and restore. Performing a backup of the System State data will back up all components that apply to your computer. Table 10.2 outlines the various components and how they apply.

Table 10.2

System State Data that Exists on Each Platform

Component Registry COM+ Class Registration Database System startup files Certificate Services database

Active Directory SYSVOL directory Cluster Service Information

Domain Controller

Server

Professional

Yes Yes

Yes Yes

Yes Yes

Yes

Yes

Yes

Yes, but only if the computer is also a Certificate server Yes Yes Yes, but only for Advanced Server running the Cluster Service

Yes, but only if the computer is also a Certificate server No No Yes, but only for Advanced Server running the Cluster Service

No

No No No

Emergency Repair Disk New to the Windows 2000 backup utility is the Emergency Repair Disk wizard. Previous versions of Windows used a separate repair disk utility. This wizard will help you create an emergency repair disk (ERD) and prepare for system failure by backing up system files and emergency repair information. To create an ERD, open Backup from the System Tools folder and select Emergency Repair Disk from the Welcome tab. Alternatively, you can select Create an Emergency Repair Disk from the Tools

74_sysad_10.qx 11/8/99 10:24 AM Page 373


menu. Next, the Emergency Repair Diskette dialog box will appear, prompting you for a blank formatted floppy disk (see Figure 10.6). In addition, you also have the option to back up the registry to the repair directory. Selecting this box will save your current registry files in a folder in your systemroot/repair folder.

Figure 10.6

The Emergency Repair Diskette dialog box used to create an ERD.


Backing up Data

Here are a couple items to keep in mind when backing up data. System State data, such as the registry, Active Directory, and system boot files, can only be backed up on a local computer, regardless of your rights on the remote computer. Also, keep in mind that a user with proper permissions to back up data may be restricted because of disk quota restrictions in place.

Back Up and Restore Options The Windows 2000 Server Help program provides checklists for performing a variety of tasks. Included are checklists for backing up and restoring data. It is best that you use these checklists before performing a backup or restore operation. Figure 10.7 shows the checklist provided for backing up data.

373

74_sysad_10.qx 11/8/99 10:24 AM Page 374

374


Figure 10.7

Using the Windows 2000 checklists to back up data.

Additionally, there are numerous options that can be configured before performing a backup or restore operation. To set the backup options, open Backup from the System Tools folder and select Options from the Tools menu. The Options dialog box shown in Figure 10.8 appears. Within this dialog box, many options can be configured across the various tabs, which include: ■

General

■

Restore

■

Backup Type

74_sysad_10.qx 11/8/99 10:24 AM Page 375

Backing Up and Restoring Data • Chapter 10 ■

Backup Log

■

Exclude Files

Figure 10.8

Viewing the options available from the Tools menu.

In the General tab, you have several options: ■

Compute selection information before backup and restore operations will show you the estimated number of files and total size of the files that will be backed up or restored before the operation begins.

■

Use the catalogs on the media to speed up building restore catalogs on disk will use the on-media catalog to build the on-disk catalog for restores. An on-media catalog refers to information stored on backup storage media, and contains a list of files and folders that have been used in a backup set. An on-disk catalog refers to information stored on a local disk, and contains a list of files and folders copied in a backup set.

375

74_sysad_10.qx 11/8/99 10:24 AM Page 376

376

Chapter 10 • Backing Up and Restoring Data ■

Verify data after the backup completes will check the information on the backup against the original information on disk to ensure the two are the same.

■

Back up the contents of mounted drives will back up the data on a mounted drive; otherwise, only the path information for a mounted drive will be backed up. A mounted drive refers to a drive that behaves like a regular drive, but is assigned a label instead of a drive letter.

■

Show alert message when I start Backup and Removable Storage is not running will simply display a message if Removable Storage is not running when you start the backup. Removable Storage is the service used to manage removable media such as tapes, disks, and libraries. If you are backing up data to the hard disk or a removable disk, you do not need to check this option.

■

Show alert message when I start Backup and there is compatible import media available will display a message if there is new media in the Import media pool. A media pool is a logical collection of removable media that have the same management policies. An Import media pool is one of four types of media pools. It is a logical collection of storage media that has not yet been cataloged by Removable Storage. Again, this box would not apply if you back up to hard disk or removable disk.

■

Show alert message when new media is inserted into Removable Storage will display a message indicating new media has been detected by Removable Storage. Only select this box if you use Removable Storage to manage your media.

■

Always move new import media to Backup pools will cause Removable Storage to automatically move new media to the Backup media pool. The Backup media pool is a logical collection of storage media that is specifically used with the Backup utility. Only check this selection if you use Removable Storage to manage your media. Like the three preceding options, this does not apply and should not be checked if you back up to a hard disk or removable disk.

74_sysad_10.qx 11/8/99 10:24 AM Page 377


The Restore tab contains the following options: ■

Do not replace the file on my computer. Selecting this option will only restore files that are contained on the backup media and not on the disk.

■

Replace the file on disk only if the file on disk is older. Selecting this option will only restore files contained on the backup media if the files on the disk have a date older than what is on the backup.

■

Always replace the file on my computer. Selecting this option will overwrite files on the disk with those contained on the backup.

The Backup Type tab allows you to select from one of the five backup types discussed earlier: copy, daily, differential, incremental, and normal. The Backup Log tab offers three choices for the type of log that will be created when you perform a backup operation. If you select all information from a detailed log, it can become quite lengthy because it also logs the names of all files and folders backed up. Optionally, you can choose to create a summary log, which logs only certain key information such as loading a tape, starting the backup, or failing to open a file. Finally, you can select None, which will not create a log; however, this is not recommended in most situations. To view or print a backup log, select Reports from the Tools menu. The Backup Reports dialog box will appear listing the logs that are available. Finally, the Exclude Files tab allows you to select files that you wish to be excluded from backups. By clicking ADD, you can choose to exclude files owned by all users, or you can select to exclude files for a user, which will exclude only files that you own. Additionally, you can restrict the backup of certain file types by excluding either a registered file type or a custom file mask. To exclude a registered file type, click the type of file you wish to exclude from Registered File Type in the Add Excluded Files dialog box. To exclude a custom file type, enter a period followed by the file extension in Custom File Mask from the Add Excluded Files dialog box (see Figure 10.9).

377

74_sysad_10.qx 11/8/99 10:24 AM Page 378

378


Figure 10.9

Use Add Excluded Files to select registered file types to exclude, or use a custom file mask.

Advanced Options The Windows 2000 Backup utility gives you the choice to set advanced options prior to beginning a backup or restore. Click ADVANCED in the Backup Job Information dialog box to select advanced options. To select advanced options for a restore, click ADVANCED in the Confirm Restore dialog box. The advanced options for performing a backup include options that are configurable from the Options pull-down selection discussed earlier, as well as some new options. The options discussed earlier include the ability to verify data after a backup is performed, and the option to select the backup type. Additionally, you can select new options, including: ■

Back up data that is in Remote Storage will back up data marked for Remote Storage, an application that automatically

74_sysad_10.qx 11/8/99 10:24 AM Page 379


moves infrequently accessed files from local storage to remote storage. ■

If possible, compress the backup data to save space can be used with media such as tapes that has the ability to compress data. Using this option, you will be able to save more data on a tape.

■

Automatically back up system protected files with the System State will back up the system files located in the systemroot directory, and will incorporate these files with the data that is normally saved with the System State data.

The advanced options for performing a restore operation include several new options not already discussed, including: ■

Restore security works only on data that was backed up and is being restored from an NTFS volume. Selecting this option will restore the original security settings, which include permissions, audit, and ownership information.

■

Restore Removable Storage database will restore the Removable Storage database information, which is located in the Ntmsdata file found in the systemroot\system32 directory. This option should only be selected if you are using Removable Storage to manage your media.

■

Restore junction points, and restore file and folder data under junction points to the original location will restore the junction points on your hard disk, as well as the information that the junction points point to. A junction point is a physical location on a disk that points to data located somewhere else on your hard disk or even another device. If this option is not selected, only the junction points will be restored, and not the linking data. This option is used most commonly when you wish to restore the data contained within a mounted drive.

■

When restoring replicated data sets, mark the restored data as the primary data for all replicas should only be selected if your server is replicating data to other servers. This option restores the File Replication Service data, and ensures that the data is properly replicated to other servers; otherwise, the data when restored will appear old, and will

379

74_sysad_10.qx 11/8/99 10:24 AM Page 380

380


be overwritten with data from other servers. This option is for use when replicating data with the Distributed file system and should not be confused with the System State data such as Active Directory. ■

Preserve existing volume mount points will not allow the restore operation to overwrite any existing mount points. For example, if you are restoring data to an entire drive or partition that you have just partitioned, formatted, and created mount points for, then you probably want to preserve the existing mount points. Do not select this option if you only reformatted a drive or partition, and you will need the old mount points.

Before beginning a backup or restore, you should become familiar with the many options that are available to you. It is important that you verify which options apply given your current situation. Next we will discuss and walk through the procedures for both backing up and restoring your data.

Backing Up Data The Windows 2000 Server Backup utility allows you to back up data to either a file or a tape. When you save a backup to a file, it will have the default .bkf extension. You also have the ability to save this backup file to other media such as a hard disk, floppy disk, Zip disk, writeable CD, or any other media that you can save a file to. Backup will prompt you for a filename and location for the data to be saved during the backup procedures. If you have a tape device attached to your computer, you also have the option to back up data to tape. The actual managing of the tape media will be done by the Removable Storage service. A basic backup is comprised of four primary steps. First, you will select the files and folders that you want to back up from the Backup utility. The utility provides you with a view of the file system much like that of Windows Explorer. To mark folders and/or files to be backed up, simply place a check mark in the corresponding box. Notice the different types of boxes shown in Figure 10.10. A blank box next to a file indicates that the

74_sysad_10.qx 11/8/99 10:24 AM Page 381


file will not be backed up, and a blank box next to a folder indicates that the folder and all of its contents will not be backed up. If a folder contains a gray check mark, this indicates that only part of the folder’s contents has been marked for backup. A folder that contains a blue mark indicates that the entire contents of the folder will be backed up. Any file marked for backup will contain a blue check mark.

Figure 10.10 Backup uses a tree structure of the file system, from which you use check marks to select objects to be backed up or restored.

After you have selected the data you wish to back up, you must select the location in which you wish to store the backed-up data. If you have a tape device attached to your system, you can select it as a destination. If you do not have a tape device, this option will be not be available from the pull-down list (see Figure 10.11), but you will

381

74_sysad_10.qx 11/8/99 10:24 AM Page 382

382


always have the ability to select a destination on a storage device such as a hard disk or other removable or nonremovable media.

Figure 10.11 Choosing a backup destination when a tape device is not attached to the system.

Next, you will be given the choice to select various options. Finally, you can start the backup. You will also be given the opportunity to click SET SCHEDULE, which allows you to run unattended backups at later times.

Back Up Files to File or a Tape To perform a backup to a file or tape, follow these steps: 1. Open Backup from the System Tools folder. 2. Select the Backup tab, and click NEW from the Job menu. 3. Mark the files and folders that you wish to back up. You can also choose to back up the System State data by selecting the box next to System State; in addition, if you only want to back up the System State and no other data, only select System State.

74_sysad_10.qx 11/8/99 10:24 AM Page 383


4. From Backup Destination, choose either File or a tape device if one is attached to your system. If you do not have a tape device, File will be selected as the default. 5. If you are backing up to a file, click BROWSE or type the path and filename for the backup file. Alternatively, you can select the tape you want to use if you are using a tape device. 6. Be sure to select any options that you wish to apply by clicking Options from the Tools menu. 7. Select Start Backup, and the Backup Job Information dialog box will appear. Here you are given options to name the backup and media and specify whether to append or replace if the media already contains data. 8. If you wish to set advanced options, click ADVANCED, and make any necessary changes. 9. Finally, click START BACKUP to begin the backup procedure. Figure 10.12 shows the Backup Progress dialog box that will appear, which indicates the status of the backup operation.

Figure 10.12 The Backup Progress box will appear after starting a backup to indicate the operation’s progress.

383

74_sysad_10.qx 11/8/99 10:24 AM Page 384

384


The preceding steps walk you through the process of a backup operation; alternatively, you can choose to use the Backup Wizard by selecting Backup Wizard from the Welcome tab (see Figure 10.13). The wizard will walk you through the necessary steps prompting you to enter the required information.

Figure 10.13 The Backup Wizard will walk you through the necessary steps, prompting you for information.

Scheduling In addition to immediately running a backup, you can also schedule a backup to run unattended. Before doing this, however, you need to be sure that the Task Scheduler service is running. Once you have scheduled a job, you can easily change the settings by selecting the Schedule Jobs tab and choosing the backup icon of the job in the calendar that you wish to display (see Figure 10.14).

74_sysad_10.qx 11/8/99 10:24 AM Page 385


Figure 10.14 Use the Schedule Jobs tab to view and change settings of scheduled jobs.

To schedule a backup, follow these steps: 1. Open Backup from the System Tools folder. 2. Select the Backup tab, and click NEW from the Job menu. 3. Mark the files and folders that you wish to back up. You can also choose to back up the System State data by selecting the box next to System State; in addition, if you only want to back up the System State and no other data, only select System State. 4. From Backup Destination, choose either File or a tape device if one is attached to your system. If you do not have a tape device, File will be selected as the default.

385

74_sysad_10.qx 11/8/99 10:24 AM Page 386

386


5. If you are backing up to a file, click BROWSE or type the path and filename for the backup file. Alternatively, you can select the tape you want to use if you are using a tape device. 6. Be sure to select any options that you wish to apply by clicking Options from the Tools menu. 7. Select Start Backup, and the Backup Job Information dialog box will appear. 8. If you wish to set advanced options click ADVANCED, and make necessary changes. 9. Next, select Schedule from the Backup Job Information dialog box. 10. The Scheduled Job Options dialog box will appear. Type a name for the backup job in Job Name, and then select Properties to set the date, time, frequency, and advanced scheduling options as seen in Figure 10.15. 11. Finally, click OK twice.

Figure 10.15 Using Schedule Job allows you to set the time, date, frequency, and other advanced backup options.

74_sysad_10.qx 11/8/99 10:24 AM Page 387


Using Batch Files Although the Windows 2000 Backup program provides powerful options and an easy-to-use graphical interface, Administrators still have the option of using batch files to back up data. The command used to perform batch file backups is ntbackup. There are, however, a couple of limitations to using ntbackup. First, you are only allowed to back up folders. Thus, you are not able to mark individual files for backup; however, to get around this you can create a backup selection file (.bks) by using the Backup utility. This file can contain a list of the files that you want to back up, which can be used as a parameter for the ntbackup command to used. The next limitation of the ntbackup command is the lack of support for wildcard characters. Despite these limitations, the ntbackup command does allow many parameters to be entered. The syntax for the ntbackup command is as follows: ntbackup backup [systemstate] "bks file name" /J {"job name"} [/P {"pool name"}] [/G {"guid name"}] [/T { "tape name"}] [/N {"media name"}] [/F {"file name"}] [/D {"set description"}] [/DS {"server name"}] [/IS {"server name"}] [/A] [/V:{yes|no}] [/R:{yes|no}] [/L:{f|s|n}] [/M {backup type}] [/RS:{yes|no}] [/HC:{on|off}]

Table 10.3 lists the parameters and their functions. The third column specifies whether a specific parameter, if not used, will default to the settings applied in the graphical version of the Backup utility used in Windows. For further assistance in using parameters available with the ntbackup utility, type ntbackup /? at the command prompt.

Table 10.3

ntbackup Command-Line Parameters

Parameter

Function

systemstate

Used to back up the System State data Identifies the name of the backup selection file to be used

bks file name

Default to GUI

Switches that Can't Be Used

387

74_sysad_10.qx 11/8/99 10:24 AM Page 388

388


Parameter

Function

/J {"job name"}

Identifies the job name to be used in the backup log files

/P {"pool name"}

Identifies the media pool to be used Overwrites or appends to this tape Overwrites or appends to this tape Identifies the name of the new tape Logical disk path and filename Identifies a label for each backup set Backs up the directory service file on a specified Exchange Server Backs up the information store file on a specified Exchange Server Performs an append-must be used with either the /G or /T switch Verifies data after the backup Restricts access to the owner or Administrators only Log file type-full, summary, or none Identifies backup typenormal, copy, differential, incremental, or daily

/G {"guid name"} /T { "tape name"} /N {"media name"} /F {"file name"} /D {"set description"} /DS {"server name"}

/IS {"server name"}

/A

/V:{yes|no} /R:{yes|no}

/L:{f|s|n} /M {backup type}

Default to GUI


/A /G /F /T /P /P /A /P /G /T

Yes

/P

Yes Yes

Yes Yes

Continued

74_sysad_10.qx 11/8/99 10:24 AM Page 389


Parameter

Function

/RS:{yes|no}

Backs up the Removable Yes Storage database Specifies hardware compression

/HC:{on|off}

Default to GUI


Restoring Data Like in the backup operation, there are basically four steps in the restore operation. First, select the files and folders that you wish to restore. You will be presented with a treelike view of your files and folders like that shown earlier in Figure 10.10. Next, select where you want to restore the files. You are allowed to restore your data to three different destinations. You can choose to restore files to their original location, an alternate folder, or to a single folder. The difference between an alternate folder and a single folder is that by restoring your backed-up data to an alternate folder, you retain the structure of the files and folders that were backed up. On the other hand, restoring your data to a single folder will place all of your backed-up files (not folders) in one folder. After you have selected the restore destination, be sure that you have selected one of the restore options that specify file replacement. These options, which were discussed in detail earlier, include the ability to prevent files from being overwritten, replace files only if the file on the disk is older, or replace all files on your hard disk. Finally, you can begin the restore. When beginning a restore operation, you will be given the chance to set advanced options that include restoring security settings, restoring the Remote Storage Database, and configuring the restore of junction point data.

Restore Files from a File or Tape Restoring files from a file or tape is much like the procedures for backing up files discussed previously. To restore files, follow these steps:

389

74_sysad_10.qx 11/8/99 10:24 AM Page 390

390


1. Open Backup from the System Tools folder. 2. Select the Restore tab. 3. Mark the files and folders you want to restore. 4. Next, select the destination of the restored files. If you select Alternate location or a Single Folder, you will need to type the destination path or click BROWSE. 5. Be sure to select any options you wish to apply by clicking Options from the Tools menu. 6. Click Start Restore. 7. If you wish to set advanced options, click ADVANCED, and make any necessary changes. 8. Finally, click OK to begin the restore procedure. The preceding steps walk you through the restore operation; alternatively, you can choose to use the Restore Wizard by selecting Restore Wizard from the Welcome tab. The wizard will walk you through the necessary steps prompting you to enter the required information.

Restore System State Data To back up the System State data, open Backup from the System Tools folder, and select the Backup Wizard. On the What to Back Up page, select “Only back up the System State data,” and click NEXT. Next, you will need to choose where you want to store your backup, and you also have the opportunity to select other options. Finally, on the Completing the Backup Wizard page, click FINISH, and the system will start backing up the System State data. This procedure is useful for restoring the System State data on a system that is not configured as a domain controller. Restoring the System State on a domain controller is discussed next. In order to restore the System State data on a Windows 2000 Server domain controller, you must first restart your computer in directory services restore mode. The following steps outline the required tasks:

74_sysad_10.qx 11/8/99 10:24 AM Page 391


1. Restart the computer and press F8 when the boot loader appears. 2. Select Directory Services Restore Mode from the menu, and press ENTER twice. 3. Log on to the system with administrative rights. Click OK when the dialog box appears informing you that Windows is operating in safe mode. 4. Open Backup from the System Tools folder. 5. Select Restore Wizard, and click NEXT. 6. On the What to Restore page, expand the menu to where you saved the backup data, select the box, and click OK. The Restore Progress dialog box will appear. 7. Click CLOSE when the restore is complete. 8. Restart your computer only if you do not need to perform an authoritative restore.

Authoritative Restore To restore distributed services such as the Active Directory, you will need to restore the System State data. If Active Directory is replicated across more than one domain controller, you will need to perform an authoritative restore to ensure that the data is replicated properly. An authoritative restore solves the problem of Active Directory information from other servers replacing the restored data because of the way Active Directory replication works. Because a regular restore operates in a nonauthoritative mode, any restored data will have its original update sequence number. This presents a problem for Active Directory because the replication system uses this number to propagate changes among the various domain controllers. Thus, replication will assume the restored data is old, and it will replace the data. The ntdsutil utility needs to be run in order to authoritatively restore Active Directory data. First, however, you must restore the System State data, and run the ntdsutil command prompt utility

391

74_sysad_10.qx 11/8/99 10:24 AM Page 392

392


before you restart the server. Using this utility, you can mark objects for authoritative restore, so that its update sequence number is higher than any other number in the replication system. As a result, any data that you restore will now be properly replicated to the other servers. Let us assume that the marketing organizational unit was accidentally deleted from the nwtraders.msft domain, thus creating the need to perform an authoritative restore. To perform an authoritative restore, follow these steps: 1. First, restore the System State data as discussed earlier. 2. Type ntdsutil at the command prompt. 3. At the ntdsutil: prompt, type authoritative restore, and press ENTER. 4. From the authoritative restore: prompt you can then, for example, perform the following command to restore the marketing organizational unit: restore subtree OU=marketing,DC=nwtraders,DC=msft, and press ENTER. 5. Click YES when the Authoritative Restore Confirmation box appears. The restore process will take place, and the authoritative restore prompt will appear when complete. 6. At the authoritative restore: prompt type quit, and press ENTER. 7. Close the command prompt, and restart the computer. Figure 10.16 shows the results of the preceding steps. For further assistance in using the ntdsutil utility, type ntdsutil /? at the command prompt.

74_sysad_10.qx 11/8/99 10:24 AM Page 393


Figure 10.16 Performing an authoritative restore using the ntdsutil utility from the command prompt.

Maintaining Media If you have a tape device installed on your system, and you will be using it to perform backups, you will need to become familiar with maintaining your tapes. From within the Backup utility, you can perform the following maintenance tasks: ■

Format a tape

■

Retension a tape

■

Erase a tape

■

Update a catalog

■

Delete a catalog

393

74_sysad_10.qx 11/8/99 10:24 AM Page 394

394


Some devices require that you format a tape before using it. If this is the case, simply open Backup from the System Tools folder, select the Restore tab, right-click the tape you want to format, and click FORMAT. To restore tension to a tape, simply right-click on the tape, or select Retension from Media Tools in the Tools menu. This action will remove loose and tight spots that may have developed. The Media Tools menu will only be available if your system is using a tape device. In addition, by choosing Erase from the same menu, you can easily erase a selected tape from the Restore tab. Choosing to erase a tape will cause the tape to move from the Backup media pool to the Free media pool. From the Restore tab in the Backup utility, you can also choose to update or delete a catalog. A catalog is a summary of the files and folders that have been saved in a backup set. To delete a catalog, right-click the backup set that contains the catalog you want to delete. If the backup set was saved to a file, select Delete Catalog; otherwise, if it was saved to tape, click “Delete from system.” Deleting a catalog is primarily used to delete a lost or damaged tape from the on-disk catalog. Finally, to create or update a catalog, right-click the media containing the backup set you wish to catalog, and click Catalog.

Best Practices Microsoft has devised several practices that you should follow when dealing with backups. These ideas are suggested in order to eliminate or minimize the damaging effects of a failed system. At the least, you should adhere to the following: ■

Develop backup and recovery contingency plans. It is important that you devise a plan of action to be taken in the event of a system failure. Such a plan most likely will assist you in recovering quickly.

74_sysad_10.qx 11/8/99 10:24 AM Page 395

Backing Up and Restoring Data • Chapter 10 ■

Train appropriate personnel. Depending upon the security level of your network, you may wish to grant certain personnel backup and restore rights. Ideally, you would want a single person with rights to back up and another person with rights to restore. In tighter security situations, you should consider allowing only Administrators to restore files.

■

Back up the entire volume. Be sure that you occasionally back up the entire volume. In the case of disk failure, it will be easier to restore.

■

Back up directory services. Be sure that you always back up the System State data on a domain controller to prevent loss of the directory service information.

■

Create a backup log. Creating backup logs and having them handy makes it easy to verify the state of the backup as well as locate specific files that were backed up.

■

Retain multiple copies. Be sure to keep at least three copies of the media. It is also recommended that you store one copy offsite in case of fire, flood, or other disaster that can potentially ruin your backups.

■

Perform trial restorations. Backups will do you no good if the restoration procedure fails. By performing trial restorations, you will have the opportunity to uncover failed media or catch hardware problems that software checks are unable to find.

■

Secure devices and media. Finally, it is recommended that you ensure the security of your backup devices and media to prevent theft.

Above all, be sure to perform backups! By following these practices, you will increase your chances of successfully recovering from a disaster. Administrators frequently get into the habit of thinking, “it could never happen to me.” If it hasn't yet happened to you, it’s not a question of “if,” but rather of “when it does happen.”

395

74_sysad_10.qx 11/8/99 10:24 AM Page 396

396


Summary This chapter introduces the Windows 2000 Server Backup program, and demonstrates the procedures to back up and restore data. An all-new Backup utility is provided with Windows 2000 Server, and it is more robust and powerful than the backup software provided in previous generations. The utility provides an easy-to-use interface and is integrated with other components such as Remote Storage and Task Scheduler. Introduced in this chapter are many features and concepts that are important to understand in order to use the Backup utility. Discussed were the five types of backups supported: normal, daily, copy, incremental, and differential. In addition, this chapter introduces the necessary permissions and user rights required in order to perform backup and restore tasks. Included in the Backup utility is a wizard that helps create an emergency repair disk (ERD), and the ability to back up System State data, which includes various distributed and system components such as Active Directory and system startup files. Before performing an actual backup or restore procedure, the utility allows you to set various options, which are available from the Tools menu. In addition, each time you perform a backup or restore, you will be prompted to set advanced options. The options from the Tools menu allow you to adjust options across five tabs: General, Restore, Backup Type, Backup Log, and Exclude Files. The advanced options allow you to select more advanced procedures such as compressing data, restoring the Removable Storage database, and restoring junction points. This chapter then walked you through the procedures to back up and restore data. This includes files, folders, and System State data. To back up or restore data, you have the option of creating your own jobs manually or using the wizard; in addition, you can run a backup operation immediately or use the Schedule Jobs feature to create backup schedules. This chapter also introduced the ntbackup utility, which allows you to perform command-line and

74_sysad_10.qx 11/8/99 10:24 AM Page 397


batch file backups, and discussed how to perform an authoritative restore, which prevents replication data on other servers from overwriting restored data. Finally, this chapter introduced how to maintain media using the Backup utility. Be certain to develop strong backup habits, and implement the best practices mentioned in this chapter. Performing backups is one of the most important jobs of an Administrator. Unfortunately, it is a thankless task, but being able to restore data quickly and efficiently will bring many praises. While you may never know exactly when you hard disk will crash or when the boss will accidentally delete a critical file, you can have the peace of mind knowing that you have a well thought-out backup and recovery plan.

FAQs Q: What backup strategies are available? A: The way you back up your data depends upon your specific needs. There are, however, a few simple methods for performing a weekly plan. For example, perform an incremental or differential backup Monday through Thursday, and do a normal backup on Friday.

Q: Can I restore the System State data to an alternate location? A: Yes; however, only the registry files, SYSVOL directory files, Cluster database information, and system boot files are restored. Other distributed services such as the Active Directory, Certificate Services, and the COM+ Class Registration database are not restored.

Q: Can I select individual parts of the System State data to be restored?

A: No. The closest alternative is to install the data to an alternate location as noted previously.

397

74_sysad_10.qx 11/8/99 10:24 AM Page 398

398


Q: Will I need to decrypt files and folders before I can back them up?

A: No. If you are a backup operator or an Administrator, you can back up encrypted data without having to decrypt it.

Q: How do I start the Task Scheduler, so that I may schedule backups?

A: The Task Scheduler is a service that can be started using Services in Computer Management, or you can type net start schedule at the command prompt.

Q: Can I restore backed-up data from an NTFS volume onto a FAT volume?

A: Yes you can; however, you could lose data as well as certain features such as permissions, encryption settings, disk quota information, and remote storage information. It is recommended that you always restore data backed up on NTFS, back on to NTFS.

Q: How do I back up and restore data on a Microsoft Exchange Server?

A: On the Backup tab, be sure to select the box next to the Microsoft Exchange icon, and type the name of the Exchange server you want to back up preceded by two backslashes in Server. Next click Connect to Organization. In order to perform a restore, select the Exchange data on the Restore tab that you want to restore, and click Start Restore. If you are restoring Information Store data, type the name of the server you are restoring data to in Restore To. Finally, choose other options, and click OK.

74_sysad_11.qx 11/8/99 10:29 AM Page 399

Chapter 11

Advanced Administration of Windows 2000


Administering Windows 2000

■

Understanding the Logon Process

■

Windows 2000 Resource Kit

399

74_sysad_11.qx 11/8/99 10:29 AM Page 400

400

Chapter 11 • Advanced Administration of Windows 2000

Administering Windows 2000 Microsoft has made great strides in extending the Microsoft Networking Paradigm, including expanding the tools used to administer those resources, allowing administrators to customize the tools for their environment. Microsoft has incorporated many Internetstandard networking services into Windows 2000 Server that allow it to function in an enterprise environment as more than just a file server and application server.

Microsoft Management Console The Microsoft Management Console (MMC) is not just an administrative tool, but a framework for the various snap-ins that provide system information or perform administrative functions. Navigation of the MMC is very straightforward; it builds from the simplicity of Windows Explorer. As shown in Figure 11.1, the left-hand side of the console is the navigation pane, which allows you to navigate your way through the console tree. The right-hand side, the detail pane, displays the data held within the container selected in the navigation pane. The console tree provides a hierarchical view of the snap-ins. Each MMC console, along with its settings, is saved as an MSC file. Windows 2000 Server comes with many predefined consoles. Some of these predefined consoles will be new to system administrators, and some are there to emulate their Windows NT 4.0 counterparts. These predefined consoles help Windows NT 4.0 administrators find the tools they need to do familiar tasks, while allowing them to learn the new administrative paradigm. In addition, the MMC has the flexibility required by organizations to build customized MMC console files, allowing them to provide customized tool sets to their network administrators. Table 11.1 lists several Windows 2000 predefined MMC consoles that function like their Windows NT 4.0 Server counterparts.

74_sysad_11.qx 11/8/99 10:29 AM Page 401

Advanced Administration of Windows 2000 • Chapter 11

Figure 11.1

This is a sample MMC custom console.

Table 11.1

Windows NT 4.0 and Windows 2000 Tools

Windows NT 4.0 Administrator Tool

Windows 2000 Predefined MMC Console

DHCP Manager

DHCP Manager

Disk Administrator Event Viewer License Manager Performance Monitor Remote Access Admin Server Manager User Manager Windows NT Diagnostics

Computer Management Event Viewer License Manager Performance Routing and Remote Access Computer Management Computer Management Computer Management

401

74_sysad_11.qx 11/8/99 10:29 AM Page 402

402


Windows 2000 System Administration This section covers the tools used to administer, check for errors, and observe general performance of the local machine, licensing models, and the reasons to choose one model over another, as well as the tools used to observe and spot trends in system performance.

Computer Management Console The Computer Management console replaces several of the old tools in Windows NT 4.0. As seen in Figure 11.2, The Computer Management console has been divided into three areas: ■

System Tools

■

Storage

■

Server Applications and Services

The System Tools node contains administrative tools that modify and monitor the local hardware and software, while the Storage node allows you to display and configure all the storage devices installed. The Server Applications and Services node allows you to manage all the applications and services on the computer that have a front end to manage them. For example, DHCP and IIS have applications for managing their service, and the tools needed to manage them are in the Server Applications and Services node. You will still find these services in the System Tools node using the Services tab, but they will allow you only to start, stop, and indicate when you want the service to start up.

System Tools Node The System Tools node contains eight containers: ■

Performance Logs and Alerts

■

Local Users and Groups

■

System Information

■

Services

74_sysad_11.qx 11/8/99 10:29 AM Page 403


Figure 11.2

This is a sample Computer Management MMC console.

■

Group Policy

■

Shared Folders

■

Event Viewer

■

Device Manager

These tools provide a variety of information about the local machine, and, in some cases, they allow the administrator to modify the system. The Performance Logs and Alerts container is the MMC version of the Windows NT 4.0 Performance Monitor. The information found in this container is a subset of the information found in the

403

74_sysad_11.qx 11/8/99 10:29 AM Page 404

404


Performance Console. It has been provided within this container as a matter of convenience to the administrator. The Local Users and Groups container allows you to manage accounts on the local Windows 2000 machine, unless the machine is a domain controller. If the server is a domain controller, you must use the Active Directory Users and Computers snap-in. The attributes available to manage a user on a nondomain controller is identical to that of the User Manager (not to be confused with User Manager for Domains). The home directory, user profile, group membership, and password information can all be entered under the properties of the user. The System Information container is an information-reporting tool with four subcontainers: System Summary, Hardware Resources, Components, and Software Environment. The System Summary subcontainer provides a quick overview of the current computer such as memory, virtual memory size, available virtual memory, OS, system name, and so on. It should be considered the first stop for any troubleshooting of the computer. The Hardware Resources subcontainer contains information about the resources used on the local computer (DMAs, IRQs, Memory, and so on). The second stop for a technician troubleshooting Windows 2000 should be to check the Conflicts/Sharing subcontainer. The Components subcontainer displays all the hardware used in the computer, its current configuration, and the driver being used. Finally, use of the Software Environment subcontainer will provide everything you want to know, and more, about the current operating system and its various services. Use this for in-depth troubleshooting. The Services container displays all the currently running processes on the computer. This container at first looks just like a reformatted version of the old services control panel from Windows NT 4.0, but there are some nice surprises in store for the administrator. By right-clicking on the service and selecting the properties, you can change the name of the service, change the startup type (automatic, manual, disabled) and change the account used by the service to perform its duties. These attributes are all available under previous versions of NT. There are two new tabs available to the

74_sysad_11.qx 11/8/99 10:29 AM Page 405


administrator. The first new property is the ability to describe what the service should do in the event of a failure. There are four options available when a service fails to start: ■

Take No Action

■

Restart the Service

■

Run a File

■

Reboot the Computer

In addition to these four options, you can decide what to do the first four times it fails. The second new property available for service configuration is called dependencies. It lets you see what services depend on this particular service and what other services are required for this service to run correctly. This allows an administrator to tweak the server so that it does not waste CPU cycles running a service that is never used. The Device Manager container is almost identical to the device manager found in Windows 95/98. By right-clicking on any device and selecting Properties, you can customize any of the attributes about a device. This is particularly useful when you install a device that is not Plug and Play and you need to reserve the resources for this particular device. Most of the available options in the System Information node are related to the hardware, software, and the current running environment. It can provide a great deal of information to administrators troubleshooting hardware problems or installing new devices.

Storage Node The storage node is used to manage permanent storage areas, including the removable media. Data storage is covered in greater detail in Chapter 8, “Managing Data Storage.”

Server Applications and Services Node This node is used to manage applications whose operation requires more information than is provided in the services subcontainer in

405

74_sysad_11.qx 11/8/99 10:29 AM Page 406

406


the System node. The service subcontainer only allows you to start, stop, and indicate what to do in the case of a failure. It does not allow you to configure any other information, such as address pools to use (DHCP) or zone information (DNS). Any service that requires additional information requires a snap-in to configure it. The snapins to configure these services will normally install themselves in the Server Applications and Services node during installation of that particular service.

Event Viewer The Event Viewer is used to check the status of various systems. The application log contains errors, warnings, and information from the various programs that have been installed. When you set an auditing policy on your server, you will find the details of the audit in the security log. Be careful to audit only the process you are interested in, because audit logs can quickly fill a hard disk, depending upon the task you choose to audit. The system log will contain error, warning, and information messages about Windows 2000 systems, such as a driver failing to load.

License Manager During the installation procedure, Windows 2000 will ask you to choose a licensing mode. There are two different types of licensing modes; per seat and per server. It is important to choose the correct licensing mode for your particular environment. In order to access any resources on a Windows 2000 server, you must have a Client Access License (CAL). The CAL allows one computer to connect. The licensing mode you choose will determine the paradigm under which one CAL will allow one computer to connect. Per server licensing allows a set number of concurrent connections to the server. For example, Company A has one server, 40 clients, and 30 CALs. If per server licensing mode were chosen for Company A, the first 30 clients to connect to the Windows 2000 server would have no problem, but the 31st client that attempted to

74_sysad_11.qx 11/8/99 10:29 AM Page 407


connect would be denied access, because there would be no available CALs. Company A would then need to purchase 10 more CALs so that all its clients could access their Windows 2000 server. Six months later, Company A buys another Windows 2000 server. Because the company has chosen a per server licensing mode, it must purchase additional CALs before any clients can access the new Windows 2000 server. This does not meet the needs of organizations that have more than one server. Even in a small- to medium-sized business, if I had 200 users and 10 servers, I would need 2000 CALs and another 200 CALs whenever a new server was purchased. Per seat licensing allows a set number of clients to connect to an unlimited number of Windows 2000 servers. For example, if Company B is identical to Company A (40 clients, one Windows 2000 server, 30 CALs), only 30 different computers could ever connect with the use of per seat licensing. Ten computers in the per seat licensing mode would never be able to access the Windows 2000 Server. Company B must purchase 10 additional licenses as well. However, when Company B purchases a second Windows 2000 server, it does not need to purchase any more CALs, because the company has chosen the per seat licensing mode. In the first example, when Company A sets up the second Windows 2000 server, Microsoft will allow a one-time conversion from per-server to per-seat licensing. This would keep Company A from having to purchase additional CALs when it needed a second server. The one-time conversion is allowed only from the per server licensing mode to per seat licensing mode; it is not allowed the other way.

Performance The most basic tool for troubleshooting any performance issues is the Performance console. Frequently, a system administrator installs a Windows 2000/NT server but fails to do the most important part of a Windows 2000 Server installation—that is, to create a baseline. It is important to perform those baselines after an

407

74_sysad_11.qx 11/8/99 10:29 AM Page 408

408


installation has been completed so that you can keep track of trends in the performance of the Windows 2000/NT server. This is particularly important to do before you do any major upgrades. You cannot know what the impact on your server is if you do not know what its performance characteristics were before you installed your new software or hardware, and you cannot tell that you have just outgrown the hardware and need a new server if you do not have those baselines. It is not necessary to baseline every option in Performance Monitor. It all depends upon the purpose of your server. This is where your knowledge of your organization becomes important. Is the server a Web server that is accessed all the time? Is it a file and print server that is only used during business hours? Is it an application server that is very busy on the first of the month and not very busy during the rest of the month? It is important to understand how the organization operates as well as the purpose of the server, so that you can pick the right time to monitor your server. The Performance console has literally hundreds of options to monitor. It is not just as simple as clicking Go to get the performance characteristics of the new machine. It is easy to become overwhelmed by the number of options available to monitor in the Performance console. Table 11.2 lists good generic counters to consider monitoring for your performance baselines. Instances are an important part of using the Performance console. An instance is the number of independent objects that can be monitored by the performance counter. For example, you may have two network interface cards in a server. When you select the Network Interface \ Bytes Total/sec., you will notice that the window on the right has two network interface cards. This allows you to select each adapter independently to monitor or to select them both for overall performance characteristics. If you want to monitor the performance of the physical disk, execute the command diskperf –y and then reboot. This is because the counters used to monitor disk activity have an impact on the performance of the disk subsystem. Therefore, once you have finished running the Performance console for the disk subsystem it should be turned off as soon as possible.

74_sysad_11.qx 11/8/99 10:29 AM Page 409


Table 11.2

Performance Counters for Creating a Baseline

Performance Performance Object Counter Processor

% Processor Time

Interrupts/sec

System

Processor Queue Length

Memory

Available Bytes

Page Faults/sec

Page Reads/sec

Paging File

% Usage Peak

Physical Disk

% Disk Time

Objective Measure the utilization of the processor. Spikes of 100% are very common. Look for sustained 100% utilization. Measure number of hardware interrupts per second. An increase in hardware interrupts per second without an increase in usage may indicate a hardware problem. (100/sec is not unusual, but should be investigated.) Measure the length of the processor queue. If the processor queue is consistently greater than 2 it may mean the processor is the bottleneck. Indicate the amount of memory available to the network operating system. Measure the number of times the network operating system did not have access to a virtual memory page in RAM. If this value is high, more memory may be needed. Measure how frequently the system had to access the hard disk to read pages because of a page fault. This is one of the most critical counters to determine a system's health. Indicate the maximum percentage of the page file that has been used since monitoring has started. Measure how much time on the disk drive is spent reading and writing to disk. Continued

409

74_sysad_11.qx 11/8/99 10:29 AM Page 410

410


Performance Performance Object Counter Avg. Disk Queue Length

Network Interface

Bytes Total/sec Packets Outbound Errors

Packet Received Errors

Objective Similar to the processor queue length, it indicates how long the queue length is to read/write information to the disk. An average of larger than 2 indicates that the disk may be the bottleneck. Indicate how much data is read and sent on a particular interface The number of errors generated because a packet could not be sent on the network. Use another tool geared toward network performance. The number of packets that could not be read because of network errors because a packet could not be sent on the network. Use another tool geared toward network performance.

Windows 2000 Network Administration This section covers the tools used by network administrators to keep their local area network operational. It includes a brief overview of the OSI model that shows how the components of a Windows 2000 system relate to the networks in general. When you understand how to configure these components, you can use the tools provided by Microsoft to ease the configuration and management of your networks. Finally, more advanced functions like Terminal Services and QoS are described.

Adapters and Protocols The building blocks of any network in Windows 2000 Server are the adapter, protocols, and clients. The selection of these tools dictates what you can and cannot do on your Windows 2000 server. The OSI

74_sysad_11.qx 11/8/99 10:29 AM Page 411


model was developed in the early 1980s. Its purpose is to describe the components used to allow computers to communicate. It is not a definitive model, but a suggestion as to how computers should communicate. It is composed of seven layers. Table 11.3 compares OSI and Windows 2000.

Table 11.3

Comparison of OSI Model and Windows 2000 Elements

OSI layer

Windows 2000 Server Element

Application

OS/Client

Presentation OS/Client

Session

OS/Client

Transport

Protocol

Network

Protocol

Data Link Physical

Adapter Adapter

Responsibility Provides users/applications with access to network services. Determines the format of messages and whether encryption is used. Establishes communications with another application. Ensures that data is delivered error free and the messages are in sequence. Finds a path through the network to the host. Responsible for actual transmission. Controls transmission of the data on the network.

In order to communicate on a network, a computer must have an adapter, otherwise known as a NIC (network interface card). Without an adapter the computer will not be able to send data to another computer. The protocol determines the characteristics of the computer’s networking capabilities. There are three commonly used protocols: TCP/IP, IPX/SPX, and NetBEUI. Table 11.4 compares their characteristics.

411

74_sysad_11.qx 11/8/99 10:29 AM Page 412

412


Table 11.4

Protocol Characteristics

Protocol

Typical Usage

NetBEUI

Small networks

IPX/SPX

TCP/IP

Pros

Quick and extremely easy to set up Small to medium- Routable and sized networks fairly easy to set up Small to large Routable; scales networks to very large (Internet environments protocol)

Cons Not routable

Hard to scale to large environments Difficult to set up

Each network protocol has its pros and cons. Protocols like NetBEUI are difficult to use if you have more than one network, and IPX/SPX (Microsoft’s implementation is called NWLink) is very talkative because of Routing Information Protocol (RIP) and Service Advertisement Protocol (SAP) updates. However, Microsoft is working with the networking industry to help ease the configuration difficulty that has become the trademark of TCP/IP.

Configuring Adapters and Protocols It is both good and bad news for network administrators that Windows 2000 is Plug and Play. There are times when configuring new hardware in a Plug and Play operating system is easy, but when things get difficult they really get difficult, especially when you use hardware that is not Plug and Play. Fortunately, the tools provided in Windows 2000 Server help determine the location of the problems. In addition, there is a wizard to help you troubleshoot problems. To administer the settings for the network, start by selecting the Start Menu➔Settings➔Network and Dial-up Connections. As shown

74_sysad_11.qx 11/8/99 10:30 AM Page 413


in Figure 11.3, this window will allow you to administer all your network connections. To configure an adapter, follow these steps: 1. Select the Local Area Connection and from the File menu select Properties. 2. Click Configure to modify any of the NIC’s settings. This window will show you all the protocols and client software associated with this particular NIC. In addition, it will allow you to manipulate any of the attributes to which the NIC’s vendors have given you access.

Figure 11.3

This is a sample Network and Dial-up Connections window.

413

74_sysad_11.qx 11/8/99 10:30 AM Page 414

414


NOTE If you are a network administrator using 10/100 Mb Ethernet cards in a Windows 2000 server, force the network connection to the highest supported network speed. While autonegotiation standards have come a long way, you do not want any guesswork when it comes to the configuration of a server, especially when you deal with 10/100Mb switches that are autonegotiating the connection speed. Frequently, 10/100 NICs connected to 10/100 switches have the hardest time autonegotiating, so do yourself a favor and set it to the highest speed possible. Use the same process to determine whether a NIC can support full duplex or half duplex. Once again, manually set the NIC to the highest supported duplex mode (full or half) supported on the network.

When the network adapter is functional, you can worry about the protocols being used. Because the default protocol of Windows 2000 is TCP/IP, we will focus on the configuration of TCP/IP only. It is important to remember that you must configure your protocols, services, and client software on a per NIC instance, so you must configure TCP/IP through the properties of the NIC. To configure TCP/IP, use this procedure: 1. Select TCP/IP in the components window and click Properties. 2. Enter the IP address, subnet mask, and default gateway address. 3. Click Advanced. 4. Enter a second IP address for the NIC (optional). 5. Select the DNS tab and enter any DNS IP addresses (optional). 6. Select the WINS tab and enter any WINS IP addresses (optional). 7. Select the Options tab to configure IPSec and TCP/IP filtering.

74_sysad_11.qx 11/8/99 10:30 AM Page 415


IP Sec is a protocol in development that will allow encryption of the data stream at the Network layer rather than at the presentation layer. If you choose to use encryption at the network layer, all communications are encrypted, not just the application that chooses to encrypt. TCP/IP filtering allows the network administrator to define which TCP, UDP, or IP ports to accept and which not to accept. The drawback with its current implementation is that if you want to block a specific port, you must define all the ports you will accept, instead of blocking only the ports you are interested in. It can be a timeconsuming effort to analyze all the ports required to keep the server functional yet restrict all the ports that are not necessary.

DHCP Manager As most networking specialists know, TCP/IP is the protocol of choice, especially for communicating with hosts in a large Internet network. It is therefore no surprise that Microsoft has chosen TCP/IP to be the default protocol for Windows 2000. However, TCP/IP’s staggering success does not mean it is trouble free. Configuring TCP/IP on any host requires a significant understanding of the protocol. Without this understanding it becomes very difficult to troubleshoot any problems that may arise. In addition, even the small to medium organization can have hundreds of PCs, making it a very time-consuming effort to configure each PC correctly and uniquely. Configuring hosts on a TCP/IP network is not the only problem associated with this protocol. Maintaining TCP/IP information on all those hosts can be a huge drain on resources. For example, Company A has one network administrator and 100 computers on his network. Company A decides that it is paying too much money for its Internet connection and decides to change ISPs. Its new ISP gives it a new IP block to use. This means that each host on the network must be reconfigured for the new block of IP addresses. To help network administrators with the burden of configuring hundreds of computers whose configuration is similar, but never

415

74_sysad_11.qx 11/8/99 10:30 AM Page 416

416


identical, Bootstrap Protocol (BOOTP) was developed. However, it was severely lacking in its ability to manage an IP subnet effectively. Dynamic Host Configuration Protocol (DHCP) (RFC 2131) has taken the idea of BOOTP and extended it. This gives it the functionality required to function in an enterprise domain. DHCP can hand out not only the prerequisite IP address, gateway, and subnet mask, but many other TCP/IP related attributes, such as WINS Servers, POP servers, SMTP servers, ARP cache timeout, Ethernet encapsulation, and many more. The basic element of DHCP is a lease, which is an offer by a DHCP server for a client to use an IP address for a predetermined amount of time (default is three days). When the lease reaches 50 percent of its term, the client asks the server whether it can renew the lease. If permission is granted, the lease is extended to the full lease period. Assuming that your DHCP server never goes down, your current active leases never have less than 50 percent of their terms left. If your DHCP server does go down, the only clients the administrator needs to be concerned about are hosts that are being turned on during the downtime and that do not have active leases. Even though a client may be turned off, it can still retain its IP address lease. When you set up DHCP, you must first define the scope, which is the subnet in which IP addresses will be leased. When the scope has been defined, you can assign an address pool to it. The address pool defines the range of IP addresses you will lease to a client. Figure 11.4 shows an address pool having been defined for range 172.31.32.50 through 172.31.32.75. At times it may not be convenient to have all your clients acquiring a random IP address. This is particularly true of power users who may need access to their computers from another subnet and do not have the ability to look up the IP address of their computer. A reservation resolves this problem by associating an IP address to a host’s MAC address at the DHCP server. This is similar to assigning static IP addresses, because it allows a DHCP client to get the same IP address even if the client is using DHCP. However, you can change that client’s IP address from a central location. The administrator should be careful when using

74_sysad_11.qx 11/8/99 10:30 AM Page 417


this feature, because if the network interface card is replaced on the client, the MAC address will change. This will make the DHCP client appear as any typical DHCP client, and it will assign an IP address from the standard pool of addresses in the scope instead of from the reservation.

Figure 11.4

This is a sample DHCP MMC console.

The exclusion list keeps IP addresses within your address pool from being assigned while allowing an administrator to create the largest single address pool possible. For example, Company A is using a scope of 172.16.20.0/24, and the network administrator wants to assign the address pool 172.16.20.50—172.16.20.254 to DHCP. Unfortunately, Meg and Morgan have been statically assigned the IP address of 172.16.20.100 and 172.16.20.101, and this cannot be changed. It would appear that the only option the network administrator has is to create two address pools 172.16.20.50—172.16.20.99 and 172.16.20.101—172.15.20.254 to use for DHCP. However, by creating an Exclusion range of 172.16.20.100—172.16.20.101, the network administrator can use one address pool from 172.16.20.50—172.16.20.254 and have Meg and Morgan continue to use their statically assigned addresses.

417

74_sysad_11.qx 11/8/99 10:30 AM Page 418

418


Those familiar with Windows NT 4.0’s DHCP Manager will see that Microsoft has changed the name of the old global scope to “superscope” within the Windows 2000 DHCP server. This is useful when a network administrator has to take care of more than one IP subnet using DHCP. The superscope allows the DHCP administrator to assign a common set of attributes to all of the scopes on the server. These attributes can also be overridden within any specific scope. For example, Company A is using two IP subnets 172.16.20.0/24 and 172.16.21.0/24. Both scopes would typically use the DNS server, but each would require a different default gateway. Using the superscope, you can configure the same DNS server once in the Server Options and have it applied to all scopes within the superscope. Then, using the Scope Options, you can configure each subnet for its appropriate default gateway. While this may not seem useful for two subnets, it is very useful when you have four or more scopes being serviced by a single server.

NOTE Before a DHCP server can hand out leases in an Active Directory, the server must be authorized to hand out IP addresses. You can accomplish this by selecting the DHCP container within the DHCP Console and selecting Action from the file menu. You will then be presented with a wizard to help guide you through the authorization process. Finally, Microsoft has found a new way to deal with the lack of a DHCP server on a local segment. If Windows 2000 Professional, Server, or Windows 98 has its IP address set to DHCP and there is no reachable DHCP server, instead of returning an error and disabling TCP/IP, the operating system will now assign itself an IP address in the IP address range 169.254.0.0—169.254.255.255. This block of IP addresses has been registered to the Internet Assigned Numbers Authority (IANA) with a Netname of LINKLOCAL. There is now no RFC for this particular protocol, but a draft of the RFC can be found at http://www.ietf.org/internet-drafts/draft-ietfdhc-autoconfig-04.txt.

74_sysad_11.qx 11/8/99 10:30 AM Page 419


NOTE When you roll out a Windows 2000 Server implementation, do not leave in the ability of the server to select its own IP address. This could lead administrators to think that their server is operational when it is not. This feature can be disabled by modifying the registry with this procedure: 1. Open the registry “regedt32.exe.” 2. Open the following hive (create it if it is missing): HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCP 3. Create the DWORD “IPAutoconfigurationEnabled” and give it a value of 0x0. Note: It may be necessary to create this registry key.

DNS Management The Domain Namespace (DNS) is most commonly associated with the Internet. DNS provides a hierarchical naming structure for the DNS database. Most people are familiar with domain names such as yahoo.com or microsoft.com. Large organizations have used DNS for their internal networks because it is more flexible than previous name resolution solutions. Each domain name represents a different logical DNS database. Its structure allows a single DNS server to hold many different domain databases or to hold only one domain database. Zones allow an administrator to partition the domain namespace into more manageable pieces. Zones require a contiguous domain namespace. For example, Company A has the domain name companya.com. If Company A only had one DNS server, then it would be managing the zone companya.com. As the company starts to grow, it adds three more domain namespaces: sales.companya.com, accounting.companya.com, and research.companya.com. Because it is still running its DNS on one server, it is still managing the zone companya.com. Eventually, the research department needs to start

419

74_sysad_11.qx 11/8/99 10:30 AM Page 420

420


managing its own DNS, and it creates a DNS server for the research.companya.com. The first DNS server is still managing the companya.com zone, but now the research group is managing the research.companya.com on its new DNS server. There are two different zone types: forward lookup zones, with which most network administrators should be familiar, and reverse lookup zones. Figure 11.5 shows an example of a the entries in a forward lookup zone.

Figure 11.5

This is the DNS MMC console.

Reverse lookup zones are typically used for security purposes because some applications implement security based on the reverse lookup zone name, not IP addresses. For example, Company A has a secured server and wants only people in the companyb.com domain to have access to it. When a client in the companyb.com domain needs to access the host server1.companya.com, the client does a DNS lookup to resolve the domain name to an IP address. When the client has the IP address, it initiates a connection to server1.companya.com. Now server1.companya.com sees a request coming in, but

74_sysad_11.qx 11/8/99 10:30 AM Page 421


it only sees IP address 172.16.20.3. The server needs to verify that the client is from an authorized site. The server then needs to look up the domain associated with this IP address, but it would be impossible to search through the millions of DNS records to find the match on the client’s IP address. This is where reverse lookup zones and the in-addr.arpa domain come into play. This special secondlevel domain is the reverse format of the IP address. Server1.companya.com now only needs to resolve the domain name of “3.20.16.172.in-addr.arpa.” This will require your DNS server to maintain the 20.16.172.in-addr.arpa domain. Use this procedure to configure Windows 2000 server as a DNS server: 1. Select the Windows 2000 server to be the DNS server in the DNS Management console. 2. Right-click on the server in the DNS management console and pick Create a new zone. A wizard will walk you through the configuration of the new zone. There are three different types of zones: a standard primary, a standard secondary, and an Active Directory integrated zone. The first two types of zones create a standard DNS text file, while the second actually stores the DNS information in Active Directory. This automatically provides fault tolerance for the DNS information, assuming you have a second domain controller in your domain. 3. Select Primary standard zone type, secondary standard zone type, or Active Directory integrated zone. 4. Select a forward lookup zone or a reverse lookup zone. Do either step 5 or 6, not both: 5. If you select a forward lookup zone, you will be prompted for the domain name. 6. If you select a reverse lookup zone, you will be presented with a window in which you can manually enter the inaddr.arpa zone, or you can enter the IP block for which you want to create it, and Windows 2000 will automatically generate the correct in-addr.arpa zone.

421

74_sysad_11.qx 11/8/99 10:30 AM Page 422

422


For Managers Only

Switching from UNIX to Windows 2000 DNS Server

Most enterprise shops and even some medium-sized shops have been running their own DNS servers for years with no problems. These same companies will undoubtedly find it difficult to justify replacing their current DNS servers running UNIX, which have been running for years with the first implementation of Windows 2000 Servers. While you do not necessarily need to use Windows 2000’s DNS server to operate effectively, you will lose some functionality if you do not use it. However, there is no reason not to run both UNIX and Windows 2000 DNS servers simultaneously in different domain namespaces.

Microsoft’s original name resolution model revolved around master browsers (local subnets) and WINS servers. Unfortunately, it was difficult to scale WINS servers to meet an enterprise environment. In addition, it was a redundant task; there was no reason to maintain a DNS server and a WINS server when both services provided name resolution. WINS was dynamic in nature, but DNS met the needs of an enterprise environment. In a WINS environment, as a client learned its IP address, using DHCP, it would notify the WINS server of its new IP address. DNS, on the other hand, required the clients to have static IP addresses, because the IP address literally had to be manually entered into the database. The networking industry has been working on a solution for this particular problem, and the solution it has reached is called Dynamic Domain Name Server. When a client gets its IP address from DHCP, the DHCP server sends the update to the DDNS server, thus allowing dynamic updates of DNS. This requires the DHCP

74_sysad_11.qx 11/8/99 10:30 AM Page 423


server to forward the request to the DNS server and the DNS server to understand the request being made. Microsoft has made DDNS the name resolution service of choice in Windows 2000 Server. WINS is still there and works fine, but it is only there for migration to DDNS. In order to use DDNS, your DHCP server must know to update the DDNS Server: therefore, in order to use DDNS, you must configure both DHCP to forward requests and your DNS server to accept them. To enable your DHCP server to forward requests to the DNS server as shown in Figure 11.6: 1. Open the DHCP Management console. 2. Right-click on the scope that needs to use DDNS. 3. Select the Dynamic DNS tab. 4. Check the Enable dynamic update of DNS client information.

Figure 11.6

Allow DHCP to update DNS.

423

74_sysad_11.qx 11/8/99 10:30 AM Page 424

424


To enable your DNS server to accept requests for dynamic updates, follow these steps as shown in Figure 11.7: 1. Open the DNS Management console. 2. Right-click on the domain that needs to participate, and select Properties. 3. Under the General tab select Allow updates in the Dynamic Update field.

Figure 11.7

Allow DNS to accept dynamic updates.

Windows Internet Naming Service (WINS) Windows Internet Naming Service (WINS) is a NetBIOS naming resolution service. Before you get ready to throw away all your WINS servers, as you make a full migration to Windows 2000, make sure that the applications you are using can use the new name resolution model. Configuring WINS is as simple as installing the service and turning it on. Use these steps to install and configure WINS:

74_sysad_11.qx 11/8/99 10:30 AM Page 425


1. Select Start Menu➔Settings➔Network and Dial-up Connections. 2. From the Advanced menu, select Optional Networking Components. 3. Select Network Services and click Details. 4. Check Windows Internet Naming Service and click OK. It is not expected that WINS will retire anytime soon. With organizations still running Windows 3.1, Windows NT 4.0 will be around for a long time. In anticipation of this, Microsoft has given its DNS server the ability to look up records in the WINS server. To enable DNS to use WINS for host name resolution, use these steps: 1. Open the DNS Management console. 2. Right-click on the zone that should use WINS as a last resort, and select Properties. 3. Select the WINS tab. 4. Check Use WINS resolution.

Terminal Services Terminal Services is the incorporation of Windows NT Terminal Server into the Windows 2000 operating system. The first multisession version of Windows was Citrix WinFrame. After seeing the success of WinFrame and its potential, Microsoft has embraced the thin client model. Thin client technology is analogous to a Telnet session. The client is responsible only for displaying the data sent to it by the host and for sending keystrokes (and mouse movement in the case of Terminal Services) back to the host for processing. All the processing is handled on the host side. The native protocol used by Microsoft to allow terminal service sessions is the Remote Desktop Protocol (RDP), which is based on the T.120 multichannel conference protocol defined by the

425

74_sysad_11.qx 11/8/99 10:30 AM Page 426

426


International Telecommunications Union (ITU). There is an additional protocol for use with Terminal Services developed by Citrix called Independent Computing Architecture (ICA). The RDP protocol runs strictly over TCP/IP and uses TCP port 3389. The bandwidth required for RDP to work properly is very low. In addition to this low bandwidth requirement, the Terminal Services client will cache bitmaps on the local machine so that they do not need to be transmitted multiple times. This means that a client can connect to a Terminal Service host over a dial-up connection as slow as 19.2 K and get reasonably good performance. This is excellent for organizations with remote users that require access to legacy applications that use shared database files instead of database engines on the back end. By allowing a client to connect to a server running Terminal Services, you can give remote users access to these network intensive applications, with good performance. Figure 11.8 shows a typical example of a remote user accessing a Terminal Server session. Notice that the Terminal Server and the fileserver are on a high-speed local area network. This bandwidth allows the application to behave adequately. Without a lot of bandwidth, these types of applications perform very poorly. The only data being sent over the “slow” 19.2Kbps dialup line are screen refreshes and keyboard and mouse input. The Terminal Service also allows administrators to connect to remote servers and perform administrative duties as if they were right in front of the servers. However, the Terminal Services environment is designed to give a higher preference to the foreground applications rather than to the background applications. While the use of Terminal Services as a remote access solution may seem like the perfect answer to many remote access problems, it is a difficult environment to set up and maintain. It requires administrators to have a good understanding of where their applications store files related to the data, and where they store data as it relates to the end user.

74_sysad_11.qx 11/8/99 10:30 AM Page 427


Figure 11.8

This is a remote user accessing a Terminal Server.

Dialup 19.2Kb/sec Dialup Client

Ethernet 10Mb/sec

File Server w/shared Database File

Dialup Router Terminal Server

There are two fundamental components any NT administrator should understand before effectively deploying Terminal Services in which multiple Terminal Servers are required: rootdrive and application compatibility scripts. In order to understand their purpose, you need to know the history of Windows applications. Windows was never designed as a multisession operating system. It has always been assumed that when an application was running, there would be only one user using it. For instance, ApplicationA is an older Windows application that uses INI files to store user-specific information (that is, default save directory, default font selection, customized toolbar, and so on). User Meg launches ApplicationA, and the application reads the settings in the INI file. Meg then changes information about the program, but the program does not save the INI file until the application is exited. Before Meg quits the application, Morgan opens the same application and reads the INI file. Morgan likes the settings and does not customize the program settings. Before Morgan quits using ApplicationA, Meg quits and updates the INI file with her settings. Morgan then quits the application and updates the file with the original INI file. The next time Meg connects, it will have the old settings intact. Any user information must be stored in a different area accessible by the user, but without modifying the application. In addition, the next time a user

427

74_sysad_11.qx 11/8/99 10:30 AM Page 428

428


connects to a completely different server, the user information needs to be network accessible so that the second Terminal Server can access this information. Terminal Server solves this problem by allowing administrators to create a rootdrive. When an application makes a call to read an INI file or a user-specific part of the registry, Terminal Server redirects the call to the rootdrive, where all the user-specific information is stored. To set the rootdrive letter, run the CHKROOT.CMD script located in the application compatibility script inside the Windows directory and make sure that you define your Terminal Services profile, found in the user’s property page. Even though Windows 2000 will listen for requests for user-specific files (INI files and parts of the registry), some applications do not store user information in HKEY_LOCAL_USER. Some programs may store user-specific information in areas of the registry that will not be redirected to the rootdrive. This is where application compatibility scripts are useful. In order to write an application compatibility script, you must do some research to find out what settings are stored in nonredirected locations. Fortunately, Microsoft has included application compatibility scripts for many programs, including Office 97, Office 4.x, Netscape 4.x, MS Project, and Internet Explorer 3.x and 4.x. By executing the application compatibility script once, you enable the application to store those user-specific settings in the rootdrive, thereby making them compatible with Terminal Services. In conjunction with Microsoft’s Terminal Services, there are other add-on products, such as MetaFrame, which uses the ICA protocol (port 1494) to extend Terminal Services capabilities by providing: ■

Access to local drives and printers

■

Load balancing for server farms

■

DOS, Mac, and Java clients

■

Ability to embed applications inside a Web page

74_sysad_11.qx 11/8/99 10:30 AM Page 429


These additional capabilities allow Terminal Services to be deployed to a larger and more diverse group without the administrative headache-producing questions: Which server do I connect to? How do I print to my local printer? I don’t have a Windows machine; how do I access Terminal Services?

Quality of Service Quality of Service (QoS) is a combination of mechanisms that provide a specific level of traffic across disparate networks. This type of service provides organizations with three benefits: lower network delays, delaying the need for additional bandwidth, and a greater level of control over the network for the network administrator. Some of the components involved with QoS relate to network infrastructure, such as the use of Asynchronous Transfer Mode (ATM) or NICs that are 802.1p enabled, a method for classifying network traffic and determining a priority based upon predefined policies. QoS as it relates to Windows 2000 focuses on RSVP and Diffserv.

Resource Reservation Protocol (RSVP) Resource Reservation Protocol (RSVP) is the host-to-host communication/negotiation of the QoS requirements. Some networking devices (such as a hub, switch, or router) will listen to the RSVP signaling between two hosts and determine whether the user requesting service, quantity of resources, or type of service being requested falls within the preestablished policies of the network. Other networking devices do not listen to the RSVP signaling and just let the traffic pass. Because RSVP is based upon host-to-host communication, there are technical concerns regarding its ability to handle large numbers of users (that is, scalability).

Diffserv Diffserv is used whenever the scalability issues of RSVP are a consideration. Diffserv works by using the aggregate of the individual

429

74_sysad_11.qx 11/8/99 10:30 AM Page 430

430


traffic flows. This eliminates the need for per-flow inspection by the network devices. RSVP and Diffserv can be used effectively to create a quality of service that is not available in normal networks.

QoS ACS Server Windows 2000 implements RSVP using the QoS ACS server. Clients make reservation requests to the QoS ACS server. When the QoS ACS server is active, it sends multicast beacons to notify the clients that it is ready to receive requests. Only one QoS server may be active at any single time, but additional servers can be installed for fault tolerance. Once a QoS ACS server receives the request, these transactions take place: 1. Authenticate the user. 2. Review policy for that user and determine whether it has sufficient rights for the request. 3. Accept or reject request. To administer the policies for QoS, use the QoS Admission Control console, which allows for the configuration of enterprise settings as well as subnetwork settings. These settings can be controlled through a policy by the QoS Admissions Control center: ■

Direction of flow

■

Service Level

■

Identify

■

Data Rate (per flow and per client)

■

Peak Data Rate (per flow and per client)

■

Duration (per flow and per client)

Routing and Remote Access Microsoft’s Routing and Remote Access service turns Windows NT4.0/2000 into a fully functional router. Until now the routing market has been dominated by Cisco, Bay Networks/Nortel, 3Com,

74_sysad_11.qx 11/8/99 10:30 AM Page 431


Ascend, Shiva, and so on. Microsoft Routing and Remote Access server provides support for: ■

RIP and SAP for IPX

■

RIP v2 for IP

■

OSPF

■

Virtual Private Networking protocols (PPTP & L2TP)

■

Internet Authentication Service (RADIUS)

■

Dial on Demand

These standard technologies allow Microsoft’s RRAS service to integrate into your environment, provided you are running these standard protocols.

Routing Information Protocol (RIP) and Service Advertising Protocol (SAP) for IPX Routing Information Protocol (RIP) and Service Advertising Protocol (SAP) are protocols used in a legacy NetWare network. (NetWare has also made the migration to IP, but it continues to support IPX). RIP for IPX is a protocol used to exchange routes across a network. It allows routers to learn about new networks so clients may connect to servers on those distant networks and vice versa. RIP is a distance vector protocol. This means that the router will exchange all its routing information on all network interfaces. Thus, any other router also sitting on one of those networks can learn about the networks Router A knows about, and vice versa. Service Advertisement Protocol is a protocol used by NetWare to advertise an available service and its IPX internetwork address on the network. These services are typically file and print, but can be anything from backup services to a fax service. SAP works by broadcasting its availability every 60 seconds or during a change of status. Much like RIP, NetWare servers periodically exchange SAP announcements to keep all other routers and SAP servers on the internetwork synchronized.

431

74_sysad_11.qx 11/8/99 10:30 AM Page 432

432


When a NetWare client initializes on the network, the client sends a GetNearestServer SAP to find the nearest server. Windows 2000 can work with RIP, SAP, and to respond to GetNearestServer requests. Windows 2000 can also set filters on the SAP services. For example, I may want to advertise all my file servers through my internetwork, but only want to advertise my printers on the local network. By using SAP filters I can limit the advertisement of printers to only local networks. It is very important to plan your environment using IPX, because if you were not careful you could flood your network with SAP traffic. For example, I have 10 SAP devices on my Ethernet network. Because of the nature of Ethernet, there are four different frame types: 802.2, 802.3, Ethernet II, and Ethernet SNAP. If I had clients using all four frame types because I had not planned well, then I would need to advertise every service on all four frame types. This would mean that every 60 seconds I would have 10 SAP devices advertising their service on all four frame types—40 broadcasts every 60 seconds of network traffic I couldn’t get rid of. This may not seem like much, but every client would have to listen to the broadcast and process it. This would consume CPU cycles and bring down the performance of not only the network, but the clients as well. By installing Routing and Remote Access Service you automatically install RIP for IPX and SAP for IPX (NWLink IPX/SPX/NetBIOS compatible transport protocol must already be configured on one interface). To configure RIP and SAP, use this procedure: 1. Open the Routing and Remote Access console. 2. Double-click on the server you want to configure. 3. Double-click on IPX Routing. From here you can configure any number of attributes about IPX routing. Typically there are two functions you will want to perform: add a routing protocol, or add a routing protocol to an interface. To add a routing protocol, use these steps: 1. Right-click on General and select New. 2. Select Interface or Routing Protocol.

74_sysad_11.qx 11/8/99 10:30 AM Page 433


In addition to adding a routing protocol or an existing interface to a routing protocol, you can add static routes, static services, or static NetBIOS Names. These services help fine-tune a Demand Dial Routing environment.

Routing Information Protocol v2 (RIP v2) The first generation of Routing Information Protocol had severe limitations for an enterprise environment, mainly because it had a hop count limit of 15. However, for small- to medium-sized networks it is easy to use and provides fairly good performance. RIP v2 is similar to RIP for IPX in its mechanics, but Microsoft has added the commonly used split horizon and split horizon with poison reverse to deal with routing loops. This allows RIP to scale to meet the needs of small- to medium-sized organizations. In order to understand their purpose, you need to understand some of the characteristics of distant vector protocols. Take the three routers in Figure 11.9.

Figure 11.9

These three routers show an example of network configuration.

433

74_sysad_11.qx 11/8/99 10:30 AM Page 434

434


Table 11.5 traces the propagation of network 172.16.20.0 through the internetwork.

Table 11.5

RIP Routing Example

Step

Advertising Router

Advertising Router's Listening Hop Count Interface Router

Listening Router's Hop Count

1

A

0

V

B

1

2

B

1

X

C

2

In step 1, Router A advertises out interface V, that it is directly connected (hop count 0) to network 172.16.20.0. Router B hears the advertisement, increments the hop count by 1, and puts the route into its routing table. In step 2, Router B announces on interface X (it announces on all interfaces, but this interface is under discussion here) that it knows how to get to network 172.16.20.0 in one hop. Router C hears the advertisement, increments the hop count by 1, and puts the route into its routing table. One of the most limiting factors of RIP is that it has a hop count of 15. Anything beyond 15 is considered unreachable, so you cannot build internetworks with more than 14 routers in a series; networks more than 15 hops away cannot communicate. Going back to step 2, in the advertisement of network route 172.16.20.0 through interface W, Router B will advertise on Network 172.16.30.0 that it knows how to get to Network 172.16.20.0 in one hop. Router A hears the advertisement, but it has a better hop count, 0, so it ignores the update. However, when network 172.16.20.0 goes down, Router A no longer can get to network 172.16.20.0. On the next advertisement by Router B, it says it knows how to get to Network 172.16.20.0 in one hop, Router A, not having a path to network 172.16.20.0, increments the hop count and inserts it into its routing table. With the packet that comes to Router B destined for Network 172.16.20.0, Router B looks up in its routing table and finds that it needs to forward the packet to Router A. Router A looks in its

74_sysad_11.qx 11/8/99 10:30 AM Page 435


routing table and finds that it needs to forward the packet to Router B, and thus we have a routing loop. This is where split horizon and split horizon with poison reverse comes into play. Split horizon states that you do not send a route out the interface on which it was learned; in other words, do not tell someone what they have already told you. Using split horizon, Router B will never advertise that it knows how to get to Network 172.16.20.0 on network 172.16.30.0; subsequently, Router A will never learn it. Router B will continue to advertise the route to 172.16.10.0 on network 172.16.40.0. Poison reverse takes this one step further. When we learn of a route through an interface, we advertise that network again on the interface on which we learned it, with a hop count of 16, otherwise known as infinity. Thus Router A will never learn of Router B’s ability to get the network 172.16.20.0, when network 172.16.20.0 goes down, because its hop count will be infinity (16 in this case). While poison reverse may not be necessary in small internetworks, it becomes more important when there are multipaths to the same network. In addition to supporting poison reverse, RIPv2 also enables authentication. This allows the department responsible for the internetwork to verify that they are exchanging information with other valid RIP devices. For example, if a user decides to install Windows 2000 Server and starts advertising a path to a network it cannot reach, it will adversely affect the entire network. All or some of the routers on the network will start sending packets to it even though it cannot reach the advertised network. Use these steps to configure RIP (remember that you need at least two interfaces to advertise a network): 1. Open the Routing and Remote Access console. 2. Double-click the server you want to configure. 3. Double-click IP Routing. 4. Right-click RIP and select New➔Interface. 5. Select the interface that has the network you want to advertise.

435

74_sysad_11.qx 11/8/99 10:30 AM Page 436

436


Use these steps to configure split horizon: 1. Open the Routing and Remote Access console. 2. Double-click the server you want to configure. 3. Double-click IP Routing. 4. Select RIP. 5. Select the interface to use split horizon. 6. Select the Advanced tab and check the Enable Split Horizon Processing. 7. To add Poison Reverse to the interface, check the Enable Poison Reverse Processing.

Open Shortest Path First (OSPF) Open Shortest Path First (OSPF) is an Internet Engineering Task Force (IETF) standard that is a link state protocol rather than a distant vector protocol. Distant vector protocols only get to hear secondhand information; that is, they learn about routes only from other routers on the same local network. Link state protocols allow routers to directly communicate their routes to other routers. When a change occurs, it floods the changes across the entire network. This requires the router to have a map of the entire internetwork, called the link-state database. In addition, it does not send all routes though periodic updates, but only when a change occurs. When it does send a link summary update (LSU), it sends information only about the link, not about its whole routing table. Because of this design, it converges very quickly in large internetworks, unlike distant vector protocols, which can take up to five minutes to converge. OSPF is typically used in medium to large internetworks, because of its efficiency, quick convergence, and elimination of potential routing loops. To configure OSPF, use this procedure: 1. Open the Routing and Remote Access console. 2. Double-click the server you want to configure.

74_sysad_11.qx 11/8/99 10:30 AM Page 437


3. Double-click IP Routing. 4. Right-click OSPF and select Properties. From here you can configure any number of attributes about OSPF routing. OSPF is a complex protocol. For more information regarding OSPF, see http://www.ietf.org/rfc/rfc2178.txt.

Remote Access Service Dial Out Dial-up connections provide access to another network using standard telephone lines. There are two main types of dial-up connections available to Windows 2000: standard analog line and ISDN. The functionality that any dial-up connection can give you is directly dependent upon the limitations of both devices. If one side supports IPX and IP and the other side only supports IP, you can only use IP to communicate between the two devices. It is possible to work around this limitation. When you establish a connection with a Network Access Server (NAS), there are four options that are negotiated between the client and the NAS during call setup: Authentication, Callback, Compression, and Multilink. During authentication with the NAS, you must negotiate which authentication protocol you will be using. Each authentication protocol has its pros and cons. There are three commonly used authentication protocols: Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Microsoft Challenge Handshake Authentication Protocol. PAP, the simplest authentication protocol, has been around the longest. It simply sends the username and password as clear text across the dial-up connection. CHAP is a bit more sophisticated in its operation. During a logon request for a PPP connection, and after CHAP has been agreed upon as the authentication protocol, the NAS will send a request for challenge. This challenge is typically a random number that the client must use to calculate a one-way hash using MD5. This provides protection against a playback attack. The password is never passed over the network in clear text. MS-CHAP v2 provides

437

74_sysad_11.qx 11/8/99 10:30 AM Page 438

438


additional security features such as mutual authentication and stronger initial data encryption keys. Table 11.6 shows a comparison of the four different authentication protocols.

Table 11.6

Authentication Protocol Comparisons

Authentication Protocol

Pro

Con

PAP

Everyone supports it

There is no security.

CHAP MS-CHAP

Good security Very good security

MS-CHAP v2

Excellent security

Not everyone can use CHAP. Only Win 9x, NT, and 2000 support it. Win 9x, NT only support for VPN connection; Windows 2000 supports natively.

Unlike previous versions of NT, Windows 2000 installs and starts the remote access service by default. This simplifies the task of getting Windows 2000 ready to support remote access. The first step to supporting a remote access connection is to make sure you have a modem installed in your system (Analog, ISDN, and so on). You can verify your modem is installed by using the Computer Management console and looking under the System Tools node for the Device Manager, as shown in Figure 11.10. When you have determined that you have a modem in your computer, use this procedure to get your dial-up connections working: 1. Open the Start➔Settings➔Network and Dial-up Connections window. 2. Double-click on Make New Connection (wizard will walk you through). 3. Select either “Dialup to a private network” (Company Network) or “Dialup to the Internet” (ISP).

74_sysad_11.qx 11/8/99 10:30 AM Page 439


Figure 11.10 Use Device Manager to verify that a modem is installed.

When you dial into your company network, follow these steps: 1. Enter the phone number of the remote ISP. 2. Select who should be able to use this connection on this computer. 3. Enter name for this connection script. 4. Enter your username, password, and logon domain. When you dial into your ISP, follow these steps: 1. Select Connect Using My Phone Line. 2. Select Create a new connection.

439

74_sysad_11.qx 11/8/99 10:30 AM Page 440

440


3. Enter the telephone number. 4. Enter username and password. 5. Enter name for this connection script. To change your authentication protocol, follow these steps: 1. Open the Start➔Settings➔Network and Dial-up Connections window. 2. Right-click and select Properties on the dial-up script that needs to be modified. 3. Select the Security Tab and modify the settings as appropriate. You can use the Advanced radio button tab for additional support of multiple authentication protocols.

Virtual Private Networks Virtual Private Networks (VPN) support in Windows 2000 is an extended attribute of the Remote Access Service. A VPN allows for additional functionality to a TCP/IP only network, allowing users to use IPX/SPX or NetBEUI over a TCP/IP only network as well as providing a secure transport of TCP/IP. This is achieved by encapsulating the IPX/SPX and NetBEUI packets with a TCP/IP header and sending them to the VPN terminating device. The VPN terminating device then unencapsulates the packets and puts them on the company network. Figures 11.11 and 11.12 show the two basic VPN paradigms that are supported by Microsoft’s VPN software.

Figure 12.11 This is an example of a LAN-attached VPN.

Client

Client

VPN Terminating Device

Router A

Router B


74_sysad_11.qx 11/8/99 10:30 AM Page 441


Figure 11.12 This is an example of a computer/modemattached VPN.

Client

Dialup Router


Client

Remember that if the NAS to which you connect supports IPX/SPX, you do not need VPN software (assuming IPX/SPX is the protocol you require).

Point-to-Point Tunneling Protocol (PPTP) Point-to-Point Tunneling Protocol (PPTP) was Microsoft’s first attempt at developing a VPN for its 32-bit operating systems. In addition to PPTP supporting IPX/SPX and NetBEUI, it also provided a secure form of communication over TCP/IP. When Routing and Remote Access is installed, five PPTP terminating ports are created. In order to use PPTP, you must have a previously configured dial-up script, or you must create one while you configure PPTP.

Layer 2 Tunneling Protocol (L2TP) PPTP is a good solid VPN; however, it was not widely accepted by the networking industry. L2TP is an industry standard protocol that is defined by RFC 2661. Using the public Internet you can connect to your company’s network similar to PPTP. PPTP provided support only for the network protocols IPX/SPX and NetBEUI. L2TP does not support a specific network protocol, but it does support any network protocol because the support is provided at Layer 2 of the OSI Model. This allows users to remotely run applications that are dependent upon any network protocol. As with PPTP, there must be an L2TP terminating device. When Routing and Remote Access is installed, five L2TP terminating ports are created.

441

74_sysad_11.qx 11/8/99 10:30 AM Page 442

442


Configuring Client Side Virtual Private Networks Configuring a VPN is very easy in Windows 2000. To configure PPTP or L2TP, use this procedure: 1. Open the Start➔Settings➔Network and Dial-up Connections window. 2. Double-click Make New Connection (wizard will walk you through). 3. Select whether you want the script to initiate the dial-up session (recommended). 4. Enter the IP address of the VPN terminating device. 5. Select whether this connection is for all users logging on this computer, or just for you. 6. Name the Virtual Private Networking connection. There is no way to specify in a connection script which VPN protocol will be used. The client will attempt to connect using first PPTP and then L2TP. Make sure the terminating device supports the required VPN ports you want to be used.

Configuring Server Side Virtual Private Network Terminating Ports To configure additional PPTP or L2TP ports on the terminating device use this procedure: 1. Open the Routing and Remote Access console. 2. Double-click the server you want to configure. 3. Right-click Ports and select Properties. 4. Select the L2TP device or PPTP device and click Configure. 5. Adjust the Maximum number of ports you wish to support.

74_sysad_11.qx 11/8/99 10:30 AM Page 443


For Managers Only

Virtual Private Networks

Virtual Private Networks can extend an organization’s network in many ways. One of the most cost-effective uses for Virtual Private Networks is in branch offices. By connecting remote offices to the public Internet, you can use a VPN to connect the branch office to the main office. Thus, you eliminate the need for dedicated high-cost leased lines to remote sites. This is especially useful if you still rely on protocols other than TCP/IP. Even if you do use TCP/IP in the branch office, it can serve to encrypt data that traverses the public Internet. The disadvantage here is a reliance on the public Internet; sometimes, when the public Internet is congested, the throughput on your VPN’s performance will suffer.

Demand Dial Routing The reason for using Demand Dial Routing is that if the dial-up connection is expensive (involving a long-distance phone call), the dial-up connection should be used only when it is necessary. When a router receives a packet destined for a remote network, it will check its tables to see what interface to use to send out on the packet. After it selects the best route, it puts the packet on the next network. Demand Dial Routing extends that concept, except that instead of always being connected to that next network, it must dial another router to make the physical connection before it can put the packet on the network. In addition, if we use Autodial and Autologon, we can establish the network connection with no human intervention.

443

74_sysad_11.qx 11/8/99 10:30 AM Page 444

444


In order for our Windows 2000 server to make a routing decision, it must be running a routing protocol or have a static route. Be careful when you use a routing protocol on a Demand Dial Interface, because the router may actually dial up the remote network to exchange RIP updates, which would be an undesired effect. If you need to use a routing protocol, autostatic updates will allow you to use updates with only distant vector protocols. To configure Demand Dial Routing, use this procedure: 1. Open the Routing and Remote Access console. 2. Right-click Routing Interface and select Demand Dial Interface. 3. Enter an Interface Name and select Next. 4. Select the connection type VPN or a Dial-up Device (modem, ISDN, or other device). If your connection type is VPN: 1. Select Automatic, L2TP, or PPTP then select Next. 2. Enter the IP address of the terminating VPN device. 3. Check the routing protocols and security model. 4. Enter your Dial Out credentials. If your connection type is Dial-up Device: 1. Select the interface to use (typically a modem). 2. Check the routing protocols and security model. 3. Enter the IP address of the terminating VPN device. One of the problems with using Demand Dial Routing in an IPX world is that you do not get to see the advertised SAPs of the remote network. In order to solve this problem, you can use the static services in the IPX Routing protocol. By defining a static service, you can advertise a service on the remote network. An alternative to static routes is to use autostatic routes. This simplifies the process

74_sysad_11.qx 11/8/99 10:30 AM Page 445


of adding networks to the central office, because you do not have to continually update the route tables on the remote router. In addition, by using autostatic routes, you keep routers from calling the main office when a packet is destined for an unreachable network. To configure an autostatic service, use this procedure: 1. Open the Routing and Remote Access console. 2. Double-click the server you want to advertise the static service. 3. Double-click IP Routing. 4. Right-click RIP and select New➔Interface. 5. Select the interface to configure with autostatic service. 6. In the Operation Mode pull-down menu, select Auto-Static Update Mode.

Network Address Translation (NAT) Network Address Translation (NAT) is a feature that allows a private network access to a public internetwork (typically the Internet). It was originally developed as a mechanism to slow the depletion of IP addresses. In RFC 1631 three blocks of IP addresses were set aside: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/24. These three blocks of IP addresses are not routable on the public Internet and can therefore be used internally by any organization that needs IP addresses, but does not necessarily need Internet connectivity. NAT typically translates IP addresses from an organization’s private IP address to a globally unique IP address. This allows organizations to give Internet access to all of their hosts without having public IP addresses for all of them. The disadvantage of NATs is that not all applications work correctly. Network management tools that rely on SNMP do break, for example; however, there are ways to correct this problem.

445

74_sysad_11.qx 11/8/99 10:30 AM Page 446

446


While NAT may just seem like an alternative to a proxy server, it works with native IP and does not require a modified TCP/IP stack. This means that you can have an IP aware device on the network without having a special TCP/IP stack to install on it. The typical scenario for NAT usage in a small group is to give everyone Internet access through NAT; this is why Microsoft has labeled the feature Connection Sharing. To configure NAT, you need an internal interface that can access the private IP address range and an external interface that has a globally unique IP address. To configure NAT’s internal interface, follow these steps: 1. Open the Routing and Remote Access console. 2. Double-click the server you want to provide the connection. 3. Double-click IP Routing. 4. Right-click Connection Sharing and select New➔Interface. 5. Select the interface connected to the local office. 6. Select the radio button Allow clients to access shared networks.

NOTE If you do not translate the headers, additional network applications will not work correctly, because there is information about the IP address embedded inside the TCP header, and this needs to be translated as well.

To configure NAT’s external interface, follow these steps: 1. Open the Routing and Remote Access console. 2. Double-click the server you want to provide the connection. 3. Double-click IP Routing. 4. Right-click Connection Sharing and select New➔Interface.

74_sysad_11.qx 11/8/99 10:30 AM Page 447


5. Select the interface connected to the Internet. 6. Select the radio button Enable Translation Across this Interface. 7. Select the check box Translate TCP/UDP headers.

NOTE Private IP addresses have a benefit for network management. By assigning all of your internally used devices private IP addresses, you make it harder for potential hackers to compromise your system.

Internet Authentication Service The Internet Authentication Service implements an IETF-based authentication service also known as RADIUS, covered by RFC 2139. RADIUS provides centralized authentication, authorization, auditing, and accounting for NAS. In small environments, RADIUS will not provide any remarkable amount of functionality. However, in large environments it can help you simplify your authentication problems. There are three scenarios in which RADIUS can be applied: 1. Allow Network Access Servers to use a central username database. 2. Allow a Network Access Server to use a preexisting username database. 3. Centralize administrative access to switches, routers, and hubs.

447

74_sysad_11.qx 11/8/99 10:30 AM Page 448

448


Centralize Network Access Servers username Database RADIUS is an essential part of any remote access security model when an organization is hosting its own dial-up servers. Organizations need a great deal of remote access, and they typically have more than one remote access server. All dial-up servers have the ability to maintain their own independent list of users and passwords. However, this presents a problem for making sure that no matter which dial-up server a user connects to, the username and password are the same. RADIUS solves this problem by handling the authentication, authorization, auditing, and accounting of users who connect to a network as shown in Figure 11.13.

Figure 11.13 RADIUS server authenticates two users from two separate NAS Servers.

Dialup Client

Dialup Router Radius Server

Dialup Client

Dialup Router

Use Preexisting username Database The Internet Authentication Service (IAS) feature of Microsoft Windows 2000 Server is a RADIUS server. This can be helpful to the network administrator has only one NAS server. If you are using a NAS server that holds its own username database, it may support RADIUS (depending on your product/vendor). All ISP class NAS servers such as Cisco, Ascend, Bay, and Shiva do support RADIUS and allow you to take advantage of a preexisting username database, your Microsoft Domain or Active Directory. As shown in Figure

74_sysad_11.qx 11/8/99 10:30 AM Page 449


11.14, this simplifies user connections, because the user’s username and password are the same username/password in the domain. In addition, it reduces the network administrators’ tasks, because it is one less username/password to manage.

Figure 11.14 RADIUS server authenticates a user from a domain.

Dialup Client

Dialup Router

Dialup Client

Dialup Router

Domain w/RADIUS server as member server

Centralize Administrative Access to Routers Hubs and Switches In the last scenario it may be useful to configure your switches and routers to use RADIUS to authenticate administrators accessing the switch or router to manage it. By providing a centralized mechanism for authentication, you can add and remove access to your network infrastructure easily. Especially when you have dozens of routers and switches, it would be very painful to have to modify the username database on each device in order to add or remove a user’s access. One of the important elements in configuring a RADIUS server is the secret key. There are three rules to follow when you define your secret key: ■

Both servers must know the key.

■

The key is case sensitive.

■

The key must be fewer than 255 characters (the longer the better).

449

74_sysad_11.qx 11/8/99 10:30 AM Page 450

450


Even though RADIUS is a standard protocol, several vendors have modified the protocol and provided extended attributes. While these extended attributes are beyond the scope of this book, both the NAS and the Windows 2000 IAS server know which RADIUS version they are using. Typically the choice is between a vendor-specific version of RADIUS or Generic RADIUS. Windows 2000 currently supports 20 different variations of RADIUS. To configure RADIUS on your Windows 2000 server, use this procedure: 1. Open the Internet Authentication Service console. 2. Right-click Client and select New Client. 3. Enter the friendly name of the client and the protocol. 4. Enter the IP address of the client. 5. Select vendor-specific version of RADIUS (use RADIUS standard if you do not know which vendor it is). 6. Enter the shared secret. 7. Click Finish.

Connection Manager Administration Kit One of the great things about technology is its continuing usefulness. As administrators we try to make the migration to new tools as painless as possible, but frequently there is nothing that we can do but walk the user through configuration changes or do it ourselves. The Connection Manager Administration Kit (CMAK), which has been around since IE4 but has now been included with Windows 2000, is a tool that network administrators who support remote users should love. It provides a customized installation package that gives your users preconfigured dial-up scripts. In order for clients to use the CMAK, they must have two components: a service profile and the Microsoft Connection Manager 1.2. A profile is a self-extracting archive and does not require any files on the client’s machine to install. Using the CMAK wizard, you can build a service profile that can subsequently be distributed. The

74_sysad_11.qx 11/8/99 10:30 AM Page 451


Microsoft Connection Manager can be included with a service profile to your users. Thus it requires very little effort to configure a client to start using the CMAK. No setup is required to use the CMAK as it comes installed with Windows 2000 Server. However, quite a few tasks may be required to make a profile, so it is important to have all the information needed to build it. Have this information ready when you create a profile: ■

Name of new profile and file OR name of old profile (if updating a profile)

■

Support Information to include on the connection script.

■

Realm name (if any) used to connect to your service

■

Name of Dial-up Networking Entries to include (and DNS and WINS if not given by NAS)

■

IP Address of the VPN Terminating Device

■

Actions to perform during connection and disconnection of dial-up connection

■

Actions to perform during connection and disconnection of VPN connection

■

Location of a customized bitmap for the logon dialog box (if desired)

■

Location of a customized bitmap for the Phone Book (if desired)

■

Location of phone book to download (if desired)

■

How you will provide updates to your phone book (if downloaded)

■

Location of a customized default help file (if desired)

■

Whether you are going to include the CMAK 1.2

■

Location of license agreement a user must read and accept before installing (if desired)

■

Location of any additional files

451

74_sysad_11.qx 11/8/99 10:30 AM Page 452

452


NOTE A Kerberos server groups users and network services into a Realm. The server is then trusted by other hosts to validate the identity of a user within the Realm.

Once you have all of this information, you can start the CMAK wizard, and it will walk you through the process of creating a selfextracting profile. Windows 2000 will store the service-profile in the \Program Files\CMAK\Profiles\Profile Name folder. In addition to the .exe file, the wizard creates four additional files in this directory for each service profile: ■

ProfileFileName.cms

■

ProfileFileName.cmp

■

ProfileFileName.inf

■

ProfileFileName.sed

These four files contain all the information required to build the .exe file. For further customization it may be helpful to modify these four files and their supporting documentation to set additional parameters. Remember to use the CMAK wizard to re-create the profile before you distribute.

Customizing Windows 2000 Tools for Your Environment Windows 2000 provides many tools to help users customize their environment and help reduce their Total Cost of Ownership (TCO). By Microsoft’s own estimates (using broad assumptions and industry averages), the TCO of 100 Windows 95 machines can cost more than $1 million. The tools that come with Windows 2000 help to reduce some of those costs by allowing for the automation of tasks, providing scripting tools and creating custom tools that allow for the

74_sysad_11.qx 11/8/99 10:30 AM Page 453


easy distribution of tasks. For more information about Microsoft’s position on Total Cost of Ownership (TCO), see this URL: http://www.microsoft.com/technet/tco/.

Creating Custom MMC Consoles There are two types of MMC consoles in Windows 2000: predefined and custom. The predefined consoles are found in the Administrative Tools under the Start menu. Custom menus allow you to build a console containing the tools you need to perform your job. Typically there are three different types of Information Technology managers: ■

Desktop Administrator

■

Network Administrator

■

Data Administrator

These roles are not always divided into separate positions, but the functions performed by each manager are unique. The desktop managers are primarily concerned with the operation of the desktops throughout the organization. They need to deal with hardware configurations, user accounts, and the rollout of new software/operating system and maintenance of the current software/operating system. Network managers have to ensure that the network has a high degree of availability. Data managers are concerned with the management of serverspecific applications, and they focus on application availability, and on backup and user accounts. As architects for Windows 2000, it is important that the appropriate managers have access to the tools they require to perform their jobs. By creating custom consoles, you can give each manager the tools required to perform a specific job without seeing the other snap-ins. Creating custom MMC consoles is a very simple task in Windows 2000. To create a custom console, we start with a blank console and add the appropriate snap-ins and save the .MSC file. Use this procedure to create a custom console:

453

74_sysad_11.qx 11/8/99 10:30 AM Page 454

454


1. Select the Start➔Run menu. 2. Type MMC.EXE /a. 3. Select the Add/Remove Snap-ins from the Console menu. 4. From the Standalone tab click Add. 5. Select the Snap-ins desired and select Add (click Close when you are finished). 6. Click OK to go back to the MMC, then select Save As from the Console menu. Because these customized consoles are just .MSC files, they can be sent as an attachment through e-mail, or put on a shared network drive for access by everyone. Figure 11.15 shows a custom console that has been tailored for a desktop administrator.

Figure 11.15 This is an example of a custom MMC console for a desktop administrator.

74_sysad_11.qx 11/8/99 10:30 AM Page 455


It is possible to add the same snap-in to a MMC several times, so you can create custom toolkits that administer the same function but can manage different objects For example, it is possible to add the Computer Management snap-in multiple times but to administer a different computer in each instance. This feature, in combination with multiple windows, allows an administrator to look at the attributes of two different computers side by side as shown in Figure 11.16.

Figure 11.16 Multiple Windows inside a custom MMC console.

In addition to the snap-ins, there are extensions associated with the snap-ins. These extensions can provide or remove functionality to the snap-in. This allows senior administrators to provide an extra level of control in the snap-ins they provide to the other administra-

455

74_sysad_11.qx 11/8/99 10:30 AM Page 456

456


tors. By default, when a snap-in is installed all of its extensions are installed as well. MMC supports two types of snap-ins: stand-alone snap-ins and extension snap-ins. A stand-alone snap-in can be added to a console tree even if another item is not added first. An extension snap-in, usually called an extension, is always added to a stand-alone or extension snap-in that is already on the console tree. A snap-in does not always require extensions, but when it does, the extensions operate on the objects controlled by the snap-in, such as a computer, printer, modem, or other device.

Console Options: Author Mode vs User Mode In a medium- to large-size organization, various tasks are performed by diverse staff. It is only human nature that staff will explore the tools that have been given to them. Typically this isn’t a problem, and it is actually encouraged. However, with the flexibility provided in the MMC, this could result in administrators’ removing access to components they need to perform their jobs. Microsoft has foreseen this and has made it possible to lock down the settings in the MMC custom console. By default, all custom MMC consoles are in author mode when they are created. Author mode gives administrators full access to all of the MMC’s functionality. This includes adding and removing snap-ins, creating new windows from the current MMC, viewing the entire console tree, and saving the custom MMC console. For small environments this may be all right, because the only person administering the environment needs full control anyway. Medium- to large-size organizations need tighter control over the tools. In order to tighten the reins, Microsoft has made it possible to create MMCs in user mode. User mode has three different modes: Full Access, Delegated Access Multiple Window, and Delegated Access Single Window. Table 11.7 shows the four different modes available and their level of functionality.

74_sysad_11.qx 11/8/99 10:30 AM Page 457


Table 11.7

Author Mode versus User Mode

Console Mode

Functionality Provided

Author Mode

Provides complete access to MMC.

User Mode: Full Access

Can display complete console tree, but cannot add or remove snap-ins. Can display portions of the console tree, view multiple windows, but cannot add or remove snap-ins. Can display portions of the console tree, view a single window, and cannot remove add or remove snap-ins.

User Mode: Limited Access Multiple Window User Mode: Limited Access Single Window

The changes to the console mode are reflected after you have reopened the MSC file. All predefined consoles open in User Mode: Limited Access Single Window.

Using the Taskpad The taskpad allows administrators to create predefined tasks to simplify the number of places users need to look in order to perform their duties. This is especially useful for inexperienced administrators or administrators who must routinely perform the same function. A taskpad is used to hold all the tasks related to a function, while a task is the specific job to be done. Figure 11.17 shows a Taskpad called Manage Martha’s Computer. Within this Taskpad several tasks have been created, such as create a user on her local machine, save the event log, and create a new share on Martha’s computer. In order for these tasks to work, it is very important that the snap-ins that contain the functions are in the console. If the snap-in is not in the console, the task will not work.

457

74_sysad_11.qx 11/8/99 10:30 AM Page 458

458


Figure 11.17 This is an example of Taskpad and custom tasks.

Using the Task Scheduler With computers becoming a more and more integral part of our business it is important to be able to schedule maintenance tasks with the simplicity of a graphical user interface but with the intelligence to determine when they run as well as when they do not. Previous attempts at a scheduler were difficult to use at best. Because it was not dependable, many developers created their own schedulers. These schedulers tend to work when they are isolated, but they rarely work well together. The latest version of the scheduler not only eases administrators’ configuration burdens, but also provides a common and fully programmable set of interfaces. As with most tasks in Windows 2000, there is a wizard to help create new tasks. You can schedule any program or script to run on any interval desired or to run during specific events such as during logon, at system startup, or when the system is idle. When a scheduled event is created, Windows 2000 stores these tasks in the “Scheduled Tasks” folder inside My Computer. This newly created task is just a file that can be copied like any other file. To activate

74_sysad_11.qx 11/8/99 10:30 AM Page 459


the scheduled task, put the .JOB file inside the “Scheduled Tasks” folder. In addition, this file can be copied and put inside other computers’ Scheduled Tasks either through an automated process or by hand. To create a scheduled task, use this procedure: 1. Select the Start➔Program Files➔Accessories➔System Tools➔Scheduled Tasks. 2. Double-click Add Scheduled Task. 3. Select application to run. 4. Select the frequency to run or the event to trigger the task, as shown in Figure 11.18.

Figure 11.18 This is a scheduler.

5. Enter the username and password of the account to execute the scheduled task. 6. Click Finish. Even though Microsoft has provided this new tool for centralized scheduling tasks, Microsoft saw the wisdom of keeping the old

459

74_sysad_11.qx 11/8/99 10:30 AM Page 460

460


scheduler “AT.EXE”. This should allow administrators who are familiar with the AT command to slowly make the migration to the new tool.

Understanding the Logon Process There are many components to understanding security. Two of the most commonly confused subjects are authentication and authorization. Authentication is the process of verifying who you are—this is your username and password, while authorization gives the ability to access a resource. Authorization is controlled by the Access List (ACL), which is created when you authenticate.

Logon Authentication In the Windows 2000 security model there are two different security models: domains and workgroups. Workgroups are a logical grouping of computers that share resources. Each computer in a workgroup manages its own authentication and authorization. A domain is a similar logical grouping of computers, but only one computer controls authentication and authorization. Even though a computer may be a member of a domain, it still holds a user database on the local machine. This allows a user to log on to the local machine even if the domain is not available. When logging on Windows 2000, a user must provide a username and password. If the user is logging on locally (workgroup), the Microsoft Graphical Identification and Authentication (MSGINA) passes the information to the local Security Accounts Management (SAM) to validate the username and password. If the user is logging on the domain, the MSGINA must pass the information to the domain SAM to validate the username and password. After the SAM has successfully authenticated a user, an access token is generated for the user. An access token is a user’s identification on the network and it allows a user to gain access to permitted resources.

74_sysad_11.qx 11/8/99 10:30 AM Page 461


Secondary Logon Services As an administrator you should only log on when you need to perform functions that require the privileges of an administrator, so that no administrator accidentally changes settings on the network. For example, when applications are upgraded, the application will frequently search out and destroy old versions of the application. If you were logged as administrator on a file server in which the application was installed on the network, but you were only upgrading the local machine, the setup application might find and delete the older version on the network. Unfortunately, logging off Windows so that you can log back on Windows as an administrator to perform the single task is time consuming and frequently frustrates both administrators and those requesting the quick fix. Microsoft has recognized this problem and has provided a solution. Secondary logon capability in Windows 2000 allows anyone with a secondary set of credentials to run a task using that second set of credentials, keeping the user from having to log off and then log on in order to perform this action. In order for you to use secondary logon services, the service must be started. Check in the services node in the Computer Management MMC to verify that it is started. To use secondary logon services, follow these instructions: 1. Select the application to run. 2. Hold down the Shift key and right-click the application. 3. Select Run As. 4. Enter a username and password with the privileges required to execute the task correctly. (If the account is in a domain, you may need to enter the username in the domain\username format and ignore the domain field.) 5. Select OK.

461

74_sysad_11.qx 11/8/99 10:30 AM Page 462

462


Windows 2000 Resource Kit The Windows 2000 Resource Kit provides useful resources that extend the functionality of Windows 2000. Resource kits have historically provided third-party tools as well as Microsoft tools that have automated a task. To view the applications in the MMC, run the Tools Management Console in the Resource Kit program group. The Windows 2000 Resource Kit is organized into two folders: Windows 2000 Debugging Utilities and Windows 2000 Resource Kit. Most administrators will find the tools in the Windows 2000 Resource Kit section more useful. The Windows 2000 Resource Kit is broken down into three different subcategories: Online Documentation, Tool Categories, and Tools A to Z. The last two subcategories are the same tools, organized differently. There are many tools in the resource kit, but we will focus on only a few of them.

Direct X Diagnostic Utility The Direct X diagnostic utility (dxdiag.exe) allows system administrators to verify that all the Direct X components within the Windows 2000 system are working correctly. It is a GUI tool that allows you to display information about these components: ■

Version, date, and timestamp of the DirectX files

■

Version, date, and timestamp of the DirectX Drivers

■

Display video drivers used and test DirectDraw and Direct3D

■

Display sound drivers and test DirectSound

■

View Synthesizer settings and test DirectMusic

■

View input device settings and their drivers

74_sysad_11.qx 11/8/99 10:30 AM Page 463


Command Line Kill The Kill application (kill.exe) allows an administrator to terminate an application from the command line. It has historically been necessary to use the Task Manager to do this, but it can be performed from a command line. This is especially useful when you are telneting to your Windows 2000 machine. In addition, the kill.exe application can terminate processes that even the Task Manager cannot terminate.

Sysprep When they deploy computers, organizations work very hard to deploy a consistent image. In Windows NT 4.0, Microsoft provided administrators with unattended setups and the Workstation Setup Manager to help build unattend.txt files. Unfortunately, the graphical user interface in the Workstation Setup Manager was not intuitive and was difficult to use. Usually Workstation Setup Manager was used just to get the unattend.txt file started. Third-party vendors responded with imaging tools that would allow administrators to build a perfect image on one machine and then make an exact duplicate of the hard drive. Imaging has two fundamental flaws. Microsoft’s domain model was built on the use of unique Security Identifiers (SIDs). The SID is a unique number generated during the graphical installation of the Windows NT 4.0 install process. Its randomness is based upon many attributes to make sure that no two SIDs are alike. However, the disk imaging products make exact replicas of everything, including the SIDs. Third-party vendors came up with tools that changed the SID on the computer to something else so that they could participate in a domain. In addition, because Windows NT is not Plug and Play, the slightest change in hardware results, at best, in the image’s needing to be debugged after installation. At worst, the operating system fails on boot.

463

74_sysad_11.qx 11/8/99 10:30 AM Page 464

464


For a long time Microsoft would not support machines that had been imaged. However, Microsoft has recently introduced a cloning tool called Sysprep (sysprep.exe) that can be used on Windows NT 4.0 and Windows 2000 systems. This is not a tool that is trouble free, and it may require some work to perfect your setup. ■

Do not assign any local permissions on the computer before running Sysprep.

■

Clone workstations while you are a member of a workgroup and not the domain.

■

Move Sysprep tools into %WINDIR%. The folder that contains Sysprep is named Sysprep (to ensure the removal of the tool after installation).

■

Update the SIDs in the repair folder on the newly imaged computer to allow Rdisk to properly repair the installation in the future.

Setup Manager The Setup Manager (setupmgr.exe) that comes in Windows 2000 is the second version of this utility. The first version of this utility tried to provide a graphical user interface to prepare unattend.txt files, but it was difficult to use. It was poorly designed and frequently required that the user understand how to interpret OEMSETUP.INF files. The latest version of this tool is a wizard-based tool requiring you to answer the questions, as they would be presented during a normal installation. This tool is extremely easy to use and can be modified at any time with the wizard. Before you run the installation tool, make sure that you have the following information at hand: ■

Product you are going to install

■

Level of interaction you want the user to see during installation

■

Name and organization to which the computer belongs

■

CD-Key

74_sysad_11.qx 11/8/99 10:30 AM Page 465

Advanced Administration of Windows 2000 • Chapter 11 ■

NetBIOS name of the computer

■

Administrator password

■

Display settings

■

Network settings (protocols used, adapters used)

■

Install into a workgroup or domain

■

Time zone computer will be located in

■

Telephony settings (for modem use)

■

Directory to install Windows

■

Network printer computer will use

Sysdiff In addition to all of the automated tools to set up Windows operating systems, most applications are acquiring the ability to install themselves with no user interaction. However, not all applications can perform this feat. In response to this Microsoft has provided the tool Sysdiff (sysdiff.exe) to allow administrators to create “difference packages.” Table 11.8. describes Sysdiff’s four-step process.

Table 11.8

Sysdiff Options

Sysdiff /snap

Inventory Computer's Files and Registry

Setup.exe

Run the application to create package

Sysdiff /diff

Inventory computer again and create package Apply the difference file to the operating system

Sysdiff /apply

Sysdiff can be used to install applications during an unattended setup. This can be useful for rolling out large numbers of computers.

465

74_sysad_11.qx 11/8/99 10:30 AM Page 466

466


Dependency Walker It is sometimes difficult for a network administrator to tell what DLLs and various other files an application needs before it will run properly. The Dependency Walker (depend.exe) is a graphical tool that allows you to open a file and see what DLLs it requires for proper operation. Not only does it show which files are required, but it also shows the hierarchical view, as shown in Figure 11.19.

Figure 11.19 This is a view of the Windows 2000 Resource Kit application Depend.

For example, Winword.exe requires wwintl32.dll for proper operation. However, in order for wwintl32.dll to work properly, kernel32.dll, user32.dll, advapi32.dll, and mso97.dll must be available.

74_sysad_11.qx 11/8/99 10:30 AM Page 467


Shutdown Shutdown (shutdown.exe) is a simple and powerful tool. You can use it to remotely shut down or reboot a Windows 2000 computer, or you can terminate a system shutdown (if it is executed before the timeout ends), force applications to shut down, and shutdown will even allow you to specify “yes” when an application shuts down. This is useful when the computer that is up may have open files and you want to make sure they are saved before rebooting the computer.

Netdiag Netdiag (netdiag.exe) is a command line tool that allows an administrator to run various tests on your Windows 2000 machine. It validates the operation of the DNS, WINS, Browser, LDAP, Kerberos, and much more.

Summary The next generation of Windows NT has come a long way to provide industry standards functionality. This additional function will allow it to enter additional marketplaces without a wholesale upgrade of the infrastructure. The tools Microsoft has created will help ease the administrative burdens on NT administrators because they will not have to learn how to use each tool. The MMC provides a shift in the way tools are used, but it allows administrators to learn a technique once and apply that methodology to any new snap-in they must use.

FAQs Q: I have multiple dial-in servers; how can I centralize the user databases?

A: Use Microsoft’s Internet Authentication Services (RADIUS).

467

74_sysad_11.qx 11/8/99 10:30 AM Page 468

468


Q: I want to schedule a defragmentation of my hard disk when it is not busy, and I want it to stop if the server becomes busy.

A: Use the advanced features of the Task Scheduler. Q: I have two computers that need to perform the same tasks; one is working and the other is not. How can I easily compare the two?

A: Create a custom MMC console and add the Computer Management snap-in twice, once for each computer.

Q: How can I give users access to my network intensive application with acceptable performance?

A: Set up a Windows 2000 server with Terminal Services installed. Q: I have a VPN in which we tunnel IPX/SPX and NetBEUI, but I need to transport DLC as well, what can I do?

A: Use Windows 2000 VPN protocol L2TP instead of PPTP. Q: I am trying to fine-tune my server, how can I verify that I’m not using a service?

A: When modifying a service from within the Computer Management MMC, a new tab is available that will show you the other services that use this particular service.

Q: How can I verify what DLLs an application is using? A: Use the depends.exe application.

74_sysad_12.qx 11/8/99 10:34 AM Page 469

Chapter 12

Administering Active Directory


Introduction to Administering Active Directory

■

Publishing Objects in Active Directory

■

Locating Objects in Active Directory

■

Controlling Access to Objects

■

Delegating Administrative Control of Objects

■

Overview of Active Directory Service Interface (ADSI)

■

Best Practices

469

74_sysad_12.qx 11/8/99 10:34 AM Page 470

470

Chapter 12 • Administering Active Directory

Introduction to Administering Active Directory As organizations grow and require more applications, services, and resources, additional management and administration become necessary. Even the smallest companies now seem to require computer networks and their services, including the assistance of an IT professional, as either a full-time employee, a contractor, or a third party. Fulfilling these needs can become expensive very quickly, so it is necessary to find the most effective and efficient methods of reducing total cost of ownership (TCO). The IT industry has developed many options to ease this burden, including the concept of directory service, which has been used for years to define many different services from one end of the spectrum to the other. For example, Microsoft has called its user accounts database NTDS (NT Directory Service) for some time. Other vendors use other forms of directory services to perform similar functions. Microsoft has incorporated many of the current and new technologies into its new operating system, Windows 2000. Microsoft has also updated and redesigned its previous NTDS into a new form, Active Directory. Although Active Directory is fairly new, many of the concepts upon which it is based have long been in use throughout the computer industry. The Active Directory namespace is based on current DNS standards that have been in place for years. Other features have been added that are fairly new to Windows; for example, the Encrypting File System (EFS), Kerberos authentication for communications, and Certificate Authorities have been added to provide a more scalable and secure environment. With these features comes a requirement for a robust directory service to support them. This is where Active Directory comes in. To use and manage Active Directory, you need a good understanding of the components and objects used within it, and you must understand the management interfaces and how to use them. Other features included with Active Directory, such as the search

74_sysad_12.qx 11/8/99 10:34 AM Page 471

Adminstering Active Directory • Chapter 12

mechanisms and security subsystems, have been enhanced. These can be used to provide advanced administration and a solution that can meet the needs of most organizations.

Active Directory Concepts You must understand several concepts and components in order to use the services that are available in Active Directory. These concepts define its layout as well as the operational factors that must be considered. Each component of Active Directory is important in making this new directory service work for you. The components and concepts that make up Active Directory help to form the directory infrastructure, and each must be properly designed and/or maintained to provide a reliable and stable Windows 2000 environment.

Directory The directory included with Windows 2000 houses the information required to perform many administrative tasks such as user management, printer management, and security information maintenance. Many of the tools included use this directory to integrate their services in order to provide a more comprehensive and cohesive networking environment. The directory information is stored within a data store that is replicated among domain controllers (DC), which are computers that provide services such as authentication, directory replication, and resource location. In other words, if an administrator makes a change to the directory on one domain controller, the change will be copied to all other servers maintaining replicas of the directory. In addition, administrators and users can publish resources within Active Directory. The directory is stored on domain controllers much as it was in earlier versions of Windows NT. Only one domain controller is required for a domain, and you can have anywhere from one to thousands if necessary. Each domain controller maintains a replica of the directory. These computers are used to provide scalability,

471

74_sysad_12.qx 11/8/99 10:34 AM Page 472

472


redundancy, and efficient resource location by providing users with multiple copies of the directory. The data that is stored within the Active Directory can be divided into two areas: private and public. The information is stored in a file located on the domain controllers named NTDS.dit and is stored in <system root>\NTDS by default. The location of the database can be specified during the domain controller promotion process. Private data is secured, while public data is freely replicated among domain controllers in a shared system volume. Three forms of public data are replicated. ■

Configuration information describes the topology or layout of the directory. Information may include domains, trees, domain controllers, and global catalog servers.

■

Domain information contains information about the objects located in the directory. This includes the information contained within objects such as user attributes or computer properties.

■

Schema information defines the attributes and objects that are available within the directory. For example, the schema defines a user object and its available attributes.

Namespace Active Directory uses namespaces to define its boundaries. A namespace is primarily a boundary that is used to define and resolve names contained in it. Based on the DNS namespace standards specified in Request for Comments (RFC) 1034 and 1035, the Active Directory namespace is interoperable with the Internet and with any other standard TCP/IP network. These standards are key to the ability of Windows 2000 and Active Directory to provide TCP/IP network services (see Figure 12.1).

74_sysad_12.qx 11/8/99 10:34 AM Page 473


Figure 12.1

This is an example of a contiguous namespace.

xyz.com

dev.xyz.com

Server1.dev.xyz.com

sales.xyz.com

regional.sales.xyz.com Server2.dev.xyz.com

Two types of namespaces can be used: contiguous and disjointed. These also reflect the difference between a Windows 2000 tree and forest. A tree is a contiguous namespace, which consists of a hierarchy of parent and related children domains. A child domain has a direct relationship to its parent. For example, dev.xyz.com is a child domain of xyz.com. Contiguous namespaces define trees in Windows 2000. A forest in Windows 2000 is a disjointed namespace, which is a series of domains that are not directly related. For example, dev.xyz.com is not directly related to abc.com. These two domains are separate, and a forest must be formed in order to connect these two together by setting up bidirectional trust relationships. Although mostly a methodology, this concept is one of the most critical concepts in understanding and designing a Windows 2000 Active Directory infrastructure (see Figure 12.2).

473

74_sysad_12.qx 11/8/99 10:34 AM Page 474

474


Figure 12.2

This is an example of a disjointed namespace.

xyz.com

dev.xyz.com

abc.com

sales.xyz.com

labs.abc.com

Naming Conventions Within Windows 2000, every object is identified by a name. Naming conventions have been created to provide a uniform method of identifying a resource. In addition, depending upon the object or its role, a particular item may have more than one name. For example, John Doe may also be known as JohnD. This may be because his full name is John Doe, but his network logon name is JohnD. Several different naming conventions are used within Windows 2000 and Active Directory. To understand each object and how it pertains to other resources, you must understand these naming schemes. The naming schemes are: ■

Distinguished Name

■

Relative Distinguished Name

■

Globally Unique Identifier (GUID)

■

User Principal Name

Distinguished Names (DN) is a unique identifier for an object within Active Directory, such as a user or printer. The distinguished name provides the information required to allow a client to request resources. These names include the complete path through Active Directory, including the domain name. Distinguished names must all be unique as well. Because Active Directory uses these names to locate resources within the directory service, no two names can be identical (see Table 12.1).

74_sysad_12.qx 11/8/99 10:34 AM Page 475


Table 12.1

Attributes Used in Distinguished Names

Attribute

Description

CN

Common Name

DC OU

Domain Component Organizational Unit

Here is an example of distinguished name for John Doe located in the sales OU in the xyz.com domain. CN=John Doe,OU=sales,DC=xyz,DC=com

The Relative Distinguished Name (RDN) is used to locate resources based on a particular attribute. For example, you may want to know only whether a JohnD user id exists. This gives you the ability to search throughout the directory for information when the DN is unknown or has been modified. Also, you can have duplicate Relative Unique Identifiers, but only if they do not reside within the same organizational unit. In other words, two JohnD users can exist, but not within the same OU, because if this object is placed within a separate OU, the DN will be different for each object (see Figure 12.3).

Figure 12.3

This illustrates the difference between DN and RDN. Distinguished Name (DN) RDN John Doe | Users | sales | xyz | com DN: CN=John Doe OU=Sales DC=xyz DC=com

RDN: John Doe

475

74_sysad_12.qx 11/8/99 10:34 AM Page 476

476


There are two other name types. The first is the Globally Unique Identifier (GUID), which is a 128-bit identifier that is used to identify an object within Active Directory. The GUID is assigned once the object is created and will remain the same if the object is moved or renamed. This allows services to find an object even if its name or attributes are modified. The second type is the User Principal Name (UPN), which is a user-friendly name for an object using the DNS name convention, which is similar to an e-mail address. This makes it easier to find an object located within Active Directory. For example, John Doe may have a UPN of [email protected].

Schema Within a directory service, rules must be used to define the objects that are available, the attributes of those objects, and how they are applied. This is the job of the schema within Active Directory. The schema contains definitions of the classes, attributes, and their properties, such as the user object with the description attribute. When Active Directory is first installed, a default schema is used. Examples of schema objects included are users, computers, and groups. There are two types of schema objects: attributes and classes. Each is used and defined differently within Active Directory. An attribute is a field that can contain information about an object such as group name or user e-mail address. These fields can also be applied to multiple classes while being defined only once. Object classes define the objects that can be created with Active Directory. For example, a user account or group account is a class of object. Every object that is created within Active Directory is known as an instance. The attributes for an object are used to define information about them such as name, location, or phone number. Therefore, a class is a collection of multiple attributes. To apply these terms, a user account named JoeS is a single instance of the object class User with attributes including the name JoeS. The domain controller, acting as the schema master, controls the schema content. By default, this is the first Windows 2000 domain

74_sysad_12.qx 11/8/99 10:34 AM Page 477


controller installed. A copy of the schema is replicated to all other domain controllers within the forest to maintain consistency. The schema can be modified, but this should only be done after extensive testing. For example, a new class object or attribute for an existing class object can be added. Although Active Directory does not support deleting schema extensions, objects can be marked as deactivated. Extending the schema can have disastrous affects on the Active Directory, as this will modify the rules by which it works. Be sure to perform extensive testing before modifying the schema in any way. Microsoft provides an application-programming interface (API) known as Active Directory Services Interface (ADSI). This tool set is designed to provide an interface with Active Directory that developers can implement without needidng to understand how the interface works technically.

Global Catalog With any directory, a fast and efficient way to locate resources is required. For example, users who are looking for a printer probably will not want to trudge through the entire network or wait a long time to find what they are looking for. Active Directory uses a global catalog server to provide the ability to index items located within the network. The global catalog is designed to provide information about resources located within the directory as efficiently as possible, which speeds the service to the end user requesting network services. In addition, since a global catalog server maintains information about all domains included within a forest, a server within the domain from which a request originates can answer a query. For example, a user located in domain1 can provide information about a resource located in domain2 without having to cross domain boundaries. Any domain controller can be configured as a global catalog server to fulfill your organization’s requirements. By default, the first domain controller installed in a forest is configured as a global catalog server. The global catalog is created and maintains information on all objects located within its domain and a

477

74_sysad_12.qx 11/8/99 10:34 AM Page 478

478


partial set of information on objects in all other domains. This allows quick and efficient query results for cross-domain lookups. The global catalog is used to provide two main roles: ■

Gives the ability to locate objects anywhere within the forest.

■

Provides universal group membership to domain controllers for a logon request.

When the logon authentication process begins, the global catalog server provides universal group membership to the domain controller being used, so user authentication can occur anywhere within the forest. If a global catalog server is unavailable, users will not be allowed access to network resources, but will be allowed to log on only locally. The role of global catalog server can be shared with any domain controller, which happens when only one domain controller exists within a domain.

NOTE Although users are unable to access network resources without a global catalog server, domain administrators are still able to log on the Windows 2000 network. It is also recommended that you place global catalog servers close to users, to provide efficient service.

This is how the global catalog server role is added or removed on a domain controller: 1. Select Start | Programs | Administrative Tools | Active Directory Sites and Services. 2. Expand the site name followed by the Servers container and then the server name to configure. 3. Highlight the NTDS domain controller properties, right-click the object, and select Properties.

74_sysad_12.qx 11/8/99 10:34 AM Page 479


4. Figure 12.4 displays the available options. Select or deselect the check box for Global Catalog to determine the domain controller’s role.

Figure 12.4

Select this check box to provide another global catalog server.

5. Select OK or Apply to approve the modification.

Replication To enable users to use services such as the directory and global catalog, the directory information must remain consistent throughout all servers that store this data. To accomplish this consistency, a replication strategy has been defined to maintain consistent replicas of directory services data such as the directory store and global catalog. This allows anyone to request a directory resource from anywhere within the network of domains and forests. For example, if User A adds the ability for User B to access a resource, this information must be replicated to the domain controller responding to

479

74_sysad_12.qx 11/8/99 10:34 AM Page 480

480


User B. Otherwise, User B would not have the ability to access this resource without making the change on both computers. Although this information must remain consistent, the amount of network traffic required must be monitored as well. If updates occur constantly, an entire network can be consumed quickly. Replication should be monitored closely to control the amount of traffic that is being caused. Windows 2000 uses several techniques to optimize replication traffic. For example, Active Directory evaluates the network connections that are used and selects the most efficient. Also, any available multiple routes are used to provide fault tolerance and redundancy. One of the most effective optimization techniques is the replication of Delta information; in other words, only the changes to an object are replicated. For example, if JoeS changes his password, only that changed attribute is replicated and not the entire object. This can make a dramatic difference for your local and wide-area network. Two types of site replication can occur. Intrasite communication occurs among all domain controllers located within the same site, and intersite communication occurs between two sites configured with a site link. Two communication methods, IP and SMTP, are available for site links. Intrasite links are automatically generated and maintained, but intersite links must be manually created. Intrasite links are maintained by Active Directory to optimize replication. By default, two links to every domain controller are created to eliminate a single link failure. This replication strategy is continually monitored and updated. For example, when a new domain controller is installed in a site, the replication topology is recalculated to provide the most efficient network replication. To configure intersite replication, you must add and configure site links. Once a site link has been created, options are available for scheduling, costs, and replication frequency. This defines how replication links among sites should be used within the network to the directory service. Without site links, domain controllers will be unable to communicate and replicate information outside their site boundaries. For example, if three domain controllers are located in Site A and two in Site B, communication can occur between the

74_sysad_12.qx 11/8/99 10:34 AM Page 481


three in Site A but not to and from computers in Site B. By default, computers are placed in the same site at installation as the first domain controller (see Figure 12.5). There are, however, a few exceptions to this rule. The domain controller will be located in an alternate site if: ■

An alternate default site is chosen.

■

The IP address at installation falls within a subnet boundary. It will be located in the site specified for that subnet.

Figure 12.5

This is an example of an Intersite replication link.

Client Software One requirement of using Active Directory is to have clients that understand features available in Windows 2000. To use tools such as Group Policy, Windows 2000 Administrative Tools, or Windows Installer, the client computer must understand Windows 2000 and the Active Directory. These clients can fully utilize the resources

481

74_sysad_12.qx 11/8/99 10:34 AM Page 482

482


available in Windows 2000. Other operating systems can be used with Active Directory; however, they will be allowed only limited functionality. For example, previous versions of Windows NT can be used on a Windows 2000 network, but only services that are available in these releases can be utilized. These operating systems are Active Directory aware: ■

Windows 95/98 (add-on client provided on Windows 2000 CD)

■

Windows 2000 Professional

■

Windows 2000 Server

Active Directory Components The components of Active Directory are among the administrative tools that are used to manage and configure Active Directory. Components used with Active Directory include objects, sites, domains, trees, and organizational units.

Objects Windows 2000 uses objects in Active Directory to provide an interface for managing a set of attributes associated with a class category. These attributes can be modified, renamed, and even altered through ADSI to meet an organization’s needs. Each object is used to represent an available resource within the directory store. By default, Active Directory includes several different object types. These are provided to offer such network services as shared printers, shared folders, user authentication, and security services. Each object is associated with a set of attributes that can be used to provide information about the object, to secure the object, or perhaps to link the object with other components in Windows 2000 such as Group Policy (see Table 12.2).

74_sysad_12.qx 11/8/99 10:34 AM Page 483


Table 12.2

Standard Objects Available by Default in Active Directory

Object

Description

Computer

Information on computer that has been added to domain

Contact

Information on contacts used for address books Grouping of users, computers, or other groups used for security or distribution purposes Object used to organize directory infrastructure Information on shared printers within the directory store User ID that also contains information on the use such as name, location, and group memberships Information about the location of shared folders located within the directory store

Group

Organizational unit Printer User

Shared folder

Organizational Unit Another object type located within Active Directory is the Organizational Unit (OU). Organizational units are used in the directory to provide a hierarchical topology to provide a more efficient and scalable administration model. Within these containers you can store objects such as users, groups, computers, printers, or other organizational units. The only drawback is that they cannot contain objects located in other domains. Organizational units are used for various reasons. Security permissions are often divided on the basis of OUs; for example, you may grant rights to all objects located within one container to a particular user or group. Permissions may be set up for all objects within a container to access a group policy. Organizational units are one of only three objects with which group polices can be associated. By using these options, you can more effectively manage resources such as users or groups.

483

74_sysad_12.qx 11/8/99 10:34 AM Page 484

484


Organizational units may also be used to provide a more intuitive and complex infrastructure. For example, an advanced OU structure may be designed to break out functions within a business such as finance, sales, and HR. This methodology allows you to minimize the administrative effort required to support these organizations—for instance, by minimizing the number of domains that are required. This provides a more efficient and robust directory service architecture.

Site Sites are a logical grouping of computers that are well connected. For example, if two domain controllers are located in the same physical location via a local area network, they may be set up in the same site. Sites can also cross TCP/IP subnet ranges, and they are used to specify more efficient ways to service Active Directory. Sites are primarily used for three services: replication, authentication, and the servicing of directory requests. Replication uses site boundaries in several ways. First, intrasite communications are faster because they are not compressed to conserve bandwidth. In addition, replication occurs much more frequently within a site rather than between sites. This allows the information that is maintained locally to be updated, and it allows changes to be applied more quickly. Sites boundaries are also used for administrative purposes. All links between domain controllers located within a site are managed by the directory service. They are monitored and changed to provide more efficient routes. Site connections require more intervention; they require site links to be set up and configured to provide the most efficient communications. The second service, authentication, is directly affected by site boundaries. This is one of the most critical services provided within Active Directory, and it must be extremely efficient. When a client requests authentication, a domain controller within the same site will respond to provide the fastest possible authentication. Directory requests are serviced much as are authentication requests. When a user or administrator requests resources, a

74_sysad_12.qx 11/8/99 10:34 AM Page 485


domain controller located within the same site can be contacted, speeding the return of the information required. This is helpful not only for users, but also for administrators who have to manage the information, which allows user requests to be handled more efficiently.

Domain Windows 2000 domains are used to provide a boundary for sharing a common directory database. Directory information is replicated between computers located only within a particular domain. For example, all domain controllers within the xyz.com domain replicate the directory store between them. A domain uses a unique name and provides a central storage of information such as user accounts and security configurations. Windows 2000 domains also use the same namespace design as the domain name server (DNS), so each domain is named on the basis of a DNS name standard such as xyz.com. The use of domains in Windows 2000 and Active Directory has several benefits, including integration with other TCP/IP networks, advanced organization options, advanced security features, and advanced administrative capability. To build a domain within an organization, a server must be promoted to a domain controller using the DCPromo utility. The domain controller is used to act as the directory server and to handle tasks such as user authentication, resource request response, and directory synchronization. Every domain must maintain at least one domain controller.

Trees and Forests In small environments, a single domain may best suit organizational needs. In many other environments, multiple domains are used. Trees and forests have been developed to allow multiple domains to communicate and to share information within an organization. Each specifies a particular setup of domains. One or more domains that

485

74_sysad_12.qx 11/8/99 10:34 AM Page 486

486


share a contiguous namespace are known as domain trees, and a continuous namespace is defined as having child domains directly related to their parents. For example, sales.xyz.com is a child domain of xyz.com. A forest is a collection of domains that share a common schema and global catalog. A forest can contain contiguous and disjointed domains. A disjointed domain is having two separate domains that are not directly related. For example, the sales.xyz.com domain and the dev.abc.com domains are disjointed.

Using Active Directory Management Utilities The tools that are used to manage Active Directory are available as snap-ins within the Microsoft Management Console or as command line tools. These tools are used to create, manage, publish, and control resources located within the Windows 2000 network. You must understand the tools and their use in order to take full advantage of the new Windows 2000 directory service.

DCPromo Before you are able to manage the Active Directory, it must first be installed. A domain controller must be installed before directory services are added to a Windows 2000 network. Domain controllers are used to store, replicate, and manage the underlying files and data used within the Active Directory. When Windows 2000 Server is installed in a computer, it is configured as a stand-alone server. A utility must be run so that this server can be upgraded to a domain controller. DCPromo.exe is used to complete this task. To use DCPromo, follow this procedure: 1. Select Start | Run, type DCPromo, and click OK, as shown in Figure 12.6.

74_sysad_12.qx 11/8/99 10:34 AM Page 487


Figure 12.6 Start the domain controller upgrade process with DCPromo.

2. The next screen is the Installation Wizard welcome dialog (see Figure 12.7).

Figure 12.7 This is the Active Directory Installation Welcome dialog.

3. Decide whether to make this a domain controller for a new domain or to add this to an existing domain (see Figure 12.8). Click Next.

487

74_sysad_12.qx 11/8/99 10:34 AM Page 488

488


Figure 12.8 Create a new domain or add to an existing domain.

4. If you create a new domain, you can create a completely new domain tree or attach this domain to an existing tree (see Figure 12.9). If you add to an existing domain, you will be prompted to specify user credentials to add this domain controller.

Figure 12.9 Add to an existing tree or create a new tree.

74_sysad_12.qx 11/8/99 10:34 AM Page 489


5. Click Next. 6. Next, you have the option to add the domain tree to an existing forest or to create a new forest altogether. If you place this domain tree into an existing forest, you are prompted for forest login credentials to add this domain. If you create a new forest, the process continues (see Figure 12.10). Click Next.

Figure 12.10 Create a new forest or add to an existing forest.

7. Next, as is shown in Figure 12.11, you must specify the DNS domain name. This must be the complete domain name to use for Windows 2000.

489

74_sysad_12.qx 11/8/99 10:34 AM Page 490

490


Figure 12.11 You must specify the full DNS name to use.

8. Now you must specify the NetBIOS name to use for the new domain. This is used for earlier versions of Windows, including Windows NT (see Figure 12.12). Click Next.

Figure 12.12 Specify a NetBIOS name for the domain for downlevel clients.

74_sysad_12.qx 11/8/99 10:34 AM Page 491


9. The next dialog offers the option to specify the Active Directory database and log files. By default, these files are stored in <systemroot>\NTDS. Figure 12.13 illustrates this option.

Figure 12.13 Select the location to store the Active Directory database and log files.

10. When the Active Directory file locations have been determined, the public Sysvol folder must be specified as shown in Figure 12.14. This folder is replicated to all other domain controllers within the domain. Click Next.

Figure 12.14 Configure the shared Sysvol.

491

74_sysad_12.qx 11/8/99 10:34 AM Page 492

492


11. If DNS is not configured, you will be prompted to configure the DNS server. Click Automatic and select available RAS permissions settings. 12. Now you must specify the password to restore directory services. This password is used to activate recovery services for Active Directory in the event of a failure or corruption (see Figure 12.15). Click Next to continue.

Figure 12.15 Select the password to use in Directory Services recovery mode.

13. A summary is now provided. Check over the options selected and click Next to complete the installation. The Active Directory then runs through the configuration process to complete the installation (see Figure 12.16).

74_sysad_12.qx 11/8/99 10:34 AM Page 493


Figure 12.16 This is the status of the Active Directory Installation Wizard.

Active Directory Users and Computers The most commonly used tool for managing the directory is the Active Directory Users and Computers management console snapin, which is used to add, modify, delete, and arrange public resources available in Windows 2000 such as users, groups, or printers. It is also used to connect to a domain controller and to manage the resources that are to be used in that domain controller’s domain (see Figure 12.17). Several options are available from the Users and Computers snap-in. For example, the operations masters can be configured

493

74_sysad_12.qx 11/8/99 10:34 AM Page 494

494


from the domain object listed here. To access these options, right-click the domain object and select Operations Master. Operations masters are the single computers that maintain responsibility for specific components. The operations masters listed include the relative identifier (RID) master, the primary domain controller (PDC) emulator, and the Infrastructure master. The RID master handles the allocation of RID pools to other domain controllers. The PDC emulator is used for backward compatibility with earlier versions of Windows NT. The Infrastructure master is used for interdomain operations.

Figure 12.17 This is an example of the Active Directory Users and Computers snap-in.

74_sysad_12.qx 11/8/99 10:34 AM Page 495


It is possible to switch the domain from mixed to native Windows 2000 mode or to set up and apply group policy objects to a particular container. Right-clicking the domain object and choosing Properties completes these tasks (see Figure 12.18).

Figure 12.18 These are properties of a domain object in the Active Directory Users and Computers snap-in.

To manage network resources, you must create a hierarchy and the associated objects to publish the resource. To create a new object within the hierarchy, select the parent object and right-click it. Select the object to create, fill in the associated attributes, and click OK (see Figure 12.19).

495

74_sysad_12.qx 11/8/99 10:34 AM Page 496

496


Figure 12.19 Create resources within Active Directory.

Active Directory Domains and Trusts Within a Windows 2000 network, multiple domains can be used to create a more effective administrative model. This may be required to meet the business requirements of some organizations. For example, creating a domain for the development organization prevents new and untested problems from affecting other users. These connections or trusts must be set up within Active Directory. To manage these domains and the trusts that are used to connect them, you must use the Active Directory Domains and Trusts management console snap-in. This utility provides the capability to

74_sysad_12.qx 11/8/99 10:34 AM Page 497

497


manage any Windows 2000 domain controller with appropriate security permissions and to manage trees and forests. To connect domains to trees or forests, trusts are created to form these relationships. Trusts are logical relationships created between two domains to allow for pass-through authentication. There are four ways to characterize trust relationships: one-way, two-way, transitive, and nontransitive. Nontransitive trusts, which are all one-way, provide services in one direction only. Two-way trusts are used in Windows 2000 forests. Domains located within a forest must use two-way trusts to communicate. Transitive trusts are created automatically as a part of the addition to a new forest or tree. Nontransitive trusts do not flow automatically to new domains and must be explicitly defined. In addition to the management of trusts, other features can be administered from the Active Directory Domains and Trusts snapin. For example, Windows 2000 runs in mixed mode by default. This provides backward compatibility for previous versions of Windows such as Windows NT. The domain can be switched to native mode, which removes additional overhead on the domain controllers. Other roles that can be managed include the domain naming master. This server maintains all domain names and verifies that they are unique within the tree or forest. The trusts for domains are managed here as well. Select the Trusts tab and set up the trusts to other domains as required. The options shown in Figure 12.20 are available when you select Start | Programs | Administrative Tools | Active Directory Domains and Trusts.

74_sysad_12.qx 11/8/99 10:34 AM Page 498

498


Figure 12.20 These Domain and Trust configuration options are available in Active Directory.

Active Directory Sites and Services Sites are managed and administered through the Active Directory Sites and Services management console snap-in. This utility is used to create and manage site links and their properties within the Windows 2000 domain. To use it, select Start | Programs | Administrative Tools | Active Directory Sites and Services.

NOTE When the first domain controller is installed, the first site is set up in Active Directory. This site will be named “Default-first-site.” Change this value to something more intuitive by right-clicking the site object and choosing the rename option.

74_sysad_12.qx 11/8/99 10:34 AM Page 499


To set up and customize a site, first set up or add the site. By default, a single site is created during installation. Two sites are required for a site link to be set up. Next, create and associate a subnet with the new site. One or more subnets should be associated with each site. Then create a site link connecting the two sites. Last, optimize site link settings to finish the process (see Figure 12.21). There are three categories of objects: the site object, the Inter-Site Transports folder, and the Subnets folder.

Figure 12.21 These are the options available within the Active Directory Site and Services snap-in.

The first option available for configuration is the site object. Three additional options are available for this object (see Figure 12.22). First, the licensing server will be defined for every site by default. This can be configured here and does not have to be a domain controller. Next, in the NTDS Site Settings, the available

499

74_sysad_12.qx 11/8/99 10:34 AM Page 500

500


information includes the Inter-Site Topology Generator and the ability to change the site replication schedule as well as security permissions for this object. The third option is the server container, which includes all the servers found within this site. NTDS settings are associated with servers. This option is used to specify options such as global catalog servers, and to query options as well as security permissions.

Figure 12.22 Individual settings available for each site are configured here.

As its name states, the Inter-Site Transports folder is used to provide a communication method between sites. Two transport mechanisms are available: IP and SMTP. IP replication uses an RPC communications mechanism for intra- and intersite replication. IP replication is generally used unless there is a need for SMTP, which is used only for intersite replication, for scheduled connections, and

74_sysad_12.qx 11/8/99 10:34 AM Page 501


if information is being exchanged directly between two servers. In addition, SMTP replication requires a Certificate Authority for security verification. Both protocols can be used to provide communications between two or more sites. To configure a particular site link, select the site link, right-click it, and choose Properties. The configuration options that are available include costs, replication frequency, and the sites included within this link (see Figure 12.23).

Figure 12.23 Configuration options are available within a site link.

The third option is used for configuring subnets, which are used to associate computers with particular sites. This option provides another method of administrative control over the operation of Active Directory. While domains map a logical structure of computers, sites are used to designate physical locations in which computers are located. For example, during installation, a computer is added to the appropriate site if its subnet is already configured within Active Directory. To configure a subnet object, right-click the

501

74_sysad_12.qx 11/8/99 10:34 AM Page 502

502


appropriate subnet and choose Properties. Options available include the site associated with, the network and subnet mask information, and security permissions.


Helpful Resource Tools

In addition to the tools that are described in this section, there are additional helpful tools in the resource kit. Microsoft creates tools internally to provide additional administrative control for many of its products. Other organizations may also create tools that have been provided to Microsoft. Some of these tools are placed in resource kits. These tools are useful and stable enough to be distributed, but not enough to become part of the application itself. Resource kit utilities are meant for experienced administrators who know and understand the full impact of using any of the included tools. Windows 2000 is no exception to this rule. Even before the product was released, several tools were made available to beta customers through the resource kit. These tools provide additional functionality but are not part of the supported product. For example, a fourth Active Directory tool is available with the resource kit. The Active Directory Schema manager can be used to manage schema additions to the directory store. Other tools include security tools; SYSPREP, which is a setup automation tool; and application support tools. Although most organizations do not use resource kit utilities on production machines, most administrators have been saved at least once by having those utilities available.

74_sysad_12.qx 11/8/99 10:34 AM Page 503


Publishing Objects in Active Directory One of the new features that Active Directory provides is the ability to provide resources throughout an entire organization via one central repository. Resources such as shared disk and printers are easier to locate because of the robustness and search features available. In addition, the advanced security permissions within this new directory service make it possible to further delineate permissions based upon user requirements. Publishing these resources within the Windows 2000 Active Directory enables this ability.

Sharing Resources Although a resource may be available on the local computer, in order for it to be made known to all users, it must be published within the Active Directory. This provides a central repository of information about all available resources within the Windows 2000 network. For example, an administrator shares a printer on his local workstation and wishes to make it known to all users that it is available for use. Since the printer is shared, users can connect and use it. However, when the printer is published in Active Directory, all users can be authenticated, and the printer can be managed from within the directory store. To set up a published file share, select the container to publish to and right-click the object. Select New and Shared Folder. As seen in Figure 12.24, a name and location are required to continue. Click OK to complete the publishing process.

503

74_sysad_12.qx 11/8/99 10:34 AM Page 504

504


Figure 12.24 You can publish a shared folder.

Once a resource has been published, it is listed and can be managed with the directory service. Another feature provided with published resources is keywords. This allows you to specify information found within this share for the purposes of searching. Figure 12.25 displays the properties of a shared folder.

Figure 12.25 These are the properties of a shared folder in Active Directory.

74_sysad_12.qx 11/8/99 10:34 AM Page 505


In addition to shared disks, other resources such as printers can be shared. In order for a published printer to be printed, it must first be installed to a local server and shared. This allows the printer to be available anywhere within the directory. A printer can be published within Active Directory from two locations. If you right-click and select properties on the printer, you can specify that the printer is published to the Active Directory. This method is used for Windows 2000 printer shares (see Figure 12.26).

Figure 12.26 A printer can be shared from the Properties dialog.

The other method is used for pre–Windows 2000 printer shares and is completed with the Active Directory Computers and Users snap-in. Select Start | Programs | Administrative Tools | Active Directory Computers and Users. Next, navigate to the appropriate container, right-click, select New, and select the Printer option. Specify the shared printer to publish (see Figure 12.27), and click OK.

505

74_sysad_12.qx 11/8/99 10:34 AM Page 506

506


Figure 12.27 Add pre–Windows 2000 printer shares into Active Directory.

With the addition of Active Directory, many resources are now available from a single directory structure. This allows for many new feature sets to be incorporated such as advanced security delegation, resource availability, and new add-on products directly tied into resources. Printers and shared disks are only a small portion of the available resource publication capabilities.

Locating Objects in Active Directory When you use Active Directory, you may need to search for resources. For example, your boss may ask you for a listing of all computers that are domain controllers. This may be easy in a small environment, but it can be a little more difficult when there are several hundred computers. There are a few different ways to locate information. First, you can click Start | Search and search for files and folders, computers, or contacts. This method works well for files and folders but not for searching based on advanced criteria. The next method is to use the Active Directory Users and Computers

74_sysad_12.qx 11/8/99 10:34 AM Page 507


management console snap-in. When you right-click the parent object and select Find, a search screen appears. The Find option uses the global catalog to locate and display information on resources throughout the entire Windows 2000 network. Although the global catalog does not maintain the entire directory, a limited amount of information is stored about all objects in all interconnected domains and therefore is available during your search. This information is available without any user intervention required (see Figure 12.28).

Figure 12.28 Search for resources in the Active Directory Users and Computers snap-in.

Many options are available to assist an administrator in searching for resources. In addition to the different categories that can be searched upon, advanced configuration of search criteria can be defined to further customize the search. Criteria can include Name, Pages per Minute, Model, and Speed for printers; Email address, Downlevel Logon name, first name, or business phone number for

507

74_sysad_12.qx 11/8/99 10:34 AM Page 508

508


user objects; or Name, Operating System, or Managed by for computer objects. Various criteria are used to further customize the search to meet your needs. Table 12.3 displays some of the elements used in the Find dialog.

Table 12.3

Elements Used to Create Advanced Searches

Components

Description

Find

Select the category to search upon. Categories include: Users, Contacts, and Groups; Computers; Printers; Shared Folders; Organizational Units; and Custom.

In Advanced tab Field Condition

Select the domain or directory to search in. Specify additional search criteria. Attribute to search upon. Condition to meet in search criteria. Conditions may include lesser than or equal, greater than or equal, starts with, equals, present, and so on. Attribute value to search on in criteria. All criteria specified for this search. Results of search defined.

Value Criteria Results

Controlling Access to Objects With the capability to administer and manage so many resources, the ability to secure those resources is a necessity. With the new features added to Windows 2000 comes a sophisticated security model to support them. Several different levels of security are provided to allow access control to take place within Active Directory. First is user authentication. Next, object-based access control is used to define very specific user rights to objects and/or their attributes. Last, Active Directory security is applied.

74_sysad_12.qx 11/8/99 10:34 AM Page 509


User Authentication To provide a mechanism for validating users and their access level to network resources, Active Directory employs user authentication, which enables the administrator to apply security attributes to a user in addition to auditing modifications, access to resources, and delegating administrative functions. Two types of authentication are used in Active Directory: interactive logon and network validation. Interactive logon is used to describe the actual logon process. Users complete the interactive logon process by pressing ControlAlt-Delete on their workstations and entering a username and password. This helps to secure the Windows 2000 operating system from would-be intruders by controlling access to the local computer. Network authentication is used to validate a user’s request for resources located on other systems within the Windows 2000 network. This is used to validate a user’s permissions to access and/or use a published resource. Three forms of security are used during the network authentication process: Kerberos for accessing resources within other trusted domains; public key certificates for external or cross domain validation; and NTLM for backward compatibility with earlier versions of Windows NT.

Object-based Access Control In addition to user authentication, access controls are placed on individual objects located in the directory store. Access controls are used to assign security permissions to objects. This is accomplished by assigning security descriptors to each individual object. In addition to the user and group access lists, security descriptors also maintain the exact permissions available to each user or group. The auditing settings that are defined individually are also stored within security descriptors. Auditing allows you to specify which resources should be monitored, so you can keep track of the users who are

509

74_sysad_12.qx 11/8/99 10:34 AM Page 510

510


attempting to access particular resources and determine whether or not they were successful. This combination of security components allows a much more complex security model to be created if necessary. Although this feature set may not work well in all environments, some organizations may find it valid and useful. For example, you may wish to place all service accounts for applications such as Microsoft Exchange within the same organizational unit. This allows for more structured control over these sensitive accounts. This methodology can be used both to control the object itself and to secure its attributes. It goes one step further by providing additional security features to meet the needs of most organizations. For example, users’ descriptions, but not their phone numbers, may be available for modification. You can also set up permissions to be allowed or denied. Some permissions are granted by group memberships to read information. You may choose to deny this to a user group such as external contractors. When a user is granted permission by two different memberships, both sets of permissions are applied in combination. For example, if a user has Read through one group and Write through another, the effective permissions will be Read/Write. There are two types of object access: standard permissions and special permissions. Standard permissions consist of normal permissions applied such as Read or Write. These provide the normal level of permissions similar to those associated with the NTFS file system. The standard permissions for files include: Read, Write, Read & Execute, Modify, and Full Control. Standard permissions for directories include Read, Write, Read & Execute, List Folder Contents, Modify, and Full Control (see Figure 12.29).

74_sysad_12.qx 11/8/99 10:34 AM Page 511


Figure 12.29 This is an example of standard permissions for an object.

Special permissions allow an even finer degree of administration by breaking down the standard permissions one step further. For example, the Read permission might have three special permissions associated with it. To access the special permissions, select the Advanced button on the Security tab of an object. Next, select the View/Edit button to specify specific special permissions. Figure 12.30 displays special permissions for an object.

511

74_sysad_12.qx 11/8/99 10:34 AM Page 512

512


Figure 12.30 This is an example of special permissions for an object.

Active Directory Permissions The Active Directory security is used to provide access to objects based upon their logon credentials. For example, permissions to modify an object can be given to a user or group located within the directory. Every object stored within the Windows 2000 directory maintains an Access Control List (ACL). This defines what users or groups have specified rights to that object. To grant these permissions to specified users or groups, an administrator or the object owner must set up these permissions.

Delegating Administrative Control of Objects An advanced delegation of administration feature is a new feature that allows for a more complex administration model. The earlier versions of Windows NT were geared more toward a centralized

74_sysad_12.qx 11/8/99 10:34 AM Page 513


administration model. With the new features and capabilities of Active Directory, it is possible to delegate control throughout a decentralized environment. Control over an object or set of objects must be delegated correctly. If the few guidelines are not followed, the delegation can quickly spin out of control, resulting in a complex security structure that is at best difficult to decipher. The Delegation of Control Wizard helps to keep these permissions in order. Two types of permissions can be delegated: permission to add or modify an object, and permission to the attributes of an object. For example, you may delegate the ability to reset disabled accounts for a group of users.

Delegation of Control Wizard Although permissions can be assigned to delegate control to another administrator, a wizard has been developed to automate this process. This wizard uses the guidelines that have been set forth to apply the appropriate permission to other users or groups. The Delegation of Control Wizard cannot be used to delegate specialized permissions. For example, you can delegate tasks for an organizational unit, but you cannot specify access controls for a particular user. Also, the Delegation of Control Wizard can assign permissions only at the OU or higher. In other words, you cannot use the Delegation of Control Wizard on a single resource such as a group or printer. These permissions must be assigned manually. This allows you to set up a particular user or group to allow them certain administrative control over an organizational unit. You will be able to specify tasks the user or group can perform but not the permissions assigned to them. 1. To start the Delegation of Control Wizard, highlight the organizational unit to delegate, right-click, and select Delegate Control. 2. Click Next to select the Welcome to the Delegation of Control Wizard.

513

74_sysad_12.qx 11/8/99 10:34 AM Page 514

514


3. Click Add and select the users and/or groups to add to this listing of administrators for this organizational unit (see Figure 12.31). Click Next.

Figure 12.31 Groups and users are chosen during the Delegation of Control Wizard process.

4. Select the tasks to delegate. Select the Create a Custom Task option to further customize the permissions to be applied (see Figure 12.32). Click Next. 5. A completion dialog will appear, validating all the options that were selected. Click Finish to complete the Delegation of Control Wizard.

74_sysad_12.qx 11/8/99 10:34 AM Page 515


Fig 12.32

Permissions are granted during the Delegation of Control Wizard process.

Overview of Active Directory Service Interface (ADSI) As with most Microsoft products, an Application Programming Interface (API) has been developed to allow developers to access and write directly to the Active Directory. The Active Directory Services Interface (ADSI) is that component. This API allows developers to create interfaces into the directory service to provide features such as additional resources, new interconnected applications, or crossplatform products such as LDAP-aware programs. Industry standard tools such as Microsoft Visual Basic, Java, or C++ can be used to program to this interface without having to learn an entire new programming language. This enables ease of use and provides an industry standard method of communicating with the Active Directory.

515

74_sysad_12.qx 11/8/99 10:34 AM Page 516

516


Best Practices To effectively use the many new techniques, methodologies, and procedures in the expanded feature sets, some best practices can be used to ensure a stable and efficient Windows 2000 environment. They act as guidelines for designing, implementing, and maintaining Active Directory within Windows 2000. ■

Verify all schema extensions through extensive testing before modifying the production environment. Never modify the schema unless all changes are well documented and well tested.

■

Avoid assigning unnecessary special permissions, as this quickly complicates a security configuration. Use standard permissions whenever possible.

■

Delegate control at the organizational unit level. Direct delegating of objects and attributes complicates the security model a great deal. Keep it as simple as possible.

■

Use the Delegation of Control Wizard to assign permissions at the OU level. This provides an automated mechanism for completing these functions.

■

Keep track of delegated assignments. This can become very complex and difficult to manage if control is not maintained.

■

Use the Deny permission only when necessary. If you set up permissions carefully, the Denied permission usually should not be required.

■

Always verify that at least one user has Full Control to a container. If this is not the case, administrators may lock themselves out of a container.

■

Determine the required attributes to use within an organization and try to fill them out. Managed properly, the directory can be a great source of information.

74_sysad_12.qx 11/8/99 10:34 AM Page 517


Summary Within Windows 2000, many new features have been added or modified from earlier versions. One of the main features added is the Active Directory. This directory service provides a store of available network resources and gives the users ability to access and use them. In addition, many of the new features that have been added, such as the encrypting file system and certificate authorities, require the robustness provided with Active Directory. With the extended and new features come some new concepts. To understand Active Directory and how it functions, you must learn the concepts associated with it. The directory is used to house the information stored within Active Directory. It is its core component. This service is replicated throughout the domain on domain controllers. If a change is made to one replica, the change is then copied to the other servers that are also maintaining a copy of this database. Only one domain controller is required to support a domain, and the database is stored on these computers in a file named NTDS.dit, which is stored in the <system root>\NTDS folder. Although private and public information is stored within the database, three different forms of public information are replicated. Configuration information describes the layout of the directory, including domains, trees, and global catalog servers. Domain information contains the objects that are located in the directory. Schema information maintains the rules for objects, attributes, and how they are applied. The namespace is used to denote the boundary in which names are resolved. The namespace used in Windows 2000 is based upon the DNS standards specified in RFCs 1034 and 1035. This also allows for better interoperability with other TCP/IP-based networks. Two types of namespaces are used: contiguous and disjointed. In a contiguous namespace, child domains are directly related to parent domains. A disjointed domain does not have this relationship.

517

74_sysad_12.qx 11/8/99 10:34 AM Page 518

518


Several different naming conventions are used in Windows 2000 and Active Directory. A distinguished name (DN) is used to identify the full path to an object located in Active Directory including the domain name. Several different attributes are associated with distinguished names such as common name (CN), domain components (DC), and organizational units (OU). A relative distinguished name (RDN) is used to locate a resource based upon a particular attribute. This is used to find a single item, such as a user ID or group name, and not where it is located. A globally unique identifier (GUID) is a 128-bit value associated with every object when it is created. This value stays with the object even if the object is renamed or moved. Finally, a user principal name (UPN) designates a friendly name for an object. The syntax is that of an e-mail address. For example, a UPN may be [email protected]. The schema is used to define the rules to determine what objects and attributes are available. This includes object classes, attributes, and their properties. A default schema is installed during the installation of the first domain controller. Two types of schema objects exist: classes and attributes. An attribute is information about a particular object. Object classes are used to determine what objects can be created in Active Directory. Schema content is controlled by the domain controller acting as the schema master, which is the first domain controller, installed by default. The schema is replicated to all other domain controllers within a forest, and therefore any modification must be carefully tested. The global catalog is used to provide an index of the information stored within the directory. The global catalog also maintains information about all objects located within a tree or forest. Although the information about objects outside the domain is only partial, it allows users to request resources in those other domains. Any domain controller can be configured as a global catalog, and for efficiency, one should be placed around areas with high utilization. Use the Active Directory Sites and Services to configure global catalogs. Replication is a key piece of the Active Directory. When a network grows, multiple directory servers will be required to provide an efficient infrastructure. To facilitate this need, a replication strategy

74_sysad_12.qx 11/8/99 10:34 AM Page 519


will keep the information on all domain controllers synchronized. Two types of replication are used: intersite and intrasite. Active Directory does intrasite replication automatically between servers that are defined within the same site container. An administrator defines site boundaries. Intersite communications must be manually set up between computers in multiple sites. Intrasite replication is faster and requires more bandwidth as it assumes a high-speed link. Intersite replication is compressed to preserve bandwidth and can be configured by an administrator. Client software is also an important part of Active Directory services. All these services on the back end server are useless without a client that can understand them. Clients that are Active Directory aware include Windows 2000 Professional, 2000 Server, and Windows 95/98. Windows 95/98 require an add-on package located on the 2000 server CD. In addition to concepts that are associated with Active Directory, the component that makes up the directory service must also be understood. Objects are used to manage a set of attributes associated with a class category. These represent an available resource located within the directory. Common objects include User, Computer, Group, and Printers. Organizational Units are created in Active Directory to provide a hierarchical management structure. They are used for several different reasons, including security delegation, and provide boundaries for features such as group policy. Sites are used to provide a logical boundary for grouping servers together. Sites are primarily used for three services: responding to authentication requests, replicating, and servicing directory requests. Authentication requests will be forwarded to a domain controller within the same site as the requester. Replication is configured on the basis of site membership. Directory requests work much like authentication requests in that they will be forwarded to a directory server in the same subnet if possible. Domains are used to provide administrative boundaries. The directory database is replicated throughout a single domain. A global catalog server and trust relationships are used to request resources from other domains. A domain follows the DNS naming

519

74_sysad_12.qx 11/8/99 10:34 AM Page 520

520


standards. Trees and forests are interconnected collections of domains. A tree represents a contiguous namespace while a forest can represent either a contiguous or disjointed namespace. In the management of Active Directory, three utilities are used. The Users and Computers applet is used to add, modify, or delete resources available in the directory such as users, groups, computers, or printers. The Domains and Trusts applet is used to manage multiple domains, or forest and trees. Not only can the trust relationships be managed from here, but also additional options are available such as altering the domain operations master server. The Sites and Services snap-in is used to monitor sites and site replication. This is used to control how and when Active Directory communicates with other sites. Although resource sharing works much as it did in previous versions of Windows NT, Active Directory provides additional capability for publishing resources. The resource must first be shared on the local computer; then a shared resource object is created and associated with the locally shared resource. In addition, keywords can be assigned to provide a more advanced search capability with these shared resources. There is a new search engine for finding objects in Active Directory. When a container is right-clicked and Find is selected, the search engine is opened. Advanced search criteria can be defined to further narrow down and customize searches. In order for a robust directory solution to be provided, advanced security capability must be offered. Several different methods can be used to control access to Active Directory objects. User authentication, the first mechanism, is provided by Kerebos, public key certificates, or NTLM. Second, object permissions can be applied to individual objects or to containers of objects. Also, standard and special permissions are available for these objects. Finally, Active Directory permissions can be applied. When you manage Active Directory, you must be able to grant access to others so they can perform administrative functions. Although this can be done manually, Microsoft has created the Delegation of Control Wizard to assist in this process. Another tool

74_sysad_12.qx 11/8/99 10:34 AM Page 521


provided by Microsoft is Active Directory Services Interface (ADSI), which provides an interface into the directory service for other applications.

FAQs Q: What is the term for a collection of trusted domains that share a common namespace?

A: Trees or forests. A tree is a contiguous namespace; a forest can contain domains that use either contiguous or disjointed namespaces.

Q: After I add a shared printer to the Active Directory, it does not show up for users in other domains. What directory service should store and provide this information to users?

A: Global Catalog. Q: What tool would you use if you wanted to add a Windows NT 4.0 domain into the Windows 2000 network?

A: Active Directory Domains and Trusts snap-in. Q: You decide to allow the helpdesk to reset passwords on the Windows 2000 network. What tool is available that can automate this delegation process?

A: Delegation of Control Wizard. Q: When you install a new application, you notice that several new object attributes are available. What API was used to allow this application to add these attributes?

A: Active Directory Services Interface (ADSI).

521

74_sysad_12.qx 11/8/99 10:34 AM Page 522

74_sysad_13.qx 11/8/99 10:40 AM Page 523

Chapter 13

Implementing Group Policy


Introduction to Windows 2000 Group Policy

■

Group Policy Structure

■

How Group Policy Is Applied in Active Directory

■

Modifying Group Policy Inheritance

■

Modifying Group Policy

■

Delegating Administrative Control of a Group Policy Object

■

Guidelines for Implementing Group Policy

523

74_sysad_13.qx 11/8/99 10:40 AM Page 524

524

Chapter 13 • Implementing Group Policy

Introduction to Windows 2000 Group Policy Group policies are rules that can be defined by an administrator for a user’s desktop environment. They are an evolution of the policies that are available from the earlier Windows 95/98 and Windows NT 4.0 desktop environments. With the release of Active Directory, Microsoft has taken policies one step further by allowing for a single administration point as well as additional feature sets that were not previously available. In addition, with the added manageability of Active Directory, Group Policies can now be used to manage more actively and accurately users’ desktops throughout an organization. Group policies are simply configurations stored in active directory that are used to configure a computer’s properties. These settings are managed by a group policy administrator and can be applied to one or multiple active directory objects such as a site, domain, or organizational unit (OU). Applying a policy to these objects defines how the object and its child objects will be configured. In addition, one object can have more than one group policy applied to create a more dynamic environment. For example, John Smith may have a computer policy assigned for his particular desktop and also a user policy assigned that follows him wherever he logs on to the network. Generally, group policies are used to enforce corporate policies. They are used to define items such as the applications that are available to a desktop or user, the ability to modify operating system variables, or the ability to use resources on the network. By allowing a single policy to be applied to multiple objects, you can set up a configuration once and have the policy enforce these settings for multiple computers. Group policies can be used in many different environments to meet multiple business needs. The wide array of features that are available by using group policy range from a secure locked-down desktop to application distribution, and from script processing to file and folder replication. The feature set can be used to facilitate a

74_sysad_13.qx 11/8/99 10:40 AM Page 525

Implementing Group Policy • Chapter 13

user who requires minimum control over their desktop to an administrator who requires additional tools to be available wherever he logs on to the network. By understanding group policies and their functions, you can use them to ease the administrative burden of managing a network and the users’ desktops within that network.

Group Policy Structure It is important to know the structure of group policies and the functions they are capable of performing. In order to apply group policies to a user or computer, you must specify how they will be used. Figure 13.1 shows the two types of configuration options that exist when a group policy is applied: Computer Configuration and User Configuration.

Figure 13.1

This is an example of a Group Policy configuration.

525

74_sysad_13.qx 11/8/99 10:40 AM Page 526

526


Types of Configurations Although each type of configuration contains similar options, they are applied differently when they are implemented. These group policy types can be managed from the Group Policy management console snap-in or through the Active Directory management console snap-in.

Computer Configuration The Computer Configuration settings are used to manage policies that control computer-specific items including desktop appearance, security settings, operating system operations, file deployment, application assignments, and computer startup and shutdown scripting. The available configuration options are designed to be used with any user who accesses this particular computer. Computer Configuration group policies are applied when the operating system is starting up.

User Configuration The User Configuration settings are used to manage policies that control more user-specific items. These may include application configurations, desktop features, assigned and published applications, security configurations, and user scripts for logon and logoff. These configuration options will be made available wherever a user logs on the network. This scenario is good if you have users who frequently change desktops. User Configuration group policies are applied when users log on the computer.

Configuration Subfolders As is shown in Figure 13.1, three different subfolders exist under Computer Configuration and User Configuration. Although they may look similar, the way each setting is applied is determined by the configuration type. The default subfolders available include software settings, Windows settings, and administrative templates.

74_sysad_13.qx 11/8/99 10:40 AM Page 527


Software Settings Software settings are used to manage the software distribution components that are installed for computers or users. Software settings are stored in \Computer Configuration\Software Settings\ for computer configurations and \User Configuration\Software Settings\ for user configurations (see Figure 13.2). A Software Installation subfolder manages application deployments.

Figure 13.2

Software settings options are available in computer and user configurations.

Windows Settings Windows settings are for managing the user environmental settings that are installed for computers or users. Windows settings are stored in \Computer Configuration\Windows Settings\ for computer

527

74_sysad_13.qx 11/8/99 10:40 AM Page 528

528


configurations and \User Configuration\Windows Settings\ for user configurations (see Figure 13.3). Within the computer configuration, two subfolders exist for Security Settings and Scripts. For a user configuration, there are four subfolders. In addition to the Security Settings and the Scripts folders, there is a Folder Replication subfolder and a subfolder for Remote Installation Services. Remote installation services can be used to install Windows 2000 by connecting a remote client to the network. Also available is Intellimirror, which uses this technology to provide features such as disaster recovery capability.

Figure 13.3

Windows settings options are available in computer and user configurations.

Administrative Templates The Administrative Templates section contains the registry-based policy information. Each configuration, the computer and the user,

74_sysad_13.qx 11/8/99 10:40 AM Page 529


maintains its own information within the registry. The User configuration information is stored in HKEY_CURRENT_USER, and the computer configuration information is stored in HKEY_LOCAL_MACHINE (see Figure 13.4). Information that a policy uses the registry to store is contained within this section, including operating system components and applications. Like Windows NT 4.0, administrative templates are identified by .ADM files. Each template is stored in a single file for each configuration type named Registry.pol. The Registry.pol file is used to manage group policies that are defined for each type of configuration, computer or user. The Registry.pol file to be used is also stored on the computer in the GPT (Group Policy Templates, see page 532)\Machine directory for computer configurations and GPT\User for user configurations.

Figure 13.4

Administrative Template options are available for computer and user configurations.

529

74_sysad_13.qx 11/8/99 10:40 AM Page 530

530


Type of Group Policies In addition to configuration types for group policies, categories have been defined for functional policy types. Each category has a distinct set of features.

Software Deployment Software deployment has traditionally been provided by a separate systems management product such as Microsoft Systems Management Server (SMS). Some of these features have now been integrated into Windows 2000. Two types of software deployment are available to further customize the user environment: Application Assignments and Application Publications. Application Assignments are used to provide restricted software distributions to a desktop. When a computer or user configuration is set up as assigned, the application is installed and cannot be modified or deleted without changing the policy. These assignments are used to enforce standard desktop configurations. Application Publications are used to provide a software distribution to a user or computer and allow them to choose to install it. In addition, they may remove that application at any time. An example of this type of application is a product add-on that some users may wish to have.

Software Policies Software policies are the most common configuration settings used. These options define a user’s working environment, such as the configuration of the users Start menu, the desktop wallpaper or screensaver, or user profile settings. Other items include operating system components and registry settings to further customize a user’s desktop environment.

74_sysad_13.qx 11/8/99 10:40 AM Page 531


Desktop File\Folder Management Another common feature set used for configuring group policies is file and folder management. These options allow a group policy administrator to add files, folders, and shortcuts to a user’s desktop. An example of this option is providing a network application to users based upon security group membership, or making a file available to the user community.

Scripts Scripts can be used to automate the process of running batch files at certain times, for example at startup or shutdown. Other time variables include running the script at logon or logoff. These scripts are used to automate repetitious tasks such as mapping to a network drive, mapping a network printer, or running an executable at startup. Windows Scripting Host is used to create these scripts and can include other technologies such as VBScript and Jscript.

Security Security policy settings are used to define tree, domain, network, and local computer security configurations. They can be used to set up account policies such as minimum and maximum password age, Kerebos security policies, network IP security policies, and account lockout policies. The security policies are used to provide a more secure computing environment within an organization.

Group Policy Objects Group Policy Objects (GPOs) are used to store group policy configuration information. Once you have created the group policy configuration settings, they are stored in a GPO and applied to a site, domain, or organization unit. In addition, you can apply multiple group policy objects to a single site, domain, or organizational unit.

531

74_sysad_13.qx 11/8/99 10:40 AM Page 532

532


Group policy objects are stored in multiple forms. First, group policy object properties are stored in Active Directory in a group policy container (GPC). Also, group policy object information is stored in a folder located on domain controllers; these sets of information are known as group policy templates (GPT). It is important to note that Global Policy Containers are used to store GPO information that is small and may change infrequently while Global Policy Templates are used to store information that is large and can change frequently.

Group Policy Containers A Group policy container (GPC) is an Active Directory object used to store information for software deployment. The GPC represents a server repository for application information, including programming interface information, software publishing, and software assignments. In addition, group policy containers maintain subcontainers for storing user and computer configuration information. Group policy containers store information to determine whether the group policy object is enabled or disabled as well as maintaining synchronization between the GPT and the GPCs. This information is stored in the group policy container: ■

Version information. Ensures synchronization between the GPT and GPC.

■

Status information. Determines whether GPO is enabled or disabled.

Group Policy Templates Group Policy Templates (GPTs) are a subset of folders created on each domain controller to store group policy objects. The subset of folders created is stored in the “System Volume” folder, or SYSVOL. The GPT contains all the information for Software Deployment, Software Policies, Security Settings, Scripts, and Desktop File\Folder Management.

74_sysad_13.qx 11/8/99 10:40 AM Page 533


Applying GPTs varies with the configuration type. A GPT defined in a computer configuration would take effect during the initialization process. On the other hand, a GPT defined in a user configuration would not take effect until a user logged on the network. Consider these differences when you create group policies.

GPT Contents Since group policy templates are essentially a file and folder system defined on computers, the following directory structure represents the folders that are created. By default, the \User and the \Machine\Microsoft\Windows\SecEdit are the only folders created. As additional policies are defined, folders are created to store and maintain each one. GPTs are assigned GUIDs, Globally Unique Identifiers, to uniquely identify each one. Each of the folders listed in Table 13.1 is created as policies are defined that fit into each category.

Table 13.1

Subfolders Used to Store Group Policy Templates

Subfolder

Contents

\ADM

.ADM files used by a group policy template

\User \User\Applications

Registry.pol file to be applied to users Windows Installer advertisement files to be applied to users \User\Documents & Settings Group policy templates identifying files or folders to add to users' desktops \User\Scripts Logon and logoff subfolders for users \User\Scripts\Logon Logon scripts for users \User\Scripts\Logoff Logoff scripts for users \Machine Registry.pol file to be applied to computers \Machine\Applications Windows Installer advertisement files to be applied to computers \Machine\Documents & Group policy templates identifying files or Settings folders to add to computer desktop Continued

533

74_sysad_13.qx 11/8/99 10:40 AM Page 534

534


Subfolder

Contents

\Machine\Microsoft \Windows\SecEdit

GPTTMPL.ini Security Editor file

\Machine\Scripts \Machine\Scripts\Startup \Machine\Scripts\Shutdown

Logon and logoff subfolders for computers Logon scripts for computers Logoff scripts for computers

GPT.INI The GPT.INI file is used to manage the local Group Policy Object. It determines whether the local GPO is enabled or disabled. For any other GPO, this information is stored in the Windows 2000 Active Directory. The GPT.INI file is located in the root folder of each group policy template (see Figure 13.5) and includes these entries: ■

Version=x. The version number begins at 0 and increments for each revision to the group policy object.

■

Disabled=z. This can be set to 1 or 0 and determines whether the local group policy object is enabled or disabled.

Figure 13.5

This is an example of a GPT.INI file.

74_sysad_13.qx 11/8/99 10:40 AM Page 535



Enhancing Your Skill Set with Windows 2000 Add-ons

Windows 2000 is built on the Windows NT foundation that Microsoft has been developing for years. Although many administrators are familiar with Windows NT, Windows 2000 will require a great deal of training for full understanding and support. The features that were included within earlier versions have been modified, and new concepts such as Active Directory are being introduced. Although this can be a timeconsuming and costly effort, there is one easy way to begin understanding Windows 2000 today. Many of the features that are found within group policy are available with previous versions of Windows NT. As development of Windows 2000 progressed, features that were completed were added to Windows NT 4.0 through Service Packs. NT 4.0 Service Pack 4 provided the first Windows 2000 additions and included tools such as Security Configuration Editor, Microsoft Management Console add-ons, and a Windows 2000–friendly version of NTFS. Other policy options have originated from earlier versions of Windows. For example, the administrative templates that are included with Windows 2000 originated from Windows NT 4.0 System Policies. These were configured by using Policy Editor and could be applied to Windows 95/98 and NT 4.0. In addition, third-party and Windows 2000–aware products were being released by vendors months before its release. For example, some Microsoft BackOffice products, such as Systems Management Server 2.0 and SQL server 7.0 that were shipped almost a year in advance, have features built in that take advantage of Windows 2000. Other vendors provided Continued

535

74_sysad_13.qx 11/8/99 10:40 AM Page 536

536


Windows 2000 enabled solutions prior to release, including Windows NT 4.0 to 2000 migration tools. By using the available tools and third-party or add-on products that are already Windows 2000 aware, administrators can begin the long process of updating their skill sets. This not only reduces training efforts and costs; some of the features included with Service Packs give you additional tools for easing today’s administrative burden while you prepare for the future.

How Group Policy Is Applied in Active Directory To fully understand the functionality of Group Policies, you must also know how group policy is applied in the Windows 2000 Active Directory. With manageability comes complexity. This is true for managing group policies. Additional rules and options have been inserted to provide better functionality and provide a scalable solution. For example, when applying a set of group policy objects that are assigned at different places, a particular order is used to determine what configuration settings apply to a user or computer. In addition, options exist to provide a secure implementation as well as to filter out unnecessary users or computers and prevent them from being affected by a policy.

Order of Inheritance When group policy is applied to objects within the Active Directory, an order of inheritance is used in applying the changes. The order of inheritance is used to determine what policies will take effect, based upon the location at which they have been applied. A good example of order of inheritance is when two policies have been defined for a computer at different locations and a conflict occurs. The order of inheritance would be used to determine which policy would take effect. This predefined order has been established and must be understood to keep policies from canceling each other out.

74_sysad_13.qx 11/8/99 10:40 AM Page 537


When you configure a group policy, you can apply them only to a site, an organizational unit, or a domain. Active Directory determines the group policies that are applied by starting at the point furthest from the user or computer object. The first object looked at is the Site object. Policies applied here can be administered through the Active Directory Sites and Services snap-in. Once the policy has been loaded for the site object, the next step is to apply group policies for the domain object. Once complete, policies assigned to the organizational units within that domain are then applied. Both the domain and organizational unit policies can be managed from the Active Directory Users and Computers snap-in. If a policy has been applied at the site or domain level that conflicts with the policy setup at the organizational unit, the OU policy will take precedence. Figure 13.6 displays the order of inheritance for group polices.

Figure 13.6

This is the Group Policy order of inheritance.

First, policies are applied to the site.

Site

Then, policies are applied to the domain.

Domain

Finally, policies are applied to the organizational unit.

Computer Policies applied at book initialization

Organizational Unit (OU)

User Policies applied at network logon

537

74_sysad_13.qx 11/8/99 10:40 AM Page 538

538


In addition to these rules, if a computer configuration policy has been set up along with a user configuration policy and they conflict, the user policy settings will always override the computer configuration policy. There are a few exceptions to these rules that must also be discussed. Overriding inheritance and blocking inheritance are two features that can be used to further customize group policy inheritance; they are discussed in “Modifying Group Policy Inheritance.”

Creating a Group Policy Object The first step in the creation of a group policy is the creation of a group policy object. This must be done before any group policy management can be performed. To create a group policy object: 1. Start the Active Directory Users and Groups snap-in by choosing Start | Programs | Administrative Tools | Active Directory Users and Groups. 2. Right-click the Active Directory site, domain, or organizational unit for which you wish to set up a group policy object and select properties. 3. Select the Group Policy tab. 4. Select the Add button under Group Policy Objects. Once it is selected, you will have the option of choosing Domains/OUs, Sites, or All. The Domains/OUs and Sites specify the group policy objects that are linked to each object. The All option allows you to create and specify group policy objects. 5. Once the tab has been selected, choose Create New Group Policy Object and enter a name for the new GPO. It is the middle icon on the top right, as shown in Figure 13.7. Once it is complete, click OK. 6. Once the GPO is complete, return to the Group Policy tab from which you must select a GPO to manage. The available options are shown in Figure 13.8 and are discussed later in this chapter.

74_sysad_13.qx 11/8/99 10:40 AM Page 539


Figure 13.7

These are the Group Policy setup options.

Figure 13.8

These options are available for customizing a group policy object.

539

74_sysad_13.qx 11/8/99 10:40 AM Page 540

540


Group Policy and Slow Networks Included within group policies is the intelligence to detect slow network connections. Because group policies can consume large amounts of bandwidth, depending upon the options that are chosen, a slow network is treated differently by group policy objects. When a user logs on the network, an algorithm is used to determine the network speed of the connection. If a slow network is detected, a modified set of policies is provided to the computer or user. For example, if a slow network connection is detected, application assignments will not be available. The default settings for policies in use over a slow network connection are: ■

Security Settings

ON

■

Administrative Templates

ON

■

Software Installation

OFF

■

Scripts

OFF

■

Folder Redirection

OFF

Each of the policy categories allows for customization of use over slow network links, with the exception of Administrative Templates. These are turned on and cannot be modified for use over a slow network connection. The algorithms used in Windows NT 4.0 systems for detecting slow networks connections were based upon file system performance. A new network-based algorithm is used to determine the network connection speed. Configuration information for slow network detection can be found in Computer Configuration\Administrative Templates\System\Group Policy for computer configurations and User Configuration\Administrative Templates\System\Group Policy for user configurations. In user configurations, you can actually

74_sysad_13.qx 11/8/99 10:40 AM Page 541


specify the speed the policies use to denote a slow network connection. For example, if you set 128Kbps for the speed, anything below this speed will be designated a slow network. The default speed used is 500Kbps.

Filtering the Scope of GPO Security groups can be used in Active Directory to further define the scope of a particular group policy object. The ability to further customize the users and computers that are affected can be managed by security groups. Group policies only apply to users or computers that have Read permissions. Therefore, even if a user or computer falls within an organizational unit that has a policy defined, it will not affect that object unless it has read permissions assigned either explicitly to that object or implicitly through group membership. To specify which groups are affected by a particular group policy, verify that they have Apply Group Policy and read access to the group policy object. If either permission is removed, the group will not have access to the group policy. You should remove the Apply Group Policy instead of removing the read permission if you want to stop a policy from affecting a group. By default, Authenticated Users cannot modify group policy objects but can be associated with them, because they have Apply Group Policy and Read permissions. Domain Administrators, Enterprise Administrators, and the local system have full control permissions with the Apply Group Policy. The administrators are also authenticated users; therefore, they receive the Apply Group Policy access from this security group. To setup permissions to a particular group policy object, select the properties of the particular group policy object and choose the Security tab. Click the Advanced button to set up permissions, as shown in Figure 13.9. This page is used to set up access permissions to provide or deny access to group policy objects.

541

74_sysad_13.qx 11/8/99 10:40 AM Page 542

542


Figure 13.9

These are filtering group policies.

Modifying Group Policy Inheritance Group policy is assigned in Active Directory, based upon the order of inheritance. A policy will be applied at the site, next at the domain, and finally at the organizational unit. In small businesses, this order may work well; however, in an enterprise environment, a more complicated group policy design may be required. Additional options are available to further customize the inheritance model in which group policy is assigned. Two options are available for modifying group policy inheritance: overriding inheritance and blocking inheritance.

Overriding Inheritance Because of the order of inheritance of group policies, lower-level administrators are able to override policies that may be set at a

74_sysad_13.qx 11/8/99 10:40 AM Page 543


higher level. For example, a domain administrator may configure a set of policies at the domain level for all users. By default, an administrator of an organizational unit within that domain may try to override these settings with a policy of their own. By using the No Override option, you can ensure that the policy that has been defined at the domain level will not be canceled out by a policy at the organizational level. This option can be set on an individual group policy object as required. Administrators can set up audit policies to monitor for these types of conflicts.

Blocking Inheritance The Block Inheritance option provides an administrator with additional control in specifying the policies that will be defined for an object such as an organizational unit. This option prevents policies defined for parent containers from being passed along to itself. In other words, an administrator who wants to create a special organizational unit beyond a policy that has been set for the domain can set the block inheritance to keep the parent policies from applying. To use this setting, you must specify a group policy for an organizational unit and mark that as “block policy inheritance.” This prevents parent policies from being used. It is important to note that if enforced policies set up by using overriding inheritance are used, block policy inheritance will not work.

Modifying Group Policy Although you have seen how group policies work, they will not provide much benefit if you do not modify them to apply the configuration settings that you want to specify. You can modify group policy objects in two ways. The first option is to select the Group Policy tab on the Properties page of the site, domain, or organizational unit. The second option is to open the Group Policy Management snap-in with the appropriate policy selected.

543

74_sysad_13.qx 11/8/99 10:40 AM Page 544

544


Group Policy Tab In order to modify configuration settings available for group polices, you can use either of the available methods. Once you have selected the Group Policy tab from the Properties page of a site, domain, or organizational unit, several options are available for controlling the group policy object (see Figure 13.10).

Figure 13.10 These are the options available for customizing a group policy object.

■

The Up or Down button can be used to specify the priority of the group policy object. This is used to manage multiple policy objects.

■

The Options button allows you to further customize a group policy object by specifying the No Override attribute or disabling the object for this property. This Properties page is displayed in Figure 13.11.

74_sysad_13.qx 11/8/99 10:40 AM Page 545


Figure 13.11 The Options tab provides two additional items that can be configured.

■

The Delete option removes this group policy object but offers two options when doing so. The first option removes the link from this list thereby un-associating this policy with this object. For example, you may have this policy associated with other objects and do not to want re-create a policy for them. The second option not only removes the link, but also completely and permanently deletes the group policy object.

■

The Properties option allows you to display properties and specify that one or both configuration types are disabled. In addition, the links to other objects are displayed. The Security attributes of this object can be specified to further customize the group policy object. This option is displayed in Figure 13.12.

■

The Block Policy Inheritance is used to determine how parent group policy objects are enforced.

■

The Edit button can be used to start the Group Policy Object editor. This is used to configure the settings stored within the policy object.

545

74_sysad_13.qx 11/8/99 10:40 AM Page 546

546


Figure 13.12 The Properties button provides additional customization options and information.

Group Policy Editor Once a group policy is created, you can select the Edit button from the Group Policy tab to display the configuration settings that are available (see Figure 13.12). Within each subfolder, options exist to configure settings for the computer or user. Figure 13.13 displays the options available for configuration under the Computer Configuration options, Administrative Templates, System, and Logon options. Each option has three status options: Enabled, Disabled, and Not Configured. To configure a particular setting, right-click the option to configure and choose Properties. Once the Properties page appears, your options are listed. Figure 13.14 shows the configuration parameters available when you configure the option for “Slow network connection timeout for user profiles.”

74_sysad_13.qx 11/8/99 10:40 AM Page 547


Figure 13.13 These options are available for configuration.

Two tabs are available for this policy. The first tab, Policy, displays the settings that are customizable for this option. The second tab displayed provides an explanation of the options and their configuration settings. In addition, a check box is located in the upper left corner. This box determines the status of this particular option. Three possible variations could be displayed within this check box: ■

If the box is checked, the policy option is applied. In addition, the Settings page will be grayed out and will not be configurable unless this box is selected.

■

If this box is not selected, the option is disabled. If the registry contains entries that would be affected by this policy, they would be removed. For example, if a computer has a configuration from a previous policy or was configured manually, those entries would be removed.

547

74_sysad_13.qx 11/8/99 10:40 AM Page 548

548

Chapter 13 • Implementing Group Policy ■

The third and final option is the default. If the check box is grayed out, the option is not implemented. This option lists itself in Group Policy Editor as “Not configured.” What this means is that it will not make any modifications at all. You should leave these settings Not Configured unless you fully understand the ramifications of changing them.

Figure 13.14 These are the settings available with the Slow Network connection timeout, with user profiles option.

Adding Administrative Templates In addition to the Administrative Template options that are listed, you can add or customize your own. The templates that are listed in the group policy editor are extracted from .ADM files located in a particular directory. Other .ADM files are available, including NT 4.0 versions that can be imported. To add additional templates, rightclick the “Administrative Templates” folder in group policy editor and choose the Add/Remove Templates option. The currently installed templates are displayed along with the options to add or delete others. This option allows you to further customize the group policies that are applied in your environment, including earlier templates that are already in use in an NT 4.0 environment.

74_sysad_13.qx 11/8/99 10:40 AM Page 549


Using the Group Policy Management Snap-in Group Policy Objects can also be managed from a custom management console. This allows you to manage multiple group policies from within a single intuitive interface. To create a custom management console: 1. Start the Microsoft Management Console (MMC) by choosing Start | Run and typing MMC and clicking OK. 2. Select the Console button and choose Add/Remove Snap-in. 3. Under the Standalone tab, select Add. 4. Choose Group Policy in the Available Options list and click Add. By default, the local group policy is selected. 5. Click Browse to locate an existing group policy to add. Once you have chosen, select Finish to complete the procedure.

Group Policy Configuration Example Now that a group policy object has been configured and applied, see Figures 13.15 and 13.16 for the before and after effect of a possible policy affecting the Start menu. Figure 13.16 shows that the Run option has been removed.

Figure 13.15 This is an example of the Start menu by default before a policy has been applied.

549

74_sysad_13.qx 11/8/99 10:40 AM Page 550

550


Figure 13.16 This is an example of the same Start menu after a policy has been applied, with the Run line missing.

Delegating Administrative Control of a Group Policy Object One important factor for implementing a group policy is the current administration model of your organization and the way group policy fits into that model. In a very small environment, one or two administrators may share the responsibility of managing group policy for everyone. This is not the case in most companies. One feature of group policy is the ability to delegate administrative control over managing policies to other personnel. This option provides the ability to create a more scalable infrastructure and better fit individual business needs. Several issues must be taken into consideration when a group policy design is created. One of the most important is the administrative control over these policies. Some of the organizational factors that must be considered include: ■

Centralized administration model vs decentralized administration model

■

Administrative boundaries within the organization

■

Delegation of authority

74_sysad_13.qx 11/8/99 10:40 AM Page 551


These issues are fundamental for preparing an efficient group policy design. The largest factor that must be considered is that of centralized vs decentralized administrative control. There are many different ways to delegate administrative tasks, depending upon your organization’s requirements. For example, security groups can be defined at the administrative boundaries to form a group policy model. Group policy objects can be created using modules. For example, you may create group policies according to different categories, such as scripts or security. For example, you may set up an administrator with the ability to create and manage only scripts within group policies. Delegation of administrative tasks can be broken down into three individual functions that can be performed together or independently of each other. The three functional groupings of group policy administrative tasks are: ■

Creating a group policy object

■

Modifying a group policy object

■

Managing a group policy object link to a site, domain, or organizational unit

To create or manage a group policy, an administrator must be given Read and Write permissions either explicitly for that user or implicitly through a security group membership. By providing administrators with this level of access, you can delegate such administrative tasks as modifying a group policy object to other personnel. If you grant administrators only Read access, they can view policies but will not have the ability to modify them. Table 13.2 lists the permissions that are given by default when a group policy object is created.

NOTE Apply Group Policy is not set for any of the groups listed in Table 13.2, except for authenticated users. By default, an administrator who is logged on the network then receives the Apply Group Policy permission from the authenticated users security group membership.

551

74_sysad_13.qx 11/8/99 10:40 AM Page 552

552


Table 13.2

Default Permissions for a Group Policy Object

User /Group

Access Control Entries (ACEs)

Authenticated users

Read Apply group policy

Creator owner Domain administrators Enterprise administrators Local system

Full Full Full Full

control control control control

Creating a Group Policy Object To create a group policy object, an administrator must have Read and Write permissions to the site, domain, or organizational unit. By default, several security groups exist that already have the appropriate permissions to create these objects. These groups include domain administrators, enterprise administrators, and group policy administrators in addition to the local operating system. To give nonadministrative users the capability to create group policy objects, make them members of the group policy administrators’ group. Keep in mind that once a group policy object has been created by a member of the group policy administrators’ group, those members now have creator-owner privileges to that object. This allows them to edit the policy object in the future. This concept can apply to other nonadministrators. For example, if two employees are placed in the group policy administrators’ group, they can create policies but can only modify those that they created or were given explicit rights to. In addition, they cannot assign group policies and therefore cannot do much damage. Figure 13.17 shows an example of the default permissions that are set up for a new group policy object. In addition, by clicking the Advanced button shown at the bottom of Figure 13.17, you have additional control over the security permissions that are set up by default. Figure 13.18 displays advanced options available when security features of group policy objects are configured.

74_sysad_13.qx 11/8/99 10:40 AM Page 553


Figure 13.17 Default permissions are applied when a new group policy object is created.

Figure 13.18 Advanced options are available when security features of group policy objects are configured.

553

74_sysad_13.qx 11/8/99 10:40 AM Page 554

554


Modifying a Group Policy Object When group policy objects are created, domain administrators, enterprise administrators, the operating system, and the creator owner of the group policy object can modify it by default. In addition, the Apply Group Policy access control entry is not set up, so the policy will not affect these users in their groups. Users located within these groups do, however, inherit the Read and Apply Group Policy permissions by being authenticated users. Additional groups can be set up to modify group policy objects to meet your business requirements. To create a new group to manage group policies, use this procedure: 1. Open the group policy management console snap-in with the particular policy selected. 2. Right-click the policy and choose Properties and select the Security tab. 3. Select the Add button and select a group to add to this policy. 4. By default, this group will be given Read permissions to this object. Check the Allow Write permission, as shown in Figure 13.19. 5. Select the Advanced button to further customize the capability of this group with the policy object if necessary. 6. Select Apply and click OK to complete the task.

NOTE You can also manage these security permissions from the Active Directory Sites management snap-in or the Active Directory Users and Groups management snap-in.

74_sysad_13.qx 11/8/99 10:40 AM Page 555


Figure 13.19 A new group can be configured with manage access to a group policy object.

Managing a Group Policy Object Link to a Site, Domain, or Organizational Unit Once a policy has been created and set up, it must now be applied to an object in order to take effect. Group policy objects can be applied only to sites, domains, or organizational units. To specify what object to associate with a group policy object, you must set up a link to that site, domain, or organizational unit. To set up a link, you must choose the Group Policy tab from the Properties page of the site, domain, or organizational unit. To create the ability for new groups to manage group policy object links, you must use a new tool in Windows 2000, the delegation wizard, and select the Manage Group Policy links predefined task. To delegate group policy link management:

555

74_sysad_13.qx 11/8/99 10:40 AM Page 556

556


1. Right-click the site, domain, or organizational unit to use and select Delegate Control. 2. Select Next when you are prompted to the first introductory screen. 3. The next screen displays the contained, domain, and site (if applicable) that are being used. Select Next to continue. 4. Choose the user or group to add by selecting the Add button, as shown in Figure 13.20, then click Next.

Figure 13.20 Choose a user or group to be delegated permissions.

5. Next, check the Manage Group Policy Links box to select that property, as shown in Figure 13.21, then select Next. 6. The last dialog displays the options selected. Click Finish to apply these settings.

74_sysad_13.qx 11/8/99 10:40 AM Page 557


Figure 13.21 Select the tasks to be assigned to the chosen user or group.

Guidelines for Implementing Group Policy When you create your group policy design and structure, there are some important concepts and rules to consider. The methods used to implement group policy are just as important as the day-to-day administration. If a poor implementation plan is devised and used, the true benefits of group policy will not be seen, and it may become more trouble than it is worth. To properly implement an efficient group policy structure, you must understand and use the necessary guidelines to create an implementation that will succeed. The first step in creating any group policy structure is to understand the organization of the Active Directory. A well-designed Active Directory infrastructure is based upon the business requirements and boundaries that it is servicing. The Active Directory design is

557

74_sysad_13.qx 11/8/99 10:40 AM Page 558

558


critical for determining how group policy will be used. Try to build your Active Directory design with group policy in mind. By considering group policy from the beginning, you can drastically simplify your Group Policy implementation and administration. Next, build your implementation around the order of inheritance. Remember that when a policy object is being assigned, it can be overridden by other policy objects. There are only three types of objects that can have policies assigned. When checking for policies, they are processed in a particular order: 1. Site 2. Domain 3. Organizational Unit (OU) This priority order begins with the object closest to the computer or user. For example, if a policy is assigned to the site and another policy is assigned to the organizational unit and they conflict, the organizational unit policy will override the policy set at the site level, because the organizational unit object is closer to the user than the site object. You should be careful in implementing policies, because they can become troublesome to administer and troubleshoot if they are applied incorrectly. When you calculate the order of inheritance, other mechanisms are available to further customize the application of group policy objects. By default, group policy objects are cumulative and flow down from parent containers. This behavior can be modified within the group policy objects themselves. One example is to use block policy inheritance. This option can be used to prevent policies defined for parent containers from being passed along to itself. This allows you to provide administrative control over child containers to other users without affecting all containers within a given policy. Another option along these lines is overriding inheritance. This option is used to cancel the block policy inheritance feature. It can be used to force a policy down onto child containers. For example, if a domain administrator has been given control over a child container, the container administrator may set block policy inheritance to

74_sysad_13.qx 11/8/99 10:40 AM Page 559


keep parent container polices from flowing into that particular child container. By selecting the No Override option, you can ensure that the policy will flow to the child container. This option is set on individual group policy objects as required. In addition, if both the No Override option and the block policy options are selected, the block policy option will be canceled out. When you apply group policy objects, use security group memberships to filter out users and computers that do not need to be included. By default, a user must have Read permission and Apply Group Policy permission assigned to be allowed to execute the policy. By removing one or both of these permissions, you can deny access to a policy by a particular user, computer, or group. When you use security group memberships to filter out affected objects, do not remove the Read attribute. Remove the Apply Group Policy attribute whenever possible instead. Be careful in the design and implementation of this concept. When it is used correctly, it can provide more advanced policy distribution, but it can also complicate the troubleshooting process. Two configuration types are available within a group policy: computer configurations and user configurations. The computer configurations are designed to be used on specific computers no matter who logs on them. The user configuration settings are used to provide a common interface no matter where a user logs on the network. The combination of the two types of policies provides a very effective configuration; however, user configuration options always override computer configuration options. With each configuration type, several categories of options are available. For each configuration type, there are three subfolders: Software settings, Windows Settings, and Application Templates. These three subfolders are used to manage five different categories of options: Software Deployment, Software Policies, File and Folder Deployment, Scripts, and Security. Each category maintains its own set of configuration options, and they vary between the two configuration types. Group policy implementations can be created and administered on the basis of a categorization of the policy objects.

559

74_sysad_13.qx 11/8/99 10:40 AM Page 560

560


For example, one administrator may be given responsibility for maintaining all policies that handle script processing. Another administrator may be responsible for maintaining the security setting stored in the group policy objects that are deployed. Many different rules and guidelines can be used for implementing group policy in an organization. The key is to understand specific business needs and requirements and to build a plan based upon them. If it is possible, try to design and build the Active Directory structure with group policy in mind. Remember the rules and concepts that are used. Finally, keep the group policy implementation as simple as possible. Especially in large environments, group policy implementation can get out of control and can cause more administrative overhead then it saves.

Best Practices Guidelines for implementing group policy explain the rules and concepts that are important. Generally, these guidelines are used to explain how group policy works. These best practices provide rules to use when you implement and administer group policies, so implementation is more efficient and simplistic. Each recommendation is based on an average environment, so each recommendation should be reviewed to determine its effect and outcome on a particular environment. ■

Use Group Policies instead of Windows NT 4.0 system policies. Although group policies can be used to override NT 4.0 system policies, this is not recommended.

■

Although group policies can be applied at many different levels, try to implement a group policy object at the highest level possible. This eases your administrative burden.

■

Try to associate group policy objects through group membership. Although you can apply security permission for group policies objects to users, group membership requires less administration, especially in medium- to largescale environments.

74_sysad_13.qx 11/8/99 10:40 AM Page 561

Implementing Group Policy • Chapter 13 ■

Use computer-based policies to override user-based policies only when it is necessary. These are used only when you require a desktop to look the same no matter who logs on at it.

■

Keep the number of policy objects associated with users in organizational units and domains to a minimum. By applying too many group policies, the log-on process can take a long time. In addition, too many policies can create more administration overhead than it saves.

■

Use the Block Inheritance feature and the Force Policy Inheritance feature only when they are necessary, as they can complicate the design and make troubleshooting difficult. In addition, these options increase the time needed for processing the policies at logon or startup. This primarily occurs when a large number of policies that have to be applied are used.

■

Try not to use group policy objects that cross multiple domains. Crossing domains increase the time needed to process the policies; this can have a dramatic user impact.

■

When you apply applications via group policies, assign an application through only computer configuration or user configuration, but never through both.

■

Filter policies on the basis of group membership. By applying security privileges to groups, you can filter whom you want to be affected by specific policies. For example, users who belong to an organizational unit that has a group policy applied, without being members of a specified group, may not have the policies applied to them. This can be very helpful when you try to manage a large amount of users with a minimum number of policies.

■

Try to use Group Policy scripts instead of per user scripts. This allows script administration to be more maintainable and efficient. By using both, they can cause problems when they compete to run during the logon process.

561

74_sysad_13.qx 11/8/99 10:40 AM Page 562

562

Chapter 13 • Implementing Group Policy ■

When you set slow network preferences, determine the requirements of the clients and the normal logon conditions. For example, if a user normally logs on to the network via a dial-up connection, it may be necessary to apply more policies over a slow connection in order to enforce them. Understand your clients’ normal network connection speeds, and build policy rules based upon them.

Summary Group policies are attributes that can be assigned to manage user desktop environments. They are configurations that are stored within Active Directory and replicated on domain controllers that are configured on a desktop when it logs on the Windows 2000 tree or domain. They are used to manage and enforce company or organizational policies at the desktop level. Group policies are broken down into two configuration types: computer and user. Although each option provides similar configuration settings, they are managed and applied differently. The computer configuration is used to manage and define policies that are computer specific. For example, file deployment or security settings may be used to enforce rules for all users who may access a particular computer. A user configuration is used to enforce policies wherever a user logs on the Windows 2000 network. This may include features such as assigned applications or desktop backgrounds. Computer policies are applied during the boot process, and user policies are applied during network logon. Three subfolders exist under each configuration type. Each defines a different set of available options that can be defined for the two configuration types. Software settings are used to manage software distribution including application publication and assignment. Windows settings are used for managing environmental configurations, including security configurations or script processing. The third subfolder consists of administrative templates. These contain registry-based policy information. The user information is stored in

74_sysad_13.qx 11/8/99 10:40 AM Page 563


HKEY_CURRENT_USER, and the computer configuration is stored in HKEY_LOCAL_MACHINE. Administrative templates are identified by .ADM, and configuration information is stored in a file named registry.pol. Two registry.pol files are defined, one for each configuration type. Five categories of group policies have been defined. These are used to provide functional areas when the complete feature set of group policies is defined. Software distribution is used to provide software installation services. Two types of software distribution in Windows 2000 are application assignments, which force an application installation, and application publications, which make the software available for a user. Software policies define a user’s work environment, for example, desktop settings or wallpapers. Desktop File\Folder Management is used to provide replication services to the desktop, for example, replicating a folder to all desktops with documentation. Scripts are used to define startup and shutdown script processing; security is used to manage desktop security configurations. Group policy objects, or GPOs, are used to store the configuration information. Once the settings have been defined, they are stored within a group policy object and applied to a site, domain, or organizational unit. GPOs are stored in two forms: Group policy containers (GPC), and group policy templates (GPT). GPCs are used to store small amounts of GPO information and are located within Active Directory. They are used to maintain information such as assignments, whether the policy object is enabled or not, and version and status information for each GPO. The GPT is stored on all domain controllers within a domain and is replicated. These maintain larger amounts of information such as replicated files and application source files. The GPT is a replicated file and folder structure and maintains its information on the System Volume, or SYSVOL. A file named GPT.INI is used to maintain the version information and the status of the group policy object for group policy templates.

563

74_sysad_13.qx 11/8/99 10:40 AM Page 564

564


There are a few rules to use when applying group policies. First, you can apply a group policy object only to a site, domain, or organizational unit. This combination is also known as SDOU. Next, the policy located closest to a computer or user object takes priority over another policy applied further up. For example, if a policy is applied to a domain and to an organizational unit, because the OU is located closer to the computer or user object, it takes precedence. This is known as order of inheritance. You can also use this order to filter security permissions to manage group policy objects. Two additional options are available for modifying group policy inheritance. Overriding inheritance is designed to prevent lowerlevel administrators from filtering out policies set at a higher level. This way, domain administrators or designated administrators at a higher level within the Active Directory tree can set policies to be enforced at lower layers. Block inheritance can be used to stop policies from flowing down to lower levels. If both overriding inheritance and blocking inheritance are set up, overriding inheritance will always take precedence. To manage group policy object configurations, you must use Group Policy Editor, which is run either by selecting an add-on snap-in within the Microsoft Management Console or by selecting the Group Policy tab on a site, domain, or OU; selecting the Configuration option; and choosing Enabled, Disabled, or Not Configured. Enabled will apply the settings chosen, Disabled will remove the settings that are effected, and Not Configured (default) will make no changes. Group policy enables you to create an administration model to meet your company’s business needs. Group policy administrators are created to manage and maintain group policy objects and associations. Administrative control can be delegated to other administrators by setting up advanced security privileges to a policy, a site, domain, or organizational unit. Finally, there are important guidelines to remember when you create group policies. First, understand the Active Directory infrastructure and how it is used. Remember and use the order of inheri-

74_sysad_13.qx 11/8/99 10:40 AM Page 565


tance (site, domain, and organizational unit—SDOU) to administer group policies. Customize group policy and its use to meet the requirements of your organization. Finally, try to keep the group policy design simple to resolve issues efficiently and effectively.

FAQs Q: With what object types can group policies be associated? A: Sites, domains, and organizational units. This grouping is also known as SDOU.

Q: If a user configuration policy and a computer configuration policy are assigned and they conflict, which policy is overridden?

A: When these two types of configurations are used and they conflict, the user configuration will always override the computer configuration.

Q: In what order are group policy objects applied? A: When policies are applied in Active Directory, the object closest to the computer or user will be applied first. In other words, if a user logs on the network and has two conflicting policies applied at different containers; the closest policy within the Active Directory structure will override the other.

Q: If block policy inheritance and No Override are set up on a set of policies, which option takes precedence?

A: Although block policy inheritance is used to prevent a policy from affecting a child container from a policy set up at a parent, the No Override option is used to prevent this. These options must be used carefully, because they can quickly complicate the deployment and troubleshooting of group policies.

565

74_sysad_13.qx 11/8/99 10:40 AM Page 566

566


Q: What can be done to reduce the time it takes to process group policies?

A: Keep the number and associations with group policies to a minimum. Remember that when a policy object is processed, Active Directory must scan all the site, domain, and organizational objects, starting from the top of the tree. Do not use policies that cross domains.

74_sysad_14.qx 11/8/99 11:24 AM Page 567

Chapter 14

Managing User Environments Using Group Policy


Introduction to Managing User Environments

■

Types of Group Policy for Managing User Environments

■

Using Administrative Templates

■

Using Scripts

■

Folder Redirection

567

74_sysad_14.qx 11/8/99 11:24 AM Page 568

568

Chapter 14 • Managing User Environments Using Group Policy

Introduction to Managing User Environments The use of Group Policy to manage user environments effectively is one of Microsoft’s key strategies to help reduce the Total Cost of Ownership (TCO) that organizations incur with regards to personal computer systems. Group Policy is used to specify settings for users and their computer environment. The settings that are controlled by Group Policy include security settings, software installation and maintenance, registry-based policy settings, folder redirection, and the scripts that are implemented for groups of users and computers. This chapter concentrates on controlling the user environment using registry settings and various types of scripts. To manage software installation and maintenance using Group Policy please see Chapter 15, “Managing Software Using Group Policy,” and for security settings see Chapter 17, “Implementing Security in the Windows 2000 Network.” Managing the user environment is not a new item being introduced with Windows 2000; Windows NT 4.0 provided the capability to manage user environments using the System Policy Editor. However, a downfall of the settings made using the System Policy Editor in Windows NT 4.0 was that the policies were persistent. In other words, once a policy was put in place, it stayed in place until the policy was changed or edited in the registry by the user. In Windows 2000, Group Policy is applied by default every 90 minutes to all users and computers, except for domain controllers where the default is every 5 minutes. Group Policy in Windows 2000 takes advantage of the Active Directory, and the Group Policy settings are stored in the Group Policy Objects that are associated with different Active Directory containers such as sites, domains, and organizational units (OUs). In order to set Group Policy for an object in the Active Directory, several prerequisites must be met. A Windows 2000 domain controller must be present and you must have read and write permissions to the system volume of the domain controller, and modify

74_sysad_14.qx 11/8/99 11:24 AM Page 569

Managing User Environments Using Group Policy • Chapter 14

permission to the directory object you want to modify. The system volume is created automatically by Windows 2000 when it is installed as a domain controller.

Types of Group Policy for Managing User Environments There are two parent nodes located at the root of the Group Policy snap-in (discussed in the next section), User Configuration and Computer Configuration. Within these items is where you configure specific desktop environments and enforce policy settings on computers and users. Included in the User Configuration settings are the policies related to application settings, operating system behavior, security settings, desktop settings, user logon and logoff scripts, and folder redirection. These settings are applied when users log on to the computer. Included in the Computer Configuration settings are the policies related to application settings, operating system behavior, security settings, desktop behavior, and computer startup and shutdown scripts. As briefly mentioned in the last section, there are several different extensions to Group Policy available for managing user environments. Table 14.1 shows the extensions available to the Group Policy snap-in to perform the different types of Group Policy available in Windows 2000. These extensions are available, as applicable, in the User Configuration and Computer Configuration parent nodes.

Table 14.1

Extensions Available to the Group Policy MMC Snap-In

Extension

Description

Administrative Templates

Used to mandate registry settings for the look and behavior of the user's desktop environment. Covered in-depth later in the chapter. Continued

569

74_sysad_14.qx 11/8/99 11:24 AM Page 570

570


Extension

Description

Scripts

Used to automate computer startup, computer shutdown, user logon, and user logoff. Windows Scripting Host can be used in the scripts by using Visual Basic Scripting Edition (VBScript) and Microsoft JScript. Covered indepth later in the chapter.

Folder Redirection

Permits you to redirect special folders to the network. Covered in-depth later in the chapter. Used to define security configuration for computers within a Group Policy Object. Used to centrally manage software for your organization.

Security Settings Software Installation

Group Policy Snap-In for the Microsoft Management Console Group Policy is managed using the Group Policy snap-in for the Microsoft Management Console (MMC) shown in Figure 14.1. Windows 2000 has several different methods available to control Group Policy. As shown in Figure 14.1, Group Policy may be applied to the Local Computer using a custom console. You can also use a custom console to configure the Default Domain Policy. There are several steps necessary in order to create a custom console for either Local Computer Policy or Default Domain Policy. The following steps illustrate how to configure an MMC custom console for Group Policy. 1.

Log on to the server as an Administrator.

2.

Click START, and choose Run….

3.

Type mmc in the Run dialog box, and click OK.

4.

Click the Console menu and select Add/Remove Snap-in….

5.

Click ADD….

6.

Select Group Policy from the Available Standalone Snap-ins list box.

7.

Click ADD….

74_sysad_14.qx 11/8/99 11:24 AM Page 571


Figure 14.1

Group Policy for the Local Computer using a custom console.

8.

At this point, you can accept the default Local Computer Policy or click BROWSE to select Default Domain Policy as shown in Figure 14.2.

9.

Click FINISH after selecting the Group Policy you want.

10.

Click CLOSE.

11.

Click OK. The policy you selected is now available in the left pane of the MMC.

The Default Domain Policy can also be configured using two preconfigured MMC snap-ins, Active Directory Users and Computers and Active Directory Sites and Services. To manipulate the Default Domain Policy using the Active Directory Users and Computers MMC snap-in, right-click on the domain, choose Properties, and select the Group Policy tab as shown in Figure 14.3. To bring up a console window in which you can modify the policies, click EDIT.

571

74_sysad_14.qx 11/8/99 11:24 AM Page 572

572


Figure 14.2

Selecting the Default Domain Policy as the Group Policy Object.

Figure 14.3

Group Policy tab accessed from the Active Directory Users and Computers snap-in.

74_sysad_14.qx 11/8/99 11:24 AM Page 573


Using Administrative Templates Administrative templates, files with the extension .adm, are used in Windows 2000 to identify the registry settings that you can modify using the Group Policy snap-in. Windows NT 4.0 also used .adm files that were modified using the System Policy Editor. The .adm files used in Windows 2000 are similar to those used in Windows NT 4.0 in that they are ASCII files that are format compatible between the two operating systems. All .adm files consist of a hierarchy of categories and subcategories that define how the options are displayed in the Group Policy snap-in of MMC. Here is an extremely small section of the system.adm file included with Windows 2000 Server. CLASS MACHINE CATEGORY !!AdministrativeServices POLICY !!NoSecurityMenu KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" EXPLAIN !!NoSecurityMenu_Help VALUENAME "NoNTSecurity" END POLICY POLICY !!NoDisconnectMenu KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" EXPLAIN !!NoDisconnectMenu_Help VALUENAME "NoDisconnect" END POLICY POLICY !!DisableStatusMessages KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\System" EXPLAIN !!DisableStatusMessages_Help VALUENAME "DisableStatusMessages" END POLICY

573

74_sysad_14.qx 11/8/99 11:24 AM Page 574

574

Chapter 14 • Managing User Environments Using Group Policy POLICY !!VerboseStatus KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\System" EXPLAIN !!VerboseStatus_Help VALUENAME "VerboseStatus" END POLICY


.adm Files

Microsoft recommends that you do not use .adm files from Windows NT 4.0 on Windows 2000 clients because the registry keys may not match, so the effect will not be what you expect. It is also possible that if the registry keys do match, it may lead to registry settings that are persistent. Another item to note is that the .adm files that ship with Windows 2000 have more options available than was present in the Windows NT 4.0 .adm files.

There are two locations that Administrative Templates in Windows 2000 write to. The settings that apply to the Computer Configuration write to the HKEY_LOCAL_MACHINE section of the registry, and the settings that apply to User Configuration write to the HKEY_CURRENT_USER section of the registry. Figure 14.4 displays the items available in the Administrative Templates for Computer Configuration. The items include settings for Windows Components, System, Network, and Printers. The file used for Figure 14.5 displays the numerous items available in the Administrative Templates for User Configuration. The items include settings for Windows Components, Desktop, Control Panel, Network, and System.

74_sysad_14.qx 11/8/99 11:24 AM Page 575


Figure 14.4

Administrative Templates available in the Computer Configuration section of the Default Domain Policy.

Figures 14.4 and 14.5 show the items available in the default Administrative Templates that ship with Windows 2000. The items that make up both of these Administrative Templates are contained in the files system.adm and inetres.adm. Both files contain sections that are in the User Configuration and Computer Configuration.

575

74_sysad_14.qx 11/8/99 11:24 AM Page 576

576


Figure 14.5

Administrative Templates available in the User Configuration section of the Default Domain Policy.

Assigning Registry-Based Policies Assigning registry-based policies means using the Group Policy MMC snap-in. For example, you have decided that you want a policy in your domain that states everyone will use a screensaver and that it will be password protected. You could draft a memo and distribute it to your users, but how many of them would actually implement your request? You can accomplish the same goal using Group Policy

74_sysad_14.qx 11/8/99 11:24 AM Page 577


to make sure that it is accomplished throughout your domain! The following steps illustrate configuring the password-protected screensaver for your Windows 2000 clients. 1.

Log on to the server as Administrator.

2.

Click START, choose Programs/Administrative Tools/Active Directory Users and Computers.

3.

Right-click on your domain and choose Properties.

4.

Select the Group Policy tab.

5.

Highlight Default Domain Policy, and click EDIT.

6.

Click the + located to the left of User Configuration.

7.

Click the + located to the left of Administrative Templates.

8.

Click the + located to the left of Control Panel.

9.

Select the Display folder. In the right pane you now see several parameters that can be set for the Default Domain Policy in regard to Display items.

10.

Double-click the “Screen saver executable name” text located in the right pane. The window, as shown in Figure 14.6, is the location that you enable this policy for the domain.

11.

Select the ENABLED radio button and type logon.scr in the “Screen saver executable name” dialog box.

12.

Select the Explain tab. As shown in Figure 14.7, an explanation is given for the topic chosen. Make it a habit to check the Explain tab prior to implementing a change in domain policy for a production network to ensure you are accomplishing what you really are trying to accomplish.

13.

Click OK.

14.

Double-click the “Password protect the screensaver” text located in the right pane.

15.

Click the ENABLED radio button to enable this policy.

16.

Click OK.

17.

You have now enabled these two policies in your domain. as shown in Figure 14.8. It is important to note that policies take effect as soon as they are enabled.

577

74_sysad_14.qx 11/8/99 11:24 AM Page 578

578


Figure 14.6

Policy tab for the “Screen saver executable name” Properties window.

Figure 14.7

Explain tab for the “Screen saver executable name” Properties window.

74_sysad_14.qx 11/8/99 11:24 AM Page 579


Figure 14.8

Two Display Policies Enabled for the Default Domain Policy.

Creating Custom Administrative Templates You may encounter situations where the choices presented in the Administrative Templates provided with Windows 2000 do not suit your needs. What do you do then? Are you stuck with the choices that Microsoft has provided? Of course not! You can create your own .adm files to fulfill your needs. An .adm file, as we saw earlier, specifies registry settings that take place in Group Policy. The three main attributes for an .adm fileare: specifying registry locations in which changes are to be made if you make that selection; specifying any options or restrictions that are associated with the selection; and specifying a default value to use if the selection is activated. There are several components that make up an .adm file. Recall that, at the beginning of the "Using Administrative Templates"

579

74_sysad_14.qx 11/8/99 11:24 AM Page 580

580


section of the chapter, a small section of the system.adm file is presented. Each portion of that text has a purpose as shown in Table 14.2.

Table 14.2

Components Utilized in .adm Files

Component

Description

STRING

String variables are used in .adm files to define text strings for the user interface. String variables can be used for CATEGORY, POLICY, PART, and DEFAULT. You assign the variable name to the component by preceding it with two exclamation points (!!). component !!variable

where component is CATEGORY, POLICY, PART, or DEFAULT, and variable is the variable you want to use for a given string. Then, in the [strings] section of the file, link the variable with the actual string to be used in the user interface. The string must be enclosed in quotation marks and names with spaces must be enclosed by double quotation marks. For example, the following is an excerpt from the system.adm file: [strings] ABCDOnly="Restrict A, B, C and D drives only" ABConly="Restrict A, B and C drives only" ABOnly="Restrict A and B drives only" ActiveDesktop="Active Desktop" ActiveDirectory="Active Directory"

CLASS

The first entry you make in an .adm file must be CLASS xxxx, where xxxx can be one of the following: MACHINE: Entries found in the Computer Configuration node of Group Policy. User: Entries found in the Computer Configuration node of Group Policy. Machine and User are the only two valid classes within an .adm file. The Group Policy MMC snap-in ignores non-valid classes. Continued

74_sysad_14.qx 11/8/99 11:24 AM Page 581


Component

Description The valid keywords for CLASS are

CATEGORY

CLASS CATEGORY [STRINGS] USER MACHINE The category name is displayed in the left pane of Group Policy as a node in either the Computer Configuration or the User Configuration node, depending on whether it is defined under the MACHINE class or the USER class. The CATEGORY syntax is as follows: CATEGORY !!"variable name" [KEYNAME "key name"] [... policy definition statements ...] END CATEGORY

The variable name is the category name as it appears in the Group Policy list box. All names with spaces must be enclosed by double quotation marks. The key name is the registry key name to use for the category. All names with spaces must be enclosed by double quotation marks. A policy definition statement cannot appear more than once in a single category. End Category is used to close the category after you finish filling in the options. The valid keywords for CATEGORY are: KEYNAME CATEGORY POLICY END POLICY

To identify the policy that the user can modify, you use the keyword POLICY: POLICY !!MyPolicy ...fill in all the policy specifics ...and then finish with: END POLICY Continued

581

74_sysad_14.qx 11/8/99 11:24 AM Page 582

582


Component

Description It is possible for you to use multiple POLICY key names under one KEYNAME.

EXPLAIN

PART

The valid keywords for POLICY are: KEYNAME VALUENAME PART VALUEON VALUEOFF ACTIONLISTON ACTIONLISTOFF END HELP CLIENTEXT POLICY The CATEGORY syntax is as follows: The EXPLAIN keyword is used to provide Help text. Each policy must include one EXPLAIN keyword that has at least one space after it, followed by either the explain string in quotation marks or a reference to the explain string. You use PART to specify various options, including drop-down list boxes, text boxes, and text in the lower pane of the Group Policy snap-in. The syntax for PART is: PART [!!]name PartType type-dependent data [KEYNAME KeyName ] VALUENAME ValueName END PART

The text that is located in name is the part name as you want it to appear in the Group Policy list box. If you use names with spaces, then they must be enclosed by double quotation marks. PartType is the policy part flags. They are discussed later in this section as a separate entity. type-dependent data is information about the part. Continued

74_sysad_14.qx 11/8/99 11:24 AM Page 583


Component

Description The use of KeyName is the optional. If you do not specify a key name, then the previous key name in the hierarchy is used.

PartTypes

The ValueName is used to set the data for this part. The valid keywords for PART are: CHECKBOX TEXT EDITTEXT NUMERIC COMBOBOX DROPDOWNLIST LISTBOX END CLIENTEXT PART The ADM language allows .adm files to be created that use VALUENAME of REG_DWORD type with a value of 1, or else it removes the value entirely. However, it is also possible to use the following modifiers to provide additional options. TEXT Displays a line of text. This is useful if you need to display a description. END is the only valid keyword for TEXT. EDITTEXT Displays a field that accepts alphanumeric text. There are several EDITTEXT part type values available: DEFAULT value Used to specify the initial string to place in the field. The field is empty if it is not specified. MAXLEN value The maximum length of a string. REQUIRED A value must be entered for this part or else Group Policy will not allow the policy to be enabled. Continued

583

74_sysad_14.qx 11/8/99 11:24 AM Page 584

584


Component

Description OEMCONVERT

NUMERIC

Sets the ES_OEMCONVERT style so that all text typed in the field is mapped from ANSI to OEM and back to ANSI. The valid keywords for EDITTEXT are: KEYNAME VALUENAME DEFAULT REQUIRED MAXLENGTH OEMCONVERT END EXPANDABLETEXT CLIENTEXT Displays a field that accepts a numeric value. It also can have an optional spinner control if you desire. The value is set in the registry using the REG_DWORD type. NUMERIC has the following options available: DEFAULT value Used to specify the initial numeric value to place in the field. The field is empty if it is not specified. MAX value Specifies the maximum value for the number. It defaults to 9999. MIN value Specifies the minimum value for the number. It defaults to 0. REQUIRED A value must be entered for this part or else Group Policy will not allow the policy to be enabled. SPIN value Specifies the increments to use for the spinner control. SPIN 0 Removes the spinner control from the item. It defaults to SPIN 1. Continued

74_sysad_14.qx 11/8/99 11:24 AM Page 585


Component

Description TXTCONVERT Writes values as REG_SZ strings ("1," "2," or "128") instead of binary values. The valid keywords for NUMERIC are: KEYNAME VALUENAME MIN MAX SPIN DEFAULT REQUIRED TXTCONVERT END CLIENTEXT

Adding Administrative Templates Customized Administrative Templates files must be added to Group Policy before you can use their features. It is very easy to add custom .adm files to Group Policy. The following steps outline the process. 1.

Log on your server as Administrator.

2.

Open the Group Policy object that you want to add the .adm file to.

3.

Right-click on the Administrative Templates node.

4.

Select Add/Remove Templates….

5.

Click ADD….

6.

Navigate to the .adm file that you want to add, highlight it, and click OPEN.

7.

The file you selected is now displayed in the Add/Remove Templates window. Click CLOSE.

8.

The information from the .adm file is now available in the Administrative Templates node.

585

74_sysad_14.qx 11/8/99 11:24 AM Page 586

586


Group Policy in Windows 2000 knows if you try to add a Windows NT 4.0 .adm file. It will accept the file, but it will show up as an Unsupported Administrative Template as shown in Figure 14.9. Unwanted .adm files can be removed from Group Policy using Add/Remove Templates.

Figure 14.9

Unsupported Administrative Templates in the Computer Configuration Policy.

Using Scripts Scripts are used to manage User environments. Windows NT has always used scripts for logon, but they were somewhat limited in their functionality. This has drastically changed in Windows 2000. Windows 2000 provides support for the following scripts: ■

Computer Startup

■

Computer Shutdown

74_sysad_14.qx 11/8/99 11:24 AM Page 587

Managing User Environments Using Group Policy • Chapter 14 ■

User Logon

■

User Logoff

The scripts you use in Windows 2000 are not limited in functionality as they were in earlier versions of Windows NT. Windows 2000 scripts are supported by Windows Scripting Host (WSH). WSH includes support for both Visual Basic Scripting Edition (VBScript) and JScript scripts. Simply put, you can now use VBScript or JScript in the scripts assigned to users and computers. However, you may still use .bat and .cmd files if you wish. Computer Startup scripts run after the computer has initialized network connections, and Computer Shutdown scripts run prior to terminating network connections. Since the Computer Startup/ Shutdown scripts function in this manner, you can have those two scripts access network resources if necessary. User Logon scripts execute after the Computer Startup scripts, and User Logoff scripts execute prior to the Computer Shutdown scripts. Computer Startup scripts and Computer Shutdown scripts are run in the context of the Local System account. User Logon scripts and User Logoff scripts are run in the context of the User. Keep this in mind when developing your scripts to ensure the proper permissions are available to perform the actions you need to perform. There are several items that can be configured with regard to scripts in the Logon node of Computer Configuration as shown in Figure 14.10, and also in the Logon/Logoff node of User Configuration. These items include choices to run scripts synchronously or asynchronously, run scripts visible, and run legacy scripts hidden.

587

74_sysad_14.qx 11/8/99 11:24 AM Page 588

588


Figure 14.10 Available settings during logon for various scripts.

Assigning Script Policies to Users and Computers Adding scripts to users and computers is accomplished from the Windows Settings node of the Group Policy object you choose. Refer back to Figure 14.10 to see the Startup/Shutdown Scripts selection in the Windows Settings node of Computer Configuration, and the Logon/Logoff Scripts selection in the Windows Settings node of User Configuration.

74_sysad_14.qx 11/8/99 11:24 AM Page 589


Adding scripts is the same for all script types, so we will only examine adding a script to the Startup object of the Computer Configuration portion of Group Policy. 1.

Log on to the server as Administrator.

2.

Open the Group Policy MMC snap-in.

3.

Click the + located to the left of Computer Configuration.

4.

Click the + located to the left of Windows Settings.

5.

Highlight Scripts in the left pane.

6.

In the right pane, click Startup, and choose Properties from the menu.

7.

Click ADD….

8.

In the Script Name: dialog box, type start.vbs.

9.

Click OK.

10.

Click ADD….

11.

In the Script Name: dialog box, type startup.bat.

12.

Click OK.

13.

Click OK.

You have now configured two scripts to start up when the computer is first powered up as shown in Figure 14.11. Of course, the scripts do not exist, so no actions will take place when the system is powered up. The purpose in adding multiple files is to illustrate that Windows 2000 can process multiple scripts. The scripts are processed in the order they are listed. You may change the order by using UP and DOWN located in the Scripts Properties window. It is also possible to apply parameters to the scripts. The parameters include any item that you would type on the command line. For example, if you normally run the script from the command line using the /I (interactive) switch, then place /I in the Parameters field of your script.

589

74_sysad_14.qx 11/8/99 11:24 AM Page 590

590


Figure 14.11 Adding multiple scripts to the Startup Properties.

Folder Redirection Folder Redirection allows you to redirect several folders located in a user profile to another location such as a network share. The folders are Application Data, Start Menu, My Documents, My Pictures, and Desktop. Why would you want to redirect users' folders away from their normal location? Let’s look at an example and see what benefits may be gained from the folder redirection. Imagine that you decide to redirect a user’s My Documents folders to \\sdc01\usersmydocs\%username%. This action ensures that the user’s documents are available if he or she roams from one computer to another. It also allows the documents to be backed up since they are located on the server instead of just being stored on the user’s machine that may not be backed up regularly. A third benefit of Folder Redirection is that the user’s My Documents folder is available using Offline Folders for those times when the user is disconnected from the network.

74_sysad_14.qx 11/8/99 11:24 AM Page 591


Using Folder Redirection is accomplished from the User Configuration node. The following steps illustrate how to redirect folders for your users. 1.

Log on the server as Administrator.

2.

Open the Group Policy MMC snap-in.

3.

Click the + located to the left of User Configuration.

4.

Click the + located to the left of Folder Redirection.

5.

Right-click the Desktop folder.

6.

In the Target tab, select Basic in the Setting: dialog box. This redirects everyone’s folder to the same location. Other choices available to you are Advanced and “No administrative policy specified” as shown in Figure 14.12.

Figure 14.12 Target tab for the Desktop Properties of Redirected Folders.

7.

Type \\sdc01\users\%username%\Desktop in the dialog box to reflect the location where everyone’s folders will be stored.

591

74_sysad_14.qx 11/8/99 11:24 AM Page 592

592


8.

Select the Settings tab, and select “Grant the user exclusive rights to the Desktop.” Move the contents of Desktop to the new location, and leave the folder in the new location when policy is removed, as shown in Figure 14.13.

9.

Click OK. Folder Redirection is now configured for the Desktop folder.

Figure 14.13 Settings tab for the Desktop Properties of Redirected Folders.

Be very careful with the choices you select on the Settings tab of Folder Redirection. It is possible for contents of the folder to be no longer visible to the user if the Redirection Policy specifies that the folder be redirected back to the local user profile location upon policy removal, but does not specify that the contents be moved during redirection. In this instance, the user's files remain at the location that was specified when the policy was still in effect.

74_sysad_14.qx 11/8/99 11:24 AM Page 593


FAQs Q: How are policies processed during the startup of the computer and during user logon?

A: Computer Group Policy is applied prior to the Startup scripts being processed. After the user is validated by the system, the user profile is loaded. At this point, User Group Policy is applied and then the logon scripts are processed.

Q: Is Group Policy only applied during the startup of the computer and user logon?

A: No, Group Policy is applied every 90 minutes for all users and computers, with the exception of domain controllers. The default is every 5 minutes for domain controllers. Setting a Group Policy in the Administrative Templates node can change the defaults.

Q: Can Group Policies be pushed out to users? A: No, Group Policies cannot be pushed to clients or scheduled. The exceptions to this rule are for Folder Redirection and Software Installation.

Q: What is a .adm file? A: A .adm file is an ASCII file that is used to set registry settings using the Administrative Templates node of the Group Policy MMC snap-in. The format of the .adm file uses a set of components that are interpreted by the Group Policy snap-in. The structure of .adm files is the same for Windows 2000 and Windows NT 4.0; however, care must be taken when using .adm files from Windows NT 4.0 in the Windows 2000 environment.

593

74_sysad_14.qx 11/8/99 11:24 AM Page 594

594


Q: Do User Profile settings override Group Policies? A: No, Group Polices override User Profile settings.

74_sysad_15.qx 11/8/99 10:48 AM Page 595

Chapter 15

Managing Software by Using Group Policy


Deploying Software

■

Creating Software Packages

■

Maintaining Software

■

Removing Software

595

74_sysad_15.qx 11/8/99 10:48 AM Page 596

596

Chapter 15 • Managing Software by Using Group Policy

Introduction This chapter focuses on one of the new features of software installation and Group Policy with Windows 2000. Group Policy, much like the Windows NT 4.0 System Policy Editor, is a way to define configurations for users and computers in your Windows 2000 domain. Group Policies enable you to restrict access, manage computer configurations, and control users' desktops and their environment. Group Policy is also used to determine which groups of users or computers receive software packages. One of the most exciting features of Windows 2000 is the ability to deploy, manage, upgrade, and remove software packages with the Software Installation snapin for the Microsoft Management Console (MMC). You can create software packages, or you can use packages that are designed for the Windows 2000 Installer. You have full control over deploying these packages in an easy-to-use interface that is built right into Windows 2000, without the need to purchase and integrate expensive third-party software installation and management utilities.

Introduction to Managing Software Deployment As computers continue to become dominant in large organizations with one (or more) computer on each desktop, they are increasingly difficult to manage. More technicians are required in order to install, maintain, and troubleshoot these computers, which comes at a high cost for companies and organizations. The Total Cost of Ownership (TCO) is far greater than the price of the actual computer. Companies need to factor in the cost for software, upgrades, maintenance, and technical support. In order to lower TCO, many companies are looking into software programs from Microsoft and third-party vendors to allow remote software deployment. This can dramatically decrease the cost and the number of hours a technician would normally be required to visit the workstation.

74_sysad_15.qx 11/8/99 10:48 AM Page 597

Managing Software by Using Group Policy • Chapter 15

With these programs, you can choose the software you would like to install, choose the computers that will receive the software, update the software, and even remove the software. All of these options can be scheduled to run during nonbusiness hours. All it takes is a skilled software deployment technician and the right software; in this case, Microsoft’s Group Policy.

Deploying Software The first step of software installation on remote computers using Microsoft’s Group Policy is deploying the software. You need to determine whether the software will be assigned or published. ■

Published software is optional, and users can browse the available software and determine if they need the application.

■

Assigned software is software that a user is required to have on his or her computer, such as a service pack or operating system upgrade. If the application is assigned, it will be installed automatically.

When you publish software, it will be listed in the Add/Remove Programs applet in the Control Panel. With published software, unlike assigned software, the user will not be forced to install the software. The software will not automatically be installed unless a user clicks on a file that is associated with the software. In this case, you are telling the computer you would like to have this application installed to view the file that is associated with the software. For example, if you do not have Microsoft Word installed, but you click on a Word document (.doc) that a coworker sent you, Windows 2000 will then install Microsoft Word (if it is in the list of published applications) so you can view this document. The user can also remove the published software at any time. If the published application is removed, the user can install it at anytime in the future using the Add/Remove Programs applet, provided the software is still being published.

597

74_sysad_15.qx 11/8/99 10:48 AM Page 598

598


When you assign software to a user, in contrast to a computer, it will be available for the user as a Start menu shortcut, Desktop shortcut, or from the Add/Remove Programs applet in the Control Panel. After the Administrator assigns the software, it will be available for the user to install at the next logon. If a user does not install the software, but clicks on a file that is associated with the software, the software will automatically be installed. The user can remove the assigned software, but it will reappear from the install point where it was originally offered at the next logon. When you assign software to a computer, in contrast to a user, it will be installed the next time the computer reboots. This means the user will not have to install the software, and it will not be offered as a Start menu shortcut, Desktop shortcut, or from the Add/Remove Programs applet in the Control Panel. However, it will create a shortcut to the application like every program does. This is not to be confused with the shortcut to install the program. The user cannot remove the software; only an Administrator can. Before you begin installing and maintaining your software, you should have your Group Policy in order. Group Policy is used to define user and computer configurations to restrict access to resources, enforce desktop settings, and control the users’ work environment. These policy settings are stored in Group Policy Objects (GPOs). These GPOs are created using the Group Policy snap-in for the MMC, and can be used as a stand-alone tool or as an extension to the Active Directory snap-ins. Group Policy uses Administrative Templates in the form of .adm files that determine the Registry settings that can be modified. In Windows 2000, these Administrative Templates can be modified in the Group Policy snap-in user interface. The .adm files are text files that contain the Registry information to modify the computer’s Registry, which includes restrictions or default values. Just like Windows NT 4.0 system policies, you have separate settings for users and computers. The computer configuration consists of settings such as operating system behavior, the desktop, Startup and Shutdown scripts, security settings, and application settings. These settings will affect every user who logs on to this computer.

74_sysad_15.qx 11/8/99 10:48 AM Page 599


They are stored in the HKEY_LOCAL_MACHINE (HKLM) portion of the Registry. User configuration consists of user-related policies such as logon and logoff scripts, assigned and published applications, and folder redirection options. They are stored in the HKEY_CURRENT_USER (HKCU) portion of the Registry. With your Group Policy in order, it is time to begin deploying software. We will continue with the creation of software packages.

Creating Software Packages Software installation and maintenance is made easier with the new Windows Installer, which standardizes the way applications are installed on multiple computers. Using the Windows Installer will allow you to take advantage of new program installation features, such as the ability to roll back an unsuccessful install. Using programs that are compliant with the new Windows Installer makes them easier to package. You can also be more comfortable that the program will install correctly. Using applications that are compliant with Windows 2000 offers a much greater benefit than noncompliant applications. Microsoft lists the following regulations for compliance: ■

Application-specific .dll files are placed in the Application folder.

■

Applications do not overwrite system .dll files.

■

Applications only write to their own areas of the Registry, and will not modify existing keys of the Registry.

■

System .dll files can only be updated by installing a service pack.

■

Users do not need permission from the local Administrator to install applications.

This addresses several issues that plagued network Administrators in the past with .dll problems, such as a .dll being overwritten by an older application. Using the Windows Installer ensures that applications will adhere to the Windows Installer

599

74_sysad_15.qx 11/8/99 10:48 AM Page 600

600


format, which means Windows 2000 will install the application on the application’s behalf, therefore creating a uniform installation routine. A Windows Installer package will have the extension .MSI, and will be located in the root of the source, whether that source is the uncompressed files, or files compressed in a cabinet (.cab) format. Windows Installer can install applications in one of four states: ■

Installed on the local hard drive, which installs the files needed on the local computer.

■

Installed to run from a server, either on the server hard disk or shared CD-ROM.

■

Advertised, which means they exist on the source but can be installed on the local hard drive at any time.

■

Not installed, which means no files will be copied.

Another feature of Windows Installer is the ability to add components of a program later that were not selected in the first run of setup. This is possible with non-Windows Installer applications, but you have to rerun the setup program; with Windows Installer, you do not. This means all features of the product are available, even if they are not installed. This is referred to as feature-level advertisement. Windows Installer can also perform checks of the program installation and make repairs if needed. When an application calls the Windows Installer service, the service will automatically check for components that have been installed on the machine. Next, the Windows Installer service will check that all components are correctly installed. If the component is corrupt, a repair will be performed. If during an application install using Windows Installer, the application is not correctly installed, you can return to a working state before the application was installed. This is very important because many times application installs that don’t finish correctly can often leave the computer in an unstable state. Another reason this is important is because a user may be installing the application, encounter problems, and can then return to a working state

74_sysad_15.qx 11/8/99 10:48 AM Page 601


without any technical intervention by support personnel. This will eliminate downtime if the user rolls back the installation until a later time when technical support can be present. However, the installation cannot be rolled back once it has successfully completed; it must be uninstalled. Another feature of the Windows Installer is the ability to “patch” applications, and to keep this patch cached on the computer that received the patch. Before this, you would have to apply the patch each time you installed a component that required the original source files. Whenever the Windows Installer service needs to be invoked, it will verify that the application’s core files are not corrupt or missing. If these files are missing or corrupt, the Windows Installer service will apply the patch that has been cached on the computer. The “Designed for Microsoft Windows” logo will ensure that applications use the standards for Windows Installer in order to be compliant.

Creating a Non-Windows Installer Package File If you are not using programs that are Windows Installer compatible, they can still be packaged. Before this program can be used for installation and maintenance, it will have to be packaged into a .zap file. These are text files that are similar to .INI files that describe how to install the program, and the properties of the program. The finished .zap file is stored in the same directory as the program that contains the setup file for that program. The following is an example of a .zap file provided by Microsoft. Notice the underscore (_) symbol, which indicates the line should be continued, but has been wrapped to the next line. ; ZAP file for Microsoft Excel 97 [Application] ; Only FriendlyName and SetupCommand are required, ; everything else is optional

601

74_sysad_15.qx 11/8/99 10:48 AM Page 602

602

Chapter 15 • Managing Software by Using Group Policy ; FriendlyName is the name of the application that ; will appear in the software installation snapin ; and the add/remove programs control panel. ; REQUIRED FriendlyName = "Microsoft Excel 97" ; SetupCommand is the command line that we use to ; Run the applications setup. if it is a relative ; path, it is assumed to be relative to the ; location of the ZAP file. ; Long file name paths need to be quoted. For example: ; SetupCommand = "long folder\setup.exe" /unattend ; or ; SetupCommand = "\\server\share\long _ ; folder\setup.exe" /unattend ; REQUIRED SetupCommand = setup.exe ; Version of the application that will appear ; in the software installation snapin and the ; add/remove programs control panel. ; OPTIONAL DisplayVersion = 8.0 ; Version of the application that will appear ; in the software installation snapin and the ; add/remove programs control panel. ; OPTIONAL Publisher = Microsoft ; URL for application information that will appear ; in the software installation snapin and the ; add/remove programs control panel.; ; OPTIONAL URL = http://www.microsoft.com/office ; Language for the app, in this case US English. ; OPTIONAL LCID = 1033

74_sysad_15.qx 11/8/99 10:48 AM Page 603

Managing Software by Using Group Policy • Chapter 15 ; Architecture, in this case, intel. ; OPTIONAL Architecture = intel ; the [ext] [CLSIDs] and [progIDs] sections are ; all optional [ext] ; File extensions that this application will ; "auto-install" for. They are not required if you ; do not want the application. This entire section ; is OPTIONAL. ; note you can put a dot in front or not, as you like ; text after the first = is optional and ignored ; but the first = is required (or the whole line ; will be ignored) XLS= XLA= XLB= XLC= XLM= XLV= XLW= [CLSIDs] ; CLSIDs that this application will "auto-install" ; for. This entire section is OPTIONAL. ; Format is CLSID with LocalServer32, ; InprocServer32, and/or InprocHandler32 (in a ; comma separated list) after the =. {00024500-0000-0000-C000-000000000046}=LocalServer32 {00020821-0000-0000-C000-000000000046}=LocalServer32 {00020811-0000-0000-C000-000000000046}=LocalServer32 {00020810-0000-0000-C000-000000000046}=LocalServer32 {00020820-0000-0000-C000-000000000046}=LocalServer32

603

74_sysad_15.qx 11/8/99 10:48 AM Page 604

604

Chapter 15 • Managing Software by Using Group Policy [progIDs] ; progIDs that this application will "auto-install" ; for. This entire section is OPTIONAL. ; format is a CLSID, with the corresponding progid ; listed after the = sign {00024500-0000-0000-C000- _ 000000000046}=Excel.Application {00024500-0000-0000-C000- _ 000000000046}=Excel.Application.8 {00020821-0000-0000-C000-000000000046}=Excel.Chart {00020811-0000-0000-C000-000000000046}=Excel.Chart.5 {00020821-0000-0000-C000-000000000046}=Excel.Chart.8 {00020810-0000-0000-C000-000000000046}=Excel.Sheet.5 {00020820-0000-0000-C000-000000000046}=Excel.Sheet.8 {00020820-0000-0000-C000-000000000046}=Excel.Sheet {00020820-0000-0000-C000-000000000046}=Excel.Template {00020820-0000-0000-C000-000000000046}=Excel.Workspace

With all of the software packages you have created, you will need to specify a distribution point on the network. This will include Windows Installer packages, ZAP files, and the files needed for the program to install. You will need to create this software distribution point by creating the network share, the appropriate folders, copying the packages and executables to the folder, and then setting the permissions on the folder. Users should have the Read permission, and Administrators should have the Full Control permission. We will be using this newly created Excel 97 ZAP file in a future exercise. It is helpful if you place this ZAP file in a network share with the permissions we described in the previous section. We will be using a network share called “Distribution” that will contain this ZAP file and the source files necessary to install Microsoft Excel 97.

74_sysad_15.qx 11/8/99 10:48 AM Page 605


Managing Software Windows Installer features a management Application Programming Interface (API) called the Management API that manages software on the local computer. This API provides the following features: ■

Determining which products, features, and components have been installed on the computer.

■

Determining the path to these products that have been installed.

■

Installing and configuring Windows Installer products.

The Windows Installer service will manage the application on behalf of the application itself, which provides a standard interface for managing software. The most compelling feature of managing software with the Windows Installer is the ability to add components and features to an application without running setup again. This will make it easy for users and Administrators to add components. In the past, it was difficult, even for skilled Administrators to add features to a program such as Microsoft Office, because it was difficult to know what was already installed. For example, when you needed to add the spell-check feature in Word, you would start the Microsoft Office setup program and see checked and unchecked boxes for features. Are these the features that are currently installed, or are these default features that come up every time? It was always difficult to know if you were going to add more features, or remove some based on this. With Windows Installer, users can install features themselves, because they won’t need special access to network shares that contain applications. In Exercise 15.1 we will be adding software with the Software Installation snap-in of the MMC.

Exercise 15.1 Adding the Software Installation Snap-In 1.

Log on to your Windows 2000 Server with Administrative privileges.

605

74_sysad_15.qx 11/8/99 10:48 AM Page 606

606


2.

Click Start, and then Run.

3.

Type mmc, for Microsoft Management Console.

4.

Click OK. Figure 15.1 shows the console with no snap-ins installed.

Figure 15.1

The MMC with no snap-ins.

5.

When the MMC opens, select Add/Remove Snap-in from the Console pull-down menu.

6.

In the Add/Remove Snap-in dialog box, click ADD.

7.

In the Add Standalone Snap-in dialog box, double-click Active Directory Users and Computers, or highlight Active Directory Users and Computers, and click ADD. Figure 15.2 shows the list of available snap-ins.

8.

Click CLOSE to close the Add Standalone Snap-in dialog box.

9.

In the Add/Remove Snap-in dialog box, click OK.

74_sysad_15.qx 11/8/99 10:48 AM Page 607


Figure 15.2

The list of available stand-alone snap-ins for the MMC.

You should now see the MMC with the Active Directory Users and Computers that you just added. You may have to resize the screen and expand the trees to see everything under your domain. Figure 15.3 shows a list of users and groups in the domain. Save the changes to your MMC as follows: 1.

Select Save As from the Console pull-down menu.

2.

In the Save In pull-down menu, find a place to store the console settings. In this example, we are using the WINNT folder.

3.

Name the file if you wish, or accept the default Console1.

4.

Click SAVE.

607

74_sysad_15.qx 11/8/99 10:48 AM Page 608

608


Figure 15.3

A list of users with a domain in MMC.

When you quit the MMC after saving the changes, the next time you open the MMC you will have to select Open from the Console menu and find the console file you saved in the previous exercise. In Exercise 15.2 we will create three users that we will use in following exercises. We will be adding these user accounts to groups, in which the groups will be used to quickly assign software to users contained within the groups.

Exercise 15.2 Creating New Users 1.

In the Software Installation snap-in that we have already created, right-click on the Users folder, which should be located under your domain in Active Directory Users and Computers.

2.

Click New, then User.

74_sysad_15.qx 11/8/99 10:48 AM Page 609


3.

Enter the first and last name of the user. (The Name field will automatically be filled in with the information you supply in the first and last name fields.)

4.

Enter the User logon name. In our case, this is the first initial of the first name, and the full last name. Figure 15.4 shows the creation of a new user.

Figure 15.4

Creating a new user.

5.

Click NEXT.

6.

In the Create New Object dialog box, enter a password for your new user. (We will not be using this password in any of the remaining exercises.)

7.

Confirm the password by typing it again in the Confirm Password field.

8.

Click NEXT.

9.

Click FINISH.

The new user will now be added. Check the Users folder to see if the user account has been created. You may have to refresh the

609

74_sysad_15.qx 11/8/99 10:48 AM Page 610

610


screen in order to see the new user account. Repeat this exercise and create two more user accounts for a total of three user accounts, which will be used in future exercises. In Exercise 15.3, we will create a group that we will use in following exercises. When we are assigning software, we will use this group to assign software to every member of this group.

Exercise 15.3 Creating a Group to Hold User Accounts 1.

In the Software Installation snap-in that we have already created, right-click on your domain, which should be located under Active Directory Users and Computers.

2.

Click New, then Group. Figure 15.5 shows the adding of a new group to a domain.

Figure 15.5

Adding a new group to a domain.

74_sysad_15.qx 11/8/99 10:48 AM Page 611


3.

In the “Name of new group” portion of the Create New Object dialog box, enter the name Support Staff. Figure 15.6 shows the creation of a new group.

Figure 15.6

Creating a new group.

4.

Make sure the Global Group scope and the Security Group type are selected.

5.

Click OK.

The new Support Staff is now created, and will be added to your list of groups that you have created. In order to verify that the group has been added, you can click on your domain under Active Directory Users and Computers. In Exercise 15.4, we will be populating this new Support Staff group with three new members. These members will receive the software that we will be assigning in following examples.

611

74_sysad_15.qx 11/8/99 10:48 AM Page 612

612


Exercise 15.4 Populating a Group with User Accounts 1.

In the right-hand portion of the MMC, double-click the Support Staff group that we have created.

2.

In the Support Staff Properties dialog box, complete the Description of the Support Staff group with a description of your choice.

3.

Complete the E-Mail address with an e-mail address of your choice. (This will not be needed in any future exercises.) Figure 15.7 shows the properties for a group.

Figure 15.7

The Properties page for a group.

4.

Click the Members tab.

5.

Click ADD.

6.

Find the user account in the Name section and double-click to add the account, or highlight the name and click ADD. Figure 15.8 shows the process of adding a user to a group.

74_sysad_15.qx 11/8/99 10:48 AM Page 613


Figure 15.8

Adding users to groups.

7.

When all the users have been added, click OK. You will now see a Properties page that will contain the list of users that you just added.

8.

Click OK to return to the MMC.

Now that we have user and group accounts in place, we can continue our installation and managing of software.

613

74_sysad_15.qx 11/8/99 10:48 AM Page 614

614


For Managers Only

Ensuring Successful Application Deployment in Your Organization

In a large corporation, or a corporation with a large number of applications, there will be a constant need to install, upgrade, maintain, and remove applications. This is basically a full-time job for one or more individuals, and should be approached in this regard. When using Windows 2000 for software deployment, you should have one or more individuals who are highly skilled in order to run an efficient operation of maintaining a complex environment of changing applications. The responsibilities for software deployment include the following: ■

Maintaining a current inventory of all applications installed on each computer

■

Packaging new applications

■

Upgrading packages

■

Repackaging existing applications

■

Removing packages

■

Administering Group Policy (for determining which users and groups receive packages)

■

Testing software installations

■

Troubleshooting failed software installation

■

Documenting

■

Tracking revisions

As you can see, there are a number of responsibilities that require training and experience in order to achieve success. You need to assess your environment and determine how frequently applications are installed, upgraded, and removed, and then determine the amount of personnel you will need to Continued

74_sysad_15.qx 11/8/99 10:48 AM Page 615


support this environment. You also have to decide whether each person on the software deployment team will be trained with the same skill set, or if each member will have a distinct responsibility that will not overlap another person. For example, you can have one person responsible for packaging applications, which includes testing and troubleshooting the packages, and another person responsible for deploying these packages using the Software Installation snap-in for the MMC. Either way, each member of the team needs to be adequately trained to ensure you are running an effective, successful software installation implementation.

Maintaining Software Maintaining software is one of the most complex tasks an administrator has to deal with. It sounds fairly simple, but when you have hundreds of computers the chore can become increasingly difficult. In the past, the most difficult aspect of maintaining software was determining what applications were installed on each computer, and what versions these applications were. It took many years before third-party vendors caught on to the difficulty of maintaining a current software inventory for an organization. When they did develop software inventory utilities, they were difficult and expensive to implement. With Windows 2000, you have software management utilities built right into the operating system. The Software Installation snap-in for the MMC can help you track which users and groups have applications installed, and the version of these applications. You can quickly see whether users, groups, or computers have the necessary applications. If they don’t, a few quick clicks of the mouse can assign applications to them. If there is an application they no longer need, it can easily be removed. All this is done without the need of a support technician visiting each computer to inventory, add, upgrade, or remove applications on each computer. This can literally save hundreds of man-hours,

615

74_sysad_15.qx 11/8/99 10:48 AM Page 616

616


and thousands of dollars for a corporation. This sounds simple, but it takes training and experience with the new features of software installation in Windows 2000 to achieve. Exercise 15.5 will use the MMC to add and configure a Group Policy for maintaining software installations. We need to create a GPO in order to continue with the management of software because we determine what users and computers require what software, based on the Group Policy.

Exercise 15.5 Creating a Group Policy Object (GPO) 1.

From the MMC, click Console, and select Add/Remove Snap-in.

2.

Click ADD.

3.

In the Add Standalone Snap-in dialog box, select Group Policy, and click ADD. Figure 15.9 shows the adding of a stand-alone snap-in.

Figure 15.9

Adding a Group Policy stand-alone snap-in to the MMC.

74_sysad_15.qx 11/8/99 10:48 AM Page 617


4.

In the Select Group Policy Object dialog box, click BROWSE.

5.

Make sure the “Look in” field contains your domain.

6.

In the Group Policy Objects linked to this container field, select Default Domain Policy. Figure 15.10 shows the GPO that you are going to administer.

Figure 15.10 Selecting a GPO to administer.

7.

Click OK.

8.

Click FINISH.

9.

Close the Add Standalone Snap-in window.

10.

Click OK in the Add/Remove Snap-in window.

The MMC has now been updated to show the Default Domain Policy that we just added. Expand the tree to view the Computer Configuration and User Configuration information. Your MMC should now look like Figure 15.11. Now that we have our domain policy in place, we can begin installing applications using packages. Microsoft Windows 2000 uses the new Windows Installer service, which is the cornerstone of software installation and maintenance. The Windows Installer

617

74_sysad_15.qx 11/8/99 10:48 AM Page 618

618


supports natively authored Windows Installer packages, such as the new Office 2000, or you can create your own Windows Installer packages. In the future, you will see many applications adhere to the Windows Installer standard by supplying a package file with the extension of .MSI, which is compatible with the Windows Installer.

Figure 15.11 The MMC with the new Default Domain Group Policy.

In the next exercise, we will be deploying an MSI package with the Software Installation snap-in of the MMC.

NOTE Microsoft provides two MSI files with Windows 2000 Server that you can use for this exercise. They are named webfldrs.msi and adminpak.msi, and are both located in the WINNT\System32 folder on your local hard drive. You can copy these to a network share to complete Exercise 15.6.

74_sysad_15.qx 11/8/99 10:48 AM Page 619


Exercise 15.6 Deploying an MSI Package 1.

In User Configuration, under Software Settings, right-click on Software installation.

2.

Select New, then Package.

3.

Browse for the shared directory in which you placed the *.MSI file.

4.

Highlight the MSI file and select Open. Figure 15.12 shows the various deployment methods.

Figure 15.12 Choosing from the various deployment methods.

5.

In the Deploy Software dialog box, select Published, and click OK.

6.

The MSI file will now appear in the Software Installation folder in the MMC.

7.

The MSI file has now been published for the Default Domain Policy.

In order to see the results of the last exercise, log on to Windows 2000 Professional as a user that would be managed by the Default Domain Policy, which is every authenticated user by default. When you log on, you should see the application listed in the Published applications in the Add/Remove Programs applet in the Control Panel. In Exercise 15.7, we will assign the Microsoft Excel 97 application that we created the ZAP file for earlier in the chapter. We named the file Excel97.zap and placed it in a network share called

619

74_sysad_15.qx 11/8/99 10:48 AM Page 620

620


Distribution in the folder Excel 97 with the necessary files from the Office 97 CD-ROM to install correctly.

Exercise 15.7 Deploying a ZAP Package 1.

Open the Software Installation Snap-in under User Configuration that was created in an earlier exercise

2.

Right-click on Software Installation.

3.

Select New, then Package.

4.

Navigate to the share that contains the Excel97.zap file. If the file is not present, you may have to change the Files of type field at the bottom of the dialog box to ZAW Down-level application packages (*.zap), as illustrated in Figure 15.13.

Figure 15.13 Selecting the ZAP file for a software installation.

5.

Click Open. A dialog box will appear, as shown in Figure 15.14.

6.

Make sure Published is selected, and click OK.

The package should now be visible in the Software Installation portion of your User Configuration screen.

74_sysad_15.qx 11/8/99 10:48 AM Page 621


Figure 15.14 Selecting a deployment method for a ZAP package.

Upgrading Software Upgrading software is now easier than ever with the Software Installation portion of the MMC. When you are viewing the properties of a package (by right-clicking the package and selecting Properties), you will see a tab for Upgrades. On this tab, you can specify options for upgrading existing packages with this package, as shown in Figure 15.15. You have the option of specifying whether the new package you are creating will be required, based on whether a user has an existing package. For example, if a user has Adobe Photoshop installed, you may require the new package to be installed for all users who had the Adobe Photoshop package installed in the past. This could be another application that works in conjunction with Adobe Photoshop. Also on the Upgrade tab, you can specify which future packages will upgrade this current package. It may be difficult for you to forecast what future application package will upgrade this package, so it is recommended that you leave this blank until you know for sure which package will upgrade this package. Once you found a package that will upgrade this package, you can come back to the existing package and easily specify the new package in this section. By clicking ADD, you can view a list of application packages that are available to upgrade. This list is basically every package that is

621

74_sysad_15.qx 11/8/99 10:48 AM Page 622

622


available. Figure 15.16 shows the selecting of a package that you want to upgrade.

Figure 15.15 Upgrading existing packages for software installation.

Once you select the package you want to upgrade, you need to determine if you should remove the application first before you install the new package, or whether you should upgrade the existing application without removing it first. The choice will depend on the application. For example, if you are upgrading Microsoft Office 97 to Microsoft Office 2000, you should upgrade the application without uninstalling the application first. This way, the new version of Office 2000 can use the settings that are already configured in the existing version of Office 97. If you are replacing one program with another program, you will most likely uninstall the program first using the radio button on the Add Upgrade Package dialog box. For example, you have been using an accounting program that will be replaced by another accounting

74_sysad_15.qx 11/8/99 10:48 AM Page 623


program from a different vendor. Since you cannot upgrade the existing application, you should remove it from the system. You need to verify whether it’s safe to remove the application from the computer. This will make sure the user is finished with the application and will no longer need to access or migrate data from this application to the new application.

Figure 15.16 Selecting a package to upgrade during software installation.

Removing Software Removing software is also a snap with the Software Installation portion of the MMC. Exercise 15.8 will illustrate the removal of an application.

Exercise 15.8 Removing Packages with the MMC 1.

Open the Software Installation Snap-in under User Configuration that was created in an earlier exercise.

623

74_sysad_15.qx 11/8/99 10:48 AM Page 624


2.

On the right side of the screen, right-click on an application you wish to remove.

3.

Select All Tasks, then click REMOVE. A dialog box will appear similar to Figure 15.17.

4.

Click OK.

Figure 15.17 Deciding whether to uninstall software or prevent new installations.

You have two options for the removal of software, which will depend on your needs. If you immediately want to remove the software, click the first option. This would be the case if you were going to immediately install another application that will take the place of the existing application, such as an upgrade. If you would like to continue to let users work with the software, click the second option. This is the case if you do not want additional users installing the software, but do not wish to remove the software from every existing computer. The software package is now removed from the Software Installation section and will no longer be assigned or published to subsequent users in the future.

Summary Group Policies enable you to restrict access, manage computer configurations, and control users' desktops and their environment. Group Policy is also used to determine which groups of users or computers receive software packages. The first step of software

624

74_sysad_15.qx 11/8/99 10:48 AM Page 625


installation on remote computers using Microsoft’s Group Policy is deploying the software. You need to determine whether the software will be assigned or published. Published software is optional, and assigned software is mandatory. Software installation and maintenance is made easier with the new Windows Installer, which standardizes the way applications are installed on multiple computers. Using the Windows Installer ensures that applications will adhere to the Windows Installer format, which means Windows 2000 will install the application on the application’s behalf, therefore creating a uniform installation routine. If you are not using programs that are Windows Installer compatible, they can still be packaged into a .zap file for installation and maintenance. With Windows 2000, you have software management utilities built right into the operating system. The Software Installation snap-in for the MMC can help you track which users and groups have applications installed, and the version of these applications. You can quickly see whether users, groups, or computers have the necessary applications. Upgrading and removing software is now much easier with the Software Installation portion of the Microsoft Management Console. You can easily upgrade or remove software from remote computers with a few clicks of the mouse.

FAQs Q: Do I have to upgrade to Windows 2000 in order to use Windows Installer?

A: No. Windows Installer is available for Windows 95, 98, and NT 4.0, but is built into Windows 2000. You can use Windows Installer locally on a computer to install applications, or it can be combined with Systems Management Server to install and manage applications across a network.

625

74_sysad_15.qx 11/8/99 10:48 AM Page 626

626


Q: If a user already has Office 97 installed, should I still publish or assign it?

A: Yes, because this will save you effort if a user removes the application, or if you have a damaged installation of the application. If users require Office 97 to do their jobs, you should assign Office 97 so that it will always be present on their systems. If they do not require Office 97 to do their jobs, publish it so that some users are free to install the application if they wish.

Q: What if I have an application I still wish to use, and I want to take advantage of the Windows Installer service?

A: Repackage the application to support the Windows Installer. There are a number of third-party utilities for repackaging software for this new Windows Installer standard. If the applications support this standard, they can take advantage of new features such as rollback of an unsuccessful installation and elevated installation privileges.

Q: Why do I need to know Group Policy if I am going to start installing software?

A: Every action you do regarding software installation is dependent on Group Policy. Make sure you have a firm understanding of Group Policy before you continue installing and managing applications. If your Group Policy is not configured correctly on your Windows 2000 computer, you will have a difficult time successfully installing and managing your applications, if you even get the applications to install correctly at all.

Q: I only have 10 computers in my organization. Why should I even use software installation to install and manage applications on such a small amount of computer?

74_sysad_15.qx 11/8/99 10:48 AM Page 627


A: Because it is so easy to install and maintain these applications with the tools provided in Windows 2000. Rather than visit each computer to install a program, you can install the package at the server and configure each computer or user in the container to install the application. Upgrading or removing the applications are even easier, and don’t require you to visit each workstation in order to do this. It may take time to set up your domain for remote software installation, but this is time well spent in advance that will pay for itself in no time.

627

74_sysad_15.qx 11/8/99 10:48 AM Page 628

74_sysad_16.qx 11/8/99 10:52 AM Page 629

Chapter 16

Administering User Accounts and Groups Solutions in this chapter: ■

Administer User Accounts and Groups Using Active Directory

■

Create Multiple User Accounts Simultaneously

■

Migrate Novell NDS or NT 4.0 User Accounts into Active Directory

■

Control User Account Requirements Using Group Policy Objects

■

Centralize User Profile Data Using Group Policy Objects

■

Troubleshoot the Logon Process

■

Administer User Accounts for Mobile Users

■

Employ Universal Groups to Administer Users from Multiple Domains

■

Best Practices for Administering User Accounts and Groups

629

74_sysad_16.qx 11/8/99 10:52 AM Page 630

630

Chapter 16 • Administering User Accounts and Groups

Introduction to Administration of User Accounts and Groups The nemesis of many NT 4.0 Domain Administrators has been the limitations in size and complexity of the Domain model. While NT 4.0 domains have ample resources for small to medium-sized organizations, their scalability is limited by various factors. In very large enterprise deployments with about 50,000 users or more, NT 4.0 domain administration relies on multiple trust relationships, the size of the accounts database must be whittled to an absolute minimum, and delegation of authority is difficult. Chief among the complaints about NT 4.0 have been the following: ■

An NT 4.0 domain has a flat namespace, meaning that all usernames and computer names must be unique within a domain.

■

The Security Accounts Manager (SAM) database containing all user and group information is stored in the registry of each domain controller, which limits its size to about 40MB. See the “NT 4.0 Domain Restrictions” sidebar for more information.

■

Domain policies such as password aging or account lockout must apply to all users in the domain, regardless of group membership.


NT 4.0 Domain Restrictions

The design of Windows NT prescribes that the registry must remain in the Paged Pool of memory, and that the maximum Paged Pool size for Windows NT is 128MB. In order to leave room for other critical services, the registry may only consume 80 percent of the Paged Pool, so the size of the NT 4.0 registry Continued

74_sysad_16.qx 11/8/99 10:52 AM Page 631

Administering User Accounts and Groups • Chapter 16

is limited by design to 102MB. This registry limit severely affects the scalability of Windows NT 4.0. Theoretically, the SAM portion of the NT 4.0 registry could consume all but about 3MB of the 102MB maximum registry size, but serious performance problems begin to surface after the SAM grows beyond about 40MB. For this reason, Microsoft recommends creating a second domain if your SAM database exceeds 40MB. For more information on this topic, search technet.microsoft.com for article ID Q130914: “Number of Users and Groups Affects SAM Size of Domain.”

By placing users and groups in Active Directory, Windows 2000 eliminates all of the limitations just discussed, greatly improves scalability, and eases the administration of domain accounts. User accounts and groups can be organized into a hierarchy for easier management and delegation of authority. No longer is there a need for an all-powerful Domain Administrator to correct user account problems or even to add new user accounts: a Domain tree can be partitioned into branches, and authority for each branch can be given to a departmental Administrator. Since the accounts are no longer bound by registry size, millions of users can participate in a single domain if need be. And with Group Policy Objects (GPOs), you can set rules, change permissions, and even install software for users within your branch of the tree. In this chapter, we will explore new ways to do old tasks (like adding a bunch of users all at once) and suggest some practices that will help you reduce the amount of time spent preparing for a migration from NT 4.0 to Windows 2000.

Creating Multiple User Accounts Adding a single user is a fairly straightforward task; it is covered in detail in Chapter 3, “Setting Up User Accounts.” However, if you have many users to add, perhaps thousands, you won’t want to

631

74_sysad_16.qx 11/8/99 10:52 AM Page 632

632


create them one at a time. Fortunately, you won’t have to. There are several methods to choose from when creating an Active Directorybased user set, whether you’re migrating from NT 4.0, Novell NDS, or even an Excel spreadsheet filled with usernames.

Migrating Users from an NT 4.0 Domain When an NT 4.0 domain controller or member server is upgraded to Windows 2000, any user or group accounts that were in the local SAM are automatically imported into a special “Users” organizational unit (OU) beneath the root of the new domain in Active Directory. Likewise, all computer accounts are added to a “Computers” OU, and the built-in groups like Administrators and Account Operators are added to a “Builtin” OU. Figure 16.1 shows these groups using the Active Directory Users and Computers MMC snap-in.

Figure 16.1

NT 4.0 users migrate to Active Directory automatically.

74_sysad_16.qx 11/8/99 10:52 AM Page 633


If you already have a reliable method for adding NT 4.0 users in bulk, such as a batch script employing the net user username /add command, it will still get your user accounts into the Users OU just below the root of your domain. From there, they can easily be moved into a more appropriate location within Active Directory. Just select all the users you want to move and select the Move command from the Action menu. As shown in Figure 16.2, you are then prompted to select an appropriate OU within your Active Directory tree.

Figure 16.2

Moving users to a different OU.

For migrations from an NT 4.0 domain to a Windows 2000 Active Directory, this is the preferred method for importing your user database. Be sure that you take the time to move your users into an appropriate OU after they have been imported; otherwise, you will still be stuck with a flat namespace and all its inherent woes.

633

74_sysad_16.qx 11/8/99 10:52 AM Page 634

634


Creating New Active Directory Users in Bulk If you prefer to toss out your existing user database and begin with a clean slate, all user accounts will have to be created within Active Directory. The Users and Computers snap-in does not allow you to add more than one user at a time. Does this mean that you will be up all night typing in usernames? Fortunately, no. If you can come up with an Excel spreadsheet containing usernames, you can use a script to read the names in from Excel and write them to the Active Directory OU of your choice. You can download the script and a sample Excel file from http://msdn.microsoft.com/scripting. The Addusers.xls Excel template is shown in Figure 16.3.

Figure 16.3

Addusers.xls.

How Does the Script Work? The script relies on a new interface called the Active Directory Services Interface (ADSI). ADSI allows programmatical access to Active Directory. With it, you can create or modify any object in the directory, including user objects. ADSI can be employed from within C, C++, VBScript, PERL, and several other programming languages. For more information, visit the Active Directory homepage on Microsoft’s Web site at http://www.microsoft.com/windows/server/Technical/directory/.

74_sysad_16.qx 11/8/99 10:52 AM Page 635


To use the script, all you need to do is populate the Excel template provided with the usernames you wish to add and the Active Directory OU where you would like to add them. Then you run the script with the name of the Excel file as an argument: Addusers.vbs addusers.xls

For IT Professionals Only Only One at a T ime?

Only One at a Time? Annoyingly, the Users and Computers snap-in does not allow you to modify the properties of more than one user at a time. In NT 4.0’s User Manager for Domains, you were able to select multiple users, press ENTER, and be presented with an abbreviated dialog box with which you could change properties for all the selected users at once. No doubt in an effort to encourage administration at the OU level rather than on a per-user basis, this feature is missing from the AD Users and Computers snap-in. For example, if you want to move all your users’ home directories to a different server, you have to change the entry one user at a time rather than making one sweeping assignment to \\servername\sharename\%username%. The moral to be learned here: Wherever possible, you should manage your users by modifying their containing OUs GPO(s), not by editing the user properties directly. This line of thought will pay off in the long run, because new users will inherit the OU’s GPO, and it will keep the size of your directory small.

635

74_sysad_16.qx 11/8/99 10:52 AM Page 636

636


Importing Users from Novell Directory Services (NDS) Windows 2000 includes two very powerful command-line utilities that can import and export information to and from any LDAP-compliant directory, including NDS. The commands are LDIFDE.EXE for importing and exporting data from other directory services, and CSVDE.EXE for importing data from comma-separated text file into Active Directory. For more information on these commands, search the online help in Windows 2000, or type the command followed by -?. Also to be included in Windows 2000 is a graphical tool for migrating Novell NDS user accounts, groups, files, and their permissions directly into Active Directory. The new tool, called the Directory Service Migration Tool, will preserve the hierarchy of users and group memberships, but will not be able to import NDS passwords. Previous versions of this utility were limited to importing information from a NetWare bindery, which exists only in NetWare versions 3.x and earlier (or emulations thereof). The new tool is a long-awaited improvement to the familiar Migration Tool for NetWare included with Windows NT 3.51 and 4.0. Find the Directory Service Migration snap-in dsmigrat.msc in the %SystemDrive%\Program Files\Dsmigrat\ directory.

Administering Logon Names While Active Directory eliminates the flat NetBIOS namespace and allows multiple instances of the same logon name within a domain hierarchy, it is still a good idea to define an account naming policy and stick with it throughout your organization.

Lockout Settings The account lockout settings allow you to set rules governing the number of times a password can be attempted unsuccessfully before

74_sysad_16.qx 11/8/99 10:52 AM Page 637


triggering an alarm that locks the account altogether. Once the alarm has been triggered, the user cannot log in even if the password is entered correctly. In NT 4.0, this setting is a property of a domain, and the applet for modifying your domain’s account policy is found in User Manager for Domains. The same feature is present in Windows 2000, but before implementing it you should understand how Active Directory has changed the domain model. The control of this policy is now granular and takes advantage of the hierarchical nature of Active Directory. Rather than having one set of rules that apply to all users in your domain, you can create a different lockout policy for each OU in Active Directory. The policy you define for an OU affects any users contained within that OU. There is still a Default Domain Policy available to you, which is really a GPO that has been assigned to the root of your domain. To examine the Default Domain Policy, open Active Directory Users and Groups, right-click your domain name, select Properties, then click the Group Policy tab, shown in Figure 16.4.

Figure 16.4

The Default Domain Policy GPO.

637

74_sysad_16.qx 11/8/99 10:52 AM Page 638

638


If you are a Domain Administrator, you can edit the Default Domain Policy GPO listed here. Use this GPO to establish rules that will affect all users in the domain. To establish different rules for a particular OU within the domain, you can edit the GPO associated with that OU and modify all the same settings that you find here in the Default Domain Policy. Within the GPO tree, there are two subtrees: Computer Configuration and User Configuration. You might reasonably expect a policy about account lockout to be a property of the latter, but in fact, the account lockout policies are defined as a computer configuration, as shown in Figure 16.5.

Figure 16.5

Account Lockout Policies within the Computer Configuration subtree.

74_sysad_16.qx 11/8/99 10:52 AM Page 639


The three Account Lockout variables interact with one another like this: ■

The Account lockout counter is the number of invalid logon attempts within a particular time window required to trigger an account lockout. When the account is locked, the user cannot log in, even with the correct password.

■

The Account lockout duration is a number of minutes that the account will remain locked. After this time has passed, the account is automatically unlocked and the user can log in if he or she has the correct password

■

Reset account lockout after a number of minutes defines the time window for the account lockout counter.

Taking the example shown in Figure 16.4, it would take five invalid logon attempts within 30 minutes of each other to trigger an account lockout. Then once the account has been locked, it will remain locked for 30 minutes before login attempts can be made again.

Password Requirements Alongside the policies for account lockout, you will find policy definitions for password requirements that in previous versions of Windows NT were administered from User Manager for Domains. The password requirement policies include all functionality from NT 4.0, plus a few more: ■

Enforce password history. The administrator can define a number of passwords that will be “remembered” for each user. For example, if the number is set to 10, then a user cannot change his or her password to any of the last 10 passwords he or she has already used. This improves system security because users will not be able to accumulate favorite passwords and thereby increase the chance of someone else discovering their password. Default value: 1 password remembered

639

74_sysad_16.qx 11/8/99 10:52 AM Page 640

640

Chapter 16 • Administering User Accounts and Groups ■

Maximum password age. The maximum number of days that a user can keep a password before being forced to change it. Six weeks is a decent medium-security setting that strikes a balance between securing the network and annoying your users. Default value: 42 days

■

Minimum password age. The minimum number of days that a user can keep a password before being allowed to change it. If you enforce a password history of, say, 10 remembered passwords, but do not enforce a minimum password age, then a crafty user can avoid having to learn a new password by changing the password repeatedly until the number of remembered passwords is exceeded. Then the original password is “forgotten” and the user can change back to his or her favorite password again. A good security setting for this would be at least a couple of days, to make such password cycling much less convenient. Default value: 0 days

■

Minimum password length. The minimum number of characters a password must contain. Given the everincreasing horsepower of today’s processors, brute force security attacks (where all possible combinations of characters are tried, one at a time) are becoming easier and easier. But every time you increase the minimum password length, you exponentially increase the number of possible passwords an attacker would have to try. A good starting point would be at least 6 to 8 characters. Default value: 0 characters

■

Passwords must meet complexity requirements of the installed password filter. In previous versions of Windows NT, it was necessary to install a file named passfilt.dll to enforce password complexity. Windows 2000 incorporates this functionality into the operating system. When enabled, this policy implements the following password restrictions: ■

Passwords must be at least six characters long.

■

Passwords must contain characters from at least three of the following four classes: 1. English Upper Case Letters

A, B, C, ... Z

74_sysad_16.qx 11/8/99 10:52 AM Page 641


■

2. English Lower Case Letters

a, b, c, ... z

3. Westernized Arabic Numerals

0, 1, 2, ... 9

4. Non-alphanumeric

e.g., punctuation symbols

Passwords may not contain your username or any part of your full name.

Default value: Disabled ■

Store password using reversible encryption for all users in the domain. This setting should only be used for Apple Macintosh users who will be connecting to your network via Remote Access Service (RAS). In order for Active Directory to authenticate a Macintosh PPP client, the user’s password must be stored in clear text. Enabling this option encrypts the password within the directory for better security. Enable this option only for Macintosh users who require clear-text password RAS authentication. Default value: Disabled

■

User must log on to change the password. Enabling this option forces a user to log on successfully before the password can be changed. Default value: Disabled

Finding the right combination of password policies is usually a dance between achieving the security you need without crossing the threshold of how much your users will put up with. When in doubt, err in favor of tighter security.

Configuring Account Policies Using Group Policy The rules and polices you establish for account lockout and password security are contained with GPOs. Active Directory allows you to leverage multiple GPOs throughout the hierarchy of your network, enabling a granular level of control never before available with the Windows platform. Each OU within Active Directory can have one or more GPOs bound to it. For example, suppose I wanted to

641

74_sysad_16.qx 11/8/99 10:52 AM Page 642

642


define account lockout policies, but only wanted the policies to affect the users within the USA\Users OU illustrated in Figure 16.6.

Figure 16.6

Defining OU-specific account policies.

To define a GPO that only affects the USA\users OU, rightclick the USA\users OU and select Properties. Then click the Group Policy tab as shown in Figure 16.7 to view a list of all GPOs currently bound to this OU. For each OU, there may be several GPOs affecting users and computers within the OU. If more than one GPO is listed here, the GPO higher in the list will take priority. You can change the priority of a GPO by selecting it and clicking Up or Down as shown in Figure 16.7. Low-priority GPOs get applied first, and then their changes may be overwritten as higher-priority GPOs get applied. If a highpriority GPO does not define a value for a particular policy that a low-priority GPO defined, then the low-priority GPO policy will still take effect. Only when there are conflicting policy definitions does the priority level matter; otherwise, the defined policies of all GPOs are merged into one master set of policies.

74_sysad_16.qx 11/8/99 10:52 AM Page 643


The “Block Policy inheritance” check box shown in Figure 16.7 allows an Administrator to ignore policies that would otherwise be inherited from GPOs further up the tree structure. For example, if there were also a GPO assigned to the USA OU, then by default, users in the USA\users OU would be affected by those policies as well (See Figure 16.6). If “Block Policy inheritance” were checked, then the GPOs listed in Figure 16.7 would be the only affecting GPOs for the USA\users OU. Since it is not checked, GPOs defined at the domain or USA OU level may also affect objects within USA\users.

Figure 16.7

List of Group Policy Objects affecting an OU.

643

74_sysad_16.qx 11/8/99 10:52 AM Page 644

644



GPOs Under the Covers

GPOs contain files such as login and logout scripts or the customizable Administrative templates (.adm files) that house configurable registry values. So where do the GPOs actually store all this information? GPOs are replicated to the SYSVOL share on each domain controller within a domain. The SYSVOL share corresponds to the %SystemRoot%\SYSVOL\sysvol\ directory on each domain controller. (Note the double occurrence of sysvol; only the second subdirectory is shared and replicated.) Each GPO is assigned a 128-bit Globally Unique Identifier, or GUID (say "gwid"). The GUID for one of my GPOs looks like this: {31B2F340-016D-11D2-945F-00C04FB984F9}

Yours will look different, as the algorithm for generating GUIDs is guaranteed to be "globally unique." To discover the GUID for one of your GPOs, highlight the GPO listed in the Group Policies tab of an OU to which it is bound, and then click PROPERTIES. Beneath the sysvol share on a domain controller you will find a subdirectory named after the domain, followed by a Policies folder containing all the GPOs for that domain. So, to track down the files contained within the above policy, I would look to this folder: C:\WINNT\SYSVOL\sysvol\mydomain.com\Policies\ {31B2F340-016D-11D2-945F-00C04FB984F9}\

That having been said, please note that it is not a good idea to modify the files within a GPO directly, unless perhaps you are fluent with the language of ADM files and are adding your own registry options to the administrative templates provided by default. To learn more about creating customized ADM files, you can read the Windows NT 4.0 Guide to Profiles and Policies available at http://support.microsoft.com.

74_sysad_16.qx 11/8/99 10:52 AM Page 645


As you have seen, a single user deep within the Active Directory tree may be affected by many GPOs. GPOs are stored on domain controllers, so the more GPOs you have to parse, the more information that must be transferred from a domain controller, and the longer your logon time will become. With that in mind, try to keep the number of GPOs in your domain to a minimum.


No More User-Specific Policies

Frequently, when troubleshooting a Windows NT 4.0 profile or application problem, especially in a tightly locked-down user environment, it proves valuable to exempt a single “troubleshooter” user account from the domain policy. In NT 4.0, this is done by adding an explicit user policy to the NTCONFIG.POL file, which overrides other group policies. This troubleshooter account can then access features that others cannot, such as the Run command, for example. Then once the problem is solved, the troubleshooter’s account-specific policy is removed from NTCONFIG.POL ,and the user returns to his or her locked-down environment. In Windows 2000, exempting single users from group policy is not so easy. Even though Windows 2000 improves granular policy support by allowing multiple prioritized GPOs at each OU, the granularity does not extend to the individual user or computer level. The only way to establish a policy that would affect only one user would be to create a separate OU for that user, move the user into the new OU, and then define a GPO for the new OU and block all inheritance. Keep this limitation in mind when designing your Active Directory structure; ensure that anyone who is responsible for troubleshooting day-to-day problems has the rights necessary to create his or her own OUs and add users to them. Once more, user-specific management is discouraged in favor of functional, group-based design.

645

74_sysad_16.qx 11/8/99 10:52 AM Page 646

646


Troubleshooting User Logon Problems There are numerous reasons why a user might not be able to log on to a domain successfully. First, eliminate basic connectivity issues like severed network cables or IP address conflicts, and then ensure that the user is entering a valid username, domain, and password combination. Assuming basic network connectivity is intact, here are a few problems that might prevent users from logging on.

Unable to Find a Domain Controller For a normal domain logon, the client workstation computer must be able to locate a domain controller. Whereas down-level versions of Windows relied on a WINS server (the NetBIOS name registration), Windows 2000 workstations will rely on a DNS server to resolve the name of your domain to an IP address of a domain controller. If a domain controller cannot be located using DNS, you may receive the error message shown in Figure 16.8.

Figure 16.8

Unable to locate a domain controller with DNS.

As you can see, the message received has nothing to do with the inability to communicate with your DNS server. If you receive this error, you should ensure that your DNS server is operational and that it is configured with the proper SRV records for your domain controller. SRV records were proposed in RFC 2052, “A DNS RR for specifying the location of services,” and are a fairly new addi-

74_sysad_16.qx 11/8/99 10:52 AM Page 647


tion to the DNS record set. SRV RRs allow clients to rely on their DNS server for the location of computer roles, not just name-to-IP address resolution. Using SRV RRs, for example, you could query your DNS server to find the nearest domain controller that is also a global catalog server. If there are several computers that match the description of the desired role, they can be “load balanced” with weighted priorities. For example, consider a situation where a site has two domain controllers, but domain controller A is four times faster than domain controller B. Ideally, domain controller A would receive four requests for every single request that domain controller B receives. The DNS server Administrator could create two SRV RR records, weighted differently, to achieve this. Entries with larger weights have a higher probability of being returned as the resolution to the service query. So, domain controller A could be assigned a weight of 400, and domain controller B assigned a weight of 100 to achieve a 4:1 load-balancing ratio. The default weight for a domain controller SRV RRs in Microsoft’s DNS server is 100. As an example of DNS SRV RRs, a domain controller for the company.com domain might register the following SRV RRs: ■

_ldap._tcp.dc._msdcs.company.com This record tells the DNS client that the associated computer is a Windows 2000 domain controller for the company.com domain.

■

_kerberos._tcp.dc._msdcs.company.com This record tells the DNS client that the associated computer is a Kerberos authentication server for the company.com domain.

■

_ldap._tcp.gc._msdcs.company.com This record tells the DNS client that the associated computer is a Windows 2000 global catalog server for the company.com domain.

■

_ldap._tcp.pdc._msdcs.company.com This record tells the DNS client that the associated computer is a down-level PDC emulator for pre-Windows 2000 clients logging in to the company.com domain.

All Windows 2000 domain controllers should add the appropriate SRV RRs to your DNS server automatically when they

647

74_sysad_16.qx 11/8/99 10:52 AM Page 648

648


are installed. If problems persist, you may need to add the records manually.

Unable to Load the User Profile Windows 2000 profile problems behave very similarly to Windows NT 3.51 and 4.0 profile problems. Profiles can be Local (located on the hard drive in the %SystemDrive%\Documents and Settings\ directory) or Roaming (located on a network file server), and Roaming profiles can optionally be Mandatory (user is not permitted to make changes to the profile). Roaming profiles are stored on a file server and are copied to the client workstation’s hard drive during the logon process. For this reason, it is a good idea to keep profiles as small as possible. Windows 2000 includes a GPO policy option for limiting the size of a user’s profile. You can find this option by browsing to this point in the GPO tree: User Configuration\Administrative Templates\System\Logon/Logoff\Limit profile size

When the “Limit profile size” policy is in effect, a user will not be able to log off until his or her profile falls under the maximum size set by an Administrator. This is very useful for preserving file server disk space and limiting network gridlock in the morning when many users log on at once. If a user is assigned to a Roaming Mandatory profile, then security settings dictate that the user should not be permitted to log on at all unless the profile can be loaded. Mandatory profiles are profiles whose directory ends with .man, and the HKEY_CURRENT_USER hive file NTUSER.DAT has been renamed NTUSER.MAN. If a user with a Mandatory profile attempts to log in, but the workstation cannot locate the Mandatory profile, the user will receive the error message shown in Figure 16.9. To troubleshoot this error, ensure that the user’s profile path is entered correctly in Active Directory Users and Computers and that the network share point to which the profile path points is

74_sysad_16.qx 11/8/99 10:52 AM Page 649


Figure 16.9

Unable to load a Mandatory profile.

accessible and contains sufficient permissions for this user to read his or her profile. You should double-check both the network share permissions and the NTFS file permissions of the profile in question. When a user’s roaming profile is nonmandatory, Windows 2000 workstations will make an effort to load the profile, but if the profile is not available, the user is still permitted to log in. If the user has logged in to this workstation in the past, then there should be a locally cached copy of the user’s roaming profile waiting in the Documents and Settings directory off the root of the system drive. The user will be able to use this version of his or her profile if it is available, but any changes made during that session will not be uploaded to the file server if the file server is not available. If the user has never logged on to this workstation before (i.e., the %SystemDrive%\Documents and Settings\%username% directory does not exist), then the user will be logged on and granted use of a temporary profile. The temporary profile is created from the workstation’s Default User profile and is stored under %SystemDrive%\Documents and Settings\TEMP while the user is logged on. When the user logs off, the TEMP profile directory is deleted. It is interesting to note that in a Terminal Services environment, there may be several users logged on to a “workstation” at once who require use of a temporary profile. In this scenario, users will receive unique temporary profiles named in this fashion: ■

%SystemDrive%\Documents and Settings\TEMP\

■

%SystemDrive%\Documents and Settings\TEMP.domain-name\

649

74_sysad_16.qx 11/8/99 10:52 AM Page 650

650


%SystemDrive%\Documents and Settings\TEMP.domainname.000\

■

%SystemDrive%\Documents and Settings\TEMP.domainname.001\

…and so on.

Missing Computer Account In addition to user accounts, all computers in your domain must also have accounts within Active Directory. The concept here is not new: Windows NT 3.51 and 4.0 maintain a list of registered domain workstations and servers in the Server Manager utility. Figure 16.10 shows the message you would receive if the computer account for your workstation were missing from Active Directory’s “Computers” container.

Figure 16.10 Missing or corrupt computer account.

The easiest way to correct this problem is usually to remove the workstation from the domain and then rejoin the domain using the proper credentials. By default, only Administrators have the authority to add computers to a domain. Alternatively, an Administrator could visit the Computers container under the root of the Active Directory tree and add a computer account for the workstation. Problems with computer accounts are typically incurred by the reckless use of drive imaging technologies such as Norton Ghost. Ghost works by creating an exact image of a PC’s hard drive and then replicating that image to multiple PCs. If nothing is done to alter each computer’s Security ID number (SID), computer

74_sysad_16.qx 11/8/99 10:52 AM Page 651


account problems will follow. The latest version of Ghost includes a utility called Ghost Walker, which automatically changes the SID on each Ghosted workstation to a “statistically unique” number. For more information about Ghost, visit http://www.ghost.com/. Of course, there are a host of other unpredictable problems that might prevent a user from logging on. The important thing is to understand the logon process so that you can troubleshoot the right areas when problems inevitably reveal themselves.

Redirecting User Data to a Network Share The idea of a user profile started with the 3.x versions of NT, where the HKEY_CURRENT_USER portion of the registry was saved out as a registry hive, generally with the name username.usr or username.man. As a user logged in, the profile hive was loaded into HKEY_CURRENT_USER and affected the appearance of icons within Program Manager: the background color, font sizes, personal program groups, and so on. Windows NT 4.0 expanded quite a bit on this idea, and enhanced profiles to include not only the HKCU registry hive but also a number of other files, such as Start menu icons, temporary Internet files and desktop shortcuts, to name a few. All of these files are then grouped into a folder along with the HKCU hive (now called NTUSER.DAT) to comprise an NT 4.0 profile directory. While a user is logged on, his or her profile directory can be verified by evaluating the %UserProfile% environment variable. While the new profile design made it easier for Administrators to change a user’s desktop experience, management of large numbers of profiles remained cumbersome. For example, in a domain with thousands of user-based (nonmandatory) profiles, the desktop shortcuts and Start menu icon files are reproduced for each and every user who receives them. Changes are difficult to manage, and file servers that host user profiles quickly balloon to unmanageable sizes.

651

74_sysad_16.qx 11/8/99 10:52 AM Page 652

652


To combat this NT 4.0 profile problem, you can alter the location of user profile subdirectories. Redirecting this data to a network share point consolidates the thousands of copies into one. You can do this by editing the following registry values in HKEY_CURRENT_ USER, changing %USERPROFILE% to the UNC path of your network file server and shared directory. HKEY_CURRENT_USER\Software\Microsoft \Windows\CurrentVersion\Explorer\ShellFolders\ AppData

: REG_EXPAND_SZ = %USERPROFILE%\Application

Cache

: REG_EXPAND_SZ = %USERPROFILE%\Temporary

Cookies

: REG_EXPAND_SZ = %USERPROFILE%\Cookies

Data Internet Files Desktop

: REG_EXPAND_SZ = %USERPROFILE%\Desktop

Favorites

: REG_EXPAND_SZ = %USERPROFILE%\Favorites

History

: REG_EXPAND_SZ = %USERPROFILE%\History

NetHood

: REG_EXPAND_SZ = %USERPROFILE%\NetHood

Personal

: REG_EXPAND_SZ = %USERPROFILE%\Personal

PrintHood

: REG_EXPAND_SZ = %USERPROFILE%\PrintHood

Programs

: REG_EXPAND_SZ = %USERPROFILE%\Start Menu\Programs

Recent

: REG_EXPAND_SZ = %USERPROFILE%\Recent

SendTo

: REG_EXPAND_SZ = %USERPROFILE%\SendTo

Start Menu

: REG_EXPAND_SZ = %USERPROFILE%\Start Menu

Startup

: REG_EXPAND_SZ = %USERPROFILE%\Start

Menu\Programs\Startup

It is possible to change these values en masse in NT 4.0, but the solution is not very easy: You must either compose your own ADM template for policy editor or employ REGINI.EXE in a login script to modify the HKCU portion of the registry as users log on. Luckily, Windows 2000 allows easier manipulation of some of these values (but not all of them) from within Group Policy Editor. To redirect user data to a network share using a GPO, navigate to the User Configuration\Windows Settings\Folder Redirection option set, as shown in Figure 16.11.

74_sysad_16.qx 11/8/99 10:52 AM Page 653


Figure 16.11 Location of Folder Redirection options within a GPO.

For each of the subdirectories listed beneath “Folder Redirection,” you can define network share points that will house the data for the affected users. For example, the user-specific portion of the Start menu (the icons above the dividing line in Start menu ➔ Programs) can be redirected to a single network share for all users rather than allowing each user to maintain his or her own copy of the personal Start menu icons. To make this change, rightclick the Start menu folder within the GPO and select Properties. (Double-clicking the folders will take you nowhere.) Folders can then be redirected to the same network share point for all users as shown in Figure 16.12. To determine which users will be affected by this setting, you need to understand which users this GPO affects. If the OU to which this GPO is bound has only one set of users beneath it, then those users are the only ones affected. But if this GPO is bound to a high-level OU with many more levels of OUs

653

74_sysad_16.qx 11/8/99 10:52 AM Page 654

654


beneath it, this policy affects all users in all sub-OUs as well (by default). Be very careful when applying changes such as this, or you may inadvertently change your CEO’s Start menu! To be more precise with this feature, select the second option, “Advanced – Specify locations for various user groups.” Doing so will mean that not all users beneath your OU will necessarily be affected by your redirection settings. With this option selected, you can add user groups to a list and define a network share point for each group individually, as shown in Figure 16.13. Now in order for users to be affected by this redirection, they must a) belong to one of the user groups for whom you defined folder redirection options and b) log in with a user account whose placement in the Active Directory tree falls beneath the OU to which this GPO is bound.

Figure 16.12 Redirecting data for all users affected by this GPO to the same share point.

74_sysad_16.qx 11/8/99 10:52 AM Page 655


Figure 16.13 Redirecting user data based on group membership.

As of Windows 2000 RC2, only the Application Data, Desktop, My Documents, and Start menu profile subdirectories can be moved with a GPO. Modifying the registry directly is still the only way to relocate the complete list of profile subdirectories.

Setting Up Accounts for Mobile Users As already mentioned in the “Only One at a Time?” sidebar earlier in this chapter, there are many user-specific settings that Administrators are no longer able to modify in bulk. As of Release Candidate 2 of Windows 2000 Server, this annoyance also affects the settings for dial-in access to a Windows 2000 network, and represents a potentially major “gotcha” in terms of getting it right the first time. By default, a new user will not have dial-in access. So if

655

74_sysad_16.qx 11/8/99 10:52 AM Page 656

656


you plan to support users connecting to your network via a Remote Access Server (RAS), it would behoove you to establish a template user account with the dial-in option enabled, and then create new users by copying this template user. The dial-in option can be found on the Dial-in tab of a user’s Properties page, as shown in Figure 16.14.

Figure 16.14 Enabling dial-in access, one user at a time.

The “Control access through Remote Access Policy” can only be enabled for your domain users after your Windows 2000 domain has been changed to native mode, meaning that there are no more pre-Windows 2000 domain controllers running in your domain. To change a domain to native mode, right-click the domain name in AD Users and Computers, select Properties, and then click "Change mode." The one-way change from mixed mode to server mode is not

74_sysad_16.qx 11/8/99 10:52 AM Page 657


reversible. In other words, you cannot add an NT 3.51 or NT 4.0 domain controller to a native-mode Windows 2000 domain. Once this milestone has been reached, though, Remote Access Policy will allow much more flexible control over RAS permissions. See Figure 16.15 for an example of the Routing and Remote Access snap-in after Remote Access Policy option has been enabled.

Figure 16.15 Flexible dial-in access control using Remote Access Policy.

By default, only one Remote Access Policy will exist: “Allow access if dial-in permission is enabled.” This means that if a user’s dial-in tab is set for “Allow access” instead of “Control Access through Remote Policy,” then the policy will not deny the user access. Additional Remote Access Policies can be defined in the Routing and Remote Access snap-in of a Windows 2000 member server or native-mode domain controller. Here you can define highly flexible policies based on the time of day, the caller’s phone number or IP address, Active Directory group membership, tunneling protocol, and a number of other criteria. Once a dial-in user is authenticated via a particular policy, the RAS Administrator can enforce a policy-specific RAS profile upon that user, defining settings like maximum bandwidth allowed, maximum session time, maximum idle time, and many others.

657

74_sysad_16.qx 11/8/99 10:52 AM Page 658

658


To edit the profile that will affect users who authenticate through a particular Remote Access Policy, double-click the policy and then click EDIT PROFILE at the bottom of the panel. For example, to set limits on maximum idle time or session time for all users, double-click the “Allow access if dial-in permission is enabled” policy, click EDIT PROFILE, and enable the options as shown in Figure 16.16.

Figure 16.16 Limiting idle and session time with a Remote Access Profile.

Multilink and Bandwidth Allocation Protocol (BAP) Another new feature of Windows 2000 is enhanced support for Multilink RAS clients. Multilink describes a RAS connection made over more than one phone or ISDN line. For example, a user with

74_sysad_16.qx 11/8/99 10:52 AM Page 659


two 56-Kbps modems and two independent phone lines can call a multilink-enabled RAS server with both lines and get a total (theoretical) bandwidth of 112 Kbps. One of the properties you can control using a RAS profile is how a multilink-enabled client behaves when it is not using all of the bandwidth allocated to it. For example, I could dial in to a RAS server with four 56-Kbps modems, allocating a total bandwidth of 224 Kbps. But then suppose I only consume about 80 Kbps of that bandwidth; a Windows 2000 RAS server can use the Bandwidth Allocation Protocol (BAP) to disconnect the two modems I am not using at the moment and give them to other users who might be trying to dial in. As you can see in Figure 16.17, this setting is part of the profile associated with a Remote Access policy.

Figure 16.17 Reduce wasted phone lines with BAP.

659

74_sysad_16.qx 11/8/99 10:52 AM Page 660

660


Since Remote Access policies are so flexible, you can establish a rule like this but have it affect only one group of users in Active Directory or only callers from one particular area code. Until you make the jump to native mode, you can still take advantage of Remote Access Policies, but only on a member server (not a domain controller). This means that you will not be able to take advantage of your domain hierarchy and user groups; instead, you will have to maintain separate accounts on the member server for dial-in authentication. With that being the case, it might be easier to go ahead and enable access for all your users one at a time and then switch to policy-based RAS permissions after your network has been completely upgraded to Windows 2000.

Using Universal Groups Universal groups are a new concept in Windows 2000, so it may prove worthwhile here to review the two kinds of groups available to Windows NT 3.51 and 4.0 and compare them to the three kinds of groups found in Windows 2000.

Windows NT 3.x and 4.x Groups Types Administrators can place users into groups for easier administration. Previous versions of Windows NT supported two kinds of user groups: global groups and local groups. ■

Global. Global groups can only contain users from a single domain. In a trust relationship where there are multiple domains, each domain maintains its own set of Global groups, and users from one domain cannot join a Global group from another domain. Global groups can only contain users; they cannot contain groups of any kind.

■

Local. Local groups can contain users and Global groups from the local domain or any trusted domain. For example, if domain A trusts domain B, a Local group in domain A could contain a Global group from domain B. Local groups can only contain users and Global groups; they cannot contain other Local groups.

74_sysad_16.qx 11/8/99 10:52 AM Page 661


Given the relatively flat nature of down-level NT domains, the preceding pair of group types has proven adequate for most administrative tasks. But remember that Windows 2000 domain trees can be grouped into forests. In NT 4.0 terms, a forest of Active Directory domain trees is like a group of NT 4.0 domains in a complete trust model: all domain trees trust all other domain trees. With that model in mind, consider the Windows 2000 group types discussed next.

Windows 2000 Group Types Windows 2000 expands upon the kinds of groups an administrator can define. Besides being able to define groups anywhere within Active Directory, a new Universal group type has been added: ■

Global. Global groups in Windows 2000 are unchanged from the previous NT model. They can only contain users from within their own domain. In a forest where there are multiple domains, each domain maintains its own set of Global groups, and users from one domain cannot join a Global group from another domain. Global groups can only contain users; they cannot contain groups of any kind.

■

Domain Local. Domain Local groups can contain users and Global groups from the local domain or any other domain in the forest. For example, if a forest consists of the mycompany.com and yourcompany.com domains, a Local group in mycompany.com could contain users and Global groups from yourcompany.com, and vice versa. But Domain Local groups can only be used to assign permissions to objects within their own domain. A mycompany.com Local group might contain users from yourcompany.com, but such a group cannot be used to secure objects within the yourcompany.com tree. Domain Local groups can only contain users and Global groups; they can not contain other Domain Local groups.

661

74_sysad_16.qx 11/8/99 10:52 AM Page 662

662


Universal. Universal groups can contain users and Global groups from the local domain or any other domain in the forest. For example, if a forest consists of the mycompany.com and yourcompany.com domains, a Local group in mycompany.com could contain users and Global groups from yourcompany.com, and vice versa. Furthermore, Universal groups can be used to secure any object in any tree in the forest. Universal groups are closely related to Domain Local groups: where the security scope of a Domain Local group stays within its own domain, the security scope of a Universal group spans the entire forest of domains.

If you have multiple forests, no user from one forest can be placed into any group from another forest. With the upcoming release of Platinum, the newest version of Microsoft’s Exchange server, Group membership within Active Directory will play a more important role than NT domain group membership plays today. Platinum will allow Active Directory groups to double as e-mail distribution lists. Universal groups, therefore, can play a very important role in your organization, as they enable a single point of gathering for enterprisewide user definitions. As an example, Figure 16.18 shows a distribution list to all Domain Administrators in all domains within the forest defined by creating a Universal group called Forest Admins. This group could then be populated with the Domain Administrator’s Global groups from all domains in my forest, and Outlook clients would be able to send e-mail to the Forest Admins distribution list. Furthermore, any Domain Administrator in the forest could grant the Forest Admins group permission to access any file within their domain.

74_sysad_16.qx 11/8/99 10:52 AM Page 663


Figure 16.18 Universal group: Forest Admins.

Best Practices Here are some “best practices” to keep in mind when creating and managing your Active Directory domain user and groups. Segregate your user hierarchy by geography and function. Depending on your organization, it may be better to subdivide Active Directory users first by geography or function, but you should definitely do one and then the other. A functional division can be further subdivided by geography, such as this: Domain.com ■

Sales USA Europe Asia

663

74_sysad_16.qx 11/8/99 10:52 AM Page 664

664


Marketing USA Europe Asia

■

MIS USA Europe Asia

Or a geographical division can be subdivided into functions, like this: Domain.com ■

USA Sales Marketing MIS

■

Europe Sales Marketing MIS

■

Asia Sales Marketing MIS

Delegate Authority. Once you have subdivided your domain into groups, define an Administrator for each major branch of the tree and give that Administrator full ownership of all objects beneath his or her OU. You can delegate ownership easily by right-clicking an OU and selecting “Delegate control…” from the menu. A wizard ensues that walks you through the delegation process, prompting you to identify the delegates and adjust what rights they should have over the OU and its contents.

74_sysad_16.qx 11/8/99 10:52 AM Page 665


Define template users. Since so many user settings cannot be altered in bulk after the user objects have been created, think carefully about what properties you want all your users to share, and assign them to a template user. Name the template user with an underscore character such as “_Template User” so that the template user always appears at the top of an alphabetical list. When you are not using the template user to create new accounts, keep the account disabled. Minimize the number of Group Policy Objects. Since processing time and network traffic per user increase with each affective GPO, try to keep the number of GPOs within your tree to a minimum. Define one Master GPO for the domain to house settings that you want to affect all users, and add additional GPOs only when you need to fine-tune settings for a particular group or override settings in the Master GPO.

Summary Windows 2000 removes many of the limitations that were present in previous versions of Windows NT. This chapter has demonstrated the following improvements in Windows 2000 over its predecessors: ■

The hierarchical namespace of Active Directory and the management capabilities added by Group Policy Objects (GPOs) make Windows 2000 an attractive solution for large organizations that need segregated network administration.

■

User and group administration is more flexible than ever before, even when your users number in the hundreds of thousands.

■

Sophisticated new dial-up options allow you to maximize your asynchronous bandwidth investments.

665

74_sysad_16.qx 11/8/99 10:52 AM Page 666

666


FAQs Q: What is the easiest way to add users in bulk, starting from a list of usernames?

A: First, import your list of usernames into an Excel spreadsheet. Then, run the Addusers.vbs script downloadable as part of the Windows Scripting Host samples at http://msdn.microsoft.com/scripting/.

Q: If I have multiple Group Policy Objects (GPOs) throughout my Active Directory tree affecting a user logon, in what order to they get applied?

A: First, the top-level domain GPOs are applied, such as the Default Domain policy. Next, any GPOs associated with your Site are processed. Third, policy objects bound to each OU under which your user resides are executed, starting at the root of the Active Directory tree and working down to your user account's parent OU. Try to remember DSOU: Domain, Site, Organizational Unit.

Q: Is it possible to import users and groups from my Novell NDS tree to an Active Directory domain while maintaining my existing tree hierarchy?

A: Yes. You can do so using the DS Migration Tool snap-in found in Program Files\Dsmigrat\dsmigrat.msc.

Q: I am unable to add a new server/workstation to an existing Windows 2000 domain because “a domain controller cannot be located.” But I know the domain controller is up and running; why can't my new machine find it?

74_sysad_16.qx 11/8/99 10:52 AM Page 667


A: Name resolution with DNS may not be working properly. In order to find a domain controller for mycompany.com, a Windows 2000 client will query DNS for the SRV Resource Record _ldap._tcp.mycompany.com. If this record is not found, the domain join cannot proceed.

Q: I have installed and configured the Remote Access Server service on my domain controller, but I still don't see the option to add Remote Access Policies as shown in Figure 16.15. Why not?

A: Remote Access Policies can only be used in native-mode domains, where all domain controllers are running Windows 2000 or later. Alternatively, Remote Access Policies can be used with the local accounts found on member servers (nondomain controllers).

Q: What's the difference between a Domain Local group and a Universal group?

A: Security scope. Both kinds of groups can contain users and global groups from any other domain in your forest, but Domain Local groups can only be added to the Access Control List (ACL) of objects within their own domain. Universal groups can be added to the ACL of any object in the forest.

667

74_sysad_16.qx 11/8/99 10:52 AM Page 668

74_sysad_17.qx 11/8/99 11:34 AM Page 669

Chapter 17

Implementing Security in a Windows 2000 Network


Introduction to Securing a Windows 2000 Network

■

Applying Security Policies

■

Creating, Modifying, and Analyzing Security Configurations

■

Implementing Public Key Security

■

Enabling and Administering File Encryption

669

74_sysad_17.qx 11/8/99 11:34 AM Page 670

670

Chapter 17 • Implementing Security in a Windows 2000 Network

Introduction to Securing a Windows 2000 Network Within any organization, security should be a prime concern for all IT managers or professionals. The need to provide secure services increases as networks grow and become more complex. As more companies link to and provide new Internet-related services, administrators must understand and provide a secure network environment. There are risks associated with new and existing technologies, and an administrator who does not know what tools and options are available can cause more damage than good. Windows 2000 includes new advanced features and tool sets, including major security revisions and additions that provide a more stable and secure platform. Acquiring an understanding of and the ability to use these new security features is a task within itself. Although you may have enough basic information to enable you to configure these new features, it will take some time and experience for you to understand their impact and capability completely. Security is considered an art by many professionals, and it can take many years to grasp the necessary concepts needed to provide a safe environment. Security features that are available in Windows 2000 range from simple to advanced. Understanding these new features and tools is important for creating a secure environment. There are changes to existing features, and new technologies have been added. For example, in earlier versions of Windows NT, security configuration was very cumbersome for administrators making changes to multiple systems. New features have been provided to ease the configuration setup as well as the deployment process. Public key services have been added that allow administrators to provide a more secure identification process for users and utilities. An example is the Encrypting File System, which works in cooperation with the public key services to provide an additional level of file and folder security in conjunction with the NTFS file system.

74_sysad_17.qx 11/8/99 11:34 AM Page 671

Implementing Security in a Windows 2000 Network • Chapter 17

With additional functionality comes complexity. An understanding of these new and expanded tools is critical for providing a secure Windows 2000 network. Improper use of these tools can cause problems rather than providing solutions.

Applying Security Policies The Security Configuration Tool Set has been included to provide more advanced configuration options with group policy. This enables administrators to manage and enforce security using group policy objects. Once a group policy object has been assigned to a domain or organizational unit, the security policies are put into place and enforced. In addition, a local group policy can be defined for stand-alone workstations or servers. The Security Configuration Tool Set has been constructed to ease the administration of security-related services, in response to complaints that although these security settings were available for configuration, they were difficult to manage. For example, an administrator who needed to modify the event log settings for ten computers had to do so on every computer individually. This may work in very small environments but is unbearable in a large enterprise. By integrating these options into the group policy infrastructure, Microsoft has provided a way to enforce a single change on an enterprise network. The security configuration tool set consists of five components. ■

Security Configuration and Analysis MMC snap-in. This is the primary tool used to analyze and configure security settings. It facilitates importing and exporting security configurations to a file for distribution to other computers.

■

Security settings extension to group policy. This allows security settings to be configured and applied through group policy.

671

74_sysad_17.qx 11/8/99 11:34 AM Page 672

672

Chapter 17 • Implementing Security in a Windows 2000 Network ■

Security configuration service. This service is used to provide a background mechanism and is responsible for the security configuration tool set database and engine.

■

Security templates. These files provide predefined security configurations. Microsoft provides several basic variants that are customizable.

■

SECEDIT.EXE command-line utility. This is a commandline interface tool, good for automating large distributions.

The Security Settings Extension to Group Policy When creating or modifying security configurations, you primarily use the Security Configuration and Analysis Management Console snap-in. This security configuration editor is used to set up and administer computer configurations to apply to local computers or through group policies. When they are complete, they can be associated with group policy objects to deploy on computers that fall within the scope of the policy object. Using group policy objects is in most cases the most efficient way to deploy security configurations. These options are made available by the selection of a particular group policy object to manage within the Microsoft Management Console. Security areas are shown in Figure 17.1. The group policy framework assigns security settings into multiple areas. Each area covers a functional grouping of security options that can be configured. Table 17.1 lists the security groupings and describes their functions.

Table 17.1

Available Option Categories within the Group Policy Editor

Policy Option

Description

Account Policies

Used to configure password policies, account lockout policies, and Kerebos policies

Local Policies

Used to configure audit policies, user rights assignments, and security options Continued

74_sysad_17.qx 11/8/99 11:34 AM Page 673


Policy Option

Description

Event Logs Restricted Groups

Used to configure event log settings Used to configure security sensitive group memberships Used to configure options and security for individual services Used to configure security on registry keys Used to configure security on NTFS partitions Used to configure encrypted certificate agents, including data recovery agents Used to configure the IP security for secure communications between computers

System Services Registry File System Public Key Policies IP Security Policies

Figure 17.1

These are the options available for configuring security configurations.

673

74_sysad_17.qx 11/8/99 11:34 AM Page 674

674


NOTE Although group policy objects are associated with users and computers, these security policies are associated only on a per computer basis.

Order of Precedence When security policies are applied, another important factor must be considered. Security policies are applied in a specific order. Since group policy objects can be defined at multiple locations, you must understand what policies take precedence. For example, if a policy is assigned to the local system and another policy is assigned to the organizational unit, the second policy takes precedence. There is a predefined order that security policies use when determining security permissions and configuration settings. In addition, unlike with the previous versions of Windows NT, if a domain policy is applied, it directly affects the local policy. For example, in Windows NT 4.0, a domain account policy setup did not have any impact on the local security accounts database. In Windows 2000, that behavior has been modified. If an account policy is applied to the domain, it overrides the local policy defined for that computer. Therefore, the local policy has the least precedence over any other security policies defined. These available policies are ranked in order, from most to least important: ■

Organizational unit policy

■

Domain policy

■

Local policy

74_sysad_17.qx 11/8/99 11:34 AM Page 675


Creating, Modifying, and Analyzing Security Configurations To apply a security policy, you must first create and configure a security configuration by using the security configuration tool set, which is used to create, analyze, and modify security configurations for Windows 2000 and Windows NT computers. With the release of Service Pack 4 for Windows NT 4.0, the security configuration tool set could be ported to older versions of Windows and could provide legacy support. Included with this tool set are the Security Configuration and Analysis tool and the SECEDIT.EXE command-line utility. In addition, security features such as audit policies, which are primarily used to monitor access to secure systems, are critical. The analysis capability is another important feature. By understanding and using the available security tools, you can apply an effective secure configuration to your computer systems in order to provide a more safe and stable environment.

Security Configuration and Analysis Snap-in When you create or modify security configurations, you must use the Security Configuration and Analysis snap-in. This security configuration editor is used to set up and administer computer configurations to apply to local computers or through group policies. These options are made available when the particular group policy object is selected to be managed within the Microsoft Management Console. This applet breaks up security areas into functional groups, as shown in Figure 17.2. Of the nine functional areas that can be applied through group policy, only seven are configured through these security tools. Each area consists of its own policy configuration options. To observe the options that are available, highlight the appropriate heading in the

675

74_sysad_17.qx 11/8/99 11:34 AM Page 676

676


left pane and select the option in the right pane. These are the seven available groups, and what they are used to configure: ■

Account policies: password policies, account lockout policies, and Kerberos policies

■

Local policies: audit policies, user rights assignments, and security options

■

Event logs: event log settings

■

Restricted groups: security-sensitive group memberships

■

System services: options and security for individual services

■

Registry: security on registry keys

■

File system: security on NTFS partitions

Figure 17.2

These are the options available with the Security Configuration and Analysis tool set.

74_sysad_17.qx 11/8/99 11:34 AM Page 677


SECEDIT.EXE In addition to the Security Configuration and Analysis tool set and the Group Policy snap-ins, a command-line version of these tools has been created. This utility can be used to analyze, to configure, to export, to refresh a policy, and to validate a configuration file. This is a good tool to use when you must analyze or configure many computers. Table 17.2 displays the command-line options available for use with SECEDIT.EXE.

Table 17.2

SECEDIT Command-Line Options

SECEDIT /Analyze: Used to analyze security configurations.

CommandLine

Options

/DB filename

Used to select the database to be configured by this action. If a new database is specified, the /CFG option must be used also.

/CFG filename

This option is used only with the /DB and specifies a security template to use. Specifies the log file to use. Specifies that more detailed information be provided. Specifies that no output or logging be done.

/log logpath /verbose /quiet /Configure: Used /DB filename to configure a computer's security configuration.

Used to select the database to be configured by this action. If a new database is specified, the /CFG option also must be used.

/CFG filename

This option is used only with the /DB and specifies a security template to use.

/overwrite

Specifies to overwrite existing database data. Defaults to appending to existing data. Valid only with /CFG option. Continued

677

74_sysad_17.qx 11/8/99 11:34 AM Page 678

678


SECEDIT

CommandLine /areas area1 area2...

/log logpath /verbose /quiet /Export: Used to export a computer's security configuration to a template file.

/MergedPolicy

/DB filename

/CFG filename

/areas area1 area2...

/log logpath

/Refreshpolicy: Refreshes security policies.

Options Specifies area to be applied to system. Defaults to All Areas. (See documentation for further explanation.) Specifies the log file to use. Specifies that more detailed information be provided. Specifies that no output or logging be done. Used to merge local and domain policies before the export.

Used to select the database to be exported into. If a new database is specified, the /CFG option also must be used. This option is used only with the /DB and specifies a security template to use. Specifies area to be applied to system. Defaults to All Areas. (See documentation for further explanation.) Specifies the log file to use.

/verbose

Specifies that more detailed information be provided.

/quiet

Specifies that no output or logging be done.

/machine_policy Refreshes policy settings for the local computer. /user_policy

Refreshes policy settings for the logged-on user. Continued

74_sysad_17.qx 11/8/99 11:34 AM Page 679


SECEDIT

CommandLine /Enforce

/Validate: Filename Validates a security template file that has been created.

Options Refreshes security settings even if no changes have been made. Filename of the security template to validate against.

Configuring an Audit Policy Advanced and extensive security parameters are great, but they will be pointless without an effective method of monitoring them. For example, if someone is trying to log on the network and does not have rights, how will you know? The auditing feature is designed to allow you to monitor such events. Auditing in Windows 2000 is used to track both user and system events. This is critical to the monitoring of the health and security of the Windows 2000 computer and/or network. Within Windows 2000, three main logs are used to monitor a computer. Other logs may be available, depending upon the services that are installed. The system log is used to monitor system events such as a service not starting or a device failure. The application log is used to monitor application level failures such as Internet Information Server or SQL Server. The security log is used to monitor all security-related events such as failed logon requests, denied file deletions, or successful password changes. Auditing is used to set up the security log. An audit entry consists of three items: ■

The user or process that performed the action

■

The action that was performed

■

The success or failure of the action performed

When you configure auditing in a network environment, you should keep in mind a couple of rules. First, if you are configuring

679

74_sysad_17.qx 11/8/99 11:34 AM Page 680

680


an audit policy for a server or workstation, you must configure a policy for each individual computer. Group policy can be used to automate this process. For example, if you create one policy and associate it to the container that contains all the computers, all computers will be configured with the audit policy settings. If you are configuring an audit policy for domain controllers, only one policy must be defined, because the domain controllers do not maintain a local database like member servers or workstations. They share the domain database. This methodology is very similar to that used in the earlier release of Windows NT. The difference resides with group policy. By using group policy, you can configure all computers instead of each one individually. To create an auditing setup, you must first find or create the group policy object to which to associate these settings. For example, you may use the default domain policy, as shown in Figure 17.3. To configure an audit policy, complete these steps: 1. Start the Microsoft Management Console and choose to Add/Remove snap-ins. 2. Click the Add button, and choose Group Policy. Click the Browse button to select a policy other than the local group policy. 3. A window will appear, and you will be asked to select the group policy to which to assign it. Choose the All tab, select Default Domain Policy, and click OK. 4. Click Finish to complete the setup. Click Close and OK to choose not to add any other snap-ins. 5. Expand the policy object, the computer configuration object, the Windows Settings object, and the Security Settings object. 6. Expand Local Policies and highlight Account Policies, as shown in Figure 17.3. 7. Right-click on the particular audit event in the right pane to configure and choose Security. 8. Check the “Define these policy settings” box to enable this policy. Choose Success and/or Failure events to audit and click OK.

74_sysad_17.qx 11/8/99 11:34 AM Page 681


Figure 17.3

This is an example of an auditing configuration.

As shown in Figure 17.4, several options are available. The first option determines whether the auditing option is enabled or disabled. If the option is disabled, the setting that is already configured is used. If the option is enabled, the settings defined in this check box are used to override the existing configuration. In addition, two criteria are used for auditing security features. You can audit on the basis of success or failure. For example, you may only want to know what logon failures have occurred but may also to know about success and failures on file and folder access. This additional level of configuration allows you to customize these tools further to meet your business requirements.

681

74_sysad_17.qx 11/8/99 11:34 AM Page 682

682


Figure 17.4

These are the configuration options for auditing policies.

Audit Event Types Categories of events have been established to simplify administration and monitoring. Each of these categories consists of event types that can be set up for success or failure event monitoring. As shown in Figure 17.3, these are available and configured from the Group Policy Management Console snap-in. The event types available for configuration are shown in Table 17.3.

Table 17.3

Event Types that Are Available within the Audit Policy

Event type

Description

Account Logon

Includes user account authentication by a domain controller.

Account Management

Includes any user account management, including password changes. Directory Service Access Active Directory object administration. These require additional configuration to audit these events. Logon Events Includes logon and logoff access, including network connections. Object Access

File, Folder, and Printer object access by a user. Additional configuration is required to audit these event types. Continued

74_sysad_17.qx 11/8/99 11:34 AM Page 683


Event type

Description

Policy Change

Monitors changes made to user security options, policies, or audit settings. Monitors rights exercised by users. Monitors system and application processes. Monitors system events such as services starting and stopping.

Privilege Use Process Tracking System Events

Analyzing Security Configurations In a real-world environment, nothing is static. For example, a computer may be set up with a particular security configuration. This configuration may need to be changed in order to fix a problem or add an application, but now this computer does not meet the organization’s standards. This is only one computer, but this situation can quickly become the norm. You should understand how a computer is set up before you make any changes to the security subsystem. For example, a computer may be set up with a special security configuration that enables it to function with a particular application. These situations are normal and may have to be dealt with on a regular basis. To solve this problem, the security configuration tools have a built-in analysis feature. You can use this analysis feature to understand the current security configuration without having to look in many different places. It can also serve as a reporting tool to monitor and eliminate security holes that have been opened up in an environment. In addition, a command-linebased utility is provided for batch processing for a large number of computers. This is crucial to security management for a large enterprise. To analyze a computer’s configuration, you must use one of two methods. The first method involves using the Security Configuration and Analysis Management snap-in. First, you must specify a working configuration database to use for the analysis. This can be either an existing database or a newly created one. To open a database, right-click Security Configuration and Analysis and select Open database, as shown in Figure 17.5. If you choose to create a new database, specify the name and click OK. A prompt will appear; select the appropriate template to use and click OK.

683

74_sysad_17.qx 11/8/99 11:34 AM Page 684

684


Figure 17.5

You must first specify a database for security configuration and analysis.

After a database has been chosen or created, you can configure or analyze the computer configuration by right-clicking Security Configuration and Analysis and choosing the appropriate option, as shown in Figure 17.6. Next, select the log file to save the analysis progress. Once the analysis is complete, you can use the configuration to verify whether the options you chose match the appropriate settings, or even to create a new configuration template.

Figure 17.6

Use these options to identify or configure the security for a computer.

74_sysad_17.qx 11/8/99 11:34 AM Page 685


Security Configuration Templates Although you can analyze and create security configurations, you will need a way to save these configurations to apply to other computers. Although a database-type structure is used to maintain these security settings, it is not used to apply these settings to other computers. Security templates have been designed to allow you to create a standard security configuration to distribute to other computers. For example, you can set up the security configuration on a server and use a template to apply these settings to all the other servers. In addition, several default templates are stored in <systemroot>\Security\Templates. These templates should be tested very carefully and modified to meet your business’s needs. The security templates are configured through a Microsoft Management Console snap-in that is used to configure the security templates and their associated settings (see Figure 17.7).

Figure 17.7

This is the security templates configuration Management Console snap-in.

685

74_sysad_17.qx 11/8/99 11:34 AM Page 686

686


These templates are the default security configuration used during a clean install. These are known as base templates. These templates are applied only during a clean install of Windows 2000 on an NTFS partition and are included for those computers that are upgraded from Windows NT 4.0 or are later converted from the FAT file system. ■

Basicdc.inf for Windows 2000 Domain Controllers

■

Basicsv.inf for Windows 2000 Server computers

■

Basicwk.inf for Windows 2000 Professional computers

In addition to these templates, there are incremental templates that are designed to use the basic templates and provide additional security setup features. These templates do not include the configuration settings that are defined in the basic templates and should be used only after the appropriate template has been applied. These are the incremental templates: ■

Compatws.inf. Removes power user capabilities from a workstation. By default, all users are power users. This setup allows most legacy applications to work with granting power user rights.

■

Dedicadc.inf. Used for computers to be dedicated domain controllers.

■

DC security.inf. Another domain controller security setup.

■

Securedc.inf. Provides additional security configuration to domain controllers. Access Control Lists are not modified by this template.

■

Securews.inf. Provides additional security configuration to workstations and servers. Access Control Lists are not modified by this template.

■

Hisecdc.inf. Provides a high security configuration to domain controllers.

■

Hisecws.inf. Provides a high security configuration to workstations and servers.

■

Setup security.inf. Another basic security configuration.

74_sysad_17.qx 11/8/99 11:34 AM Page 687


NOTE During upgrades of Windows, security policies that have already been applied are lost. Security policies must be reapplied to maintain the desired security configuration.

Implementing Public Key Security As networks grow larger, and more companies provide services to large public networks such as the Internet, the need to increase and maintain security becomes more vital. Computers and networks no longer are locked away in a room or confined to a single building. Networks for organizations not only span the world, but also are connected directly into the Internet. With such complex network infrastructures, the security requirements become harder and harder to manage and maintain. For these reasons, new technologies are being sought out to fulfill these needs. A technology that is growing more popular along side the Internet is public key services. With the use of this huge public network becoming increasingly popular every minute, these security services have become critical to companies providing e-commerce and Web-based applications. As this technology becomes more popular, more ways are found to use it. For example, some corporations are using this technology to replace network logon IDs. This provides a more secure environment, because users do not write down their logon credentials or use easy-to-guess passwords. Public key services provide a mechanism for validating users’ or objects’ identity using a proven symmetric cryptographic encryption algorithm. With both a public and a private key, it is possible to maintain a more secure environment than is possible with conventional methods. To provide these services, a Public Key Infrastructure (PKI) is developed. This infrastructure consists of

687

74_sysad_17.qx 11/8/99 11:34 AM Page 688

688


several different components and represents a logical collection of items. There are companies that provide public key services to millions of users throughout the world.

Components of Public Key Services A Public Key Infrastructure (PKI) is made up of several components. Each installation varies with the service being provided and the vendor being used to create the infrastructure. Windows 2000 now adds support to build, maintain, and utilize public key services within the operating system. Public key services can be used to integrate with Active Directory or as a stand-alone configuration to provide service outside an organization. Several components are included with the Windows 2000 public key services, including certificates, certificate authorities, group policy extensions, and hardware add-on support.

Certificates A certificate can be defined as a digital signature provided by an authority that states that your certificate is valid and belongs to you. A certificate is used to bind a cryptographic public key to the person or service to which the certificate is assigned. Certificates can be used by many different services including Web-based and e-commerce applications to provide a secure communications and authentication method such as Web-based application user authentication, secure e-mail, or IP Security (IPSEC). Windows 2000 offers additional functionality in the form of a domain user validation with a certificate. A certificate is issued by a certificate authority. A Windows 2000 certificate follows the X509v3 format, which defines the standard for the information stored as well as the cryptographic standard used in defining a certificate. Information included may contain identifiers for the certificate recipient or publisher, public-key algorithm information, validity period, or additional customizable fields. A certificate remains valid only as long as the stated validity period. Once

74_sysad_17.qx 11/8/99 11:34 AM Page 689


a certificate expires, a new one must be obtained. In addition, there is a revocation process under which a certificate can be revoked prior to its validity expiration. For example, if Joe has a certificate assigned and leaves his company, the company may choose to revoke the certificate to remove his access to a resource. Each issuer must keep a certificate revocation list that is checked every time the certificate is used. This helps to maintain the validity of certificates.

Certificate Authority One key component of any public key infrastructure is the certification authority (CA). The certification authority is used to perform a variety of functions, from validating certification authenticity, through responding to certification requests, to revoking expired certificates. Major vendors such as Verisign and Cybertrust provide certificate authority services to the public. Certificate authorities of this size service millions of users. Windows 2000 makes it possible to create a certificate authority within your private intranet. This allows you to manage how certificates are used within your own environment. A public key infrastructure may consist of a two-class hierarchy of certificate authorities that trust each other. The first class, the root, is the top of the CA hierarchy. The second class, intermediate, is used to identify all other downlevel CAs. By providing the ability to link these certificate authorities together, additional customization is available to create as advanced an infrastructure as is required to meet an organization’s needs. When using this infrastructure, you can also further decide what information is stored within it. Remember that when certification authorities are connected, other organizations may differ in their implementations as well. In addition to a certification hierarchy, these services must maintain a certificate revocation listing (CRL). These lists are used to revoke certificates prior to the expiration date that is maintained. This is used if a certificate has been compromised or should no

689

74_sysad_17.qx 11/8/99 11:34 AM Page 690

690


longer be valid. Once the certificate is added to the CRL, it will no longer be accepted as valid. Each certificate must check the issuer’s certificate revocation list whenever it is used. Within Windows 2000, two types of certification authorities can be configured. The term policy module is used to identify them and is chosen during the installation of certificate services. These modules determine how each certification authority will operate. The two policy modules available are Enterprise and Standalone. Usually, an Enterprise CA is used for users located within the Windows 2000 Active Directory, and a standalone is used outside the Windows 2000 network. Specific requirements are used to define the environment required for each class and type of certificate authority used in Windows 2000. The Enterprise Root CA is used as the root of a Windows 2000 Active Directory–based network. This is used to provide services to users within your network. Requirements for the Enterprise Root CA include: ■

Windows 2000 Active Directory

■

Windows 2000 DNS Service (required by AD)

■

Administrative privileges on the certificate authority, Active Directory, and DNS server(s)

The Enterprise Subordinate CA is similar to the Enterprise Root CA except that it does not maintain the root privileges. An Enterprise Subordinate CA may be used to service a smaller number of users or computers, such as an organizational unit, and it maintains a trust to the Enterprise Root CA. This configuration requires: ■

Windows 2000 Active Directory

■

Windows 2000 DNS Service (required by Active Directory)

■

A parent CA. This could be an internal subordinate or Root CA. In addition, an Enterprise Subordinate CA can report to a stand-alone or external third-party CA.

74_sysad_17.qx 11/8/99 11:34 AM Page 691


A Standalone Root CA is used to provide services external to the Windows 2000 network and is at the top of a CA hierarchy. A Standalone Root CA is used primarily to provide certificates to subordinate CAs which are used to provide a more secure, isolated type of configuration. The requirements for a Standalone Root CA are local administrative privileges. A Standalone Subordinate CA is used as a solitary server or exists in a Standalone trust hierarchy. Standalone CAs are primarily used to offer certificates outside your organization. The requirements for Standalone Subordinate CA include local administrative privileges, and an association with a certificate authority that will respond to the certificate requests. (This can be external.)

Group Policies Included with group policy are some public key services configuration options. These options are used to provide additional services that cannot be used without public key support. For example, the Encrypting File System uses public key services to provide security and recoverability. Although none of the services provided by group policy are required to operate a public key infrastructure, they provide additional services that can use the benefits that a public key service provides. The services that are available through group policy, which are shown in Figure 17.8, are: ■

Automatic Certificate Request Settings. Certificate requests for computer objects can be automated by using this policy option. This allows a computer to request, receive, and install a certificate automatically on the basis of group policy settings that have been defined. This will work only with Windows 2000 certificate authorities (CA) using the Enterprise module.

■

Encrypted Data Recovery Agents. Used to identify the users who are granted the ability to recover files used by the Encrypting File System. If a private key is lost, a data recovery agent can recover files encrypted by EFS using the public key service.

691

74_sysad_17.qx 11/8/99 11:34 AM Page 692

692


Trusted Root Certification Authorities. This option is used to publish certification authorities to be used by users or computers. If the CA is part of Windows 2000 Active Directory, this is not required. If a third-party CA is used, this option should be used to publish those.

■

Enterprise Trust. This option defines the scope of a certification authority. Although a CA may have the ability to create certificates for multiple items, this option can be used to filter only the abilities you want.

Figure 17.8

These are the options available within group policy for public key services.

Hardware Add-ons In addition to software–based public key services, additional hardware–based features are available. Windows 2000 includes support for hardware–based public key services such as smart cards. These devices are used to maintain cryptographic information for storage and security, and they are used to store certificates that have been

74_sysad_17.qx 11/8/99 11:34 AM Page 693


issued. They also make it possible to authenticate users for any services that have been set up such as logon validation, Web server authentication, or secure e-mail services.

Using Public Key Services In configuring public key services, in order to support a PKI, the first step is to decide on and set up one of the four types of certificate authorities. To set up a certificate authority, first verify that the prerequisites have been met for the type of CA you have chosen. Next, follow these steps: 1. Select Start | Settings | Control Panel. Select the Add/Remove programs applet. 2. Select the Add/Remove Windows Components button on the left-hand sidebar. 3. Select Certificate Services as shown in Figure 17.9. A prompt will appear stating that because of the security nature of the certificate services, the computer cannot be renamed or its domain membership changed. Click Yes to accept this prompt. Click Next to continue.

Figure 17.9

Select certificate services to be installed.

693

74_sysad_17.qx 11/8/99 11:34 AM Page 694

694


4. As shown in Figure 17.10, select the Certificate Authority role to use. This should have been determined before you started this process to verify that all prerequisites were met. The Advanced button provides additional features such as the cryptographic service provider and the encryption algorithm.

Figure 17.10 Choose the CA type to be created.

5. Click Next to continue. The CA Identifying Information screen is displayed next, as shown in Figure 17.11. Type the information and click Next. 6. Select the Database and Log locations to be used for this CA. Click Next to continue. If the World Wide Web services are running, a prompt will appear. This is required to set up the Web publishing services for the CA. Click OK to continue. 7. If you chose to install a subordinate CA, a selection now appears to specify the parent CA to use. Fill in the path and click Next to continue. 8. A file copy will then begin the installation process for Certificate Services. (You may be prompted for your server CD.) When this is done, click Finish to complete the installation.

74_sysad_17.qx 11/8/99 11:34 AM Page 695


Figure 17.11 Fill out the information to be associated with this Certificate Authority.

To verify that Certificate Services is functioning properly, you can use Internet Explorer 5 and open this URL: http://<server>/certsrv. If you follow the prompts, you should be allowed to request a certificate from the server. This can also be used as a permanent method of distributing certificates to users or computers. To request a certificate, connect to the IIS server running on the certificate authority. You can use more than one type of certificate. 1. Open Internet Explorer 5 by navigating to Start | Programs | Internet Explorer. 2. Select the URL for the appropriate server and the virtual directory of “certsrv.” (Figure 17.12 displays the Web page used for requesting Certificate Services.) Click Next. 3. Specify the type of certificate to request. Click Next (see Figure 17.13).

695

74_sysad_17.qx 11/8/99 11:34 AM Page 696

696


Figure 17.12 Connect to the IIS server to request a certificate.

Figure 17.13 Select the type of certificate to request.

74_sysad_17.qx 11/8/99 11:34 AM Page 697


4. Fill out the information to identify yourself within the certificate. This information is stored within the certificate for future use. Some types of certificates can gather information automatically by querying Active Directory (see Figure 17.14).

Figure 17.14 Information identifying the owner of the certificate is stored.

5. If the Certificate Authority is configured as an enterprise server, it will respond to a certificate request immediately, but stand-alone servers will await an administrator’s approval before granting a certificate request. Figure 17.15 shows the Web page shown on which a stand-alone server is configured. To manage certificates, you must use the Certification Authority Management Console snap-in. You can reach it by going to Start | Programs | Administrative Tools | Certification Authority. You must use this tool to accept pending certificate requests. Figure 17.16 shows a pending request, Figure 17.17 an issued certificate.

697

74_sysad_17.qx 11/8/99 11:34 AM Page 698

698


Figure 17.15 This Web page is displayed if a certificate from a stand-alone Certificate Authority is requested.

Figure 17.16 Pending requests must be approved by an administrator.

74_sysad_17.qx 11/8/99 11:34 AM Page 699


Figure 17.17 Completed requests are located in the Issued Certificates folder.

To install a certificate, you can use the same URL as the one that is used to retrieve a certificate. 1. Open Internet Explorer 5, navigate to the CA server running IIS, and connect to the “certsrv” virtual directory. Figure 17.18 shows the option to retrieve a certificate from the certificate authority. 2. Select Download CA certificate as shown in Figure 17.19. A certificate revocation listing can be downloaded as well. This provides a mechanism for updating certificates to protect against unauthorized use. 3. Open the certificate and install it to your computer as shown in Figure 17.20. Information about its possible uses as well as validity dates are provided. Select Install Certificate.

699

74_sysad_17.qx 11/8/99 11:34 AM Page 700

700


Figure 17.18 Certificates are retrieved from a CA through Internet Information Server and Internet Explorer 5.

Figure 17.19 Retrieve a certificate or certificate revocation listing.

74_sysad_17.qx 11/8/99 11:34 AM Page 701


Figure 17.20 Install a certificate to a computer.

4. The Certificate Manager Import Wizard will now start. Click Next (see Figure 17.21). Select the certificate store to use for managing certificates. By default, this is configured to detect for you automatically.

Figure 17.21 Select the certificate store to use.

701

74_sysad_17.qx 11/8/99 11:34 AM Page 702

702


5. The options that have been chosen will now be specified. Click Finish. Figure 17.22 shows the import completed message as it appears when the process is done.

Figure 17.22 Import Completed dialog for installing certificates.

Enabling and Administering File Encryption If a computer experiences a hard disk failure, a common practice is to boot to a floppy disk. This can be used for multiple reasons, most of which are valid. For example, an administrator may boot to a floppy and run an antivirus application to verify that a computer is not infected by a boot virus. An administrator can also boot a computer from a floppy to bypass security features that may have been enabled. As the Microsoft NTFS file system has become more popular, new utilities that provide this ability have become more common. There may be sensitive documents on a network to which even a domain administrator should not be allowed access. For example, the human resources documents may be stored on a file server. These files may require additional security above and beyond NTFS permissions. The Encrypted File System (EFS) was designed to provide a secure solution for situations like these. The encryption processes associated with this tool are seamless to the user. A user who wants to encrypt a file selects the encryption attribute, and it is done. This system is part of the overall security design within Windows 2000 and Active Directory. The use of EFS with other services such as certificate authorities and group policies can provide additional management and functionality.

74_sysad_17.qx 11/8/99 11:34 AM Page 703


Encrypted File System Architecture The Encrypted File System was developed and designed to prevent unauthorized users from accessing a file or directory. This is an additional tool to add to your existing arsenal of security mechanisms. EFS provides the technology built into itself in cooperation with the NTFS file system. When an encrypted file or folder is set up, you work with it as if were a regular object. Maintaining encryption and decryption is transparent to the user. If a folder is encrypted and a user copies a file into it, the new file now becomes encrypted as well. In addition, if a user tries to open a file with an application such as Microsoft Word, the file will be decrypted and made available to the user without the user’s knowledge. An unauthorized user who attempts to rename, move, copy, or delete the file or folder will receive an “Access denied” error message. You encrypt and decrypt a file or folder by selecting or deselecting the encrypt property, much as you set the system or hidden attribute. Although EFS works much like FAT-based files and their attributes, this technology is currently supported only on the version of NTFS available with Windows 2000.

Encryption and Decryption EFS is based upon the public key technology available in Windows 2000 and Active Directory. It uses this public key service to provide secure file encryption based on Microsoft’s CryptoAPI security architecture. It uses a fast symmetric encryption algorithm based on random character generation stored within a file encryption key (FEK). Each file that is encrypted maintains its own FEK, which is also encrypted. This key is later used to decrypt the original file as needed. Two public keys are associated with each file during the encryption process: a public key associated with the user and a recovery agent public key. When a file requires decryption, first the FEK is decrypted by either the original user or the recovery agent. The FEK is then used to decrypt the original source file. Therefore, the recovery agent

703

74_sysad_17.qx 11/8/99 11:34 AM Page 704

704


responsibilities should be carefully monitored and controlled. In addition, private keys are maintained in a secure private store that is separate from the Security Accounts Manager database. This also provides a more secure environment for these services.

Data Recovery If the Encrypting File System is used, there will always be scenarios in which data recovery will be required—for example, if a user loses a file and needs to restore it, or if users leave an organization and later have a need some for files they had worked on. EFS has builtin mechanisms to allow for many different situations that require data recovery. EFS accomplishes this by requiring that a recovery policy be set up before encryption is made available. This allows a person to be designated as the recovery agent. This can be done automatically the first time an administrator logs on the machine, making that person the recovery agent. The recovery policy is set up by default locally for computers that are not part of a Windows 2000 network. For these computers, the policy is configured at the domain, organizational unit, or the computer object itself. When this policy is applied to one of these levels, all computers included within that scope are affected by this recovery policy. These recovery policies are issued by a certificate authority (CA) and managed within the Certificates Microsoft Management Console snap-in. The recovery agent functions by using a certificate and private key that will allow recovery on the basis of the scope set up in the policy. To set up recovery, you must first export the associated certificates and private key and store them in a secure area, and then you should delete the certificates in the Management Console snapin. The lost files can be restored after the associated private key and certificate are restored using the Import command. You should then remove the certificate again. Although this is not a requirement for completing these operations, it is a good security procedure to follow.

74_sysad_17.qx 11/8/99 11:34 AM Page 705


When using the encrypting file system within a Windows 2000 network, it can become more complicated. The domain administrator delineates the ability to administer the recovery policy. By default, domain administrators are made recovery agents when the first Windows 2000 domain controller is built. Be sure to understand the scopes defined for the recovery agents, as they can grow out of control in an enterprise environment.

NOTE Windows 2000 uses the security subsystem to enforce and cache the recovery policy for EFS. This allows a system such as a laptop, that is temporarily off the network, to keep using file encryption services.

Using the Encrypted File System Two methods for using EFS have been made available in Windows 2000. The first method is to use the Explorer interface. The ability to encrypt files and folders can be configured from the Properties tab of a particular folder. To set up a folder to use the Encrypting File System, complete these steps. (This example represents a single stand-alone workstation.) 1. Start by selecting Start | Programs | Accessories | Windows Explorer. 2. In the right pane, highlight the appropriate directory. 3. Right-click the directory chosen and choose properties. Once complete click the Advanced button (see Figure 17.23). 4. Next, select the Encrypt contents to secure data check box that is shown in Figure 17.24. Other options include Archiving, Indexing, and Compression.

705

74_sysad_17.qx 11/8/99 11:34 AM Page 706

706


Figure 17.23 The properties dialog is used to enable EFS for a directory.

Figure 17.24 This is the option to encrypt the contents selected.

74_sysad_17.qx 11/8/99 11:34 AM Page 707


5. The option box is shown in Figure 17.25. Select the appropriate option to apply changes either to this folder or to the folder, files, and subdirectories as well.

Figure 17.25 Select the objects to which to apply encryption.

6. Once the selection is chosen, click OK, and the changes will be applied. There is a second option available for using the Encrypted File System through command-line utilities. The Cipher.exe command is used to apply, remove, or modify encryption applied to a directory. When used without any of these command-line options, the encryption state of the current files and directories is displayed. Figure 17.26 gives an example of Cipher.exe in use. This is a listing of the command-line options that are available for Cipher.exe. CIPHER [/E | /D] [/S:dir] [/A] [/I] [/F] [/Q] [/H] [pathname [...]] /E

Encrypts the specified directories. Directories will be marked so that files added afterward will be encrypted.

/D

Decrypts the specified directories. Directories will be marked so that files added afterward will not be encrypted.

/S

Performs the specified operation on directories in the given directory and all subdirectories.

707

74_sysad_17.qx 11/8/99 11:34 AM Page 708

708

Chapter 17 • Implementing Security in a Windows 2000 Network /A

Operation for files as well as directories. The encrypted file could become decrypted when it is modified if the parent directory is not encrypted. It is recommended that you encrypt the file and the parent directory.

/I

Continues performing the specified operation even after errors have occurred.

By default, CIPHER

stops when an error is encountered. /F

Forces the encryption operation on all specified objects, even those which are already encrypted. Already-encrypted objects are skipped by default.

/Q

Reports only the most essential information.

/H

Displays files with the hidden or system attributes. These files are ommited by default.

pathname

Specifies a pattern, file or directory.

Figure 17.26 This is an example of Cipher.exe.

NOTE Only files are encrypted by EFS. When a folder is selected, all files contained within it , as well as all subfolders, are marked as encrypted.

74_sysad_17.qx 11/8/99 11:34 AM Page 709


Guidelines for Using EFS Although the Encrypting File System is transparent to the user, some rules and guidelines must be followed for the proper use of this new feature. These guidelines are based on functionality provided by other subsystems as well as on issues that have been found in certain situations. Other rules are based on the architecture and the way EFS performs its functions. Some of the most important guidelines to follow when EFS is used are: ■

Only NTFS volumes support EFS.

■

Compressed files or folders do not support encryption.

■

When you copy or move encrypted files, verify that the destination volume supports encryption services. Currently, only Windows 2000 NTFS volumes support EFS.

■

Encrypted files cannot be shared. Only the user who encrypted the file has permission to open it.

■

System files cannot be encrypted.

■

Files that are marked with the Read-only attribute cannot be encrypted.

■

Encrypted files do not maintain their security when they are copied over the network. To provide a secure communications mechanism between two computers, an additional feature such as IPSEC (IP Security) must be employed.

■

If a file was created with 128-bit encryption, it must be restored to a system that also employs 128-bit encryption. Restoring an encrypted file to a system with a lesser encryption level such as 56-bit encryption, the file will be unreadable.

709

74_sysad_17.qx 11/8/99 11:34 AM Page 710

710


For Managers Only

The Encrypting File System

As with any new security technology, many individuals seek out to crack it or find holes within its architecture. Although this may sound bad, it is a good practice as it publicizes security holes that may be present that otherwise are left hidden. In many cases, this also prompts the manufacturer or a security agency to provide a fix or workaround to prevent securityrelated threats. This publicity is important for educating IT professionals and organizations about potential security problems before they are affected. When the Encrypting File System first became available, many reports, white papers, and security bulletins were posted to educate professionals about the vulnerabilities and weaknesses of EFS. Although techniques that granted the ability to bypass the additional security were discussed, improper configuration or incorrect use was the culprit in each of these security-related incidents involving EFS. As with most securityrelated tools, it is installed in a basic configuration. To properly set up and use this tool, you must understand how it works and how to configure it. To gain the benefits EFS can provide, use the resources available and create a set of policies to complement a design to fit your organization.

Best Practices It is important to set up and maintain each utility or tool correctly. By implementing any of these features poorly, you can cause more administrative overhead and make the Windows 2000 network unstable. These are best practices that can be used to properly configure and administer security in a Windows 2000 network: ■

When you configure policies, remember that Active Directory allows only one domain account policy residing at the root of the directory.

74_sysad_17.qx 11/8/99 11:34 AM Page 711

Implementing Security in a Windows 2000 Network • Chapter 17 ■

Minimize the number of group policy objects for manageability.

■

Make group policy objects as granular as possible to help minimize the number of required policy objects.

■

Try to group policy configurations into logical groupings. This helps you manage group policy objects.

■

Test predefined Security Templates before you implement them. Copy and customize templates for future installations.

■

Importing security configurations ensures that unusual or special security settings are maintained. On the other hand, this also imports security holes. Carefully examine every Security Template you create.

■

When computers are upgraded into a Windows 2000 network, account and password policies will override local policies on any computers.

■

When restricted groups are set up, any memberships that are not specified are removed.

■

Try to place computers into Active Directory on the basis of policy scopes. This is helpful for maintaining and managing group policy objects. For example, place all workstations located at one location in a single container if you can.

■

Remember to maintain valid backups of public key certificate authorities. Without a valid backup, you may not be able to administer existing certificates.

■

Use the certificate authority that best suits your needs. Enterprise CAs are usually used for internal users, and Standalone CAs are used to provide public key services externally.

■

Encrypt any Temp directories in use. This forces any temporary files that are created to be encrypted by default.

■

Encrypt folders instead of files. This encrypts files created in the future.

■

Encrypt the folders used to store documents. For example, you may encrypt the My Documents directory to secure personal files.

711

74_sysad_17.qx 11/8/99 11:34 AM Page 712

712


Use the Export utility within the Certificates Microsoft Management Console snap-in to make backup copies of certificates for restoration purposes.

■

Export and delete certificates and store them in a secure location. This further guarantees the security of this system. If they are required for recovery, reimport the certificate, recover the particular files, and remove the certificate and associated keys again.

■

When you move files, use the cut-and-paste rather than the drag-and–drop method. If you drag and drop a file, the encryption will not be moved with the file.

Summary As networks begin to grow, security is becoming more of a necessity in organizations. As their networks become more complex, the security requirements become more difficult to manage. With this growth comes the business need for security setups that are more advanced and easier to manage. With Windows 2000, new security enhancements have been provided for previous utilities, and new add-ons and utilities have been added to further ease the burden of administration. Security additions included services such as group policy security extensions. Related to that tool set is the security configuration manager. These tools provide the ability to analyze, configure, and monitor security setting for an enterprise. In addition, public key services have been added to provide advanced certificate services integrated with Windows 2000 and Active Directory. Another feature is the Encrypting File System, or EFS. In conjunction with NTFS, this provides a more advanced file and folder security feature set. The security configuration tool set has been created to ease the deployment of security configurations. Five tools are included within this tool set: Security Configuration and Analysis Management snap-in, security settings group policy extensions, security configuration service, security templates, and the secedit.exe command-line

74_sysad_17.qx 11/8/99 11:34 AM Page 713


utility. The security extensions to group policy were created to take advantage of the group policy infrastructure. This allows for easy deployment and advanced administration of security policies through an enterprise environment. Nine policy categories are defined: account policies, local policies, event logs, restricted groups, system services, registry, file system, public key policies, and IP security policies. Security policies also can be applied only to computers. When security policies are applied, a specific order of precedence is used. From lowest to highest, this is local policy, domain policy, and then organizational unit. When you apply security policies, you must first define what settings to use. The Security Configuration and Analysis snap-in can be used to analyze and configure security settings. The settings defined by this tool set are broken up into seven functional groups: account policies, local polices, event logs, restricted groups, system services, registry, and file system. In addition to this tool, a command-line utility is provided. This tool is used primarily for automating large-scale configurations. It also can be used to analyze, export, refresh a policy, and validate a security template. When defining security parameters, you must also set up a mechanism to monitor the output of the security setup, so you must define an audit policy. An audit entry will consist of three items: the user or process that performed the action, the action that was performed, and the success or failure of that action. Use group policy to configure audit policies to be applied to multiple computers. When you configure security parameters, you may choose to analyze a computer security setup first. When you analyze a computer, you first must specify a database in which to store the information. If one does not exist, create a new database using the security configuration and analysis tools or the secedit.exe command-line utility. You can use security templates to configure a computer with predefined parameters. Microsoft provides several templates, including the default configurations used during installation. In addition, you can save configuration files into templates to create your own.

713

74_sysad_17.qx 11/8/99 11:34 AM Page 714

714


Public key services have been added to Windows 2000 to provide a more secure network environment. Public keys are based upon a symmetric encryption algorithm used to identify an entity for validation purposes. Several different components are included with Windows 2000 public key services, including: certificates, certificate authorities (CAs), group policy extensions, and hardware add-on support. Certificates are the objects that contain the information for validating the user. Certificate authorities are the back-end system used to validate a certificate’s authenticity. Four types of CAs are available: Enterprise Root, Enterprise subordinate, Standalone Root, and Standalone subordinate. Enterprise CAs are integrated with Active Directory and used for internal users, and stand-alone CAs are used to provide services to external parties. Root CAs are the topmost certificate authority in a hierarchy, and subordinates always report to a parent CA. Group policy extensions are used to provide additional public key services such as trusted external CAs and encrypting file system recovery agents. The hardware add-on support is used to allow devices such as smart cards to be used with the public key infrastructure. The Encrypting File System (EFS) is used to provide a more secure method of storing files and folders. Used in conjunction with NTFS, EFS uses a public-key-based encryption method to secure files located on a NTFS partition. EFS is seamless to a user, and all functions perform in the background. To activate EFS, just select the Encrypt advanced option on a folder, and all future files will be encrypted. In addition, a data recovery agent must be used if the encryption keys are lost. These are defined by default the first time EFS is used on a domain or on a stand-alone computer. In a domain, the administrator’s group is defined as the recovery agent; on a local machine, the local administrator is used. A commandline-based utility, cipher.exe, is also provided to encrypt and decrypt files and folders. With security becoming vitally necessary in every environment, additional and more advanced tools are needed to keep up with the changing times. Windows 2000 provides enhancements and new

74_sysad_17.qx 11/8/99 11:34 AM Page 715


features that provide this additional level of security. In addition, some tools are integrated directly into Active Directory and provide not only security from external sources, but internal security improvements as well.

FAQs Q: What are provided to apply standard configurations for security settings?

A: Security templates. Q: What group policy security setting is used to configure audit policies, user rights assignments, and security options?

A: Local Policies. Q: What are the four components of the Windows 2000 public key services?

A: Certificates, certificate authorities (CAs), group policy security extensions, and hardware add-on support.

Q: What are the four types of certificate authorities in Windows 2000?

A: Enterprise Root, Enterprise Subordinate, Standalone Root, and Standalone Subordinate.

Q: What file systems are supported by the Encrypting File System? A: Windows 2000 NTFS. Q: What two methods are available for configuring EFS? A: Windows Explorer and Cipher.exe command-line utility.

715

74_sysad_17.qx 11/8/99 11:34 AM Page 716

74_sysad_18.qx 11/8/99 11:01 AM Page 717

Chapter 18

Sharing File Resources by Using DFS


Introduction to DFS

■

Setting Up a Fault-Tolerant DFS Root

■

Setting up a Stand-Alone DFS Root

■

Setting Up Child Nodes

■

Configuring Child Nodes as Replica Sets

■

Administering DFS

■

Client Interactions with DFS

717

74_sysad_18.qx 11/8/99 11:01 AM Page 718

718

Chapter 18 • Sharing File Resources by Using DFS

Introduction to DFS Distributed File System (DFS) is a Windows 2000 Server component that makes the management of and access to shared file resources simpler. DFS simplifies network file access for the user by presenting available shares in a single logical hierarchical namespace, and eliminates the need for users to know which share of which server contains files that they need. Users can simply navigate through a hierarchy of folders that reflects the geographical or organizational layout of an organization. DFS was initially available as an add-on to NT Server 4.0 (requires Service Pack 3 or higher) and is improved with Windows 2000 Server. The version of DFS available for Windows 2000 takes advantage of Active Directory and supports fault tolerance of child nodes. Shared resources from an NT4 server can be integrated into a Windows 2000 DFS namespace. This eases the migration path for an organization that wants to start deploying Active Directory and Windows 2000 but does not want to have to quickly migrate all servers in a short period of time. In most organizations, users are spread out in several divisions, departments, and locations. The information that these users need to do their jobs is likewise spread out among several different fileservers in these locations. DFS unifies all these shares into a single logical hierarchical namespace. The physical location of these resources is no longer important for the user to know, as the user can simply query DFS and see all of the organization’s files. In addition to helping users locate files easily, DFS can provide other advantages. If several different departments update an organization’s intranet content, a DFS namespace can be used to link the content together. The intranet root URL can point to the DFS root, and what appear to be subdirectories under the intranet server are actually separate directories on separate servers. This is separate from Internet Information Server and other Web servers’ ability to host virtual Web servers. In this case, as far as IIS can tell, all files and directories in the DFS namespace are part of a single disk.

74_sysad_18.qx 11/8/99 11:01 AM Page 719

Sharing File Resources by Using DFS • Chapter 18

DFS also supports several different protocols, and allows an administrator to include in the DFS namespace any file system for which a client redirector exists. Any volumes available to a client via a UNC path (NT 4.x and 3.x shared volumes, Client Services for NetWare, Gateway Services for NetWare, and the Novell Client 32 software) can also be included in the DFS namespace. Figure 18.1 shows a portion of the network of a sample corporation. This corporation has set up several Active Directory domains into an Active Directory tree.

Figure 18.1

A sample corporate network setup.

corporation.com

philadelphia

los_angeles

\\w2kdc1\share_1

\\w2ksvr2\share_1

\\w2kdc1\share_2

\\w2ksvr2\hr_info \\w2ksvr2\intranet_la

\\w2kdc1\hr_info \\w2kdc1\intranet_philly

The figure shows the top-level domain, corporation.com, and two of its child domains, philadelphia.corporation.com, and los_angeles.corporation.com. Each of the two child domains is connected by WAN links. In the philadelphia domain, one of the domain controllers, \\W2KDC1, has two shares available to users, share_1 and share_2. Similarly, one of the domain controllers in the los_angeles domain shares out \\W2KSVR2\SHARE_1.

719

74_sysad_18.qx 11/8/99 11:01 AM Page 720

720


In addition, there are two Web sites that local employees use to maintain separate intranets. The organization would like to consolidate this intranet, but would like to keep the information on separate servers. The Human Resources department, located in Philadelphia, publishes several electronic HR forms and documents that it wants to make available to users in both locations. To accomplish this, there is a share created on each server called hr_info. At the end of each day, the HR manager copies any updated forms or policies from \\w2ksvr2\hr_info to \\w2kdc1\hr_info. The administrator who manages IT resources for both locations constantly receives complaints that the files located on these two servers are not easy to locate. There is no easy way to determine whether a needed file is on the local server. Even if the correct server is found, the share and path to that file are also difficult to determine. Implementing DFS can solve these problems. To allow for a single hierarchical namespace for the users in both domains to access files, the resources from both file servers should be combined into a DFS namespace and published into Active Directory. To allow the intranet to be combined into what appears to be a single site, another DFS namespace is created. The intranet is not published into Active Directory. To eliminate the manual task of ensuring that all Human Resources information is kept up to date in both locations and accessible to all employees, the HR information currently stored on two servers is added to the DFS namespace. This combined HR information appears as a single resource, although clients in either office are able to access it locally. Figure 18.2 gives an example of the proposed DFS solution. Table 18.1 lists some definitions that are important for setting up and administering DFS in Windows 2000. The Distributed File System service is installed automatically when you install Windows 2000 Server. It is considered a core component of Windows 2000, and as such, cannot be uninstalled. The service alone will not do anything. DFS shares must be created before the benefits of DFS can be seen by the users.

74_sysad_18.qx 11/8/99 11:01 AM Page 721


Figure 18.2

A proposed DFS solution.

\\corporation.com\dfsroot

Fault-tolerant DFS root published into Active Directory

\\corporation.com\dfsroot\engineering

Contents of \\w2kdc1\share_1

\\corporation.com\dfsroot\marketing

Contents of \\w2kdc1\share_2

\\corporation.com\dfsroot\sales

Contents of \\w2ksvr\share_1

\\corporation.com\dfsroot\intranet\la \\corporation.com\dfsroot\intranet\philly \\corporation.com\dfsroot\hr_info

Table 18.1

Standalone DFS root contents of intranet servers available from one location

Contents of hr_info shares Clients will be sent to local copy

DFS Definitions

Item

Definition

DFS root

A share created on a Windows 2000 server that runs the DFS service. There are 2 types of DFS roots, stand-alone and fault-tolerant.

Stand-alone DFS root

A DFS root whose topology and configuration information is stored on the DFS root server. If the DFS root server crashes or becomes otherwise unavailable, the entire DFS namespace hosted by that DFS root becomes unavailable. If this happens, the individual shares hosted on other servers are still accessible through their individual UNC paths. This is the only type of DFS root available on an NT4 Server. This share appears to client machines as a normal UNC share in the format \\server\share. Continued

721

74_sysad_18.qx 11/8/99 11:01 AM Page 722

722


Item

Definition

Fault-tolerant DFS root

A DFS root whose topology and configuration information is stored and replicated as part of the Active Directory schema. The fault tolerance refers to the ability of the clients to query any local Windows 2000 domain controller to discover the DFS topology. Since no single individual machine hosts the DFS root, this share appears to client machines as a normal UNC share in the format \\domain\share. A share from another computer that is incorporated into the DFS namespace. A child node created from a share on a machine running an older version of Windows NT. A leaf node that participates in the DFS namespace cannot have a child node below it. A location in your DFS namespace where another DFS root is inserted. As clients traverse the Inter-DFS link, the responsibility for mapping the DFS namespace to the shares is transferred to the new child DFS root. A set of two or more shares whose content is identical. These shares can be published into the DFS namespace at the same child node. Clients are sent to the closest copy, based on the client's Active Directory site configuration, and the sites of each of the replica shares.

Child node Leaf node

Inter-DFS link

Replica set

Setting Up a Fault-Tolerant DFS Root The administrator for the corporation.com network must set up the basic DFS namespace and publish it into Active Directory. DFS administration is performed from the Distributed File System snap-

74_sysad_18.qx 11/8/99 11:01 AM Page 723


in for the Microsoft Management Console (MMC). The snap-in can be loaded in one of these ways: ■

From the Start menu, point to Programs, then to Administrative Tools, then click Distributed File System. This loads a user-mode console containing the DFS administration tools. This console file is located in %systemroot%\system32\dfsgui.msc.

■

From an author-mode console, click the Console menu, then click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears. Click Add. The Add Standalone Snap-in dialog box appears. Select Distributed File System from the list, and click Add.

NOTE When you first load the DFS Administration Console, you get the message shown in Figure 18.3. This message indicates that there are no DFS roots currently being managed from this console, and can be ignored.

Figure 18.3

This message is displayed after the DFS console is run for the first time.

When you load DFS, you get the blank DFS console window shown in Figure 18.4.

723

74_sysad_18.qx 11/8/99 11:01 AM Page 724

724


Figure 18.4

This is a blank DFS administration console window.

To create a new DFS root, select New DFS Root Volume from the Action menu. This starts the Create New DFS Root Wizard. The first screen of the wizard is shown in Figure 18.5.

Figure 18.5

This is the opening screen of the Create New DFS Root Wizard.

74_sysad_18.qx 11/8/99 11:01 AM Page 725


NOTE All items in the Action menu in the MMC can also be accessed from the context menu resulting from a right-click on any object in the MMC window.

The next screen of the wizard asks which type of DFS root is to be created, as shown in Figure 18.6. There are two types of DFS root, fault-tolerant and stand-alone. Select Create a fault-tolerant DFS root and click Next.

Figure 18.6

Choose a fault-tolerant DFS root.

The configuration information for a fault-tolerant DFS root is stored in an Active Directory domain. The next screen of the wizard, shown in Figure 18.7, asks with which domain the new DFS root is to be associated. Select from the Available domains list the domain that is to host the DFS root, then click Next.

725

74_sysad_18.qx 11/8/99 11:01 AM Page 726

726


Figure 18.7

Choose a domain.

After a domain is chosen, a server must be specified to host the DFS root. The default choice is the current server, as shown in Figure 18.8. Choose any server in your domain either by typing the DNS name of the server you want, or by clicking Browse and navigating to the desired server. When the server is chosen, click Next. After choosing a server, you are asked to select a share on that server to use as the DFS root. As Figure 18.9 shows, you can either select an existing share, or provide a path and share name to have the DFS Wizard create a new share. For this example, we are creating a new share on \\W2KDC1. Configuration and topology information for a fault-tolerant DFS root is stored as part of the Active Directory schema, and not on a single machine. So why does the previous screen in the wizard ask for a single machine to serve as the DFS root? The server specified in the previous step contains the root share (as specified in the current step) upon which the DFS namespace will be built. The topology (the fact that this specific logical name maps to that specific physical server) is stored separately in the Active Directory. A share name is still needed to create the initial top-level hierarchy.

74_sysad_18.qx 11/8/99 11:01 AM Page 727


Figure 18.8

Specify a server to host the DFS root.

After either specifying an existing share, or creating a new share, click Next.

Figure 18.9

Specify a share to be used as the DFS root.

727

74_sysad_18.qx 11/8/99 11:01 AM Page 728

728


The next screen of the wizard lets you set the UNC name of the DFS root. The default choice is the same share name as the DFS root share (see Figure 18.9). This default can be changed and probably should be, because the new logical namespace being created does not always match the previous share naming convention. For example, if one departmental file share is called \\server\fin and a similar share on another departmental server is called \\server2\financial, combining these two shares into one DFS namespace might lead to confusion. Renaming each of the nodes “finance” when they are inserted into DFS ensures a common naming convention. In each case, the name of the original share being pointed to does not need to change. Figure 18.10 indicates that the new UNC for the DFS root is \\corporation.com\dfsroot, which matches what was specified in Figure 18.2.

Figure 18.10 Specify a UNC name for the DFS root.

This screen also offers the option to add the current DFS root to the MMC console. If a DFS root is added to a console, that DFS namespace can be managed from that console. Once a DFS root is added to a console, it can be administered, and the message shown in Figure 18.3 no longer appears.

74_sysad_18.qx 11/8/99 11:01 AM Page 729


After specifying a UNC name for the DFS root, click Next. The final screen of the wizard asks you to confirm your choices. Figure 18.11 summarizes the choices made. The items listed on the screen cannot be edited, although they are shown in text boxes. To modify any of the choices made during the wizard, click Back and make the changes on the appropriate screen.

Figure 18.11 Summarize DFS root choices.

When you have verified that the configuration is correct, click Finish. After the wizard has completed, and the DFS root has been created, a message box is displayed, indicating success (see Figure 18.12). Figure 18.13 shows the DFS MMC console with the newly added DFS root. Note that the UNC name of the DFS root is shown in the left pane, and the actual share that that root points to is shown in the right pane. When a client attempts to access \\corporation.com\dfsroot, the DFS client software redirects the connection to \\W2KDC1\dfs_root behind the scenes.

729

74_sysad_18.qx 11/8/99 11:01 AM Page 730

730


Figure 18.12 The DFS root has been successfully created.

An optional last step in setting up the DFS root is to publish the DFS root UNC into Active Directory as a Shared Folder object. The advantage of doing this is that the DFS root is available when it is browsed via the Directory object in My Network Places. Clients can still point to the DFS UNC name, as well as to the individual UNC paths that make up the DFS namespace.

Figure 18.13 This is the MMC console with a new DFS root.

Setting Up a Stand-Alone DFS Root The administrator for the corporation.com network must set up a stand-alone DFS root to be used as the intranet. This new DFS root incorporates both current DFS servers into a single namespace, and

74_sysad_18.qx 11/8/99 11:01 AM Page 731


this namespace can then be incorporated into the existing fault-tolerant DFS root (via an Inter-DFS link). When the root has been set up, Microsoft Internet Information Server can be directed to use the combined DFS namespace for all intranet activity. The fact that the intranet is spread out among two different servers in two different sites is transparent to both IIS and the intranet users. With the current release of Windows 2000 DFS, only one DFS root can be created on a single server. This limit will be removed in a future release. Therefore, the stand-alone DFS root must be created on \\W2KSVR2 in Los Angeles, because \\W2KDC1 already hosts a DFS root. To create a new DFS root, select New DFS Root Volume from the Action menu. This starts the Create New DFS Root Wizard. The next screen of the wizard asks which type of DFS root is to be created, as shown in Figure 18.14. There are two types of DFS roots, fault-tolerant and stand-alone. Select Create a stand-alone DFS root and click Next.

Figure 18.14 Choose a stand-alone DFS root.

731

74_sysad_18.qx 11/8/99 11:01 AM Page 732

732


A stand-alone DFS root is associated only with the particular server that is hosting the DFS root. The next screen of the wizard, shown in Figure 18.15, asks which server is to host the new DFS root. Any server in your domain can be chosen, as long as it is not currently hosting a DFS root. Select the server either by typing the DNS name or by clicking Browse and navigating to the desired server. When the server is chosen, click Next.

Figure 18.15 Choose a server.

After choosing a server, you are asked to select a share on that server to use as the DFS root. As Figure 18.16 shows, you can either select an existing share, or provide a path and share name to have the DFS wizard create a new share. For this example, we are creating a new share on \\W2KSVR2. Configuration and topology information for a stand-alone DFS root is stored only on the host machine. If this host server goes offline, or becomes otherwise unavailable, the entire DFS namespace hosted by this server is unavailable. After either specifying an existing share, or creating a new share, click Next.

74_sysad_18.qx 11/8/99 11:01 AM Page 733


Figure 18.16 Specify a share to be used as the DFS root.

NOTE A DFS root or child node can also be applied to a path beyond a share point (that is, \\server\share\dir1\dir2\dir3). The examples in this chapter reconfigure existing shares, but DFS has the capability to map entire file directory paths to child nodes as well.

The next screen of the wizard lets you verify the UNC name of the DFS root. Figure 18.17 indicates that the new UNC for the DFS root is \\w2ksvr2.corporation.com\intranet, which matches what was specified in Figure 18.2. Note that you cannot change the name of the stand-alone DFS share. The share name specified matches the share name given from the server. As in the fault-tolerant DFS wizard, this screen also offers the option to add the current DFS root to the MMC console. After verifying the UNC name for the DFS root, click Next.

733

74_sysad_18.qx 11/8/99 11:01 AM Page 734

734


Figure 18.17 Verify the UNC name for the DFS root.

The final screen of the wizard asks you to confirm your choices. Figure 18.18 summarizes the choices made. The items listed on the screen cannot be edited, although they are shown in text boxes. To modify any of the choices made during the wizard, click Back and make the changes on the appropriate screen. Note that the entries for Domain and DFS root name are set to Not Applicable, since we are creating a stand-alone DFS root that is not associated with a domain. After you verify that the configuration is correct, click Finish. After the wizard has completed, and the DFS root has been created, a message box is displayed, indicating success. Figure 18.19 shows the DFS MMC console with the newly added DFS root. The UNC name of the DFS root is shown in the left pane, and the actual share that that root points to is shown in the right pane. Both paths point to the same location in a stand-alone DFS root.

74_sysad_18.qx 11/8/99 11:01 AM Page 735


Figure 18.18 This is a summary of DFS root choices.

The last step in setting up the stand-alone DFS root is to publish the DFS root UNC into IIS. Consult the IIS documentation for details about creating an IIS Web site.

Figure 18.19 This is the MMC console with new DFS root.

735

74_sysad_18.qx 11/8/99 11:01 AM Page 736

736


Setting Up Child Nodes The fact that the stand-alone DFS root shown in Figure 18.19 looks exactly like the UNC share that it is based on is not exactly useful. In order to benefit from the ability to create a logical namespace for your physical servers, you must start publishing separate shares into your DFS namespace. When these separate shares are added, they are called child nodes. In this example, the administrator for the corporation.com domain adds the separate intranet locations as child nodes in the intranet stand-alone DFS root. To add a child node in the DFS MMC console, select New DFS Child Node from the MMC Action menu. Figure 18.20 shows the resulting dialog box. There are four options on this dialog box. The child node text box refers to the junction in the DFS namespace that will map to the specified share. In Figure 18.20, the child node is set to \\W2KSVR2\intranet\la. When the client navigates to the child node path, DFS automatically redirects the client to the path specified in the Send the user to this network path: text box. If a comment is added, it appears in the DFS MMC Console. The DFS Cache setting is made in seconds and tells the client how long to store the logical-DFS-name-to-physical-UNC-name mapping in memory. If the client needs to access the DFS name again before the cache timeout occurs, it consults its local DFS cache. After the timeout occurs, the DFS client must query Active Directory or the stand-alone DFS server to get the DFS mapping again. The default value for the DFS cache is 1800 seconds (30 minutes). The DFS cache setting is intended to help an administrator control network traffic. The DFS cache setting is made separately for each child node. If the node contains information that is read-only, or rarely changes, set the referral cache to a high number. If the content of the node changes frequently, set the referral cache to a low number, so that the client always has an up-to-date mapping. After filling in the dialog box, click OK to save the changes.

74_sysad_18.qx 11/8/99 11:01 AM Page 737


Figure 18.20 Add a child node to the DFS dialog box.

After the child node is added to the DFS root, the DFS MMC console is updated to reflect the changes. Figure 18.21 shows the completed intranet stand-alone DFS root, with both the “la” and “philly” nodes added. The “la” node redirects clients to \\W2KSVR2\ intranet_la, and the “philly” node redirects clients to \\W2KDC1\ intranet_philly.

Figure 18.21 This is the MMC console with child nodes added.

737

74_sysad_18.qx 11/8/99 11:01 AM Page 738

738


Child nodes can also be added to a fault-tolerant DFS root. Figure 18.22 shows \\corporation.com\dfsroot with the shares from \\W2KDC1 and \\W2KSVR2 added. The DFS nodes point to the existing shares, as shown in Figure 18.2.

Figure 18.22 This is the MMC console with child nodes added to fault-tolerant DFS root.

Configuring Child Nodes as Replica Sets A replica set consists of two or more shares whose content is identical. When a client tries to access a child node configured as a replica set, DFS refers the client to the closest replica. A DFS replica set can contain up to 128 identical shares. The closest replica is determined by comparing the site of the client to the closest site of the node replicas. An Active Directory site is a collection of machines that share good IP connectivity. Usually, an organization’s Active Directory site configuration closely follows the existing IP subnet configuration. Therefore, if it is given the choice between several replicas, all pointing to the same DFS child node, DFS refers a client to the replica that requires the lowest network traffic to reach.

74_sysad_18.qx 11/8/99 11:01 AM Page 739


Clients in the Philadelphia site are always referred to a local resource, if it is available. Clients are referred to the closest replica of the information. An administrator must ensure that no matter what replica a client accesses, each client is guaranteed to see the same information. There are two recommended situations in which setting up a replica set makes sense. The first situation occurs when the files in the replica shares do not change or when they change infrequently, such as a shared CD-ROM drive, or when manual synchronization is sufficient. The second situation occurs if an alternative mechanism is already in place to synchronize the content of two different file systems. Windows 2000 ships with a service to do this task, the File Replication Service (FRS). The FRS uses the Active Directory site synchronization schedule to ensure that changes made to one file system are replicated to another one. Keep in mind that if you plan to use FRS to keep entire fileservers synchronized, the replication traffic might flood all available inter- and intrasite bandwidth. For more robust synchronization, it is recommended that an administrator use the built-in clustering capabilities of Windows 2000 Advanced Server. When it sets up a replica set, DFS can configure FRS to replicate the contents of both fileservers automatically. You must manually enable replication between the replica shares. To create a replica set, you must first create a child node. After the child node is created, you add a replica member to that child node. Figure 18.23 shows the hr_info share on \\W2KDC1 already added as a DFS child node. To add the replica set, select the child node where the replica set is to be added, then select New DFS Replica Member from the Action menu. The Add to Replica Set dialog box appears, as shown in Figure 18.24. At the top of the dialog box, the currently selected DFS path is shown. You are prompted for another UNC path that contains an identical copy of the existing replica sets. No checking is done by DFS to ensure that the content of the replica set shares is identical.

739

74_sysad_18.qx 11/8/99 11:01 AM Page 740

740


Figure 18.23 This is the MMC console with hr_info node added.

In this dialog box, there is also a setting to configure the file replication. By choosing No Replication, you tell DFS not to configure replication for the contents of the shares. DFS assumes that no replication is needed, or that some other replication mechanism is being used. If you choose Join replication—normal replication settings, the contents of the directory are replicated as part of normal Active Directory replication operations.

Figure 18.24 Add to the replica set dialog box.

74_sysad_18.qx 11/8/99 11:01 AM Page 741


Type or browse to the share that is to be added to the replica set, and click OK. After a replica set is added to the child node, the shares assigned to that node appear in the DFS console. Figure 18.25 shows the DFS child node \\corporation.com\dfsroot\hr_info. Clients in the Philadelphia site are sent by DFS to the replica on \\W2KDC1\hr_info, and clients in the Los Angeles site are sent by DFS to the replica on \\W2KSVR2\hr_info.

Figure 18.25 This is the MMC console showing hr_info replica set.

Administering DFS As is the case with implementing any network service, an administrator’s work is not completed when the system is in place. Ongoing maintenance and administration are required to ensure that the system continues to function.

741

74_sysad_18.qx 11/8/99 11:01 AM Page 742

742


Connecting to an Existing DFS Root Earlier examples assumed that the administrator was sitting in front of the server that was hosting the DFS root. Administrators cannot always administer a server while they sit directly in front of it; they might wish to perform all administrative tasks from their desks. From a blank DFS console, select Connect to existing DFS root from the Action menu. The dialog box shown in Figure 18.26 appears. From the window in the center of the dialog box, select the DFS root you want to connect to and administer. You can navigate and select from both fault-tolerant and stand-alone DFS roots.

Figure 18.26 Connect to an existing DFS root.

NOTE You can also create a new DFS root by clicking Create New DFS root on the bottom of the dialog box.

74_sysad_18.qx 11/8/99 11:01 AM Page 743


In order to delete a connection to a DFS root, select the DFS root from the DFS console and select Delete Connection to DFS Root from the Action menu. This removes the DFS root and all child nodes from being administered from the current console. It does not delete the DFS root itself from the Active Directory or host server, and client access to the DFS root is unaffected.

WARNING Do not select Delete DFS Root by mistake from the Action menu. This deletes the DFS root and all child nodes from the Active Directory or host server.

Command-Line Administration As with most tasks in Windows NT/Windows 2000, DFS administration can be done in several ways. The earlier examples used the DFS MMC snap-in to perform GUI administration. A command-line DFS administration tool ships with Windows 2000. This commandline tool can be used to script or automate the setup and maintenance of the DFS namespace, or can be used by an administrator who prefers to use the command line. The DFS command-line tool is called dfscmd.exe, and is located in %systemroot%\system32. When you run dfscmd.exe from a command prompt without any parameters, this help listing is displayed: C:\>dfscmd The syntax of this command is: DFSCMD [options] DFSCMD configures a Dfs tree. [options] can be:

743

74_sysad_18.qx 11/8/99 11:01 AM Page 744

744

Chapter 18 • Sharing File Resources by Using DFS /help Display this message. /map \\dfsname\dfsshare[\path] [\\server\share[\path]] [comment] Create a Dfs volume; map a Dfs path to a server path or create a new Dfs root or add a replica to an exiting Dfs root. Do not specify \\server\share for a Standalone Dfs root. /unmap \\dfsname\dfsshare[\path] [\\server] Delete a Dfs volume; remove all its replicas or remove a server from a Dfs root. Do not specify \\server and \path for a Standalone Dfs root. /add \\dfsname\dfsshare\path \\server\share\path Add a replica to a Dfs volume. /remove \\dfsname\dfsshare\path \\server\share\path Remove a replica from a Dfs volume. /view [\\dfsname[\dfsshare[\path]]] [/partial | /full | /client] View all the Dfses within a domain or all the volumes in the Dfs or all the replicas of a certain volume. Without arguments, view just the volume names. With /partial, view state and comment also. With /full, display state, timeout, comment and a list of all the replicas for a volume. Use /client to retrieve the information cached into the client rather than to fetch data from the server. /partial and /full flags are ignored in the presence of /client or \path. C:\>

Note the difference between the /map & /unmap and the /add & /remove switches. The /map switch creates a new DFS root or adds a new volume into the DFS namespace. The /add switch adds a replica set for an existing node. The /unmap switch deletes a

74_sysad_18.qx 11/8/99 11:01 AM Page 745


volume (including any replica sets), but the /remove switch only removes the specified replica from an existing replica set. The dfscmd.exe command-line tool supports operations on both faulttolerant and stand-alone DFS roots. For example, to create the sample DFS namespace shown in this chapter (see Figures 18.1 and 18.2), use these commands: C:\dfscmd /map \\corporation.com\dfsroot \\w2kdc1\dfs_root --Creates the fault-tolerant DFS root hosted by \\w2kdc1. C:\dfscmd /map \\corporation.com\dfsroot\engineering \\w2kdc1\share_1 --Adds a share hosted on \\w2kdc1 into the DFS namespace. C:\dfscmd /map \\corporation.com\dfsroot\hr_info \\w2kdc1\hr_info C:\dfscmd /add \\corporation.com\dfsroot\hr_info \\w2ksvr2\hr_info --Creates a replica set at the hr_info child node. C:\dfscmd /unmap \\corporation.com\dfsroot\engineering --Deletes the sepcified DFS root or child node. not asked to confirm the action.

You are

There is no way to

undo this action, other than recreating the DFS root or child node.

Removing DFS Roots and Nodes Additions, changes, and deletions must be made for the ongoing maintenance of a DFS root.

Removing a Child Node To delete a DFS child node, select the node to be deleted in the left pane of the DFS console, and select Remove from DFS from the

745

74_sysad_18.qx 11/8/99 11:01 AM Page 746

746


Action menu. You get the warning shown in Figure 18.27. Deleting a child node only modifies the DFS namespace. Any replicas are also removed, and the target shares and all files in those shares are unaffected.

Figure 18.27 This is the way to delete a child node.

NOTE There is no way to rename a DFS child node. In order to simulate a rename, you must delete the existing node, and add a new node with the changed name pointing to the same network share.

Removing a DFS Root To delete a DFS root, select the root in the left pane of the DFS console, and select Delete DFS Root from the Action menu. You get the warning shown in Figure 18.28. When a DFS root is deleted, the entire DFS namespace is removed from the network. All child nodes and replicas are removed. The target shares and all files in those shares are unaffected. There is no way to undo the removal of a DFS root, other than re-creating the entire namespace from scratch.

74_sysad_18.qx 11/8/99 11:01 AM Page 747


Figure 18.28 This is the way to delete a DFS root.

Forced Removal of DFS Information If the need arises to remove a child node or the entire DFS root from a server, and other methods do not work, it is possible to remove the DFS configuration from the server manually. This process should be used only as a last resort, and only if other troubleshooting and removal methods do not work. The information for the DFS namespace is stored in the Windows 2000 Registry, which can be edited using regedt32.exe.

WARNING Incorrect use of Registry Editor can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

These paths should be deleted to remove any DFS information from a server. These deletions result in the DFS namespace’s being permanently unavailable until it is re-created. It is recommended that the server be rebooted after these deletions are made. HKEY_LOCAL_MACHINE\Software\Microsoft\DfsHost (and any subfolders) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ DfsDriver\LocalVolumes\* (Do not delete the LocalVolumes folder!)

747

74_sysad_18.qx 11/8/99 11:01 AM Page 748

748


Client Interactions with DFS Clients can navigate the DFS namespace as if it were one huge shared directory. Since the DFS client software is included or available for most NT clients, users are unaware that the volume being accessed is actually spread out among several servers. The requirements for DFS clients are shown in Table 18.2.

Table 18.2

DFS Client Requirements

Client OS

DFS client software

Windows 2000 (Professional/Server)

Included

Windows NT 4.0 (Workstation/Server) Windows 95 Windows 98 DOS/Win3.x

Integrated into SMB redirector Separate add-on required Integrated into SMB redirector No direct DFS support available

Clients query Active Directory or the stand-alone DFS root to see exactly on which sharepoint a certain portion of the DFS namespace is located. This information is then cached locally for the duration of time specified in the child node properties (see Figure 18.20). During this cache time, if subsequent access is required to the child node, the previous reference is used. If the cache time for that node has expired, the client contacts Active Directory and gets an up-todate listing of child nodes and shares.

Security Concerns Proper security measures are an essential part of a sound network deployment. DFS does not add an extra layer of security requirements to the existing ACL setup; it uses the existing security of the network. There is no added DFS-related ACL.

74_sysad_18.qx 11/8/99 11:01 AM Page 749


To set up a fault-tolerant DFS root, you need to use a Domain Administrator account. To publish a DFS volume into Active Directory, you need the appropriate permissions in the container or domain where the volume will be added. To set up a stand-alone DFS root, you need administrative privileges on the server that is to act as the DFS root. To publish a DFS root into IIS, you need the appropriate permissions on the IIS server. When a client accesses a DFS root and navigates through the namespace, the permissions required to access the resulting shares and files are computed on the basis of cumulative share-level and NTFS-level permissions. If a client tries to access a child node directly, the same share and NTFS permissions are applied.

Best Practices The benefits that DFS brings to the management of your network cannot be seen unless the clients are aware that the DFS namespace exists. To discourage users from gaining direct access to the non-DFS shares, hide all shares and servers to prevent them from appearing in Network Neighborhood/My Network Places. This can be done by creating new shares (or re-creating existing shares) with a $ symbol appended after the share name. An example of this is a sharename called \\server\hiddenfiles$. The $ symbol prevents a share from being listed in Network Neighborhood, although a user who knows that a sharename exists can still connect by specifying the sharename. For maximum availability of the DFS namespace, create only fault-tolerant DFS roots. The ability to use Active Directory replication to ensure that all clients see the DFS namespace guarantees that a single server failure does not affect users’ access to individual DFS nodes, as is the case with a stand-alone DFS root. DFS can be used as part of your backup and disaster recovery strategy. If you have enough bandwidth and tape storage capacity for the entire network to be backed up in one session, you can con-

749

74_sysad_18.qx 11/8/99 11:01 AM Page 750

750


figure the backup software to back up the entire DFS namespace (and therefore every server on your network) by directing it to your DFS root. If your backup infrastructure is not capable of handling an entire organization’s DFS namespace, an administrator can create separate DFS namespaces for backup purposes, and include as child nodes the only specific shares and servers that need to be backed up.

Summary The Distributed File System service for Windows 2000 allows an administrator to combine all physical file-sharing resources into a logical hierarchy that can more closely match an organization’s geographical or organizational layout. The administrator can then modify the DFS namespace easily, using both graphical and command-line tools. The benefits that DFS can bring to your organization can be enjoyed before Windows 2000 is completely deployed. DFS is available now for NT Server 4.0, and is enhanced in Windows 2000 to take advantage of the increased benefits of Active Directory.

FAQs Q: I have set up my DFS system. When certain users attempt to navigate to a portion of the DFS namespace, they get an “Access is denied” message. Why is this?

A: DFS adds no additional security features. It merely provides a namespace into which existing shares can be published. When a client queries the DFS root, it receives the list of UNC share names where the actual files are located. The existing share-level and NTFS-level permissions are applied. To find out where an “Access is denied” message is coming from, verify the share and NTFS permissions.

74_sysad_18.qx 11/8/99 11:01 AM Page 751


Q: I just accessed a volume in the DFS namespace, but now it is not available. Why is this?

A: There are a few things to check. Is the server that the client attempted to access available? Has the server been taken offline for any reason? Is the client caching the DFS reference?

Q: Can I uninstall DFS? A: DFS is an integral component in Windows 2000. It cannot be uninstalled. If there is a server that does not need to run DFS or participate in the DFS namespace, the DFS service can be either stopped or disabled by going into Control Panel, Manage Computer.

Q: DFS is misbehaving and I cannot delete a DFS root and start over. Can I force a deletion of DFS information?

A: You can use Windows 2000 Registry Editor, regedt32.exe, to delete the following paths, then reboot the server: HKEY_LOCAL_MACHINE\Software\Microsoft\DfsHost and any subkeys. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ DfsDriver\LocalVolumes\*.* (Do not delete the LocalVolumes key!! A DFS root cannot be re-created on this server if the DFS software does not find the LocalVolumes key.)

751

74_sysad_18.qx 11/8/99 11:01 AM Page 752

74_sysad_19.qx 11/8/99 11:54 AM Page 753

Chapter 19

Implementing Disaster Protection


Protecting a Windows 2000 Network from Disasters

■

Backing Up Data

■

Advanced Startup Options

■

Recovering from a System Failure

■

Repairing and Restoring the Active Directory

753

74_sysad_19.qx 11/8/99 11:54 AM Page 754

754

Chapter 19 • Implementing Disaster Protection

Introduction This chapter focuses on disaster protection, and discusses the various failures and disasters that can take place on your Windows 2000 network and how to protect yourself from them. We will learn that Windows 2000 can help you survive a network disaster by backing up your data to a removable storage media such as a tape drive, or to remote hard disk. Windows 2000 also introduces enhancements to the startup options that allow you to troubleshoot and fix your computer in the event of a failure that prohibits you from starting your computer normally. These include new startup options, combined with recovery options that allow you to restore files and the Active Directory rapidly if you encounter problems. There are also new features that back up and restore the Active Directory, which is one of the new and exciting features of Windows 2000 that will provide the cornerstone of user and group management. For this reason, we must make sure we can protect our Windows 2000 network from disasters, and quickly and effectively recover data in the event one occurs.

Protecting a Windows 2000 Network from Disasters Every company or organization that uses computers, especially servers, is concerned with data loss. This could be from a fire or any natural disaster, but most often comes from computer failure. This could be a critical component such as a motherboard or hard drive. Depending on the disaster, there is a strong possibility of downtime, which is what can cost a company the most money. Without critical business systems being up and operational, the company can lose money while printing presses, conveyer belts, or shipping and receiving systems are down. Most often, the downed system affects all other systems that are dependent on it. For example, in a paper-making company, if one of the first processes fails, it can affect the rest of the line, such as roll tracking, boxing, shipping, and inventory.

74_sysad_19.qx 11/8/99 11:54 AM Page 755

Implementing Disaster Protection • Chapter 19

How can you determine how much your company can be affected by a disaster? You need to identify the critical systems and determine what effect the loss of these systems would have on your corporation. A workstation failing would not have as much of an impact as if the main file server were to fail. Database servers are becoming increasingly important because they contain databases that many different departments of the company use. For example, in a school, prospective students are tracked in the database by recruiting. If these students apply and are accepted, they are passed on to the Registrar for registration. From there, their information will be seen by billing, which will need to bill the student for tuition. You can see how each different department uses the student’s information. If the database server were to fail, none of these departments would be able to access the student’s information. Messaging systems are also becoming increasingly important. Although it seems like most people use company e-mail for sending messages to friends, some companies actually conduct vital business through messaging systems. For example, a supplier company receives daily orders from a company, and they must fulfill these orders. The users that check the e-mail are usually the first ones, even before the Administrator, to know that the e-mail system is down. When they don’t receive their daily e-mail from the outside source, they know something is wrong. How can you protect your Windows 2000 network from disaster? Windows 2000 can only partially help you to recover from a disaster, but it comes well equipped to handle disaster prevention. When a hardware malfunction occurs, this is not anything an operating system could have prevented, but the operating system can supply diagnostic tools to monitor the critical system components for irregularities that are indicative of hardware problems. Motherboards are one of the most reliable components within a computer, even though they consist of many smaller soldered components. Some vendors will provide software for monitoring the motherboard components, but a failure is most often unexpected.

755

74_sysad_19.qx 11/8/99 11:54 AM Page 756

756


Memory also is a very reliable component of a computer system and, like a motherboard, it won’t give you much of an indication there is a problem before it fails. You can expect a blue screen error on startup with bad memory, or the operating system will occasionally lock up. Video cards also rarely fail, and will give you no indication of fault before they actually do. Network cards also rarely fail, but they can give an indication they are failing by sending bad packets, or broadcasting excessively on the network. Most vendors supply software to monitor network card activity, and you can also do this to a certain degree with the Performance and Network Monitor that is provided by Microsoft. Hard disks are the primary concern when it comes to hardware problems. Hard drives fail quite often because they are mechanical devices with moving parts. Hard drives are constantly moving, especially on busy network servers. The best way to protect your hard disk against failure is to use variations of RAID (Redundant Array of Inexpensive Disks) to reconstruct the data when a failed disk is replaced with a new one. Backing up data is also very important in case you need to restore information that was contained on the hard disk before it failed. Power supplies do not fail that often, but when they do they can take other components with them. Luckily you might be able to discover you are having a power supply failure because the fan might stop working. However, if the fan stops working, you only have a short period of time before the power supply or computer itself overheats. Other than fan problems, it is very difficult to detect power supply problems before they happen. Usually they will cause components to fail, and you will replace that component and feel you fixed the problem. It is quite easy to overlook power supply errors when other devices are failing, but the power supply may be the source of the other problems. Power failure can be avoided by using an Uninterruptable Power Supply (UPS) for your critical systems in order to protect yourself from power loss, brownouts, spikes, and surges. It is not necessary to provide UPS devices for every computer on your

74_sysad_19.qx 11/8/99 11:54 AM Page 757


network, because this is quite costly, and most computers on your network are not critical. Servers, hubs, switches, and routers are the most important devices to provide protection for. Windows 2000 supports a wide range of UPS devices and provides a number of features that coincide with these devices. The UPS will provide enough time for users to log off and for you to perform an orderly shutdown. If you want to guarantee that the system is shut down properly, without you even being present, you can configure the UPS to process a command file during a power failure. This file will contain commands that can be used to stop services and programs in an orderly fashion so that data will not be corrupted. Network failure can occur for a number of reasons, including wiring, hubs, routers, and individual workstations. The most critical network failures are when a hub, switch, or router fail, because these devices affect more than one computer. You may not realize at first what has failed, until more than one computer is affected. From then, you can check the hub or switch and see if the device is giving you indication of failure, such as a fault LED, or the activity lights have stopped, or there are no lights on the device. If the hub or switch has failed, you will need a replacement in a hurry, or else multiple computers will not be able to communicate on the network. It is wise to have spares of these critical network devices onsite. When a router fails, you won’t realize it until you attempt to connect with a remote network. At first it will appear as if one computer cannot connect to the remote network. For this reason, you should verify the problem on more than one computer. If you determine that the router is malfunctioning, you may have to cycle the power. Pinging the router from both directions is also a good way to test the router. Routers are more expensive than hubs, so you may not have a replacement onsite in the event of a failure. Vendors supply programs that can monitor the status of routers, hubs, and switches, and alert in the event of an emergency. The failures that usually affect one computer are network card and cable errors. When you have determined that only one computer is unable to connect to the network, you need to determine if the

757

74_sysad_19.qx 11/8/99 11:54 AM Page 758

758


problem is the network card, cabling, or a possible software issue. If the computer was working fine a few hours ago and no one has touched it since, chances are it is not the software configuration. It is most likely a hardware error, because no one has been working on the computer to cause the problem.

Backing Up Data The most important chore you can do to protect your network from data loss is to back up the data on a regular basis. By doing this, you can recover from catastrophes that may occur. There is nothing worse than losing a server to a power surge, and then discovering you have lost all the data that was contained on that server; data that was not backed up.

For Managers Only

Establishing a Successful Backup Routine

If you are responsible for the operations of your network, you must ensure that you are backing up the critical data reliably. Your job is on the line if you lose data, so you need to rule with an iron fist when it comes to the importance of backing up data. This should be your primary concern. The following list is what you should consider when implementing and maintaining an effective backup solution. ■

Is all the data on the file servers being backed up?

■

Are the databases and transaction logs being backed up?

■

Is the messaging (e-mail) server being backed up?

■

Is there data on a user’s local machine that needs to be backed up regularly?

■

Are the tapes being rotated correctly?

■

Are the tapes being stored correctly? Continued

74_sysad_19.qx 11/8/99 11:54 AM Page 759


■

Have we done test restores to verify the validity of the backups?

■

Do we have the entire process documented for backing up and restoring data?

■

Do we regularly check for new information or files to back up?

■

Do we apply patches to the backup software?

■

Are we backing up the Registry of our servers?

As you can see, the preceding list contains some very critical information that you must know if you are managing an IT department. You may want to read through the documentation that your employees create concerning the backups, and whether they are addressing the issues listed. It is also very important to get the results from the test restores. Schedule test restores once a week until you feel they can be done quickly and correctly within minutes. You must also be aware that restoring e-mail and database servers is much more difficult than restoring individual files. If you cannot guarantee the accurate backing up and restoring of data at your site, you have some work to do. Once again, I cannot stress enough the importance of the backup routine.

Most companies back data up to tape, which can hold an extraordinary amount of data. Tape drives are slower, because tapes are still sequential, not random access. Tape magazines are becoming popular too, because jobs can be continued on to the next tape in the magazine. Also, if your site’s backup jobs are not very large, you can use a tape each day and only have to replace the tapes in the magazines weekly. You also need to determine what data needs to be backed up and where it is located. Sites often have a server that is dedicated to backing up and will attach to other servers, even workstations at night, in order to back up the information. This is very bandwidth intensive and, therefore, it is scheduled for off-hours. Many sites

759

74_sysad_19.qx 11/8/99 11:54 AM Page 760

760


also have high speed, such as 100MB, links between servers. You also can use a tape backup at the important servers, which means they do not have to traverse the network in order to back up information; it is done locally. With this implementation, you will use more tapes for your backup and will have to remember to change the tapes in all these servers. Also, the backup program will have to be installed and configured on each of these servers. This method costs more, because of the price of the tape backup devices, and the license for backup software; however, this method is the fastest way to back up to tape. If most or all of your data is located on one server, this is probably the best method. If your corporation is very large, you will most likely have large banks of optical drives that back up huge amounts of data very quickly. These are usually hardware-based implementations that Windows 2000 will not administer. By far, the most used backup solution for sites is tape backup drives with a backup solution such as Cheyenne ARCserve (see Figure 19.1) or Seagate Backup Exec, or even Microsoft’s own Backup that comes with the operating system (Figure 19.2).

Figure 19.1

The Cheyenne ARCserve backup program.

74_sysad_19.qx 11/8/99 11:54 AM Page 761


Figure 19.2

The Microsoft Windows 2000 backup program.

Very large corporations also may have a dedicated backup Administrator who verifies the status of the backups that ran the previous night. This Administrator can use a product such as pcAnywhere to attach to the remote site’s backup server and check the job status of the backup. Everything that can be done locally can also be done remotely, with the exception of inserting tapes. You can also configure the backup program to notify an Administrator by pager if the job fails, or send alerts and status reports to the backup Administration team. Some permissions are needed in order to perform backups and restores for your network. In Windows 2000, you need to have share permissions, NTFS permissions, or file attribute permissions to have access to files that are going to be backed up. There are two ways to have access to these files: ■

You belong to the Administrators, Backup Operators, or Restore Operators group.

761

74_sysad_19.qx 11/8/99 11:54 AM Page 762

762

Chapter 19 • Implementing Disaster Protection ■

You have been granted the right to back up files and directories and restore files and directories.

It should be noted that FAT16 and FAT32 volumes do not provide file permissions; therefore, you do not need special rights to back up data located on these volumes. Here are a few more tips for successful backing up: ■

Back up the entire volume, instead of bits and pieces of the volume. This makes restoration of the volume much easier and quicker.

■

Keep copies of the backups onsite and offsite. The onsite copies can be accessed quickly if you need to restore data.

■

Always back up the Registry on domain controllers to prevent the loss of user accounts.

■

Keep your tapes secure, because any data that is backed up can be retrieved if someone gets your tapes and has the same type of tape drive.

■

Make sure you understand how to restore Differential and Incremental backups before you implement these backup methods. Differental backups will back up every file that has changed since the last normal backup, and will not mark the files as having been backed up. Incremental backups will back up every file that has been changed since the last normal backup, and will mark the file as having been backed up. When restoring an Incremental backup, you will have to provide the full backup and every incremental tape, and work through the tape you want to restore. For a Differential backup, you only need to provide the full backup and the last differential backup tape that was made.

■

If you are not sure if you should back up a certain computer or set of folders, back them up anyway. It’s better to be safe than sorry.

■

If a backup job keeps failing, start the job when you are present so you can catch it immediately, rather than the next morning.

74_sysad_19.qx 11/8/99 11:54 AM Page 763

Implementing Disaster Protection • Chapter 19 ■

Refer to Microsoft TechNet for information on how to back up Microsoft Exchange servers and SQL servers. These are much more complex to back up and restore.

■

Use Alerts to notify you if the backup job fails.

■

The backup logs will give you the reason the job failed. Unfortunately, a failed job could be something as simple as one file not being backed up.

Before we continue with the actions necessary to repair problems encountered with Windows 2000, we need to cover the preventative measures we can take in order to avoid these problems if possible. ■

As we indicated earlier, make sure you have reliable system backups, and are comfortable with restoring files.

■

Use fault tolerant features such as disk mirroring, duplexing, or a stripe set with parity.

■

Check often for viruses, and update your virus signature files.

■

Review the Event Viewer logs on a regular basis.

■

Configure your Windows 2000 system appropriately for Startup and Recovery, which is configured by right-clicking My Computer, selecting Properties, and clicking Startup and Recovery on the Advanced tab (see Figure 19.3).

■

Use Windows 2000 to create Emergency Repair Disks (ERDs), and update them regularly.

If you do find yourself with a Windows 2000 system that will not start, there are a variety of options you have at your disposal to get this computer running quickly. 1.

Try Safe Mode first, or any of the Safe Mode counterparts (Safe Mode with Networking, Safe Mode with Command Prompt), which will start the system with minimal drivers and services. If a newly installed driver caused the system startup problem, it can likely be fixed with the Last Known Good configuration. If this fixed the problem, do not repeat the problem by installing the driver again; verify if it was the correct driver and if it was configured correctly.

763

74_sysad_19.qx 11/8/99 11:54 AM Page 764

764


Figure 19.3

The Startup and Recovery tab located in the System applet of the Control Panel.

2.

If Safe Mode does not fix the problem, consider using the Recovery Console. This is a new feature of Windows 2000 that is reserved for experienced users, because it can cause damage, and because it requires special skills to get the system running with the use of this utility. You will have to log on to the Recovery Console using an Administrative account. The Recovery Console is accessed by using the setup CD-ROM or floppy disks, and entering the Recovery Console, which is a command-line interface where you can perform tasks such as access the local drive and stop and start services. The Recovery Console will be discussed in more detail later.

3.

If Safe Mode or the Recovery Console have not fixed the problem, you can continue with the ERD that you hopefully created. The ERD will only repair core system files, so if anything else is damaged, it will not be repaired using this method.

74_sysad_19.qx 11/8/99 11:54 AM Page 765


4.

If the ERD did not work, you can try the Automated System Recovery option, which is new to Windows 2000 Backup. You will have had to prepare your Windows 2000 Backup with the Automated System Recovery option in advance, or else this option will be of no help to you. If you have prepared using the Automated System Recovery option, you will insert the CD-ROM or floppy disks and repair all the files on the local partition.

The Recovery Console One of the new features in Windows 2000 for troubleshooting and repairing a downed system is the Recovery Console. This is a command-line interface you enter by inserting the Windows 2000 setup CD-ROM and restarting the computer (if your computer supports bootable CD-ROM drives), or by inserting the setup floppy disks. When entering the Recovery Console, you will be asked to supply an account with Administrative rights. This prevents unauthorized access to this powerful utility. Once in the Recovery Console, you can change directories, start and stop services, and copy to and from the partition even if it is an NTFS partition. In the past, you could not write to the NTFS partition if you booted up with a floppy disk. This makes Windows NT more secure from hackers. By typing help at the command prompt within the Recovery Console, you will see a list of commands and options that are available to you. The most used feature of Recovery Console will be copying to and from the local partition, such as manually copying a driver to a directory, or overwriting another file with a new version. The Recovery Console can also be used on a Windows 2000 computer that is functioning normally. Enter the Recovery Console as you normally would, which was described earlier. The following exercise describes the process of entering the Recovery Console on Windows 2000.

765

74_sysad_19.qx 11/8/99 11:54 AM Page 766

766


Exercise 19.1 Entering the Recovery Console on a Windows 2000 Computer 1.

Insert the Windows 2000 setup CD-ROM in the drive if your computer is capable of booting from the CD-ROM drive, or insert the setup floppy disks if your computer is not capable of booting from the CD-ROM drive.

2.

Restart the computer. If you are using floppy disks, insert the disks as instructed.

3.

When the text-based portion of the setup program starts, select the Repair or Recover option by pressing R.

4.

If you are using floppy disks, insert the next disk as prompted.

5.

If you are using a dual-boot system, select the Windows 2000 installation that you wish to repair with the Recovery Console.

6.

Enter the Administrator password when prompted.

7.

Now you are at the system prompt. Type the commands you wish to use, or type help for a list of commands and options.

8.

Type exit to quit the Recovery Console when you are finished.

Advanced Startup Options One of the best features to come out of previous versions of Windows NT is the advanced startup options that are available. When you accidentally misconfigured a video driver or installed the wrong device driver, you could revert to a previous working mode, known as Last Known Good, and repair the system. This has come in handy for almost any technician who has spent time installing and configuring hardware in Windows NT. Windows 2000 still supports the Last Known Good configuration, and a few more advanced startup options. Table 19.1 is a list of the advanced startup options that Windows 2000 now supports, and their descriptions.

74_sysad_19.qx 11/8/99 11:54 AM Page 767


Table 19.1

Advanced Startup Options and Their Descriptions

Advanced Startup Option

Description

Safe Mode

Starts Windows 2000 Server using basic files and drivers only, without networking. Use this mode if a problem is preventing your computer from starting normally.

Safe Mode with Networking

Starts Windows 2000 Server using basic files and drivers only, as above, but also includes network support. Starts Windows 2000 Server using basic files and drivers only, without networking, and displays only the command prompt. Creates a boot log of devices and services that are loading. The log is saved to the filename NTBTLOG.TXT in the \Winnt directory.

Safe Mode with Command Prompt Enable Boot Logging

Enable VGA Mode

Starts the system with the VGA driver only.

Last Known Good Configuration

Starts Windows 2000 Server using the last known good configuration. IMPORTANT: Changes to the system made after the last successful login are also lost!

Directory Services Restore Mode

For Windows 2000 domain controllers only. Restores the Active Directory on a domain controller.

Debugging Mode

Starts Windows 2000 and sends debugging information to another computer via serial cable.

As you can see, you have a number of options available when confronted with a system that won’t boot. The trick is knowing which of the options to use first.

NOTE If you have used the new Remote OS Installation Services available with Windows 2000 on this particular system, you will see additional advanced startup options that refer to recovering your system using this method.

767

74_sysad_19.qx 11/8/99 11:54 AM Page 768

768


Recovering from a System Failure When it comes to recovering from a system failure, you have a few options with which to get your system up and running. The more knowledgeable you are in Windows 2000 and emergency alertness, the better off you will be during a crisis. This is a critical time because you may make the situation worse by guessing at how to fix the problem. In this case, it’s more effective to take a step back, gather information, research on TechNet, and determine a course of action. This doesn’t seem like the most effective way, because when a server is down you feel you have to get it up as soon as possible. You get the feeling that if you are not currently plugging away at the server trying different things that you aren’t attempting to fix the problem. However, one false move and you will have made your job of restoring the system much more difficult. The more you install Windows 2000, the more you are comfortable with quickly restoring a system that requires a complete operating system install. This is the case when you have experienced a hard disk crash and need to install the operating system on a clean hard disk, and restore the data from tape. The most effective restore methods involve reinstalling the operating system and restoring data from tape. This scares most Administrators, because there is a great chance that they have not documented the previous settings, or have too many services and programs installed on the computer to facilitate an easy install. Windows 2000 makes this easier with the new backup features such as Automated System Recovery (ASR). ASR will create and periodically update a backup copy of your system files, in addition to any files that exist on the Windows 2000 partition that you choose. This is only effective if you periodically update the backup information, or else when you experience a system failure and restore the system using this backup, it could be out of date and then you would really be in trouble. Microsoft recommends you run ASR before and after any changes you make to the server. This allows you to return the system to the state before the change if your change damaged the configuration. Running ASR

74_sysad_19.qx 11/8/99 11:54 AM Page 769


after the change will give you a good copy of the new configuration for future use. ASR is designed to restore a system without any use of the network. Most Administrators know it is very difficult to get a system, such as a laptop, installed without use of the network. A computer with a formatted hard drive can’t access the network without drivers. This means you need tons of disks lying around with drivers for each network card in use on your network. You also need to know what network card your computer is using in order to select the right driver disk. Earlier laptop computers, and computers without CD-ROM drives were also very difficult to get an operating system on when you couldn’t use the network. Windows 2000 eliminates this problem with the new features of Microsoft Backup, and ASR. To prepare a system for recovery, you must first make sure you have tried all of the steps that would logically precede reinstallation of an operating system, such as trying Safe Mode, and trying the Last Known Good configuration. Once you are sure you need to format the hard drive and start over, you will need to create and maintain two components that will be essential for restoring your system with Windows 2000: ■

The logon recovery component, called the Automated System Recovery (ASR) disk. The Automated System Recovery wizard can create and update this 1.44MB floppy disk. This disk will bring your system to a state in which you can log on. The ASR disk can then restore the following:

■

■

The original configuration of the system’s physical storage

■

Windows 2000 operating system files

■

Windows 2000 startup files

A file restoration component, which is the backup of the system and data files that were previously backed up using the ASR backup.

769

74_sysad_19.qx 11/8/99 11:54 AM Page 770

770


NOTE The ASR disk is a new feature of Windows 2000, and replaces the Emergency Repair Disk (ERD) in previous versions of Windows NT for file recovery. You can still use the ERD to repair the startup and system files. The Registry of a Windows 2000 machine is also backed up using ASR.

The next exercise uses ASR to restore a system. The ASR recovery preparation consists of two parts: backing up the system and creating an emergency repair floppy disk.

Exercise 19.2 Backing Up a System Using ASR 1.

Log on with Administrative privileges to the Windows 2000 server that you wish to back up. You will need Administrative privileges to back up the Active Directory.

2.

Start Windows 2000 Backup by clicking Start, Programs, Accessories, then click Backup.

3.

Click AUTOMATED SYSTEM RECOVERY PREPARATION WIZARD.

4.

Click NEXT.

A backup destination screen for the Automated System Recovery Preparation Wizard will appear, similar to Figure 19.4. 5.

Enter the name of your backup file in the Backup media or filename section.

6.

Click NEXT.

7.

Click FINISH.

The Automated System Recovery Preparation Wizard will now back up your system into the backup file that you just specified. 8.

In order to complete the Automated System Recovery Preparation Wizard, you need to insert a blank 1.44MB floppy in the drive, and click OK. The repair data will then be successfully saved, and you will be prompted to remove the diskette and label it “Automated System Recovery Save Set .”

74_sysad_19.qx 11/8/99 11:54 AM Page 771


Figure 19.4

Choosing the backup file during the backup process.

Repairing and Restoring Active Directory In order to restore the Active Directory, you need to have prepared for this failure by backing up the data in advance. You can only back up the Active Directory on a local domain controller; you cannot back up the Active Directory of a remote computer. The following exercise demonstrates the steps required in order to back up and successfully restore the Active Directory.

NOTE You must have information in the Active Directory in order to restore it. Create some test objects to complete the following exercises.

771

74_sysad_19.qx 11/8/99 11:54 AM Page 772

772


Exercise 19.3 Backing Up the Active Directory on a Windows 2000 System 1.


2.

Start Windows 2000 Backup by clicking Start, Programs, Accessories, then click Backup. A window will appear, as illustrated in Figure 19.5.

Figure 19.5

The Windows 2000 Backup and Recovery Wizard.

3.

Click BACKUP WIZARD to begin the backup process.

4.

Click NEXT. You will see a window similar to Figure 19.6.

5.

Select “Back up everything on my computer,” then click NEXT.

74_sysad_19.qx 11/8/99 11:54 AM Page 773


Figure 19.6

6.

Specifying what to back up on your local computer.

If you have access to a tape drive and tape, back up to that. If not, back up to the file system by selecting File from the Backup Destination pull-down menu, as illustrated in Figure 19.7.

Figure 19.7

Specifying the backup media or filename during the backup process.

773

74_sysad_19.qx 11/8/99 11:54 AM Page 774

774


7.

Create the backup file by providing a name for the file.

8.

Click NEXT. A summary sheet similar to Figure 19.8 will display showing you the specifications on the backup job you are about to perform.

Figure 19.8

9.

The backup process summary sheet.

Click FINISH to start the backup process. You will then see a backup progress indicator similar to Figure 19.9.

You have now backed up the local system, including the Active Directory. Exercise 19.4 walks you through restoring the Active Directory that we just backed up in the previous exercise.

NOTE In order to verify that your Active Directory will be restored correctly, you should delete some Active Directory objects that you created before the backup, and restart the Windows 2000 computer. You can then continue the restore. After the restore, you can verify if the objects were actually restored.

74_sysad_19.qx 11/8/99 11:54 AM Page 775


Figure 19.9

The Backup Progress status indicator.

Exercise 19.4 Restoring the Active Directory on a Windows 2000 System 1.


2.

Start Windows 2000 Backup by clicking Start, Programs, Accessories, then click Backup.

3.

Click the Restore Wizard to begin the backup process.

4.

Create a catalog by right-clicking the File icon, and then selecting Catalog File. A dialog box will appear similar to Figure 19.10. The catalog file will be used to list every file and folder that was backed up during the backup process, and will be used when you need to restore selected files and folders.

5.

Click BROWSE to find the backup file that you used in the previous exercise.

6.

Click OK when you have found the backup file.

7.

Reboot your Windows 2000 server.

775

74_sysad_19.qx 11/8/99 11:54 AM Page 776

776


Figure 19.10 Specifying the name of the backup file that you want to catalog.

8.

On the Advanced Startup options, select Directory Services Restore Mode.

9.

When Windows 2000 has finished loading in Directory Services Restore Mode (which looks like Safe Mode), Start Windows 2000 Backup by clicking Start, Programs, Accessories, then click Backup.

10.

On the Backup and Recovery Tools screen, click RESTORE WIZARD.

11.

Click NEXT.

12.

Right-click on File, and select Catalog file.

13.

Click BROWSE to once again find the backup file that you used in the previous exercise. A dialog box will appear similar to Figure 19.11. The backup file is the actual file that will be used for the backup process.

14.

Check the box for System State.

15.

Expand the tree under System State.

16.

A dialog box should appear similar to Figure 19.12 prompting you to enter the Backup File name. Click BROWSE to once again find the backup file that you used in the previous exercise. This is the actual file that will be used for the backup process.

17.

Click OK.

18.

Click NEXT. A summary dialog box should now appear, similar to Figure 19.13.

74_sysad_19.qx 11/8/99 11:54 AM Page 777


Figure 19.11 Specifying what files to restore from the backup file.

19.

Click FINISH to start the Restore process. A Restore Progress status dialog box should now appear, similar to Figure 19.14.

The restore process is now complete. In order to check if the Active Directory was restored correctly, you must restart your computer. When the computer is restarted, it will detect the system Active Directory has been restored and will begin an integrity check. After the integrity check is performed, log on to the system as Administrator and browse the Active Directory and verify the objects have been restored.

Figure 19.12 Specifying the backup file you want to catalog.

777

74_sysad_19.qx 11/8/99 11:54 AM Page 778

778


Figure 19.13 The Restore Wizard summary sheet.

Figure 19.14 The Restore Progress status indicator.

74_sysad_19.qx 11/8/99 11:54 AM Page 779


Authoritative Restore Once we restored our Windows 2000 computer in the previous exercise and then restarted the computer, the Active Directory will begin replicating directory objects across all domain controllers in this domain. If you remember, we can only restore the Active Directory on domain controllers. The Active Directory replicates similarly to the File Replication service. We performed nonauthoritative data recovery, which is the default method. Once restarted, this server will be brought up to date with the rest of the domain controllers through the regular Active Directory replication. The other method of data recovery is authoritative, in which you cannot use normal Active Directory replication to update a server after it has been restarted following the restore. For example, if you deleted a container with a group of users, and restored the container with a backup tape from one week ago, as soon as you restarted the computer after the restore, the rest of the domain controllers would bring this server up to date, which would include the lack of the container you are trying to restore. The reason for the authoritative restore is to make the copy of the Active Directory that is stored on the tape the present copy of the Active Directory, not the copy of the Active Directory that is currently being replicated by the active domain controllers. The term authoritative is used because you, as the Administrator, are specifying the Active Directory replica that is authoritative in relation to the other domain controllers. You can mark the objects in the Active Directory as authoritative with respect to their replication partners.

Summary Windows 2000 helps you prepare for and recover from system failure by providing an easier, more robust backup and restore system, and the addition of the Automated System Recovery (ASR), the Recovery Console, and advanced startup options. ASR will create

779

74_sysad_19.qx 11/8/99 11:54 AM Page 780

780


and periodically update a backup copy of your system files, in addition to any files that exist on the Windows 2000 partition that you choose. The Recovery Console is a command-line interface you enter by inserting the Windows 2000 setup CD-ROM and restarting the computer (if your computer supports bootable CD-ROM drives), or by inserting the setup floppy disks. The advanced startup options enable you to troubleshoot your computer by starting in various modes, such as the Last Known Good, Directory Services Restore Mode, and Debugging Mode. Windows 2000 also introduces the Active Directory, and we discussed the process of backing up and restoring the Active Directory, using the Directory Services Restore Mode advanced startup option. The Active Directory is backed up using Microsoft Backup, and can be included in any backup job that runs on the local computer.

FAQs Q: How often should we do test restores of data? A: In the beginning of establishing a backup scheme, you should be restoring files every week just to ensure that you are confident and skilled enough to restore any file at any time. Also, if you are assigning a new user to administer the backup process, you need to have this user do test restores for a period of time until he or she is also confident with restoring files. You can then do test restores every month to ensure the backups are working correctly.

Q: Should I use the backup software that comes free with Windows 2000, or purchase a third-party product?

A: It depends on your site, including how much data you need to back up, where the data is located, whether you back up messaging and/or e-mail services, and what hardware you are using. Most companies purchase a third-party product because they have a mixture of requirements that are not supported by

74_sysad_19.qx 11/8/99 11:54 AM Page 781


Microsoft Backup, or are more robust than Microsoft Backup. If you have a tape magazine, you should probably purchase a third-party product to provide ample support for the features inherent with a tape magazine.

Q: How do I know when to back up to another hard disk or to tape? A: You should always back up to tape so that you have a means of offsite removable storage. Most companies back up to tape every day or week. You can back up to another hard disk, which is much faster; however, this hard disk should not be located on the same computer. If the hard disk of this computer were to fail, you would lose the data plus the backup that you stored on the same hard disk.

Q: How can I make sure I am ready for system failure? A: Some failures you cannot prepare for, but many failures can easily be repaired if you have prepared for them. You should back up your data, create and update Emergency Repair Disks (ERDs), use the new Automated System Recovery (ASR) option with Windows 2000, learn to use Recovery Console before a problem occurs, have boot floppies and CD-ROMs easily accessible, and understand all of the advanced boot menu options.

Q: Should I assign a user the Backup and Restore Files and Directory rights, or make him or her a Backup Operator?

A: It is possible to assign a user or group to the Backup Operators group to back up and restore data, but these users should be qualified to successfully administrator the backup process. This should not be taken lightly. If you are the only one onsite who is skilled enough to maintain the backups, you should be responsible for this task.

781

74_sysad_19.qx 11/8/99 11:54 AM Page 782

782


Q: Should we use Incremental and Differential backups? A: Most companies do not use differential and incremental backups because of the extra time required to restore files, and the extra effort it takes to maintain a full backup and differential or incremental backups. It’s much easier to use a full backup each time and not have to deal with incremental or differential backups.

74_sysad_index.qx 11/8/99 1:24 PM Page 783

Index A Access control, 92. See also Objectbased access control; Objects. management, 136–138 product, 95 files, 182 folders, 182 permissions, 177, 187, 192. See also Shared folders.; Special access permissions problems. See Permissionrelated access problems. troubleshooting, 213–214 Access Control Entries (ACEs), 178, 179, 214, 240 Access Control List (ACL), 63, 83, 178, 179, 181, 185, 214, 237, 460, 512, 686 Account configuration issues, troubleshooting, 234 database, 126 disabling, 97 Expires option, 114 lockout counter, 639 duration, 639 policy, 107 reset, 639 lockout count, 109 reset, 109 management, 160 operators, 162 passwords, 132 policies, 103, 132, 676 change, 106–110 configuration, group policy usage, 641–646 options, 108 property management, 110 setup. See Mobile users. tab, 113–115 ACEs. See Access Control Entries. ACL. See Access Control List. Acquisitions, 27 ACS Server. See Quality of Service.

Active databases, 107 Active Directory (AD) administration, 469 best practices, 516 FAQs, 521 introduction, 470–502 advanced features, 129 backup, 772–775 benefits, 65–72 best practices, 128–132 components, 482–486 computers, 52, 99–100, 493–496 functions, 123–128 usage, 129–130 concepts, 471–482 database, 145, 154 DNS integration, 72 domains, 52, 496–498 Domains and Trusts management console snap-in, 496, 498 features, 65–79 group policy application process, 536–542 information replication, 70–71 infrastructure, 473 interoperability, 71 introduction, 56–72 key concepts, 56–65 management, 66–67 utilities, usage, 486–502 objects, 89, 186, 239, 774 locating, 506–508 publishing, 503–506 OU, 634 permissions, 512 repair/restoration, 771–778 scalability, 70 schema, 53 Schema manager, 502 security, 67–70 services, 53, 498–502 sites, 53, 498–502 Sites and Services snap-in, 537 trees, 633, 719 trusts, 52, 496–498 users, 52, 99–100, 123–128, 144, 145, 159, 237, 370, 493–496

creation, 634–635 opening, 170 usage, 129–130 Users and Computers MMC snap-in, 571 Active Directory Service Interface (ADSI), 71, 477, 482, 515 overview, 515 Active Server Pages (ASPs), 17, 18 ActiveX scripting architecture, 14 AD. See Active Directory. Adapters, 410–412 configuration, 412–415 Add Printer Wizard, 253 Address pools, 417 Address tab, 112–113 .adm files, 574, 585, 644 Administration model, 512, 513, 550 Administrative access, 130 centralization. See Routers. Administrative boundaries, 550 Administrative control, delegation. See Objects. Administrative logon, 130–132 Administrative privileges, 775 Administrative responsibility, 27 Administrative rights, 164, 165 Administrative roles, 44 Administrative shares, 201–202 Administrative templates addition, 548, 585–586 creation. See Custom administrative templates. usage, 573–586 Administrative tools, 51, 126 Administrative Tools folder, 34 Administrators, 98, 162 backup, 370 groups, 165, 200 password, 34, 465 Adobe Photoshop, 621 ADSI. See Active Directory Service Interface. Advanced startup options, 766–767 Advanced tab, 263 Alert message, 376

783


784

Index

All Users folder, 224–225 Alphanumeric characters, 99 America OnLine (AOL), 60 Analog, 438 Analysis display, 312 text-based version, 315 Analysis MMC snap-in, 671 Analysis snap-in, 675–676 Anonymous logon, 164 AOL. See America OnLine. API. See Application Programming Interface. Applet, 675 AppleTalk printing devices, 257–258 Application-enabled operating system, 17 Application Log, 332, 333, 406 Application Programming Interface (API), 477, 515, 605 Application-specific .dll files, 599 Applications assignments, 526 compatibility scripts, 428 deployment, success, 614–615 server. See Windows 2000. services, 17–18 Architecture, design, 26, 27, 39 Archives, attributes, 367 Arcserve backup software, 366 ARP cache timeout, 416 Ascend, 431, 448 ASCII files, 573 ASPs. See Active Server Pages. ASR. See Automated System Recovery. Assigned software, 597 Associated account, 268 Asynchronous Transfer Mode (ATM), 429 AT command, 460 ATM. See Asynchronous Transfer Mode. Attribute, 476 Audit Log, 341 Audit policy, 340, 676 configuration, 679–683 Audit resources, 46 Auditing. See Events; Folders. ability, 92

Authenticated Users, 164, 541, 554 Authentication, 484. See also Kerberos; Logon; User authentication. definition. See Numeric authentication; Singlefactor authentication; Two-factor authentication; User authentication. protocols, 438 Author mode, user mode comparison, 456–457 Authoritative data recovery, 779 Authoritative restore, 391–393, 779 Authority, delegation, 550, 664 Autodial, 443 Autologon, 443 Automated System Recovery (ASR), 75, 768 disk, 769 Preparation Wizard, 770 usage. See System. Automatic certificate request settings, 691 Automatic restart, 6 Autostatic routes, 445 Autostatic service, 445

B Backed-up data, 389 BackOffice products, 535 Backup. See Copy backup; Daily backup; Data backup; Differential backup; Incremental backup; Normal backup; System protected files; Volume. administration, 126 administrator, 761 copies, 762 data, 371 compression, 379 destination, 382–385 file, 386 creation, 774 job, failure, 762 Job Information, 378 log, 375

creation, 395 usage, 763 operations, 375 operators, 162, 370, 761 plans, development, 394 procedures, 380 routine, establishment, 758–759 starting, 377 strategy, 749 types, 367–370, 378 utility, 75 window, 114 Backup Domain Controller (BDC), 36 Backup Wizard, 390 Backups, 46, 230 maintenance, 48 Bandwidth, 540 intensiveness, 759 Bandwidth Allocation Protocol (BAP), 658–660 Banner pages, 270 BAP. See Bandwidth Allocation Protocol. Basicdc.inf, 686 Basicsv.inf, 686 Basicwk.inf, 686 Batch files, usage, 387–389 Bay Networks/Nortel, 430, 448 BDC. See Backup Domain Controller. Bi-directional communication, 259 Bi-directional printer, 258, 262 Bidirectional trust relationships, 473 Biometric identifier, 91 Bitmaps, 451 Block inheritance, 561 Block policy inheritance, 543, 558, 643 Blocking inheritance, 543 Blue screens, 10, 11 Boot virus, 702 Boot volumes, 314 BOOTP. See Bootstrap Protocol. Bootstrap Protocol (BOOTP), 416 Bridge 99, 49 Browser, 467 Built-in administrators group, 199


Index Built-in domain local groups, 162 Built-in global groups, 163 Built-in groups, 137, 156, 162, 200 behavior, 164–168 implementation, 162–168 Built-in local groups, 163 Built-in object groups, 100 Built-in system groups, 164

C C++, 515 CA. See Certificate Authority. CAL. See Client Access License. Catalogs updating/deletion, 393 usage, 375 CDFS volumes, 344 Central-point administrative tool, 55 Certificate Authority (CA), 470, 689–696, 704 Certificate Manager Import Wizard, 701 Certificate Revocation Listing (CRL), 689, 699 Certificates, 126, 688–689 Certificates Microsoft Management Console snapin, 704 Certification Authority (CA), 127, 697. See also Trusted root certification authorities. Challenge Handshake Authentication Protocol (CHAP), 437 Change management, 14 Change permission, 187 CHAP. See Challenge Handshake Authentication Protocol. Cheyenne ARCserve, 760 Child domains, 58, 473 Child nodes, 733, 748 configuration, 738–741 removal, 745–747 setup, 736–738 Child objects, 156 CHKROOT.CMD script, 428

Cipher command, usage. See Data decryption; Data encryption. Cipher.exe command, 707, 708 Cisco, 430, 448 Citrix WinFrame, 425 Client access. See World Wide Web. interactions. See Distributed File System. side VPN, configuration, 442 software, 481–482 Client Access License (CAL), 406, 407 Cluster Service information, 371 Clustering. See High-end clustering. CMAK. See Connection Manager Administration Kit. CN. See Container. Color scheme, 289 COM. See Component Object Model. COM+. See Component Services. 3Com, 430 Command-line administration, 743–745 Command-line interface, 764 Command line Kill, 463 Command line options, 210, 677 Command-line utilities, 707 Communications services, 19–20 systems security, 93–94 compatws.inf, 686 Component Load Balancing, 12 Component Object Model (COM), 18 Component Services (COM+), 371 Compressed folder, 293 Compression. See Folders. status, 289 Computer Management console, 402–406, 438 MMC, 461 snap-in multiple times, 455 Computer name, 34 Computers accounts, 650–651

configuration, 526, 575 definition, 90 object groups, 100 OU, 632, 633 policy, 240 script policies, assignation, 588–590 security, 93–94 snap-ins, 635 Startup scripts, 587 Configuration. See Computer configuration; Users. information, 472 management, 14 parameters, 546 settings, 340, 544, 547 subfolders, 526–529 template, 684 types, 526–529, 559 Connection Manager Administration Kit (CMAK), 450–452 wizard, 452 Connection Sharing, 446 Connection speed, autonegotiating, 414 Console file, 608 tree, 122, 129 Container (CN), 64. See also Group policies. administrator, 558 Contention, 12 Control Wizard, delegation, 513–515 Copies, retaining, 395 Copy backup, 368 Core operating system services, 6 Corporate & Systems Security, 93, 95 Corporate databases, 95 CPU cycles, 405, 432 CPU throttling, 17 Crash avoidance, 10–11 Creator owner, 164, 192, 215 Creator-owner Full Control access, 215 Creator-owner privileges, 552 CRL. See Certificate Revocation Listing. Cross-domain lookups, 478

785


786

Index

CryptoAPI security architecture, 703 Cryptographic public key, 688 Custom administrative templates, creation, 579–585 Custom File Mask, 377 Custom MMC consoles creation, 453–458 options, 456–457 Customized roaming profiles, assignation, 231–233 Cybertrust, 689

D Daily backup, 367–368 Data access. See Encrypted data. Administrator, 453 backup, 363, 373–389, 758–765 advanced options, 378–380 best practices, 394–395 FAQs, 397–398 introduction, 364–373 options, 374–380 compression best practices, 318–319 management, 286–297 decryption, 309 cipher command usage, 306 encryption, 305–310 cipher command usage, 306 moving, 198. See also Encrypted data. rate, 430 recovery, 704–705 certificate, 310 introduction, 364–373 renaming. See Encrypted data. repository, definition, 90 restoration, 363, 373, 389–393. See also Folders. best practices, 394–395 FAQs, 397–398 options, 374–380 sets, restoration. See Replicated data sets. storage, 405

FAQs, 319–320 management, 46, 285 troubleshooting, 317–318 verification, 376 warehousing, 5 Database administrator, 44 Date/time settings, 34 DC. See Domain-component; Domain controllers. DC security.inf, 686 DCPromo, 486–493 DCPromo.exe, 485, 486 DDNS. See Dynamic Domain Namespace. Decryption, 703–704. See also Data decryption; Files. dedicadc.inf, 686 Dedicated print servers, nondedicated print servers comparison, 249 Default administrator account, 99 Default Domain Policy, 637 Default printing preferences, 263 Default subfolders, 526 Default templates, 685 Default user settings, 223 Defragmentation, 74–75. See also Disk defragmenter; NT File System. Delegated Access Multiple Window, 456 Delegated Access Single Window, 456 Delegation of Control Wizard, 513, 514 Demand dial routing, 443–445 Demand Dial Routing environment, 433 Dependencies, 405 Dependency Walker, 466 Description bar, 128 Desktop Administrator, 453, 454 Desktop configurations, 530 Desktop environment, 223, 225 Desktop file/folder management, 531 Destination drive, 291 Destination folder, 194, 309 Device Manager, 52, 403, 437 Devices securing, 395

Settings tab, 265 DFS. See Distributed file system. Dfs. See Distributed file system. DHCP. See Dynamic Host Configuration Protocol. Dial-in access, 655 Dial-in option, 656 Dial-in permission, 658 Dial-in tab, 119–120 Dial on Demand, 431 Dial out. See Remote Access Service. Dial routing. See Demand dial routing. Dial-up device, 444 Dial-Up Networking Entries, 451 Dial-up scripts, 450 Dial-up servers, 448 Dialup, 164 Differential backup, 369–370 restoration, 762 Diffserv, 429–430 Direct cable connection, 248 Direct-connect print clients, 257 Direct X diagnostic utility, 462 Directory, 471–472 databases, 485 services, 13–14, 56, 57, 81. See also Integrated directory services. backup, 395 store, 70 structure, 187, 506 tree, 48, 63 Directory Service Migration, 39 Tool, 23 Disabled=z, 534 Disaster protection. See Windows 2000. implementation, 753 FAQs, 780–782 introduction, 754 Disaster recovery, 6, 8–9 methods, 25 Disaster Recovery Preparation Wizard, 75 Disaster recovery strategy, 749 Disk Quota Manager, 298 Disks. See Logical disks. defragmentation, 317 defragmenter reports, viewing, 315–316


Index usage, 311–316 mirroring, 763 quotas, 9, 73–74 limits, 298, 301 management, 74, 297–304 space, 303 requirements, 291 subsystem, 408 system, 360 Display settings, 465 Distinguished Name (DN), 64, 81, 474 Distributed File System (DFS/Dfs), 7, 16, 76–79, 82 administration, 741–747 child node, 741, 745 client interactions, 748–749 console, 743 information, removal, 747 introduction, 718–722 Manager, 78 Microsoft Management Console, 729, 734 console, 736, 737 namespace, 744, 746–748, 750 nodes, 749 replica set, 738 root connection, 742–743 removal, 745–747 setup. See Fault-tolerant DFS root; Stand-alone DFS root. Root Volume/Wizard, 724 usage. See File resource sharing. Distribution lists, 139 .dll files, 599 DLLs, 466 DMAs, 404 DN. See Distinguished Name. DNS. See Domain Name Server; Domain Name System; Domain Namespace. record set, 647 server, 647, 690 DNS RR, 646 Documents administration, 236 management. See Print queue. Domain Admins global group, 164

Domain-component (DC), 64 Domain controllers (DC), 96, 170, 370, 391, 395, 471, 472, 479, 486, 487, 493, 498, 506, 532, 568, 569, 705. See also Backup Domain Controller; Primary Domain Controller. discovery, 646–648 object group, 100 roles, 36 Domain Migrator tool, 23 Domain Name Server (DNS), 485 Domain Name System (DNS), 26, 27, 60, 84. See also Dynamic DNS. domain, 64 integration, 66. See also Active Directory. Domain Namespace (DNS), 467. See also Dynamic Domain Namespace. management, 419–424 console, 421, 424 namespace standards, 472 server, 420 Domains, 32, 56–60, 81, 485, 555. See also Active Directory; Child domains; Parent domains. account policy, 674 administration, 630 administrators, 552, 554, 631, 702 Group Policy Object, 241 link, management, 555–557 groups, 137 information, 101, 472 level, 543 local group, 63, 140–143, 157, 158, 661. See also Built-in domain local groups. management, 46 mode, change, 52 name, 278 networks, 479 node, 124 object, 495 resource access, 140, 141. See also Local domain resources.

restrictions. See NT 4.0 domain. selection, 125 structures, 57 trees, 58–59, 142, 170, 486 trusts, administration, 52 users, 349 account, requirement, 99–103 DOS clients, 428 Down-level logon name, 113 Downlevel name, 152 Driver Verifier, 11 Drivers. See Print; Printer. Dump option, 7 Duplexing, 763 Dynamic DNS, 72 Dynamic Domain Namespace (DDNS), 423 server, 422 Dynamic Host Configuration Protocol (DHCP), 402, 416, 422 client, 416, 417 Console, 418 manager, 415–419 servers, 418 Dynamic Volume Management, 16 Dynamic volumes, 9, 72

E E-mail, 112, 454 address, 111, 152 distribution, 139 distribution lists, 63 entry, 117 generation, 144 EFS. See Encrypted File System; Encrypting File System. Emergency Repair Disk (ERD), 364, 372–373, 396, 763–765, 770 Employee access, 93 Encrypted clear text, 114 Encrypted data, 308 access, 309 moving/renaming, 309 recovery agents, 691 Encrypted File System (EFS), 305, 309, 310, 702 architecture, 703–705

787


788

Index

certificate, 308 usage, 705–708 guidelines, 709 Encrypted files, storage. See Remote servers. Encrypted folders, 306 Encrypting File System (EFS), 470, 670, 691, 709, 710 Encryption, 703–704. See also Data; File encryption; Reversible encryption. certificate, 310 key pair, 305 End-to-end management solutions, 6 Enterprise administrators, 552, 554 Enterprise certification authorities, 126, 711 Enterprise environment, 422 Enterprise-level backups, 366 Enterprise modules, 690 Enterprise trust, 692 Enterprise-wide deployment, 92 Enterprisewide user definitions, 662 ERD. See Emergency Repair Disk. Error-correcting memory, 45 Error handling, 6 Error message, 291 Ethernet II, 432 Ethernet SNAP, 432 Event fields, 330 Event ID, 330, 333 Event Logs, 322, 323, 326, 335, 347, 357, 676 archiving policy, 359 entry, 342 FAQs, 361 information, monitoring, 324–325 management, 354–358 monitoring, 321 best practices, 359–360 introduction, 322–325 viewing, 325–335 Event Viewer, 326, 332, 403, 406 console, 356 database, 334 review, 763 Events Description, 353

monitoring, 682. See also Security. types, auditing, 682–683 EVT extension, 356 EVT file, 326, 327, 331, 332, 334, 357 Excel 97, 604, 620 Exchange, 510 server, 139 Exchange/Outlook, 113 Exclude files, 375, 377 Extended interoperability, 66 Extension snap-ins, 456 External access, definition, 90

F Fail-safe defaults, usage, 92 FAT file system, 176, 686 FAT32 file system, 176 FAT partitions, 193, 196, 211, 215, 292 FAT32 partitions, 196 FAT volumes, 78, 197, 295, 311, 344 file/folder moving/copying, 295–297 FAT16 volumes, 762 FAT32 volumes, 311, 344, 762 Fault tolerance, 6, 7, 78, 480, 763 Fault-tolerant DFS root, 725, 726, 745 setup, 722–730 wizard, 733 Favorites tab, 79, 80 Feature-rich laser printers, 269 FEK. See File Encryption Key. Fibers, usage, 12 File Encryption Key (FEK), 703 File Replication Service (FRS), 739 data, 379 File resources administration, 175 FAQs, 218–219 sharing best practices, 749–750 DFS, usage, 717 FAQs, 750–751 Filename, 380 Files auditing, 342–345

backup, file/tape source, 382–384 changes, application, 288 compression, 286–288 copying/moving, 292–297 rules, 292 status determination, 289–291 copying, 192–193. See also FAT volume; Floppy disk; NT File System volume. data, restoration, 379 decryption, 308 deployment, 526 encryption, 308 enabling/administering, 702–710 management. See Desktop file/folder management. moving, 192–196. See also FAT volume; Floppy disk; NT File System volume. names, 316 ownership control, 190–191 permissions, 215. See also NT File System. override. See Folders. replacement, 377, 389 restoration, file/tape source, 389–390 servers, 720, 755 service management, 76 snap-in, 76 sizes, 316 storage. See Remote servers. system, 676. See also Recoverable file system. architecture. See Encrypted file system architecture. Filtering policy, security group membership basis, 241 Filters, 129–130. See also Password. Floppy disk, 380 file/folder moving/copying, 295–297 Folders, 187, 302. See also All Users folder. auditing, 342–345 changes, application, 288 compression, 286–288


Index copying/moving, 292–297 rules, 292 state, 292 status determination, 289–291 copying, 192–196. See also FAT volume; Floppy disk. creation. See Home folders. data, restoration, 379 management. See Desktop file/folder management. moving, 192–196. See also FAT volume; Floppy disk; NT File System volume. names, 290 ownership control, 190–191 permissions. See NT File System; Shared folder permissions. file permission override, 179 redirection, 568, 590–592 sharing, 200–211 Forests, 59–60, 485–486, 497, 662 login credentials, 489 networks, 479 object location, 478 Forms, assignation. See Paper trays. Forward lookup zone, 421 Fragmentation, 74. See also Defragmentation. Frame types, 432 Free space, 316, 318 FRS. See File Replication Service. Full Control access, 213. See also Creator-owner Full Control access. permissions, 199, 370 privileges, 199

G Gateways, 416 General tab, 111–112, 152–153, 158, 261 Ghost works, 650 Global Catalog, 56, 61–62, 67, 81, 477–479 servers, 500

Global groups, 63, 140–143, 157, 660, 661. See also Built-in global groups; Domain Admins global group. Globally Unique IDentifier (GUID), 474, 476, 533 GPC. See Group Policy Container. GPO. See Group Policy Object. GPT. See Group Policy Template. Graphical interface, 211, 387 Graphical User Interface (GUI), 208, 350, 458, 464 administration, 743 interface, 310 Group policies, 235, 336, 403, 481, 483, 541, 691–692. See also Slow networks; Windows 2000. administrative tasks, 551 administrators, 552 application, 240–242 process. See Active Directory. best practices, 560–562 configuration, 531 example, 549–550 development, best practices, 242–244 FAQs, 565–566 filtering, 139 implementation, 523 guidelines, 557–560 inheritance, modification, 542–543 introduction, 239–242 management snap-in, usage, 549 modification, 543–550 range, 524 security settings extension, 671–674 snap-in, 239, 569 usage. See Microsoft Management Console. structure, 525–536 tab, 544–546 types, 530–531 usage. See Account policies; Software management; User environment management.

Group Policy Container (GPC), 532 Group Policy Editor, 238, 546–548, 652 Group Policy Management Console snap-in, 682 Group Policy Object (GPO), 338, 531–532, 534, 536, 545, 549, 558, 616, 617, 635, 641, 644, 652–655 administrative control, delegation, 550–557 association, 560 creation, 538–539, 551–553, 616–618 link, management. See Domains; Organizational Unit; Sites. management, 551 minimization, 665 modification, 551, 554–555 policy, 642 option, 648 scope, filtering, 541–542 usage, 561 Group Policy Template (GPT), 529, 532 contents, 533–534 GPT.INI, 534–536 Groups, 56, 62–63, 81, 183. See also Domain; Global groups; Restricted groups; Security; Universal group. access, 180 lists, 509 accounts, 100 administration, 629 best practices, 663–665 FAQs, 666–667 introduction, 630–631 behavior. See Built-in group behavior. creation, 145–146. See User accounts. information, 144 preparation, 144 deletion, 159–160 discovery, 158–159 FAQs, 172–174 implementation, 144–160. See also Built-in groups; Local groups. introduction, 136–141 management, 157–160, 169

789


790

Index

membership, 169 list, 178 name, 144 objects, 169 population, user accounts usage, 612–613 scope, 140–141, 144, 146, 153 change, 157–158 settings configuration, 151–157 interface, 147 usage. See Users. window, 151 strategies, implementation, 142–143 structuring, 143 types, 139, 144, 152. See also NT 3.x groups types; NT 4.x groups types; Windows 2000. usage, 138. See also Universal groups; User accounts. reasons, 142 users, assignation, 147–151 Growth, 27 Guest account, 165 GUI. See Graphical User Interface. GUID. See Globally Unique IDentifier.

H H.323 standard, 19 Hackers, 46, 109, 325 Hard disks, 311, 376, 380, 756 space, 27 Hard drives, 33, 756 Hardware add-ons, 692–693 configurations, 49 Hardware Compatibility List (HCL), 32 Hardware Resources, 404 HCL. See Hardware Compatibility List. Hidden shares, 202 Hierarchical naming structure, 61 Hierarchical Storage Management, 15, 76

High-availability solutions. See Windows 2000. High-end clustering, 5 High Performance File System (HPFS), 83 hisecdc.inf, 686 hisecws.inf, 686 History records, 93 HKCU. See HKEY_CURRENT_USER. HKEY_CLASSES_ROOT, 352 HKEY_CURRENT_CONFIG, 351 HKEY_CURRENT_USER (HKCU), 351, 529, 574, 599, 648, 651, 652 HKEY_LOCAL_MACHINE (HKLM), 351, 352, 419, 529, 574, 599, 747 HKEY_LOCAL_USER, 428 HKEY_USERS, 351 HKLM. See HKEY_LOCAL_MACHINE. Home directories, 235–236 creation, 236–239 security, tightening, 243–244 Home Directory, 115 Home folders, creation, 235–239 Hop count, 434, 435 HP LaserJet 5Si/5Si MX PostScript driver, 261 HPFS. See High Performance File System. HR. See Human Resources. HTML. See HyperText Markup Language. HTTP compression, 17 Hubs, 429, 447. See also Routers hubs/switches. Human Resources (HR), 484 department, 88 information, 720 policies, 345 self-service applications, 91 systems, 113 tool, 118 HyperText Markup Language (HTML), 18, 79 interface, 83

I IANA. See Internet Assigned Numbers Authority.

IAS servers, 162, 450 ICA. See Independent Computing Architecture. Icons, 129 appearance, 651 ID 560, 354 ID assignments, 96 ID length, 97 ID usage, 98 IE4, 450 IETF. See Internet Engineering Task Force. IETF-based authentication service, 447 IIS. See Internet Information Server. Implementation plan, 557 Import media, 376 In-depth troubleshooting, 404 Incremental backup, 368–369 restoration, 762 Independent Computing Architecture (ICA), 426 protocol, 428 Independent Software Vendors (ISVs), 18 Information Events, 333 Information replication, 66. See also Active Directory. Information Services (IS), 92–94 Information Technology (IT), 20, 24, 31 foundation, 23 managers, 324, 670 professional, 470 Infrastructure, 194, 550, 687 Inheritance. See Blocking inheritance; Overriding inheritance; Permissions. blocking. See Policies. model, 542 modification. See Group policies. order, 536–538 prevention, 190 rules. See NT File System. Inherited permissions, 184, 215 INI files, 351, 427 Initial password, 97 Installation files, 33 Installation Wizard, 487 Installer, 600, 601


Index packages, 604 file, creation. See NonWindows Installer package file. Integrated directory services, 13 Intelligent I/O, 12 IntelliMirror, 15, 66 Inter-enterprise network connectivity, 90 Inter-Site Topology Generator, 500 Inter-Site Transports folder, 500 Interactive switch, 589 Interconnected domains, 507 Internal billing group, 267 International Telecommunications Union (ITU), 426 Internet Assigned Numbers Authority (IANA), 418 Internet Authentication Service, 431, 447–450 Internet-aware operating system, 17 Internet-based standards, 82 Internet domains, 82 Internet Engineering Task Force (IETF), 85, 447 Internet Explorer 5, 699 Internet Information Server (IIS), 17, 278, 322, 402, 679, 695, 718 Web site, 735 Internet names, 72 Internet Printing Protocol (IPP), 17 Internet Protocol (IP), 437, 480, 500 addresses, 60, 72, 94, 254, 278, 414, 416–422, 445, 450, 481. See also Unregistered IP addresses. conflicts, 646 phone, 116 routing, 435, 436 subnet configuration, 738 Internet Protocol Security (IPSEC), 709 Internet server. See Windows 2000. Internet Service Providers (ISPs), 5, 415, 439 Internet standards, 65

Internetworks, 434 Interoperability, 13. See also Active Directory; Extended interoperability. Interpersonal skills, 44 Intersite replication, 500 Intra-enterprise network connectivity, 90 Intranet root URL, 718 Intranet stand-alone DFS root, 737 Intrasite replication, 500 Inventory management system, 93 IP. See Internet Protocol. IPP. See Internet Printing Protocol. IPSEC. See Internet Protocol Security. IPSec, 414 protocol, 19 IPX, 431–433 RIP, 433 SAP, 431 IPX/SPX, 411, 432, 441 IRQs, 404 IS. See Information Services. ISDN, 437, 438, 658 ISPs. See Internet Service Providers. ISVs. See Independent Software Vendors. IT. See Information Technology. ITU. See International Telecommunications Union.

J Java, 515 clients, 428 JavaScript, 14 Jscript, 531 Junction points data, 389 restoration, 379

K KB. See Knowledge Base. KDC. See Key Distribution Center. Kerberos, 68, 85, 467, 509 authentication, 470 policy, 107

protocol, 69 security models, 65 server groups, 452 _kerberos._tcp.dc._msdcs, 647 Key Distribution Center (KDC), 68 Keywords, 504 Kill (command), 463 Knowledge Base (KB), 359 maintenance, 49

L LAN. See Local Area Network. LaserJet 5Si, 273 Last Known Good configuration, 766 Layer 2 Tunneling Protocol (L2TP), 19, 431, 441, 442, 444 LDAP. See Lightweight Directory Access Protocol. _ldap._tcp.dc._msdcs, 647 _ldap._tcp.gc._msdcs, 647 _ldap._tcp.pdc._msdcs, 647 License manager, 406–407 licensed, 94 Licensing agreement, 34 Lightweight Directory Access Protocol (LDAP), 65, 71, 467 LDAP-aware programs, 515 LDAP-compliant directory, 636 queries, 129 servers, 113 Limited membership, 140 Link-state database, 436 Link Summary Update (LSU), 436 LINKLOCAL, 418 LOBs, 93 Local Area Network (LAN), 426 Local domain controller, 771 Local domain resources, access, 140 Local groups, 137, 140–143, 158, 161, 163, 660. See also Built-in local groups.; Domains. creation, 161 preparation, 160–161 implementation, 160–161 Local policies, 676

791


792

Index

Local printers, 250 installation, 250–253 Local users, 163 profiles, 226–227 Local Users/Groups, 402 Lockout. See Account. accounts, 109 policies, 107, 637 settings, 636–639 Log files, 491 Log-on name, 65 Log size settings, 355 Log views, 329 Logging options, 300 Logical-DFS-name-to-physicalUNC-name mapping, 736 Logical disks, 364 Login attempts, 639 Logon, 97, 103, 586. See also Administrative logon. authentication, 460 count, 109 Hours option, 114 names, 302. See also Downlevel logon name; Users. administration, 636–641 option, 102 To option, 114 problems, troubleshooting. See User logon problems. process, understanding, 460–461 request, 478 script, 115 services. See Secondary logon services. usage. See Password change. Logon/Logoff scripts selection, 588 LPD services, 258 LPR/LPD print services, 258–259 LPR port, 258 LPT1, 273 LPT2, 273 LSU. See Link summary update. L2TP. See Layer 2 Tunneling Protocol.

M MAC address, 416, 417 Macintosh clients, 119, 428 PPP client, 641 workstations, 258 Mail objects, 156 Maintenance tasks, 393 Managed access, definition, 90 Managed By tab, 154 Management, 13 infrastructure, 14 snap-in usage. See Group policy. solutions, 13 tasks, 67 Management/executive approval, 24 Management Saved Console (MSC), 52, 400 files, 457 Manager responsibility, 92 Mapping. See One-to-one mapping; User Principle Name mapping. Masquerading, 95 definition, 91 Master File Tables (MFT), 314 MD5, 437 Media failure, 364 insertion, 376 maintenance, 393–394 securing, 395 Tools, 394 Member Of tab, 149, 153–154 Member servers, 99, 680 roles, 35 Members tab, 153 Membership rules, 141 Memory, 404, 756. See Errorcorrecting memory. allocation, 12 leaks, 10 support, 45 Mergers, 27 Messaging systems, 755 MFT. See Master File Tables. Microsoft Graphical Identification and Authentication (MSGINA), 460

Microsoft Management Console (MMC), 14, 51–56, 73, 75, 76, 96, 103, 121, 145, 167, 168, 325, 400–401, 403, 454, 596, 605–608, 723, 725. See also Computer Management MMC. consoles, 123, 338, 453, 456, 535, 728 creation. See Custom MMC consoles. snap-in, 75 domains, 158 group policy snap-in, usage, 570–572 Security Configuration and Analysis snap-in, 167 security snap-ins, loading, 104–105 snap-ins, 70, 144, 145, 161, 364, 486, 685. See also Analysis MMC snap-in. Software Installation, 621, 623 snap-in, 618 starting, 549 supports, 456 usage, 616. See also Packages. Microsoft Routing and Remote Access, 430, 431 Migration process, 25 Mission-critical systems, 88 MMC. See Microsoft Management Console. Mobile users, account setup, 655–660 Modes, switching, 170–172 Modify permissions, 194 Motherboards, 755 Mount points, preservation. See Volume. Mounted drives, contents backup, 376 MS Project, 428 MSC. See Management Saved Console. MSC files, 454 MSGINA. See Microsoft Graphical Identification and Authentication. MSI package, deployment, 618–620


Index Multihomed computers, 11 Multilink, 658–660 Multilink-enabled RAS server, 659 Multimaster replication, 71 Multiple processors,support, 45 Multiple user accounts, creation, 631–636 Multisession operating system, 427 My Documents, 235–236 folder, 238, 318

N Name, 64–65 Namespace, 56, 60–61, 81, 472–474, 633, 718, 730 Naming conventions, 144, 474–476 NAS. See Network Access Server. NAT. See Network Address Translation. Native mode, 37, 141, 172, 656. See also Non-native mode. Native-mode Windows 2000 domain, 657 Nature metaphor, 59 NDS. See NetWare Domain Services; Novell Directory Service. Net Use, 210, 211 NetBEUI, 411, 412, 440, 441 NetBIOS, 84, 424, 432, 465, 490, 646 Names, 433 Netdiag, 467 Netscape 4.x, 428 NetWare, 431, 719 bindery, 636 client, 432 migration, 31 NetWare Domain Services (NDS), 23 Network Access Server (NAS), 437, 441, 447, 451 username Database, centralization, 448 Network Address Translation (NAT), 445–447 Network Administrator, 453 Network-based algorithm, 540

Network-based applications, 92 Network-based UNC paths, 208 Network Interface Card (NIC), 411, 413, 414, 429 Network IP security policies, 531 Network Load Balancing, 12 Network Monitor, 323 Network Neighborhood, 61, 208, 210 Network-printing environment, 248 Networking hardware, 45 infrastructure, 24 objects, 57 services, 400 Networks, 140, 164. See also Slow networks. administator, 44, 46, 47, 50, 98 administration, 81, 138 introduction, 44–51 Administrator, 453 bottlenecks, 282 cards, 756, 758 errors, 757 clients, 273 connections, 210, 414, 443 delays, 429 design, 45–46 documentation, 48–51 environments, 679 failure, 757 folder, 115 infrastructure, 429, 449 logon IDs, 687 maintenance, 138 management, 46 Path, 115 printers, 250 computer, 465 installation, 254–255 types, 257–259 protection, 46–48 resources, 478, 495 securing, 196–197 servers, building. See Sharefriendly networks/servers. services, 19–20 settings, 34, 465 setup, 45–46

share, user data redirection, 651–655 storage resources, 77 NIC. See Network Interface Card. Non-alphanumeric characters, 99 Non-business-critical systems, 91 Non-dedicated print servers, comparison. See Dedicated print servers. Non-dedicated servers, 249 Non-native mode, 141 Non-Windows 2000 servers/clients, 36 Non-Windows Installer package file, creation, 601–604 Nonauthoritative data recovery, 779 Nonauthoritative mode, 391 Nondomain controller, 404 Nonredirected locations, 428 Nonremovable media, 382 Nontransitive trusts, 497 Normal backup, 367 Not-for-profit organizations, 21 Novell, 73 Client 32 software, 718 networks, 65 Novell Directory Services (NDS), user importation, 636 NT 3.51, 636, 650 domain controller, 657 NT 4.0, 2, 66, 70, 76, 80, 82, 115, 119, 170, 292, 430, 536, 573, 636, 650 domains, 661 controller, 657 restrictions, 630–631 user migration, 632–633 Event Log, 327 event viewer, 327 Guide to Profiles and Policies, 644 policies, 240 Primary Domain Controller, 29 profile directory, 651 problem, 652 registry, 630 Service Pack 4, 535

793


794

Index

system policies, 560, 598 System Policy Editor, 596 usage, 222 User Manager for Domains, 96, 635 NT Directory Service (NTDS), 470, 472, 478, 491 folder, 517 Site Settings, 399 NT File System (NTFS), 15, 73, 78, 83, 286, 297, 535 5.0, 7 encryption, 292 file permissions, 177–178, 649 file system, 8, 225, 295, 670, 702, 703, 749 folder permissions, 176–177 inheritance rules, 179 partitions, 192–194, 198, 211, 292, 676, 686, 765 defragmentation, 316–317 permissions, 204, 211–212, 761 assignation, 181–192 best practices, 214–217 change, 191–192 combination, 179–180 management, 182–185 plan, 181–182 usage, 176–178. See also Windows 2000. volumes, 9, 185, 197, 311, 379 file, copying, 293 file/folder, moving, 293–295 NT 3.x groups types, 660–661 NT 4.x groups types, 660–661 ntbackup comand, 387 NTConfig.pol, 240 NTCONFIG.POL file, 645 NTDS. See NT Directory Service. ntdsutil utility, 391, 392 NTEVNTLG.MDB, 359 NTFS. See NT File System. NTLM, 509 Ntmsdata file, 379 NTUSER.DAT, 648, 651 NTuser.dat file, 224, 229 NTUSER.MAN, 648 Numeric authentication, definition, 91 NWLink, 412

O O. See Organization. Object-based access control, 508, 509–512 Object Pathname, 156 Object tab, 154–156 Objects, 482–484. See also Computers; Group Policy Object. access control, 508–512 administrative control, delegation, 512–515 attributes, 129 class, 156 group. See Domains. locating. See Active Directory. location. See Forests. publishing. See Active Directory. types, 483 OEMSETUP.INF files, 464 Office 97, 622 On-disk catalog, 375 One-to-one mapping, 127, 128 One-way trusts, 58, 497 Open membership, 140, 141 Open named pipe, 207 Open Shortest Path First (OSPF), 436–437 Operating System (OS), 56, 75, 126, 322, 404, 465, 508, 552, 554, 756. See also Multisession operating system. modification, 524 operations, 526 services, 6–7 upgrades, 181 Order of inheritance. See Inheritance. Order of precedence. See Precedence order. Organization (O), 64 tab, 118–119 Organizational Unit (OU), 46, 56, 62, 63, 81, 101, 110, 124, 132, 475, 483–484, 513, 524, 541–543, 561, 568, 638, 664. See also Active Directory; Computers; USA OU. application, 555

folder, 159 Group Policy Object, 241 link, management, 555–557 level, 516, 635 object, 558 policy, 537 definition, 637 OS. See Operating System. OSI model, 410, 411, 441 OSPF. See Open Shortest Path First. OU. See Organizational Unit. Outages, avoidance, 6 Override denial. See Permissions. Overriding inheritance, 542–543, 558 Overwrite events, 355 Ownership control. See Folders.

P PAC, 91 Packages removal, MMC usage, 623–624 upgrading, 614 Packets, 435, 443 PAP. See Password Authentication Protocol. Paper-source trays, 269 Paper trays, forms assignation, 269–270 Parent domain, 58, 473 Parent folder, 193 Parent object, 191 Partitions, defragmentation. See NT File System. Pass-through authentication, 497 Password Authentication Protocol (PAP), 437 Passwords, 69, 91, 97, 122, 439, 449, 459, 461, 480, 687. See also Account; Initial password. Age (maximum/minimum), 108, 640 change, 98, 102, 113, 679 user logon, usage, 97, 109, 641 complexity requirements, 109, 640 enforcement, 108


Index entering, 131 expiration, 98, 114 filter, 640–641 history, enforcement, 639 information, 404 length (minimum), 109, 640 policies, change, 106–110 requirements, 639–641 setting, 103–110 rules, 89 standards, 95 storage, 641 Pcl.sep, 271 PDC. See Primary Domain Controller. Peak data rate, 430 Performance baselines, 408 console, 407–410 Logs/Alerts, 402 Monitor, 323 Permission-related access problems, 213 avoidance, 215 solving, 214 Permissions, 288, 342, 370–371, 510–514. See also Active Directory; Change permission; Full Control; Security; Shared folder permissions; Special access permissions; Take Ownership permission; Users; Write permissions. addition, 192 assignation, 163, 169 cumulative usage, 179 inheritance, 180 management. See Printers. multiple changes, 142 override denial, 180 problems, solving, 213–214 sets, 182 sharing, 198 usage. See NT File System. Permissions-related problems, 179 Personal Identification Number (PIN), 69, 91 Personnel, training, 395 Phone objects, 156 Physical location, 48 PIN. See Personal Identification Number.

PKI. See Public Key Infrastructure. Plug and Play (PnP), 12, 17, 412 PnP. See Plug and Play. Point-to-Point Tunneling Protocol (PPTP), 19, 431, 441, 442, 444 server, configuration, 31 Pointer, 352 Poison reverse, 435 Policies. See Account; Computer; Filtering policy; Group policies; Local policies; Software. application order, 241 assignation. See Registrybased policies. combination. See Profiles/policies. distribution, 559 enforcement, 241–242 inheritance, blocking, 241 specificity, 645 POP Servers, 416 Ports tab, 262–263 Power failure, 756–757 supplies, 756 Power failure, 48 PPP client. See Macintosh. PPP connection, 437 PPTP. See Point-to-Point Tunneling Protocol. Pre-Windows 2000 domain controllers, 656 Pre-Windows 2000 printer shares, 505 Precedence order, 674 Primary data, 379 Primary Domain Controller (PDC), 36, 494 Primary group, 119 Print devices, 254, 276 definition, 248 network separation, 282 driver, definition, 248 environment creation, 250–260 planning, 248–250 jobs, 272, 283 information, 256 processor specifications, 263 queue, 266

documents management, 276–278 server, 252, 278 definition, 248 services. See LPR/LPD print services. spool service, restarting, 283 Printer/paper combinations, 270 Printers, 62. See also Local printers; Networks; Remote printers. administration introduction, 248–260 Web browser, usage, 278–281 business function, 281–282 configuration, 278 definition, 248 drivers loading, 259–260 removal, 275 geographic location, 281–282 information, 255 interfaces. See World Wide Web. management, 46, 269–275 objects, 250, 265 organization, 281–282 ownership, 268–269 permissions, management, 265–269 pool, creation, 272–273 priorities, specification, 273–274 properties, 261–265 queues, 265, 279 redirection, 274 resources administration, 247 FAQs, 283–284 server installation, 256 types, 251 Printing configuration, 274 devices. See AppleTalk printing devices. environment, best practices, 281–283 terminology, 248 Printout, 279 Private key certificates, 91 Privileges assignment, 92

795


796

Index

management, 94–95 Problem-tracking software, 49 Process, 93–95 Processor speed, 27 Product sales team, 169 Profiles path, 115, 227 policies, combination, 243 subdirectories, 655 tab, 115–116 Program groups, 224, 225 Programming interface information, 532 Project-related data, 181, 200 Project Software, 30 Proprietary software, 94 Protected subsystems, 6 Protocols, 410–412 configuration, 412–415 Proxy server, 446 Pscript.sep, 271 Public data, types, 472 Public key, 308 certificates, 509 security, implementation, 687–702 services components, 688–693 usage, 693–702 Public Key Infrastructure (PKI), 687–689, 691 Published software, 597 Purchase orders, 267

Q QoS. See Quality of Service. Quality of Service (QoS), 410, 429–430 ACS Server, 430 Query capabilities, 82 Query capabilities, 67 Queue, documents management. See Print. Quotas, 82 Entries, 301, 302 deletion, 304 limit, 300, 302 management, 299 menu, 303 tab, 73

R RADIUS, 431, 447–450 server, 448 RAID. See Redundant Arrays of Inexpensive Disks. RAS. See Remote Access Server; Remote Access Service. RC2, 655 RDN. See Relative Distinguished Name. RDP. See Remote Desktop Protocol. Read-only access, 282 Read-only roaming profile, 245 Readme text files, 32 Reboots. See System. avoidance, 6 Recoverable file system, 6 Recovery. See Disaster recovery. agents, 310. See also Encrypted data. responsibilities, 703–704 Console, 84, 764–766 entering, 766 contingency plans, development, 394 utility, 75 Redirection Policy, 592 settings, 654 Redundant Arrays of Inexpensive Disks (RAID), 73, 756 levels, support, 7 support, 45 REGINI.EXE, 652 Regional settings, 34 Registry, 350–352, 371, 599, 676 Editor, 348 entries, auditing, 347–352 files, 373 locations, 579 settings, 579 Registry-based policies assignation, 576–579 settings, 568 Relative Distinguished Name (RDN), 64, 65, 81, 474, 475 Relative IDentifier (RID), 494 Relative Unique Identifiers, 475 Remote access, 430–437, 449 connection, 438

Remote Access Policy, 658 Remote Access Server (RAS), 656 Administrator, 657 connection, 658 permissions, 660 Remote Access Service (RAS), 19, 641 dial out, 437–440 permissions settings, 492 servers, 162 Remote Desktop Protocol (RDP), 425, 426 Remote hard disk, 754 Remote installation services, 528 Remote network, 443 Remote OS Installation Services, 767 Remote printers, 250 Remote printing, 256 Remote servers, encrypted file storage, 308–309 Remote storage, 364, 380–381 server, 9 Remote Storage Services (RSS), 76, 82 Removable media, 382 Removable storage media, 754 Repair Command Console, 8 Repair disk. See Emergency repair disk. Replica sets, 738–741 Replicated data sets, restoration, 379–380 Replication, 479–481, 484. See also Intersite replication; Intrasite replication; Multimaster replication; Single-master replication; SMTP. frequency, 480 Replicator, 162 Request For Comment (RFC), 418 1123, 26 1510, 85 1631, 445 2044, 26 2052, 646 2131, 416 2136, 84 2139, 447 1034/1035, 472


Index Resource Reservation Protocol (RSVP), 429, 430 Resources access. See Domains. kits, 502 management, 160 publication capabilities, 506 sharing, 196–198, 503–506 tools, 502 Restorations, performing, 395 Restore. See Authoritative restore. catalogs, building, 375 operations, 375 Operators group, 761 Restricted groups, 676 Return on investment (ROI), 28 Reverse lookup zones, 420, 421 Reversible encryption, 641 Revisions, tracking, 614 RFC. See Request For Comment. RID. See Relative IDentifier. Rights, assignation, 163 RIP. See Routing Information Protocol. RIPv2. See Routing Information Protocol v2. Roaming profiles, assignation. See Customized roaming profiles. Roaming user profiles, 227–235 creation, 228–229 mandatory profiles, 229 setup, 230–231 ROI. See Return on investment. Rollback capabilities, 23 Root folder, 534 Root privileges, 690 Routers, 429, 447, 449 failure, 757 hubs/switches, administrative access centralization, 449–450 Routing, 430–437, 441 loops, 433 protocol, 432 Routing Information Protocol (RIP), 412, 431–434, 444 v2 (RIPv2), 433–436 RSS. See Remote Storage Services. RSVP. See Resource Reservation Protocol.

S Safe mode, 763, 764, 769 boot, 8 SAM. See Security Accounts Management. SAP. See Service Advertisement Protocol; Service Advertising Protocol. Scalability, 66, 471. See also Active Directory; Windows 2000. Scheduled task, 459 Scheduling, 384–386 Schema, 476–477 information, 472 master, 476 Screen displays, 556 Screensaver, 530 Scripting Host, 531 Scripts, 531. See also Logon. function, explanation, 634–635 policies, assignation. See Computers; Users. usage, 586–590 Seagate Backup Exec, 760 Technology, Inc., 75 Search criteria, 507 Search screen, 507 SECEDIT.EXE, 675, 677–679 command-line utility, 672 Secondary logon services, 461 Secured domain controllers, 103–104 securedc.inf, 686 securews.inf, 686 Security, 13, 531. See also Communications systems security; Computer. breaches, 95 concerns, 748–749 configuration, 105, 531, 671, 675–676, 711 analysis, 675–687 creation, 675–687 modification, 675–687 service, 672 templates, 685–687 tool, 671 Configuration and Analysis Management Console, 672 snap-in, 683

controls, 68 decisions, 49 descriptors, 509 events analysis, 353–354 monitoring, 336–346 groups, 139, 240 membership, basis. See Filtering policy. implementation. See Public key security. Log, 341 management, 683 policies, 58, 101, 243 application, 671–674 definitions, 90–91 interpretation, 90 purpose, 90 responsibility, 91–95 template, 90–95 procedures, 47 relationships, 57 rules, 132 settings, 58, 526 Sharing permissions, 266–268 snap-ins, loading. See Microsoft Management Console. tab, 156–157, 263–264 templates, 70, 103–106, 167, 672 loading, 105–106 Security Accounts Management (SAM), 460, 630, 631 Security Identifiers (SIDs), 463, 464, 650, 651 Security-related events, 336 Security-related services, 671 Selection information, computation, 375 Self-extracting archive, 450 Send page notifications, 366 Separator pages, 263 assignation, 270–271 Server-based roaming user profile, 226 Server side VPN terminating ports, configuration, 442–443 Servers, 104. See also Dedicated print servers; Print server; Remote servers. applications node, 405–406

797


798

Index

building. See Share-friendly networks/servers. day-to-day administration, 324 environments, 194 mode, 656 operating costs, 28 operators, 162, 200 Service Advertisement Protocol (SAP), 412 Service Advertising Protocol (SAP), 431–433, 444 Service level, 430 Service Ticket (ST), 68 Services. See Active Directory. node, 405–406 provider, 92 Setup manager, 464–465 Setup program, text-based portion, 766 Setup security.inf, 686 SFP. See System File Protection. Share-friendly networks/servers, building, 194–196 Shared applications, 199 Shared data, 200 Shared database files, 426 Shared files, 305 Shared folders, 164, 204, 210–212, 214–216, 305, 403, 504, 730 access permissions, 196 connection, 208–211 creation, 198–211 environment, 180 management, 206–207 permissions, 197–198 assignation, 204–206 management guidelines, 216–217 strategy, development, 198–200 Shared resources, 98, 138, 142 Shares, 206, 727, 748. See also Administrative shares; Hidden shares. name, 203 Sharing. See File resource sharing. permissions. See Security. tab, 262 Shiva, 431, 448

Shutdown, 467 SIDs. See Security Identifiers. Single-factor authentication, definition, 91 Single-master replication, 71 Single roaming profile, 233 Single server failure, 71 Single Window, 55 Sites, 241, 484–485, 555. See also Active Directory. connections, 484 Group Policy Object, 241 link, management, 555–557 links, 480, 498, 499 Slow networks, group policy, 540–541 Smart cards, 68, 69, 91, 692 SMP. See Symmetric MultiProcessing. SMS. See Systems Management Server. SMTP, 480, 500 replication, 501 servers, 416 Snap-ins, 121, 455, 457 hierarchical view, 400 loading. See Microsoft Management Console. management applications, 51 module, 75 SNMP, 445 SNMP-based monitoring applications, 323 Software. See Assigned software; Client; Published software. assignation, 598 assignments, 532 configurations, 49 deployment, 596–599 management, introduction, 596–597 development, 530 distributions, 530 installation, 568, 614 snap-in, addition, 605–608 interface, 248 inventory utilities, 615 maintenance, 568, 615–621 management, 605–615 FAQs, 625–527 group policy, usage, 595 introduction, 596

packages, creation, 599–604 policies, 530, 559 publishing, 532 removal, 623–624 settings, 527 upgrading, 621–623 usage, 94 Software-based public key services, 692 Special access permissions, 185–188, 214 setting, 188–190 usage, 188–191 Special permissions, 187–188 Split horizon, 433, 435 Spool reports, 366 Spool services, 276 restarting. See Print. Spooler service, 277 SPX. See IPX/SPX. SQL Server, 322, 679 7.0, 535 databases, 3 SRV records, 646 SRV RR records, 647 ST. See Service Ticket. Stand-alone CA, 690, 691, 711 Stand-alone DFS, 731 root, 725, 742, 745 setup, 730–735 server, 736 Stand-alone roles, 36 Stand-alone root, 79 Stand-alone servers, 32, 99, 143, 163, 697 Standalone modules, 690 Standalone Subordinate CA, 691 Startup disks, 33 Startup options. See Advanced startup options. State data. See System. Status bar, 128 Storage. See Windows 2000. management. See Hierarchical storage management. node, 405 Storage management, 14 Streamlining, 26 Stripe sets, 73, 763 Subdirectories, 653. See also Profiles.


Index Subfolders, 209, 212, 214, 287, 292, 306, 307, 528, 546, 559, 708. See also Configuration; Default subfolders. changes, 288 Subnet masks, 416 Subnetwork systems, 430 Subsystems. See Protected subsystems. Superscope, 418 Support Staff, 611, 612 Switches, 429, 447, 757. See also Routers hubs/switches. Symmetric MultiProcessing (SMP), 45 Sysdiff, 465 Sysprep, 463–464, 464 Sysprint.sep, 271 Sysprtj.sep, 271 System administrator, 407 backup, ASR usage, 770 failure, recovery, 768–779 files, 709 groups. See Built-in system groups. log, 679 protected files, automatic backup, 379 reboots, 10–11 recovery, 6, 8–9 services, 676 stability, 130 startup files, 371 updates, 6 variable, 115 volumes, 314, 568 System File Protection (SFP), 8, 9 System State Data, 371–372, 379, 390 restoration, 390–391 System Tools node, 402–405 Systems Management Server (SMS), 530 SYSVOL, 532 directory, 371 share, 644 Sysvol folder, 491

T Take Ownership permission, 185–186 Tapes backup, 8 devices, 381, 393 drives, 773 erasure, 393 formatting, 393 retension, 393 security, 762 storage device, 364 Target folder, 294 Target shares, 746 Task lists, 26, 39 Task Manager, 463 Task scheduler, 384 usage, 458–460 Taskpad, usage, 457–458 TCO. See Total Cost of Ownership. TCP/IP. See Transport Control Protocol/Internet Protocol. TCP/UDP headers, 447 Team leaders, 187 Technet, 224, 763 TechNet reference, 763 Telephone/Notes tab, 116–117 Telephony settings, 465 Templates. See Security policy; Security templates; Use policy. creation, 232 importation/reloading, 106 users, definition, 665 Temporary ID, 115 Terminal Services, 410, 425–429, 649 TGT. See Ticket-Granting Ticket. Third-party backup programs, 366 Third-party CA, 690, 692 Third-party event monitoring utility, 356 Third-party software, 94 Third-party tools, 462 Third-party utility, 9 Third-party vendors, 463 Threads, 12 Throughput, 12 Ticket-Granting Ticket (TGT), 68

Time zone computer, 465 Timelines creation, 26, 39 development, 30 Timeout re-authentication feature, 95 Timestamp, 323, 462 Top-level domain, 719 Top-level hierarchy, 726 Total Cost of Ownership (TCO), 13, 28, 452, 453, 470, 596 Transitive trusts, 497 Transport Control Protocol/Internet Protocol (TCP/IP), 12, 26, 39, 411, 414, 440, 443 configuration, 31 filtering, 415 networks, 415, 472, 485 ports, 89 selection, 254 printing, 258 environment, 282 protocols, 257 stack, 446 subnet ranges, 484 transport protocol, 65 Trees, 485–486. See also Domain. Trojan horses, 94 Trusted domains, 161 Trusted root certification authorities, 692 Trusts, 497. See also Active Directory; Intransitive trusts; Nontransitive trusts; One-way trusts; Two-way trusts. TweakUI, 296 Two-factor authentication, definition, 91 Two-sided printing, 265 Two-way trusts, 497

U UDP, 415 Unauthorized users, 317 UNC. See Uniform Naming Convention; Universal Naming Convention. name, 728–730, 733, 734 path, 719 Uncompressed file, 290, 292

799


800

Index

Uniform Naming Convention (UNC), 77 Uniform Resource Locators (URLs), 17, 111, 256, 278, 453. 695 Uninterruptible Power Supply (UPS), 45, 48, 756, 757 support, 8 Unique Sequence Number (USN) created, 155 modified, 155 Universal groups, 63, 140–141, 662 usage, 169–170, 660–663 Universal Naming Convention (UNC), 115, 179, 237 paths, 208, 210, 256. See also Network-based UNC paths. Universal user policies, development practices, 242–244 UNIX, 73 print services, 258 switch, 422 workstations, 258 UNIX/Windows 2000 DNS Server, switch, 422 Unregistered IP addresses, 93 Unsecured domain controllers, 104 Unsupported Administrative Templates, 586 UPN. See User Principal Name. UPS. See Uninterruptible Power Supply. URLs. See Uniform Resource Locators. USA OU, 643 Use policy defining, 88–95 definitions, 90–91 interpretation, 90 purpose, 90 responsibility, 91–95 template, 90–95 User-based profiles, 651 User-friendly interface, 364 User Manager, 404 User Mode-Delegated Access, 55 User Principal Name (UPN), 474 mapping, 126 suffixes, 52

User-specific settings, 655 User_ID, 94, 95 Username, 439, 449, 459, 461 username Database. See Network Access Servers. usage, 448–449 Users, 62, 493. See also Mobile users. access, 197 lists, 509 account administration, 221, 629 best practices, 663–665 FAQs, 666–667 introduction, 630–631 accounts, 46, 71, 126, 127, 143, 181, 230, 243, 610, 762 creation, 100–103. See also Domain user account; Multiple user accounts. deletion, 122 development, 88–89 disabling, 98–99, 123 enabling, 123 FAQs, 133, 245–246 holding, group creation, 610–611 introduction, 95–96 management, 121–128 modification, 110–120 moving, 125 organization, groups usage, 135, 168–172 properties, setting, 110–120 requirements, 96–99. See also Domain. settings, 97–99 usage. See Groups. addition, 137 groups setting usage, 147–149 user settings, usage, 149–151 authentication, 430, 509 definition, 91 certificate, mapping, 125–128 configuration, 234, 526, 529, 574, 575 information, 617 policy, 538

settings, 240 creation, 608–610 credential, 128, 488 data, redirection. See Network share. definition. See Template users. deletion, 137 environment management FAQs, 593–594 group policy usage, 567 group policy usage, types, 569–572 introduction, 568–569 environmental settings, 527 environments, 242 hierarchy, segregation, 663–664 ID, 115, 178 definition, 91 importation. See Novell Directory Service. logoff, 587 logon, 587 name, 113, 609 problems, troubleshooting, 646–651 usage. See Password. migration. See NT 4.0 domain. mode, comparison. See Author mode. names, 302 objects, 665 group, 100 passwords, change, 122–123 permissions, 102 policy, 240 development practices. See Universal user policies. productivity, 234 profiles, 228, 404. See also Local user profiles; Roaming user profiles. benefits, 234–235 contents, 223–225 folders, 226 hardware configurations, 242 loading, success, 648–650 management, 222–235 overview, 222–223 settings, saving, 225–226


Index types, 223 requirements, 503 rights, 162, 370–371 assignments, 168 granting, 139 settings. See Default user settings. usage. See User addition. snap-ins, 635 Users and Computers snap-in, 493 USN. See Unique Sequence Number.

V VBScript, 531 Verisign, 689 Version=x, 534 Video cards, 756 Virtual memory size, 404 Virtual Private Network (VPN), 19, 431, 440–443 configuration. See Client. Terminating Device, 451 terminating ports, configuration. See Server side VPN terminating ports. Viruses, 46, 94. See also Boot virus. checking, 763 Visio Professional program, 50 Visual Basic, 515 Visual Basic Script, 14 Volume. See Dynamic volumes. administration, 73 backup, 395, 762 information, 316 management, 72–73 mount points, preservation, 380 VPN. See Virtual Private Network.

W WAN. See Wide Area Network. Warning Level, 302 Web. See World Wide Web. Wide Area Network (WAN), 480 links, 719 Windows 3.11, 216 clients, 217

Windows 95, 195, 208, 296, 352, 405, 452, 482 usage, 222 workstations, 259 Windows 98, 8, 195, 208, 296, 352, 405, 482 usage, 222 workstations, 259 Windows 2000 Add-ons, skill enhancement, 535–536 administration, 400–460 Administration, FAQs, 83–85 advanced administration, 399 FAQs, 467–468 Advanced Server, 38, 41, 739 backup utility, 372 data compression, 286 Datacenter Server, 4, 5, 38 DNS Server, switch. See UNIX/Windows 2000 DNS Server. environment, 60 Group Policy, 524–525 group types, 661–663 groups, 336 Help system, 80 usage, 79–80 Network Administration, 410–452 best practices, 710–712 disaster protection, 754–766 FAQs, 715 securing, information, 670–671 security implementation, 669 NTFS permissions usage, 178–180 operating system files, 769 printing, 266 registry, 223 Resource Kit, 462–467 Server, 12, 261, 271, 326, 358, 407 action plan, 29 cost determination, 28–29 deployment, 31–31 FAQs, 40–42 installation, 32–35

migration, 23–32 overview, 2–5 planning, 26–30 preparation, 24–25 Resource Kit, 32 setup, 32–37 streamlining, 25–26 testing, 31 timeline creation, 30 upgrading, 35–37 startup files, 769 System, 772–777 System Administration, 402–410 applications server, 17–20 change, 20–22 cost reduction, 13–17 file/print/web services, 15–17 high-availability solutions, 11–12 Internet server, 17–20 management solutions, 13–15 overview, 5–22 reliability/availability, 6–13 scalability, 6, 12–13 storage capability, 9 system32 directory, 271 Tools, customization, 452–460 Windows Explorer, 73, 290, 305, 380 Windows Internet Naming Service (WINS), 84, 414, 424–425, 451, 467, 646 Servers, 416, 422 Windows Media Services, 17 Windows NT, 222, 296, 336, 640, 660 Performance Monitor, 403 Windows NT Server 3.51, 35 4.0, 35 Terminal Server, 35 Windows settings, 527–529 WINS. See Windows Internet Naming Service. Word, spell-check feature, 605 Workgroups, 32, 200, 201, 465 Working databases, 106

801


802

Index

Workstations, 44, 45, 69, 104, 200, 217, 222, 278, 503, 509, 646, 680. See also Macintosh; UNIX; Windows 95; Windows 98. features, 25 World Wide Web (WWW / Web), 79, 83 address, 111 browser, usage. See Printers. interface, 280 page, 130, 428 printer interfaces, client access, 282

servers, 3 abilities, 718 authentication, 693 services, 15. See Windows 2000. sites, 40, 720 Worms, 94 Write permissions, 192, 194

X X.509 security models, 65 X509v3 format, 688

Z .zap file, 601, 604, 619, 620 ZAP package, deployment, 620–621 Zone information, 406 Zones, 419, 425. See also Forward lookup zone; Reverse lookup zones.

74_BM.qx 11/8/99 2:03 PM Page 803

The Global Knowledge Advantage

Global Knowledge has a global delivery system for its products and services. The company has 28 subsidiaries, and offers its programs through a total of 60+ locations. No other vendor can provide consistent services across a geographic area this large. Global Knowledge is the largest independent information technology education provider, offering programs on a variety of platforms. This enables our multi-platform and multi-national customers to obtain all of their programs from a single vendor. The company has developed the unique CompetusTM Framework software tool and methodology which can quickly reconfigure courseware to the proficiency level of a student on an interactive basis. Combined with self-paced and on-line programs, this technology can reduce the time required for training by prescribing content in only the deficient skills areas. The company has fully automated every aspect of the education process, from registration and follow-up, to "just-in-time" production of courseware. Global Knowledge through its Enterprise Services Consultancy, can customize programs and products to suit the needs of an individual customer.

Global Knowledge Classroom Education Programs

The backbone of our delivery options is classroom-based education. Our modern, well-equipped facilities staffed with the finest instructors offer programs in a wide variety of information technology topics, many of which lead to professional certifications.

Custom Learning Solutions

This delivery option has been created for companies and governments that value customized learning solutions. For them, our consultancy-based approach of developing targeted education solutions is most effective at helping them meet specific objectives.

Self-Paced and Multimedia Products

This delivery option offers self-paced program titles in interactive CD-ROM, videotape and audio tape programs. In addition, we offer custom development of interactive multimedia courseware to customers and partners. Call us at 1-888427-4228.

Electronic Delivery of Training

Our network-based training service delivers efficient competency-based, interactive training via the World Wide Web and organizational intranets. This leading-edge delivery option provides a custom learning path and "just-in-time" training for maximum convenience to students.

74_BM.qx 11/8/99 2:03 PM Page 804

Global Knowledge Courses Available Microsoft ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■

Windows 2000 Deployment Strategies Introduction to Directory Services Windows 2000 Client Administration Windows 2000 Server Windows 2000 Update MCSE Bootcamp Microsoft Networking Essentials Windows NT 4.0 Workstation Windows NT 4.0 Server Windows NT Troubleshooting Windows NT 4.0 Security Windows 2000 Security Introduction to Microsoft Web Tools

Web Site Management and Development ■ ■ ■ ■ ■ ■

PERL, UNIX, and Linux ■ ■ ■ ■ ■ ■

Management Skills ■ ■ ■

Project Management for IT Professionals Microsoft Project Workshop Management Skills for IT Professionals

■ ■ ■ ■ ■ ■ ■

Understanding Computer Networks Telecommunications Fundamentals I Telecommunications Fundamentals II Understanding Networking Fundamentals Upgrading and Repairing PCs DOS/Windows A+ Preparation Network Cabling Systems

■ ■

■

■ ■ ■

■ ■ ■ ■

Building Broadband Networks Frame Relay Internetworking Converging Voice and Data Networks Introduction to Voice Over IP Understanding Digital Subscriber Line (xDSL)

Internetworking ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■

ATM Essentials ATM Internetworking ATM Troubleshooting Understanding Networking Protocols Internetworking Routers and Switches Network Troubleshooting Internetworking with TCP/IP Troubleshooting TCP/IP Networks Network Management Network Security Administration Virtual Private Networks Storage Area Networks Cisco OSPF Design and Configuration Cisco Border Gateway Protocol (BGP) Configuration

Introduction to Red Hat Linux Red Hat Linux Systems Administration Red Hat Linux Network and Security Administration RHCE Rapid Track Certification

Cisco Systems

WAN Networking and Telephony ■

PERL Scripting PERL with CGI for the Web UNIX Level I UNIX Level II Introduction to Linux for New Users Linux Installation, Configuration, and Maintenance

Authorized Vendor Training Red Hat ■

Network Fundamentals

Advanced Web Site Design Introduction to XML Building a Web Site Introduction to JavaScript Web Development Fundamentals Introduction to Web Databases

■ ■ ■ ■ ■ ■ ■ ■ ■ ■

Interconnecting Cisco Network Devices Advanced Cisco Router Configuration Installation and Maintenance of Cisco Routers Cisco Internetwork Troubleshooting Designing Cisco Networks Cisco Internetwork Design Configuring Cisco Catalyst Switches Cisco Campus ATM Solutions Cisco Voice Over Frame Relay, ATM, and IP Configuring for Selsius IP Phones Building Cisco Remote Access Networks Managing Cisco Network Security Cisco Enterprise Management Solutions

Nortel Networks ■

■ ■ ■ ■ ■ ■ ■

Nortel Networks Accelerated Router Configuration Nortel Networks Advanced IP Routing Nortel Networks WAN Protocols Nortel Networks Frame Switching Nortel Networks Accelar 1000 Comprehensive Configuration Nortel Networks Centillion Switching Network Management with Optivity for Windows

Oracle Training ■ ■

Introduction to Oracle8 and PL/SQL Oracle8 Database Administration

74_BM.qx 11/8/99 2:03 PM Page 805

Custom Corporate Network Training Train on Cutting Edge Technology We can bring the best in skill-based training to your facility to create a real-world hands-on training experience. Global Knowledge has invested millions of dollars in network hardware and software to train our students on the same equipment they will work with on the job. Our relationships with vendors allow us to incorporate the latest equipment and platforms into your on-site labs.

Maximize Your Training Budget Global Knowledge provides experienced instructors, comprehensive course materials, and all the networking equipment needed to deliver high quality training. You provide the students; we provide the knowledge.

Avoid Travel Expenses On-site courses allow you to schedule technical training at your convenience, saving time, expense, and the opportunity cost of travel away from the workplace.

Discuss Confidential Topics Private on-site training permits the open discussion of sensitive issues such as security, access, and network design. We can work with your existing network’s proprietary files while demonstrating the latest technologies.

Customize Course Content Global Knowledge can tailor your courses to include the technologies and the topics which have the greatest impact on your business. We can complement your internal training efforts or provide a total solution to your training needs.

Corporate Pass The Corporate Pass Discount Program rewards our best network training customers with preferred pricing on public courses, discounts on multimedia training packages, and an array of career planning services.

Global Knowledge Training Lifecycle Supporting the Dynamic and Specialized Training Requirements of Information Technology Professionals ■ ■ ■ ■ ■ ■ ■

Define Profile Assess Skills Design Training Deliver Training Test Knowledge Update Profile Use New Skills

74_BM.qx 11/8/99 2:03 PM Page 806

Global Knowledge Global Knowledge programs are developed and presented by industry professionals with "real-world" experience. Designed to help professionals meet today’s interconnectivity and interoperability challenges, most of our programs feature handson labs that incorporate state-of-the-art communication components and equipment.

ON-SITE TEAM TRAINING Bring Global Knowledge’s powerful training programs to your company. At Global Knowledge, we will custom design courses to meet your specific network requirements. Call (919)-461-8686 for more information.

YOUR GUARANTEE Global Knowledge believes its courses offer the best possible training in this field. If during the first day you are not satisfied and wish to withdraw from the course, simply notify the instructor, return all course materials and receive a 100% refund.

REGISTRATION INFORMATION In the US: call: (888) 762–4442 fax: (919) 469–7070 visit our website: www.globalknowledge.com

74_BM.qx 11/8/99 2:03 PM Page 807

Get More at access.globalknowledge

The premier online information source for IT professionals You’ve gained access to a Global Knowledge information portal designed to inform, educate and update visitors on issues regarding IT and IT education. Get what you want when you want it at the access.globalknowledge site: Choose personalized technology articles related to your interests. Access a new article, review, or tutorial regularly throughout the week customized to what you want to see. Keep learning in between Global courses by taking advantage of chat sessions with other users or instructors. Get the tips, tricks and advice that you need today! Make your point in the Access.Globalknowledge community with threaded discussion groups related to technologies and certification. Get instant course information at your fingertips. Customized course calendars showing you the courses you want when and where you want them. Get the resources you need with online tools, trivia, skills assessment and more! All this and more is available now on the web at access.globalknowledge. VISIT TODAY!

http://access.globalknowledge.com

74_BM.qx 11/8/99 2:03 PM Page 808

WINDOWS 2000 SYSTEM ADMINISTRATION

MANAGING ACTIVE DIRECTORY FOR WINDOWS 2000 SERVER

LE! AT om ILAB AVA R NOW e s s . c E r D g OR . s y n www

Windows 2000's Active Directory provides a single uniform interface to all of the network's resources, including printers, documents, e-mail addresses, databases, and users. It also manages naming, querying, registration, and resolution needs. This book covers everything a system administrator needs to know about Active Directory. ISBN: 1-928994-07-5 $49.95

AVA I ORD LABLE! E www R NOW .sy ngr AT ess .co m

CONFIGURING WINDOWS 2000 SERVER SECURITY Network security has become an increasing problem, with stories about sometimes significant security breaches a common feature of the nightly news. The premier network platform, Windows NT, has many important security features but they are difficult to configure and manage. With the launch of its successor, Windows 2000 Server, Microsoft has announced new security features that must quickly be grasped by network administrators. ISBN: 1-928994-02-4 $49.95

Managing Windows 2000 Network Services

0 LE 200 ILAB AVA uary, r Feb

Windows 2000 Server will integrate network and internetwork services, enabling companies to set up and manage networks, remote access, and other communications. This book helps network administrators deploy multiple protocols within an enterprise network and covers all of Network Services. ISBN: 1-928994-06-7 $49.95

[email protected]

Document3

4/3/02

4:04 PM

Page 1

Windows 2000 Server System Administration Handbook

Windows 2000 Server System Administration Handbook

Mastering Windows 2000 Server

Windows 2000 Server 24Seven

Windows 2000 Server - Kompendium

Microsoft Windows Server Administration Essentials

Microsoft Windows Server 2008 Administration

Microsoft Windows Server 2008 Administration

IP. Ресурсы Windows 2000 Server

Hack Proofing Windows 2000 Server

Hack Proofing Windows 2000 Server

Configuring Windows 2000 Server Security

Configuring Windows 2000 Server Security

Hack Proofing Windows 2000 Server

Schnellübersicht Windows 2000 Professional Server

Windows 2000 Server - Kompendium GERMAN

UNIX System Administration Handbook

UNIX System Administration Handbook

UNIX System Administration Handbook

Microsoft Windows 2000 Scripting Guide: Automating System Administration

MCSE: Exchange 2000 Server administration: study guide

Exchange 2000 Server Administration: A Beginner's Guide

MCSE: Exchange 2000 Server administration: study guide

McSe SQL Server 2000 Administration: Study Guide

Microsoft Windows 2000 Registry Handbook

Межсетевое взаимодействие. Ресурсы Microsoft Windows 2000 Server

Microsoft Windows 2000 Server Operations Guide

опровождение сервера. Ресурсы Microsoft Windows 2000 Server

MCSE: Windows 2000 Server Study Guide

2000 ADSI Scripting for System Administration

Inside Windows Storage: Server Storage Technologies for Windows Server 2003, Windows 2000 and Beyond

Windows 2000 Server System Administration Handbook