The Best Damn Windows Server 2003 Book Period- P102 pptx

986 Index copying, 177 pools, 167–168 media access control (MAC), 237, 300 Media Services, improvement in Windows Server 2003, 10–11 memory leaks, 244 minimum system requirements for operating systems (table), 67–68 and performance bottlenecks, 244–245 required configuration, 16 requirements per site, 532 virtual, and system performance, 245 messages DHCP warning, 240 error. See error messages IGMP warning, 236 Microsoft Cluster Service (MSCS), 6–7 Microsoft Exchange and e-mail distribution groups, 404 Microsoft Knowledgebase, 106 Microsoft Licensing Program Reseller Web page, 14 Microsoft Metadirectory Services, 13 Microsoft Passport authentication, 442 Microsoft Point-to-Point Encryption (MPPE), 858 Microsoft Resource Centre, 14 Microsoft SQL Server, 78 Microsoft Systems Management Server (SMS), 19, 292 migration of Windows 2000 to Windows Server 2003, 3 MIME (Multipurpose Internet Mail Extension) and IIS, 923 mirrored volumes creating, 144–146 described, 111 troubleshooting, 187–188 MMC (Microsoft Management Console) Active Directory administration, 347 adding snap-ins, 89–91 Computer Management, 35–36 console modes (table), 29 custom snap-ins described, 29 disk management, using, 115–116 installing media services from, 10 Remote Storage, 174 System Monitor. See System Monitor models AGDLP, 445–446 AGGUDLP, 446–447 cluster, 192–193 extensive defense, 432 OSI reference (table), 884 remote access by user, by policy, 853 modes and functional levels (Active Directory), 370 MMC console (table), 29 Terminal Services Administration, 34 modifications, software packages, 606 modifying See also changing data in AD database, 629 existing listener connections, 957–965 objects in Active Directory, 359 password policies, 435–436 monitoring AD database, 636–640 client Internet connections, 309–310 disk quotas, 159–160 DNS servers, 705–710 IPSec, 813–814 IPSec connections, 318–320 NAT activity, 308 Network Load Balancing (NLB), 233–234 network traffic and devices, 756 performance counters, 251 replication, 525–526 servers with Event Viewer, 260–267 servers with System Monitor, 247–257 and troubleshooting Internet connectivity, 304–318 mounted drives, 208, 645 mountvol command, 178 MOVETREE command, moving objects in forests, domains, 359–360, 427–429 moving AD database, 633–635 log files, 633–635 objects in domains, 359–360, 427–429 MPIO (multipathing input/output), 9 MPPE (Microsoft Point-to-Point Encryption), 858 mrinfo command, 791 .msc files, 29 .msi files, 602, 606 MSI install package, 101 MsiInstaller messages, 623 .msp files, 607 .mst files, 606 multi-masters, 55 Multi-Win component,Terminal Services, 932 multicast communications, 743 IP addresses, 760 multihomed computer route descriptions (table), 744–745 multilink connections, 853 multimaster replication, 345 multipathing input/output (MPIO), 9 multiprocessing described, 245 Multipurpose Internet Mail Extension (MIME) and IIS 6.0, 923 multithreading described, 245 mutual authentication, 439 My Documents folder, redirecting, 589 N N-node failover pairs, server cluster deployment option, 196–197 name collisions, 490 name resolution host. See host name resolution troubleshooting, 310–314, 732–739 names logon. See logon names NetBIOS, 710 namespaces Active Directory, 381 discontinuous, 456 disjointed, 669 DNS. See DNS namespace guidelines for internal domain, 672 multiple, support for, 668 NetBIOS, 710–711 naming Active Directory scheme, 328–329 conventions, security principals and SIDs, 381–384 distinguished names, 62 GPOs (Group Policy Objects), 578 host conventions, 666 logon names, 382 renaming. See renaming schema objects, 555 schemes, and Active Directory, 330–331 NAT (Network Address Translation) components of, 761 and Internet connectivity, 292 and IPSec, 796, 800–801 services described, 873–877 troubleshooting, 304–310 NAT traversal (NAT-T), 8 NBMA (non-broadcast multiple access) network type, 769 nbstat command, 737 NBTStat, 312 nesting security groups, 455 .NET Framework, support for, 6 .NET passport authentication, 922 Net share command, 471 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 986 Index 987 NetBIOS disabling encapsulation, 757 name resolution, troubleshooting, 311, 710–713, 736–737 renaming, 3 and WINS service security, 730–731 NetBIOS over TCP/IP (NetBT), 77 netdiag.exe, 320, 814 netdom query fsmo command, 429 Netdom.exe, 486 NETMON.exe, protocol analyzer described, 790 netsh command utility administering routing servers, 770–772 controlling IPSec, 805 described, 319–320, 752 monitoring IPSec, 813 troubleshooting remote connections, 886 netstat utility, 309–310 Network Access Quarantine Control (NAQC), 316–318, 867 network address translation. See NAT network authentication, 438 network components and system performance, 246–247 network interface cards. See NICs network interface controllers and server clustering, 206 Network Load Balancing (NLB) best practices, 234–242 creating NLB clusters, 236–242 described, 6–7, 224 error detection, handling, 232–233 introduction, 113–114 managing clusters, 228–233 relationship to clustering, 227–228 terminology, concepts, 225–227 Network Monitor Capture Window, 296–297 configuring, 298–304 determining IPSec protocol in use, 798 installing, 292–298 monitoring network traffic, 319–320 troubleshooting IPSec, 819 Network News Transfer Protocol. See NNTP network protocols, Windows Server 2003, 742 network security settings, 84–88 network topology and network performance, 247 planning, 755–756 network traces, interpreting, 301–304 network traffic, monitoring, 756 networking, wireless. See wireless networking networks bridges, 773–774 determining bandwidth requirements, 757 directory services, 322 gateways, 764 hubs, 772–773 lease time, determining, 318 minimizing attack points, 784–785 monitoring generally, 291–292 perimeter, 782 planning infrastructure, 17–21 subnets and, 508 updates. See software updates using convergence, 766–767 New Delegation Wizard, 665 New Partition Wizard, 121 New RADIUS Client Wizard, 871 New Server Cluster Wizard, 218 New SMTP Virtual Server Wizard, 912–913 New Trust Wizard, 486, 496 New Volume Wizard, 136–139, 142, 146 next-hop IP address, 762 NICs (network interface cards) IPSec and system performance, 247 and listener connections, 956 NLB support, 7 redundancy in, 288 NLB. See Network Load Balancing (NLB) NLB Manager described, using, 7, 228–229 enabling logging, 233–234 logging entries, 241 NLB (Network Load Balancing), 6–7 NLB query, display commands, 234 NLB.exe, 229–232 NNTP (Network News Transfer Protocol) and IIS 6.0, 913 protocol described, 59 NNTP servers, setting up, 913–914 No Terminal Server user SID security template, 83–84 nodes multiple interconnections, 211 NetBIOS (table), 311–312 recovering from failed cluster, 205 in server clusters, 190 non-broadcast multiple access (NBMA) network type, 769 nonrecursive servers, 677 Notssid.inf, 83 Novell, NDS structure, leaf objects, 341 NSLookup tool described, 662 troubleshooting remote connections, 887 using to monitor DNS servers, 709 NT LAN Manager network authentication option, 441–442 version 2 (NTLMv2), 84 Ntbackup, 641 NTBackup.exe, 275 NTDS performance object counters, monitoring Active Directory, 638 NTDS.dit, 55, 326 ntds.dit, 628 NTDSUTIL tool command options, 649–658 described, 362, 632–635, 647–648 managing SIDs with, 380–381 transferring FSMO roles, 476 NTFS file system and clustered disks, 208 converting partitions to, 74 and data restoration, 645 formatting basic volume with, 130–131 managing, 119–120 NTFS permissions in server clusters, 216 NTLMv2 (NT LAN Manager version 2), 84 O Oakley key-determination protocol, 801 object classes in Active Directory, 551–552 object counters, using to monitor Active Directory, 637–639 Object Identifier (OID) and naming schema objects, 555 object inheritance, 364–365 objects in Active Directory, 326 adding to Active Directory, 358 attributes and properties, 344 expiration of, 630 identifiers, and SIDs, 376 locating by distinguished names, 383–384 modifying in Active Directory, 359 moving in Active Directory, 425–428 setting permissions on Active Directory, 366–367 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 987 988 Index site-link, 346, 515 user, creating in Active Directory, 389–390 Office XP and Terminal Services, 66 offline defragmentation, 631–633 Open Shortest Path First (OSPF), 759, 768–770 operating systems choosing, 66–67 running multiple, 22 operations masters, 55–57, 539 organizational units (OUs) adding to Active Directory, 358 creating and managing, 500–503 delegating control of, 503 described, 327, 340, 495 and distinguished names, 330 planning structure and strategy, 503–505 organizations, administrative structure and physical network structure, 510–511 OSI reference model (table), 884 OSPF (Open Shortest Path First), 759, 768–770 out-of-band DoS attacks, 701 out-of-band operations, 37 P packet event logging, troubleshooting IPSec, 817 packet filtering configuring RRAS, 855–858 controlling IP filters, 883 and firewalls, 788–789 IPSec, 821 packet sniffers, 819 paging and system performance, 245 PAP (Password Authentication Protocol), 865 partitioning physical sites and logical domains, 511 partitions application, 452, 491–494 application directory, using, 483 defragmenting, 149–155 directory. See directory partitions disk and directory, 325 types and logical drives, 110–111 Passport authentication, 442, 922 Passport Integration described, 9 Password Authentication Protocol (PAP), 865 password policies components of, 431 creating for domain users, 431–437 defining, 433–437 passwords See also permissions changing Directory Services Restore Mode, 657–658 creating, editing, 356 and logons, 389–390 policies. See password policies and remote connections, 865 setting LM values, 85 strong, 74, 230, 433 patches, security, 95, 605, 607 path rules (Group Policy), 592 pathping command, 314–316, 790, 889 PDC Emulator, 56, 343, 475 PDC Masters, locating, transferring, and seizing role, 479–481 PEAP (Protected EAP), 867–868 performance administration tool. See System Monitor bottlenecks, 244–247 DC functions affecting (table), 531–532 DNS servers, issues, 674 establishing baseline, 251 and fault tolerance, 631 mirrored volumes and, 113 monitoring with System Monitor, 637–638 optimizing disk, 149–155 optimizing network, 757 WINS servers, 726–730 Performance Console monitoring DNS servers, 708 using to monitor Active Directory, 637–638 performance counters analyzing, 256 commonly referenced (table), 249–251 Performance Logs and Alerts function, 251–252 permissions See also passwords access control in Active Directory, 364–368 access for Web sites, 909 Active Directory, when adding packages (table), 621 configuring group, 414–415 and FAT16, FAT32, 327 granting to non-administrators, 583 inheritance, allowing, 402 NTFS, 216 printer, setting, 76–77 for security groups, 404 setting for access to objects, 401–403 setting on listener connections, 964–965 setting on objects, 365–367 setting printer, 40 SIDs. See SIDs standard, for listener connections (table), 965 viewing, modifying, 355–356 personal information tabs, user accounts, 393–395 physical vs. logical disks, 108 PIN numbers and Kerberos authentication, 439–440 ping command, 747, 753, 754 capturing ICMP, 303–304 enabling in IIS 6.0, 920 pathping, 790 troubleshooting IP addressing, 314–318 troubleshooting remote connections, 887 PKI (Public Key Infrastructure) Active Directory, protocol use, 368–369 auto-enrollment, 841 certificate revocation, 837 described, 825 function of, components, 826–827 lost keys, solution, 835–836 to support L2TP over IPSec for VPNs, 859 planning backup and recovery strategy, 268–283 baseline security, 70 CA hierarchy, 835 certificates enrollment and distribution, 838–843 and deploying domain controllers, 529–538 DNS forwarding, 683–685 DNS server deployment, 672–678 for fault tolerance, 287–290 Group Policy strategy, 568–575 group strategies for forests, 443–447 for host name resolution, 660–665 IP addressing strategy, 746 NetBIOS name resolution, 710–713 network infrastructure, 17–21 network topology, 755–756 OU structure and strategy, 503–505 remote access security, 864–867 replication topology, 520 routing strategy, 759–760 running RSoP query, 573 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 988 Index 989 security group strategies, 443–447 security in depth, 432 server roles, security, 51 server security strategy, 66–69 sites and site links, 511–518 system recovery with ASR, 283–287 Windows Server 2003 certificate- based PKI, 825–830 Windows Server 2003 test network, 22–24 WINS server deployment, 713 zone replication, 678–683 point-to-point network type, 769 Point-to-Point Protocol over Ethernet (PPPoE), 8 Point-to-Point Protocol (PPP), Multilink and BAP, 860–862 Point-to-Point Tunneling Protocol (PPTP), 785, 798, 858 policies configuring IPSec, 803 DNS Security levels, 702–704 Group. See Group Policy IPSec, configuring, 805–808 network security configurations, 84–88 password. See password policies remote access, administrative model, 854 remote access, creating, 878–884 remote access wireless, 863 security. See security in security templates, 82 software restriction, 591–594 policy-based administration, 327 pooling print jobs, 41 POP3 (Post Office Protocol) on mail servers, 60 and SPA, 79 port rules adding, editing, 237 and NLB, 226 port switching, 775–776 ports and hubs, 772 POSIX-compliant applications, 403, 422 Post Office Protocol. See POP3 posts, limiting, 926 power-saving features of Windows Server 2003, 209 power supply redundant, 290 secure, 71 PPP (Point-to-Point Protocol) dial-in, 884 Multilink and BAP, 860–862 PPPoE (Point-to-Point Protocol over Ethernet), Windows Server 2003 support for, 8 PPTP (Point-to-Point Tunneling Protocol), 785, 798, 858 pre-shared keys and IPSec, 821–822 primary domain controller (PDC) emulator DC role, 343 and server roles, 56 primary master DNS server, 675 primary restore method, 648 print servers described, using, 57 securing, 76–77 printers, creating, 39, 40 printing enhancement in Windows Server 2003, 4–6 managing, 38–46 priority of program threads, 246 private networks in server clusters, 214–215 processes, terminating, 48–49 processor affinity, 246 processor object counters, monitoring Active Directory, 638 processors minimum system requirements for operating systems (table), 67–68 requirements per site, 532 and system performance, 245–246 profiles remote access, 878 server roles, 52 setting for user accounts, 396–397 Terminal Services, 400 programs, scheduling, 47 properties accessing user object, 393 and object attributes, 344 viewing Active Directory object, 358–359 Protected EAP (PEAP), 867–868 protocols See also specific protocol authentication, 368–369 IEEE 802.1X, 9 Internet printing, 46 Network Load Balancing (NLB), 234–235 routing, 764–770, 793 Web server, 58–59 Windows Server 2003 network, 742 wireless security, 867–873 proxy servers, 289 Public Key Infrastructure. See PKI publishing applications (Group Policy), 602–603 applications using .zap setup files, 610–611 services in Active Directory, 509 pull model, software deployment, 605, 718–719, 739 pull replication, 521 push model, software deployment, 605, 716–718, 739 Q queries Global Catalog, example, 543 and nonauthoritative responses, 674 RSoP, 573, 599–600 Quota administration, 452 quotas, disk. See disk quotas R RADIUS (Remote Authentication Dial- In User Service) authentication described, 862 configuring IAS, 891–893 configuring WAPs as clients, 864 IAS vs. Windows authentication, 865–866 improvement in Windows Server 2003, 8 RAID controllers, 206 solutions, implementing, 164–166 troubleshooting, 187–188 RAID-5 volumes creating, using, 146–149 described, 114–115 RAM (random access memory) and performance bottlenecks, 244–245 required for installation, 16 RCP-Tcp connections, configuring, 956 RD (Remote Desktop) for Administration, 34 RDC utility. See Remote Desktop Connection RDN (Relative Distinguished Name), 383 RDP (Remote Desktop Protocol), 10, 931–932 realm trusts, 353, 497 recovering from cluster node failure, 205 transactions, 651–653 Recovery Console described, using, 75 redirection attacks, 700, 730 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 989 990 Index redundancy and fault tolerance, 287 regedit.exe, 105 Registration Agent (RA), 835–836 registry category in security templates, 82 configuring for SUS clients, 103–104 and system state backup, 273 regulatory considerations, network design, 19 relative distinguished names (RDNs), 330–331, 383 relative ID master (RID), 56 Relative ID Masters. See RID Masters relnotes.htm, 16 remote access configuring dial-in accounts, 401 configuring policies for wireless connections, 863–864 creating policies, 878–884 restriction methods, 880–882 troubleshooting client connections, 884–887 troubleshooting server connections, 888–890 types and strategies for, 850–852 using smart cards for VPNs, 847 Remote Access Quarantine Agent service, 881 remote administration of cluster nodes, 215 deciding which tool to use, 37 managing remote computers with Computer Management, 35–36 NLB, 229, 236 shutting down, restarting computers, 48 using Terminal Services components for, 933–938 using Web interface for, 33–34 Remote Assistance (RA), 32–33, 387, 931, 934–938 Remote Authentication Dial-In User Service. See RADIUS Remote Control tab, user accounts, 399 Remote Desktop Connection (RDC) utility, 940–942 Remote Desktop Protocol (RDP), 10, 931–932 Remote Desktop (RD) for Administration, 34, 930–931, 934 Remote Desktops (RD) MMC snap-in (Terminal Services), 946–949 Remote Desktop Web Connection utility, 949–953 Remote Installation Services (RIS) managed computers, 418 Remote Storage best practices, 177–178 described, 166, 316–317 managing remotely, 120 troubleshooting, 186–187 using, 174–177 Remote Storage Setup Wizard, 171 Removable Storage, using, 167 Remove Administrative mode, 10 removing managed applications, 618–621 users from groups, 403 renaming DC renaming tool, 372 domains, 372–373 domains in forests, 486–489 NetBIOS, DNS names, 3 objects within domains, 359–360 sites, 513 replicating AD information to other domain controllers, 75 directory data, 373 replication Active Directory improvements, 373 bandwidth and network traffic considerations, 548 configuring between sites, 522–524 described, 508 and directory partitions, 324 Global Catalog, 546 inter-site, 520, 680 linked value, 452 managing with Active Directory Sites and Services console, 354 managing with multiple domains, 337 models of, 719–722 multi-masters, 55 planning for zone, 678–683 site. See site replication topology, and Active Directory, 345–346 troubleshooting failure, 524–525 WINS partnership configuration, 715–719 WINS, troubleshooting, 738 Replication Monitor, using, 525–526 Replmon.exe, 528 report view, System Monitor, 248–249 reporting defragmentation, 151–153 with GPMC, 4 reports, RSoP, 575, 596 Res1.log, Res2.log, 628 resources licensing issues, 14–15 NAT (Network Address Translation) information, 304 and server clustering, 191 TechNet site, 106 WMI (Windows Management Instrumentation), 35 restarting computers remotely, 48 restoration options, backup utility, 276–277 Restore Wizard, 473 restores, performing ASR, 286–287 restoring Active Directory, 640–649 default domain policies, 358 Directory Services Restore Mode, 632 domain controllers (DCs), 538–539 IPSec policies, 812 restrictions remote access, 880–882 software policies (Group Policy), 592–594 restructuring forests, and renaming trusts, 486–89 Resultant Set of Policy (RSoP) Group Policy tool, 19 and IPSec security, 822–823 logging and planning mode, 582 planning and troubleshooting policies, 595–597 tool, using to evaluate group policy design, 568 Resultant Set of Policy Wizard, 568 reverse lookup zones configuring, 663–665 described, 662 updating, 686 and WINS reverse lookup records, 697 RID Masters DC role, 343 described, 475 locating, transferring, and seizing role, 479–481 relative identifier generation, 376 troubleshooting, 429 ring topology, replication and, 519, 719 RIP (Routing Information Protocol) configuring Version 2, 780–781 protocol described, 759, 765–768 RIS (Remote Installation Services) and managed computers, 418 risk assessment, 69 rogue servers, 77, 895 role-based access control, 367 role-based administration, PKI (Public Key Infrastructure), 843 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 990 Index 991 roles, server See also server roles assigning (IIS), 897–899 Terminal Server, 930–931, 938–940 root authorities (root CAs), 61, 829 root domains in forests, 450 root hints file, 661 root zones on DNS servers, 670–671 Rootsec.inf, 83 route command, 890 router-to-router VPNs, 785–788 routers analyzing components, 783–784 bridge, 773 ICMP discovery, 877–878 RIP, 765–766 Windows Server 2003 as, 777–781 routes, tracing, 889 routing See also IP routing adjacencies, 768 administering with netsh commands, 770–772 common problems, 792 demand dial, 304 described, 762–763 evaluating options, 772–777 IP, basics of, 760–764 logging level, 789–790 packet filtering and firewalls, 788–789 planning strategy for implementing and maintaining, 759–760 security considerations, 782–790 segment, and port switching, 775–776 static vs. dynamic, 763–764 Routing and Remote Access console, using for troubleshooting, 790 Routing and Remote Access Services. See RRAS Routing and Remote Access utility, viewing routing tables with, 762–763 Routing Information Protocol. See RIP routing protocols See also specific protocol ICMP (Internet Control Message Protocol), 761 NAT (Network Address Translation), 761 routing tables configuration problems, 794 ICMP and, 761 RQC.exe, RQS.exe, 316–317 RQS.EXE, RQC.EXE, 881 RRAS (Routing and Remote Access Service) configuration, and routing problems, 792 configuring packet filtering, 855–858 described, 304 and dial-in access, 852–854 NAT services, 873–877 packet filtering and firewalls, 788–789 protocol described, 759 when to use, 772 RRAS servers configuring dial-up, 855–858 configuring as routers, 792 rss.exe, 115 rules port. See port rules precedence of policies, 593 for Remote Storage file management, 175 Run as command, 32 Runaway call limit, Remote Storage, 176 S SACLs (security access control lists), 364 Safe Mode startup, 284 SAM database and Active Directory authentication, 368 SAs (security associations) and IPSec, 797 saving log files, 266 sc.exe program described, 47 scheduling backups, 277 file-copy for Remote Storage, 176 printers, 42–43 programs, tasks, 47 Windows Update, 98–101 Schema Masters DC role, 343 described, 344, 475 Schema MMC snap-in, 545, 556 Schema Operations Masters, locating and transferring, 476–477 schema partitions, 325–326 schemas and Active Directory, 344 defunct and reused, 450 modifying, extending, 556–557 object classes and attributes, 550 redefining, 4 troubleshooting, 559 working with Active Directory, 550–559 schtasks.exe program described, 47 scope described, 405 group, in Active Directory, 405–406 of problems, determining, 429 screened subnets, 783 scripting command-line, 6 printer, printing management, 43–45 scripts, application assignment, 605, 607 SCSI controllers, 207 searching directory information search, 543 secedit.exe, 93–94 Secure Password Authentication (SPA), 79 Secure security template, 83–84 Secure Sockets Layer (SSL) Active Directory, protocol use, 368–369 encryption process described, 440–441 Secure Sockets Layer/Transport Layer Security (LLS/TLS), 440–441 securedc.inf, 89 Secure*.inf, 83 securing application and terminal servers, 80 backups, 268 certificate authorities (CAs), 79–80 database servers, 78 DNS deployment, 494 domain controllers, 75 file and print servers, 76–77 mail servers, 79 servers according to server roles, 71 trusts using SID filtering, 499 Web servers, 78 zone replication, 682 security analyzing baseline, 88–93 and authentication strategies, 431 callback, 866 DNS issues, levels, 699–705 and DNS namespaces, 666 Group Policy settings for users and computers, 588–591 IIS 6.0 new features, 900–902 implementing Active Directory, 363–369 improvement in Windows Server 2003, 8–9 IPSec considerations, 803, 820–823 Local Security Policy utility, 269 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 991 992 Index managing IIS, 920–923 minimum requirements for your organization, 68–70 network settings, 84–88 and NLB, 235–236 patches, 95 planning baseline, 70 planning CA, 836–837 planning remote access, 864–867 planning server strategy, 66–69 Remote Assistance issues, 937 Remote Desktop (RD) for Administration, 934 routing considerations, 782–790 and RSoP, 822–823 in server clusters, 214–216 setting user object, 400–403 specific policies for, 69 security access control lists (SACLs), 364 Security Accounts Manager (SAM), 328–329, 384 security associations (SAs) and IPSec, 797 Security Configuration and Analysis, applying security templates with, 93–95 Security Configuration Manager (SCM), 81 security groups best practices, 443–447 described, 404 nesting, 455 universal, 446 Security Identifiers. See SIDs security parameters index (SPI), 797 security principals, naming conventions, limitations, 381–384 security templates applying, 93–95 configuration areas, 82 generally, 81 types of, 83–84 segment switching, 775–776 Select Cryptographic Service Provider (CSP), 901 selective authentication, 454 semantic database analysis, 653–655 server authentication (SSL), 440 server clustering administration, 201–216 backup and recovery, 274–275 binding order, 213 cluster groups, models, 191–195 cluster network configuration, 209–216 clusters, creating, 216–224 deployment options, 196–201 failover ring option, 199–200 and high-availability planning, 190 introduction, 189–190 Network Load Balancing (NLB). See Network Load Balancing (NLB) nodes, heartbeats, 190–191 random deployment option, 200–201 relationship to NLB, 227–228 Server-Gated Cryptography (SGC), 901 server roles configuring, 53–54 described, 50 described, setting up, 52 planning, 51 securing servers according to, 71 server security, planning, 51 servers See also specific servers application, and terminal, 64–66 and client, authentication settings (table), 85 clustering. See server clustering configuring, managing with wizards, 50 customizing security for, 70–79 database, 60 DHCP, 57–58, 686–688 DNS, 57–58 file, 57 FTP, setting up, 909–911 hot-swappable components, 289 mail, 60–61 managing remotely, 32–37 monitoring with Event Viewer, 260–267 monitoring with System Monitor, 247–257 NNTP, setting up, 913–914 planning security strategy for, 66–69 print, 57 promoting, 457 rogue, 77 SMTP, setting up, 912–913 SUS, 96 synchronizing Windows Update, 98–101 terminal, configuring, 938–940 WINS, 57–58 Service Level Agreements (SLAs), 20 Service Pack 3 (SP3), 101 Service Pack 4 (SP4), 81 service packs and system updates, 71–72 services, removing unnecessary, 73 session keys and digest authentication, 442 sessions configuring with Terminal Services, 959–960, 967–968 resetting, 972 Setup security.inf, 83 setx.exe program described, 48 sever fault-tolerance solutions, 289–290 SGC (Server-Gated Cryptography), 901 shadow copies, improvement in Windows Server 2003, 5 sharing printers, 5–6, 39 shortcut trusts, 497 shortest path first (SPF) protocols, 765 shutdown.exe program described, 48 shutting down remote computers, 48 SID filtering for securing trusts, 499 SIDs (Security Identifiers) described, using, 376–378 managing, 362 resolving to logon names, 160 and RIDs, 343 and security groups, 404 well-known (table), 379–380 Simple Access Protocol (SOAP), 3 Simple Authentication Security Layer (SASL), 442 Simple Mail Transfer Protocol (SMTP) protocol described, 59 and site links, 354 simple volumes, 111–112, 136–139 Single Instance Store (SIS), 453 single node server cluster, 193 single quorum device service cluster, 194 single sign-on feature, 508 site link bridges, 511, 523 site-link objects, 346 site links configuring availability, 522–523 creating and storing, 354 planning, creating, configuring, 511–518 site replication configuring site link bridges, 523 creating topology, 521 described, types, 518 planning, creating and managing topology, 520–524 sites in Active Directory described, 508 configuring replication between, 522–524 creating, 512 creating topology for replication, 507 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 992 Index 993 described, 335 minimum memory, processor requirements (table), 532 placing DCs within, 537–538 placing GC servers within, 547 relationship with domains, subnets, 510–511 and site links, planning, 511–518 slave servers, 675 sliding window method of transmitting data, 757 smart cards authentication, 443, 843–848 using for remote access, 867 SMS (Microsoft Systems Management Server (SMS), 19, 292, 605 SMTP servers, setting up, 912–913 snap-ins Active Directory Domains and Trusts console, 351–354 Active Directory Sites and Services console, 354 Active Directory Users and Computers tool (ADUC), 385 adding to MMC, 89–91 ADUC (Active Directory Users and Computers tool), 349–351 Authorization Manager, 368 in Computer Management (table), 36 Disk Management, 35–36 multiple, and MMC interface, 347 SOAP (Simple Access Protocol) support, 3 soft associations, 822 soft lockouts, 436 software deployment. See Group Policy software installation push and pull models of deployment, 605 restriction policies, 591–594 software packages See also application packages adding, removing modifications for, 622–623 declared upgrade relationship, 616–617 described, 602 software policies (Group Policy), 563 Software Update Service (SUS) described, 81 managing software updates with, 95 software updates Group Policy deployment, 617 managing, 95–106 testing, 106 SPA (Secure Password Authentication), 79 space, disk enabling disk quotas, 155–163 extending with Remote Storage, 166 ‘insufficient disk space’ message, 186 planning for applications, 208 setting desired free, Remote Storage, 175 spanned volumes, 112, 138 special permissions, 365 speed clock, or processors, 245 performance. See performance speed-buffering bridges, 774–775 SPF (shortest path first) protocols, 765 SPI (security parameters index), 797 split DNS configurations, 694–695 spooler service, printer management, 45 SSL/TLS protocol described, 440–441 stand-alone CAs, 831 Standard Edition, Windows Server 2003, 12–13 standards 802.11 wireless, 851, 862 authentication, 368–369 starting Active Directory Users and Computers tool (ADUC), 388 Backup Utility, 275 MMCs, 347 NLB Manager, 229 Safe Mode startup, 284 static address pools, 852 static packet filters, 304 static vs. dynamic routing, 763 static WINS entries, 722, 737 statistics, capturing network data with Network Monitor, 296–297 stealth servers, 676 stopping processes remotely, 48–49 Storage Area Networking (SAN) and clustering technology, 6–7 storage devices and server clustering, 206 strategies planning and implementing routing, 759–760 planning DNS, 659–660 planning remote access, 850–852 streaming, fast, 11 striped volumes, 112–113, 141–144 strong encryption algorithm (3DES) and IPSec security, 820 strong passwords, 74, 230, 433 stub zones, 670 subnets associating with sites, 514 creating, 513–515 creating scheme for IP addressing, 746 described, 335 and networks, 508 relationship with sites, 511 screened, 783 storing information about, 354 subordinate CAs, 61 suffixes, UPNs (user principal names), 382, 424–425 Support Tools for managing sites, subnets, and networks, 527–528 Support_388945a0 account, 386–388 SUPTOOLS.MSI, 428 switches described, 775–776 in Ethernet networks, 247 synchronizing media copies, 177 servers with Microsoft Windows Update servers, 98–101 SYS command, 283 syskey command, 433 System Compatibility wizard, 16 System Equivalency licenses, 15 system key utility (syskey), 432–433 system media pools, 167–168 System Monitor comparisons with multiple systems, 256 creating console, 257–260 described, using, 247–257 managing print performance with, 6 monitoring network traffic with, 756–757 monitoring Active Directory with, 639–640 system object counters, monitoring Active Directory, 639 system performance, 244–247 System root security template, 83–84 system state data backing up, 538, 631, 641 and new system state backup method, 472–476 Systems Management Server (SMS), 35 T tape backups, 277 taskkill.exe program described, 48–49 tasks managing, 48–49 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 993 994 Index scheduling, 47 taskslist.exe program described, 48 TCO (Total Cost of Ownership), 20–21 TCP/IP automatic interface metric determination, 744 configuration problems, 794 default protocol, 246 infrastructure planning, implementing, maintaining, 741 interconnect settings, 213 IPv6, 743 troubleshooting IP addressing, 314–318 Windows Server 2003 enhancements, 742–745 TechNet site, 106 technologies, determining costs of, 20–21 Telnet, stopping service, 47 templates certificate, 838–841 security. See security templates Terminal Server Client Access License (TS CAL), 14–15 terminal servers logging on with smart cards, 848 securing, 80 security template setting, 84 and server roles, 64–66 Terminal Services command-line tools (table), 971–972 configuration server settings, 965–966 improvement in Windows Server 2003, 9–10 introduction to, 929–930 listener connection, managing, 957–965 Remote Assistance (RA), 931 setting properties, 398–400 and terminal servers, 66 troubleshooting, 972–974 using administrative tools, 953–972 using client tools, 940–953 using Configuration tool, 956 using for remote administration, 933–938 using group policy settings to control users, 970–971 Terminal Services Administration mode, 34 Terminal Services Manager. See TS Manager testing developing Windows Server 2003 test environment, 21–25 DNS server configuration, 706 software updates, 106 ‘this initial program cannot be started’ error message, 973 threads in programs, 245 three-hop rule of intra-site replication, 518–520 ticket-granting service (TGS) and Kerberos authentication, 440 time-outs, troubleshooting, 926 Time To Live (TTL), dynamic data, 362 TLS (Transport Layer Security), 369 Token Ring networks, 247 tombstone interval and WINS servers, 712 tombstone process, interval, 630 tools See also specific tool Active Directory Object Manager, 427 Active Directory Support, 527–528 Backup Utility, 269–275 cluster administrator, 201–202 command-line utilities. See command- line utilities defrag.exe, 154 Disk Defragmenter, 149–154 disk management command-line, 117–120 NLB Manager, 228–229 NSLookup diagnostic, 662 NTDSUTIL, 380–381 Resultant Set of Policy (RSoP), 568 software installation diagnostics tool, 625 Terminal Services administrative, 953–972 for viewing, managing security identifiers, 380–381 topology Active Directory, 326 convergence, 766 and network availability, 289 and network performance, 247 and physical directory structure, 341 planning network, 755–756 replication, 345–346, 520–524 simplifying network to minimize attack points, 784–785 Web site, for optimizing replication, 507 Total Cost of Ownership (TCO), 20–21 tracert command, 314–318, 748, 889–890 traces, interpreting network, 301–304 traffic distributing within NLB cluster, 225–226 management planning, 756 monitoring IPSec, 318–320 transaction logging, 629 transactional database, 628 transactions recovering, 651–653 and tombstone interval, 630 transforms applying to software packages, 622 described, 602 and software packages, 605–607 transitive relationships described, 338, 496 and trusts, 484–486 transitive site links, 523 translating bridges, 774 Transport Layer Security (TLS), 369, 440 trees and forests, 450 troubleshooting account problems, 429 Active Directory availability, 649–658 Active Directory schema issues, 559 basic disks, 178–181 disk quotas, 184–186 disk space problems, 149 dynamic volumes, 181–183 fragmentation problems, 184 Global Catalog issues, 549–550 Group Policy, 595–600 Group Policy software deployment, 623–625 IIS 6.0, 923–927 installation, 16–17 IP addresses, 314–318 IP routing, 790–794 IPSec, 814–820 and monitoring Internet connectivity, 304–318 name resolution, 310–314, 732–739 NAT (Network Address Translation), 304–310 NetBIOS name resolution, 736–737 performance issues, 251 RAID, 187–188 remote access client and server connections, 884–890 Remote Storage, 186–187 replication failure, 524–525 software updates, 106 Terminal Services, 972–974 trust relationships described, 495 and domain trees, 338 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 994 Index 995 establishing, 484–486 types of, 496 trusts direction and transitivity, 484 forest-level, 3 realm, 353 renaming after forest restructuring, 486–89 securing using SID filtering, 499 shortcut, forest, 352 types of, 486 working with, 496–503 TS Manager, connecting servers, managing users and processes, 954–956 tunneling, 6to4, 753 U UCS Transformation Format (UTF) and IIS 6.0, 904 UDDI (Universal Description, Discovery, and Integration Services), 13 underscore character in NetBIOS names, 667 unicast addresses, 760 Unicode Transformation Format, 667, 904 Uniform Resource Locators. See URLs uninstalling applications, 618–621 Uninterruptible Power Supplies (UPSs), 71, 290 Universal Description, Discovery, and Integration Services (UDDI), 13 Universal Group caching, 452, 548–549 Universal Group membership, 345, 544, 546 Universal Groups and group conversions, 454–456 Universal Naming Convention (UNC) and Active Directory, 328 universal security groups, 405, 446 Unix and IIS errors, 926–927 ‘unreadable’ disk message, 180 updates automatic, 72–73 deploying with Group Policy, 617 dynamic, and DNS servers, 466 dynamic DNS (DDNS), 667–668 managing software, 95–106 replication and, 324 and software packages, 607 for Windows operating systems, 71–72 updating forward and reverse lookup zones, 686 upgrades, Windows Server 2003, issues, 16–17 upgrading applications, 616–617 DCs to Windows Server 2003, 536–537 domain or forest functional level, 23–24 UPN (User Principal Name), 328, 382, 424–425, 798 UPN authentication and Global Catalog, 542 UPSs (Uninterruptible Power Supplies), 71 URLs (Universal Resource Locators) accessing resources via, 329 and Active Directory, 328 user accounts Account tab, 396–398 Active Directory server objects, 376 built-in domain, 386–388 configuring with Terminal Services, 966 creating in test environment, 23 creating, managing, 385 disabling, 73 lockout policies, creating and applying, 436–437 managing, 393–403 passwords. See passwords for Remote Assistance, 935 restricting hours of access, 396 troubleshooting, 429 working with, 384–386 user and computer policies (Group Policy), 563–565 User CALs, 15 user certificates use in PKI system, 828 User Datagram Protocol (UDP), 798 user logons, processing policy settings (Group Policy), 566 User Principal Name (UPN) and Active Directory, 328 creating alternative suffixes, 424–425 in forests, 381 user rights, viewed from Local Security Policy, 269 userenv, 623 usernames, creating and editing, 356 users accounts. See user accounts adding to Active Directory, 358 deploying software to (Group Policy), 607–608 displaying information about logged- on, 362–363 educating about security, 442 managing with TS Manager, 954 remote access, administration of, 854 removing from groups, 403 security settings, 589 single sign-on authentication, 438 software restriction policies, 591–594 Users container, default groups in, 407–408 UTF (UCS Transformation Format) and IIS 6.0, 904 V VDS (Virtual Disk Service), 9 verbose logging, 624–625 verifying forest-root, 468–469 Group Policy, 582 viewing group membership, 411 information about groups, 414 IP policy assignment information, 815–816 IPSec statistics, 814 policy maps, 594 printer queue, 46 RSoP results, 570–571 security identifiers, 380–381 Virtual Directory Creation Wizard, 916 Virtual Disk Service (VDS), 9 virtual LANs (VLANs), 864 virtual memory (VM) and system performance, 245 virtual private networks. See VPNs VMware, 22 volume shadow copy (backup), 272, 641 volumes defragmenting, 149–155 extending basic, 132–133 managed, 166, 174 mirrored, 111, 113–114, 144–146 mounting, 178 RAID-5, 114–115, 146–149 spanned, 112, 138–139 striped, 112–113, 141–144 VPNs (virtual private networks) design considerations, 858–860 PPP Multilink and BAP, 860–862 router-to-router, 785–788 troubleshooting connections, 884–886 using smart cards for remote, 847–848 vs. other remote access types, 851 301_BD_W2k3_Ind.qxd 5/14/04 12:09 PM Page 995 . 432 server roles, security, 51 server security strategy, 66–69 sites and site links, 511–518 system recovery with ASR, 283–287 Windows Server 2003 certificate- based PKI, 825–830 Windows Server 2003. of Windows Server 2003, 209 power supply redundant, 290 secure, 71 PPP (Point-to-Point Protocol) dial-in, 884 Multilink and BAP, 860–862 PPPoE (Point-to-Point Protocol over Ethernet), Windows Server. Authentication Dial- In User Service) authentication described, 862 configuring IAS, 891–893 configuring WAPs as clients, 864 IAS vs. Windows authentication, 865–866 improvement in Windows Server 2003,