book

Microsoft® Windows Server™ 2003 Administrator's Companion, 2nd Edition

by Charlie Russel, Sharon Crawford, Jason Gerend

March 2006

Intermediate to advanced

1504 pages

43h 10m

English

Microsoft Press

Read now

Unlock full access

Microsoft® Windows Server™ 2003 Administrator’s Companion, Second Edition
Dedication
A Note Regarding Supplemental Files
Acknowledgments
Introduction
Meet the FamilyNew in Windows Server 2003How to Use this BookWhat’s in the BookWhat’s on the CD?Talk to Us
System Requirements
I. Preparation
1. Overview of Windows Server 2003
Versions of Windows Server 2003Deploying Windows Server 2003 and Windows ClientsNetwork ManagementPrinter ManagementGroup PolicyIntelliMirrorTerminal ServicesInteroperabilitySystem and Network SecurityAvailability and ReliabilityActive DirectoryStorage and File System SupportCommunicationsInternet Services and .NET Application ServicesScalabilityThe Need for PlanningSummary
2. Introducing Directory Services
Understanding Directory ServicesActive Directory in Microsoft Windows Server 2003Terminology and Concepts in Active DirectoryNamespace and Name ResolutionAttributeObjectContainerTree and SubtreeDistinguished NameSchemaThe Active Directory ArchitectureThe Directory System AgentNaming FormatsThe Data ModelSchema ImplementationThe Security ModelDelegation and InheritanceNaming Contexts and PartitionsThe Global CatalogSummary
3. Planning Namespace and Domains
Analyzing Naming Convention NeedsTrees and ForestsTreesForestsDefining a Naming ConventionThe Organizational Naming ConventionThe Geographical Naming ConventionMixed Naming ConventionsDetermining Name ResolutionUsing the Same Internal and External NamespacesUsing Different Internal and External NamespacesPlanning a Domain StructureDomains vs. Organizational UnitsDomainsOrganizational UnitsDesigning a Domain StructureDesigning a Single Domain Tree StructureDesigning a Multiple Domain Tree StructureDomain Security GuidelinesCreating Organizational UnitsPlanning Multiple DomainsPlanning a Contiguous NamespaceDetermining the Need for a Multi-Tree ForestCreating the ForestSummary

4. Planning Deployment
How Information Technology FunctionsIdentifying Business NeedsGetting SpecificSeeing into the FutureAssessing Current SystemsDocumenting the NetworkThe Organizational and Physical InfrastructureTraffic PatternsNetwork AddressesOperating System ConnectivityExternal ConnectivityExisting Network Operating SystemsExisting Applications and ServicesMaking a RoadmapDefining GoalsAssessing RiskSummary
II. Installation and Configuration
5. Getting Started
Designing a Deployment EnvironmentChoosing an Installation MethodChoosing a Setup-Based Installation MethodChoosing an Image-Based Installation MethodChoosing a Preinstallation EnvironmentChoosing a Software Update SolutionChoosing an Application Deployment SolutionUnderstanding Licensing and Product ActivationLicensing ModesProduct ActivationDesigning a Test LabPlanning Server ConfigurationsPlanning Server RolesAssessing System RequirementsPlanning PartitionsPlanning Server SecurityCreating Your Deployment PlanCreating Your Deployment EnvironmentUsing Setup ManagerUsing Unattended Setup with Windows Server 2003 R2Creating and Modifying a Distribution ShareCreating a Distribution ShareApplying Service Packs to a Distribution ShareInstalling Software Updates with an Answer FileInstalling Plug and Play Drivers in the Distribution ShareInstalling OEM Drivers in Remote Installation Preparation ImagesInstalling Mass Storage DriversConverting Short Filenames Back to Long FilenamesUsing Sysprep with Disk ImagingInstalling WindowsPreparing the SystemPerforming a Manual Installation of WindowsInitiating Windows Setup Using an Answer FileInitiating Setup Using Command-Line ParametersTroubleshooting InstallationsSetup Freezes or Locks UpSetup Stops During File CopyingPrevious Operating System Will Not BootChanging the Default Operating System and Boot TimesRestoring the MBR of the Previous Operating SystemSummary
6. Upgrading to Windows Server 2003
Architectural Changes Since Windows NT 4.0Domain Controllers and Server RolesServer Roles in Windows NT 4.0Server Roles in Windows 2000 and Windows Server 2003Active DirectoryActive Directory DomainsSites and Organizational UnitsForest Root DomainsTrust RelationshipsTrust Relationships in Windows NT 4.0Trust Relationships in Active DirectoryHardware SupportSoftware SupportPlanning a Windows NT Domain UpgradeChoosing Whether to Upgrade or MigrateDocumenting the Existing NetworkThe Existing Domain ModelExisting Trust RelationshipsAccount Domains and Resource DomainsDNS NamespacesServer Software and Compatibility IssuesPlanning the Active Directory ForestDesigning the Active Directory Domain StructureSingle-Domain ModelSingle-Master–Domain ModelMultiple-Master–Domain ModelComplete-Trust ModelChoosing DNS NamesPlanning the Site TopologyMaking a Recovery PlanMake Sure All Domains Have at Least One BDCBack Up Each Computer Before UpgradingSynchronize All BDCs with the PDCTake a BDC Offline for BackupRelaxDeveloping an Upgrade StrategyUpgrading or Replacing Windows NT RAS ServersMaking Sure the PDC Is Sufficiently PowerfulCreating the Dedicated Forest Root Domain Before Upgrading the PDCUpgrading or Retiring Any Incompatible Clients and ServersUpgrading the PDC FirstUpgrading or Replacing the BDCs QuicklyUpgrading Member Servers and Clients IndependentlyScheduling the Domain Upgrade AppropriatelyCreating a Testing CriteriaPreparing Domains and ComputersReviewing Server Upgrade RequirementsPreparing Windows NT DomainsPreparing the ComputersUpdating the Active Directory SchemaTesting Active Directory Functionality in Active Directory DomainsUpdating the Active Directory Forest SchemaVerifying the Forest Schema UpdateUpdating the Active Directory Domain SchemaUpgrading Clients to Windows XPUpgrading Servers to the Windows Server 2003 FamilyInstalling Windows Server 2003 R2Upgrading a Server to Windows Server 2003Switching Forest and Domain Functional LevelsChoosing a Forest Functional LevelChoosing a Domain Functional LevelSwitching Functional LevelsSummary
7. Configuring a New Installation
Installing UpdatesEnabling Remote AdministrationChecking for Setup ProblemsConfiguring DevicesUsing Device ManagerWorking with Device ManagerWorking with Device PropertiesTroubleshooting DevicesConfiguring StorageConfiguring Networking SettingsChanging Your Network IdentityConfiguring Network ComponentsConfiguring TCP/IPUsing Dynamic AddressingUsing Static AddressingSetting Advanced TCP/IP OptionsConfiguring IP SettingsConfiguring DNS SettingsConfiguring WINS SettingsConfiguring TCP/IP OptionsSetting Up Server RolesSecuring WindowsSummary
8. Installing and Managing Printers
Planning Printer DeploymentEstablishing Printer Naming ConventionsCreating Location-Naming ConventionsEnabling Printer Location TrackingChoosing Whether to Upgrade or Migrate Print ServersInstalling PrintersManaging Printers and Print ServersUsing the Print Management ConsoleCreating Filtered Printers FoldersDeploying Printer ConnectionsManaging Print Jobs from WindowsManaging Printers from a Web BrowserManaging Printers from a Command LineChanging Printer OptionsSetting Security OptionsChanging Printer Availability and Group PrioritiesSpecifying a Separator PageChanging Spool SettingsManaging Printer DriversManaging Printer DriversCreating Printer Pools and Changing Port SettingsPrinter Maintenance and TroubleshootingOptimizing Print Server PerformancePreparing for Print Server FailurePrinting from the Client Machine Experiencing the ProblemDocument Prints IncorrectlyDocument Fails to PrintPrinting from Some Applications FailsChecking the Print Server StatusChecking the PrinterDeleting Stuck DocumentsTroubleshooting Printer Location TrackingClients Cannot Locate Some Printers in Active DirectoryNaming Scheme Needs to Be ChangedSummary
9. Managing Users and Groups
Understanding GroupsAssigning Group ScopesGlobal ScopeDomain Local ScopeUniversal ScopePlanning Organizational UnitsCreating Organizational UnitsMoving Organizational UnitsDeleting Organizational UnitsPlanning a Group StrategyDetermining Group NamesUsing Global and Domain Local GroupsUsing Universal GroupsImplementing the Group StrategyCreating GroupsDeleting GroupsAdding Users to a GroupChanging the Group ScopeCreating Local GroupsManaging Built-In Groups and User RightsBuilt-In Local GroupsBuilt-In Domain Local GroupsBuilt-In Global GroupsDefining User RightsAssigning User Rights to a GroupAssigning Rights LocallyCreating User AccountsNaming User AccountsAccount OptionsPasswordsCreating a Domain User AccountCreating a Local User AccountSetting User Account PropertiesTesting User AccountsManaging User AccountsFinding a User AccountDisabling and Enabling a User AccountDeleting a User AccountMoving a User AccountRenaming a User AccountResetting a User’s PasswordUnlocking a User AccountUsing Home FoldersCreating Home Folders on a ServerProviding Home Folders to UsersMaintaining User ProfilesLocal ProfilesRoaming ProfilesSetting Up Roaming ProfilesCreating Customized Roaming ProfilesUsing Mandatory ProfilesAssigning a Logon Script to a User ProfileSummary
10. Managing File Resources
Sharing File ResourcesShared FoldersNFS Shared FoldersActive Directory Shared FoldersDFS FoldersShare Permissions vs. File PermissionsShare PermissionsFile PermissionsNTFS PermissionsWhat Permissions MeanHow Permissions WorkConsidering InheritanceConfiguring Folder PermissionsAssigning Permissions to FilesConfiguring Special PermissionsOwnership and How It WorksShared FoldersUsing the File Server Management Snap-InCreating a Shared FolderRemoving a Folder ShareDisconnecting UsersLimiting Simultaneous ConnectionsSpecial SharesThe Command Line—Net ShareNFS Shared FoldersInitial ConfigurationSpecify a User Name Mapping ServerWindows Firewall ConfigurationCreating an NFS ShareDeleting or Modifying an NFS SharePublishing Shares in Active DirectorySummary
11. Administering Group Policy
Components of Group PolicyGroup Policy ObjectsGroup Policy TemplatesGroup Policy ContainersDefault Group PoliciesManaging Group PoliciesOrder of ImplementationOrder of InheritanceOverriding InheritanceEnforcing a GPO Link in GPMCSetting No OverrideSetting Block Inheritance in GPMCBlocking Inheritance on Computers Without GPMCCreating a Group Policy ObjectCreating a GPO in GPMCCreating a GPO on a Computer Without GPMCInside the Group Policy Object EditorManaging Group Policy LinksLinking a GPO Using GPMCLinking a GPO Without GPMCSetting the Scope of Group Policy ObjectsUsing GPMC to Set the Scope for a GPOSetting the GPO Scope Without GPMCDelegating Permissions on GPOsDelegating Group Policy Using GPMCDelegating Permission to CreateDelegating Permission to LinkDelegating Permission to Edit, Delete, or Modify SecurityDelegating Group Policy Without GPMCDelegating Permission to CreateDelegating Permission to Link, Edit, Delete, or Modify SecurityDisabling a Branch of a GPODisabling a Node Using GPMCDisabling a Node without GPMCRefreshing Group PolicyBacking Up a Group Policy ObjectRestoring a Group Policy ObjectUsing Group Policy for Folder RedirectionRedirecting to One LocationRedirecting by Group MembershipRemoving RedirectionUsing Resultant Set of Policy (RSoP)Running an RSoP QueryA Planning RSoPA Logging RSoPSummary
III. Network Administration
12. Managing Daily Operations
Using the Microsoft Management ConsoleConvenience ConsolesCreating an MMC-Based Console with Snap-InsCustomizing the Layout of a ConsoleSetting Options for a Console FileModifying Console FilesDistributing and Using ConsolesUsing MMC for Remote AdministrationUsing the Secondary LogonOpening Programs Using Run AsMaking Shortcuts to Run AsUsing Runas for Printers or Control PanelAdministrative ToolsInstalling Administrative Tools LocallyMaking Administrative Tools Available RemotelySupport ToolsAutomating Chores with ScriptsAuditing EventsAudit Settings for ObjectsViewing Event LogsSearching Event LogsFiltering Event LogsSetting the Size of Event LogsArchiving Event LogsDelegating ControlUsing Task SchedulerChanging a ScheduleTracking Task SchedulerViewing Tasks on a Remote ComputerUsing the AT CommandUsing cronSummary
13. Using Scripts for Consistent Administration
Scripting on Windows Server 2003Windows Server 2003 Scripting InfrastructureCommand ShellActive ScriptingCOM InterfacesExtending the InfrastructureWhat’s New in Windows Server 2003 ScriptingThe Windows Command Shell—Cmd.exeWindows Scripting HostDistributed COMADSI and WMIScripting PracticesThink from the Command PromptWrite WSH Scripts as Console ToolsCredentials and ScriptingUse RunAs and Scheduled TasksAvoid Specifying Passwords on the Command LineUse Obfuscated Password EntryPath Management PracticesHow Command Discovery WorksMaking Changes to the Shell Working DirectoryUse Fully Qualified Command PathsMonitor the %PATHEXT% VariableAdd a Tools Directory to Your PathInput and Output HandlingWSH: Use Text Streams for Input and OutputLimit MsgBox UseWScript.Echo: Flexible but Suppressed in Batch ModeUse the WScript.Shell LogEvent for Critical Information LoggingUse Good Error ManagementUse VBScript’s On Error Resume Next CarefullyConsole Scripts Should Handle Most Errors as Normal EventsReturn Error Information to the ShellLog Errors in Noninteractive ScriptsWMI Scripting IssuesUse Scriptomatic to Explore WMIUse WMIC for Interactive Exploration and One-Shot WMI CallsAvoid Authentication and Impersonation SettingsTranslating Script LanguagesCreating and GettingVBScriptJScriptPerlNoninteractive Scripts: Remote and Scheduled UseThe Future of Windows ScriptingSummary
14. Installing and Configuring Active Directory
Using the Active Directory Installation WizardPreparing for InstallationNTFSDNS ServerPromoting Your First Server to a Domain ControllerLaunching the Active Directory Installation WizardCreating a New DomainSpecifying Domain NamesChoosing Installation OptionsCreating Additional (Replica) Domain ControllersCreating a Child Domain in an Existing TreeCreating a New Tree in an Existing ForestCreating a New ForestUpgrading Windows NT 4 Domain ControllersDemoting a Domain ControllerChanging a Domain Controller IdentificationSetting a Global Catalog ServerUsing Active Directory Domains and TrustsLaunching Active Directory Domains and TrustsDomain and Forest FunctionalityChanging the Domain Functionality LevelsChanging the Forest Functionality LevelsManaging Domain Trust RelationshipsSpecifying the Domain ManagerConfiguring User Principal Name Suffixes for a ForestManaging DomainsUsing Active Directory Users and ComputersLaunching Active Directory Users and ComputersViewing Active Directory ObjectsActive Directory Object TypesNormal Mode vs. Advanced ModeChanging the DomainUsing Filters to Simplify the DisplayFinding ObjectsDefault Active Directory ObjectsCreating an Organizational UnitConfiguring OU ObjectsDelegating Object ControlCreating a User ObjectUsing the Command Line to Add a UserConfiguring User ObjectsThe General TabThe Address TabThe Account TabThe Profile TabThe Telephones TabThe Organization TabThe Member Of TabThe Dial-In TabThe Environment TabThe Sessions TabThe Remote Control TabThe Terminal Services Profile TabThe COM+ TabThe Published Certificates TabThe Object TabThe Security TabCreating a GroupConfiguring Group ObjectsThe General TabThe Members TabThe Member Of TabThe Managed By TabThe Object TabThe Security TabCreating a Computer ObjectConfiguring Computer ObjectsUsing Remote Computer ManagementPublishing a Shared FolderPublishing a PrinterMoving, Renaming, and Deleting ObjectsRenaming a Domain Controller or a Whole DomainRenaming a Domain ControllerRenaming DomainsUsing Active Directory Federation ServicesSummary
15. Managing Active Directory
Using Active Directory Sites and ServicesDefining Site ObjectsSubnet ObjectsServer ObjectsUnderstanding Domain ReplicationIntrasite ReplicationIntersite ReplicationLaunching Sites and ServicesViewing Replication ObjectsCreating Site ObjectsCreating Server and Connection ObjectsCreating Subnet ObjectsCreating Site Link ObjectsConfiguring Site LinksCreating Site Link Bridge ObjectsUsing Active Directory SchemaExamining Schema SecuritySchema Administrator PermissionsFlexible Single-Master OperationsRead-Only Schema AccessLaunching Active Directory SchemaModifying the SchemaCreating AttributesCreating Object ClassesAdding Attributes to a ClassAdding an Auxiliary Class to a Structural ClassModifying Display SpecifiersPerforming Batch Importing and ExportingUsing the Ldifde.exe UtilityExporting ObjectsImporting ObjectsModifying ObjectsUnderstanding Operations Master RolesPrimary Domain Controller EmulatorTransferring the PDC EmulatorSeizing the PDC EmulatorSchema MasterTransferring the Schema MasterSeizing the Schema MasterDomain Naming MasterTransferring the Domain Naming MasterSeizing the Domain Naming MasterRelative Identifier MasterTransferring the RID MasterSeizing the RID MasterInfrastructure MasterTransferring the Infrastructure MasterSeizing the Infrastructure MasterSummary
16. Understanding TCP/IP
The TCP/IP Protocol SuiteInternet ProtocolTransmission Control ProtocolUser Datagram ProtocolWindows SocketsNetBIOSRequests for CommentsIP Addresses and What They MeanClass A NetworksClass B NetworksClass C NetworksClass D and Class E AddressesRouters and SubnetsWhat Is a Subnet?Gateways and RoutersAddress Resolution and Routing ProtocolsName ResolutionThe Domain Name SystemThe Domain NamespaceTop Level DomainsHow Names Are Resolved into AddressesReverse LookupsDynamic DNS and Active Directory IntegrationZone Storage and Active DirectoryLightweight Directory Access ProtocolDynamic Host Configuration ProtocolHow DHCP WorksUsing Multiple DHCP ServersWindows Internet Name ServiceSingle Domain Across a Subnet BoundaryMultiple Domains Within a Subnet BoundaryMultiple Domains Across a Subnet BoundaryIP Version 6Summary
17. Administering TCP/IP
Using DHCPDesigning DHCP NetworksDHCP Security ConsiderationsPlan the IP Address Range and ExclusionsInstalling the DHCP ServiceCreating a New ScopeAuthorizing the DHCP Server and Activating ScopesAdding Address ReservationsEnabling Dynamic Updates to a DNS Server for Earlier ClientsUsing Multiple DHCP Servers for RedundancySplitting the Address Space Between Two ServersSetting Up a DHCP Server ClusterOther DHCP FunctionsModifying ScopesEnabling Server-Based Conflict DetectionSetting Up a DHCP Relay AgentBacking Up and Restoring the DHCP DatabaseUsing Ipconfig to Release, Renew, or Verify a LeaseDHCP Command-Line AdministrationUsing DNS ServerInstalling DNSUsing the Configure A DNS Server WizardSetting Up a DNS ServerCreating ZonesCreating Subdomains and Delegating AuthorityAdding Resource RecordsConfiguring Zone TransfersInteroperating with Other DNS ServersEnabling WINS ResolutionSetting Up a ForwarderUpdating Root HintsSetting Up a Caching-Only DNS ServerSetting Up a WINS ServerDetermining Whether You Need WINSConfiguring the Server to Prepare for WINSInstalling WINSAdding Replication PartnersMiscellaneous WINS FunctionsCompacting the WINS DatabaseSummary
18. Implementing Disk Management
Understanding Disk TerminologyOverview of Disk ManagementDisk Administration EnhancementsRemote ManagementDynamic DisksCommand LineDisk Management TasksAdding a Partition or VolumeAdding a New Disk Using the Initialize And Convert Disk WizardCreating a VolumeCreating a PartitionCreating Logical Drives in an Extended PartitionDeleting a Partition, Volume, or Logical DriveConverting a Disk to a Dynamic DiskExtending a VolumeAdding a MirrorDrive Failure in a Mirrored VolumeRemoving a MirrorBreaking a MirrorConverting a Volume or Partition from FAT to NTFSFormatting a Partition or VolumeChanging a Drive LetterMounting a VolumeNTFSEncrypting on the File System LevelDisk Quotas, File Screening, and Shadow CopiesSummary
19. Using Clusters
What Is a Cluster?Network Load Balancing ClustersServer ClustersCluster ScenariosIntranet or Internet FunctionalityTerminal ServicesMission-Critical AvailabilityRequirements and PlanningIdentifying and Addressing GoalsIdentifying a SolutionIdentifying and Addressing RisksMaking ChecklistsNetwork Load Balancing ClustersNLB ConceptsChoosing an NLB Cluster ModelSingle Network Adapter in Unicast ModeSingle Network Adapter in Multicast ModeMultiple Network Adapters in Unicast ModeMultiple Network Adapters in Multicast ModeCreating an NLB ClusterNew NLB ClusterAdding a Node to an NLB ClusterRemoving a Host from an NLB ClusterPlanning the Capacity of an NLB ClusterProviding Fault ToleranceOptimizing an NLB ClusterServer ClustersServer Cluster ConceptsNetworks (Interconnects)NodesGroupsResourcesTypes of ResourcesPhysical DiskDHCP and WINSPrint SpoolerFile ShareInternet Protocol Address and Network NameLocal QuorumMajority Node SetGeneric ApplicationGeneric ScriptGeneric ServiceVolume Shadow Copy Service TaskDefining Failover and FailbackConfiguring a Server ClusterHigh Availability with Load BalancingMaximum Availability Without Load BalancingPartial Failover (Load Shedding)Virtual Server OnlyPlanning the Capacity of a Server ClusterCreating a Server ClusterNew Server ClusterCreating a Clustered ResourceNew Cluster GroupNew Physical Disk ResourceNew IP Address ResourceNew Network Name ResourceNew File Share ResourceCompute ClustersSummary
20. Managing Storage
Using File Server Resource ManagerSetting Global OptionsScheduling Storage ReportsUsing Quota ManagementQuota ConceptsCreating Quotas and Auto Apply QuotasViewing and Managing QuotasCreating and Editing Quota TemplatesScreening FilesCreating File ScreensCreating ExceptionsCreating and Editing File Screen TemplatesWorking with File GroupsUsing Disk QuotasEnabling Disk QuotasSetting Quota Entries for UsersExporting and Importing Disk QuotasCreating Quota ReportsDistributed File SystemWhat’s New in DFS for Windows Server 2003 R2Concepts and TerminologyNamespace RootsFoldersTargetsDFS ReplicationRequirementsDFS ClientsDFS ServersUsing DFS Without NetBIOS or WINSInstalling DFS Management and DFS ReplicationDFS NamespacesCreating or Opening a Namespace RootAdding Namespace ServersAdding DFS FoldersChanging Advanced SettingsChanging Namespace Referral SettingsOverriding Referral Settings on Individual FoldersDelegating Management PermissionsChanging Namespace Polling SettingsBacking Up and Restoring the DFS Folder TargetsDFS ReplicationCreating a Replication GroupReplicating a DFS FolderCreating a Branch Office Replication GroupCreating a Multipurpose Replication GroupManaging Replication GroupsOverview of Storage Manager For SANsConcepts and TerminologyInstalling Storage Manager For SANsUsing the Storage Manager For SANs ConsoleManaging Server ConnectionsManaging iSCSI TargetsManaging iSCSI SecurityLogging On to iSCSI TargetsCreating and Deploying Logical Units (LUNs)Extending a LUNRemovable StorageConcepts and TerminologyRemovable Devices and LibrariesMedia PoolsRemovable Storage Media IdentificationMedia StatesPhysical StatesSide StatesUse and ManagementManaging LibrariesInventorying LibrariesSetting Door and Inject/Eject Port TimeoutsEnabling and Disabling Individual Drives in a LibraryCleaning LibrariesManaging Media PoolsCreating Media PoolsDeleting Media PoolsManaging Physical MediaInjecting and Ejecting MediaMounting and Dismounting MediaUsing the Work QueueWorking with Operator RequestsRemote StorageConcepts and System RequirementsOverviewProgram CompatibilityData SafetySystem RequirementsSetup and ConfigurationSetting Up Remote StorageSetting Up Additional Volumes with Remote StorageChanging Include/Exclude RulesDisabling Remote Storage for a Managed VolumePerforming Tasks ManuallySetting Recall LimitsData Recovery and ProtectionUnderstanding Data Protection StrategiesSingle Drive StrategiesMultiple Drive StrategiesWorking with Media CopiesRecovering from DisasterSummary
IV. Security
21. Planning for Security
Security BasicsAuthenticationProof of IdentityAuthentication ProtocolsHardware-Enabled AuthenticationMutual AuthenticationSingle Sign-OnData ProtectionData ConfidentialityData IntegrityAccess ControlAuditingNonrepudiationSmart CardsPublic-Key InfrastructuresPublic-Key Encryption vs. Symmetric-Key EncryptionPublic-Key Certificates and Private KeysCertificate AuthoritiesRoot and Subordinate Certificate AuthoritiesChain Verification and TrustCross-Root CertificationCertificate RegistrationCertificate DirectoriesCertificate TemplatesCertificate RevocationCertificate RenewalFull CRLs and Delta CRLsSecurity-Enabled ProtocolsSecure Multipurpose Internet Mail ExtensionsSigned MessagesEncrypted MessagesOther Content TypesKerberos Version 5Windows NT LAN ManagerSecure Sockets LayerInternet Protocol SecurityIPSec Policy ManagementHow IPSec WorksVirtual Private NetworksRemote Access VPNsRouter-to-Router VPNsWindows Rights Management ServicesSecurity ModulesCryptographic Application Programming InterfaceCryptographic Service ProvidersCAPICOMData Protection APISummary
22. Implementing Security
The Security Configuration WizardInstalling the WizardUsing the WizardDeploying the PolicyUsing Templates to Implement Security PoliciesExamining Template PoliciesUsing Predefined TemplatesSecure Security TemplatesHighly Secure Security TemplatesCompatible Security TemplateOut-of-the-Box Security TemplatesModifying a Predefined TemplateDefining New TemplatesApplying TemplatesUsing Security Configuration and AnalysisOpening a Security DatabaseImporting and Exporting TemplatesAnalyzing Security and Viewing the ResultsConfiguring SecurityUsing Windows FirewallEnabling AuthenticationObtaining Smart Cards and CertificatesSetting Up an Enrollment AgentProgramming Smart CardsObtaining Software-Based CertificatesLogging On with Smart CardsEnabling Remote Certificate or Smart Card AuthenticationAuthentication with Certificate on Smart CardAuthentication with Certificate Stored on Local ComputerConfiguring Authentication for a Remote Access ServerImplementing Access ControlEstablishing OwnershipAssigning PermissionsManaging CertificatesExporting Certificates and Private KeysImporting CertificatesRequesting CertificatesEnabling Certificates for Specific PurposesUsing Internet Protocol Security PoliciesDefining IPSec PoliciesUsing Predefined IPSec PoliciesCreating an IPSec PolicyEditing an IPSec PolicyIP Filter ListFilter ActionAuthentication MethodsTunnel SettingConnection TypeAssigning IPSec PoliciesSecuring Local DataCreating a Recovery PolicyEncrypting Files and FoldersDecrypting Files and FoldersSharing Encrypted Files and FoldersRecovering FilesAuditingEstablishing an Audit PolicyAuditing Access to ObjectsViewing the Security LogManipulating the Security LogSecurity Log MaintenanceUsing Microsoft Baseline Security AnalyzerWhat to Do When HackedSummary
23. Patch Management
Why It’s ImportantThe Patching CycleAssessIdentifyEvaluate and PlanDeployRepeatDeployment TestingTest Network DeploymentBeta User DeploymentFull DeploymentObtaining UpdatesAutomatic UpdatesWindows Server Update ServicesInstallationPrerequisitesBasic ConfigurationSystems Management Server 2003Third-Party ProductsSummary
24. Using Microsoft Certificate Services
More VocabularyPolicy ModulesExit ModulesCertificate PublishersCertificate TemplatesCertificate Authority TypesEnterprise CAStandalone CAPreinstallationUnderstanding Certificate Authority RolesEnterprise Root CAEnterprise Subordinate CAStandalone Root CAStandalone Subordinate CAPreparing for InstallationInstallation and ConfigurationThe Certification Authority Snap-InManaging the Certification Authority ServiceStarting and Stopping the CABacking Up the CARestoring the CARenewing the CA CertificateConfiguring the CA’s PropertiesThe Policy Module TabThe Exit Module TabThe Storage TabThe Security TabWorking with Certificate TemplatesSetting Security Permissions and Delegate AccessEnabling AutoenrollmentManaging Revocation and TrustPublishing CRLsDelta CRLsChanging CRL Distribution PointsControlling Which Trusted Certificates Are DistributedManaging Certificate Trust Lists for a Group Policy ObjectManaging Standalone CAsSetting the Default Action for New RequestsChanging Certificate Request StatusThe Certificates Snap-InCAs Linked into a HierarchyRequesting a Certificate if Your Root CA Is OnlineRequesting a Certificate if Your Root CA Is OfflineCommand-Line UtilitiesThe Certsrv ToolThe Certreq ToolThe Certutil ToolSummary
25. Connection Services
How Dial-Up Remote Access WorksUnderstanding Virtual Private NetworksHow VPNs WorkComponents of a VPNCommon Configurations for Remote Access ServersConfiguring a Server for Dial-Up ClientsConfiguring a NAT ServerSetting Remote Access PoliciesUnderstanding the Default PolicyChoosing an Administrative Model for Remote Access PoliciesAdministering Access by UserGranting Access by UserAdministering Access by Policy for a Mixed-Mode DomainGranting or Denying Access by Group Membership for a Mixed DomainAdministering Access by Policy for a Native DomainGranting or Denying Access by Group Membership for a Native DomainConfiguring a Remote Access PolicySpecifying Conditions of Remote Access PoliciesConfiguring Profiles in Remote Access PoliciesSpecifying Dial-In ConstraintsSpecifying IP Address PoliciesEnabling Multilink and the Bandwidth Allocation ProtocolSpecifying Authentication MethodsSpecifying an Encryption MethodSetting Advanced AttributesConfiguring a Remote Access ServerConfiguring a Virtual Private NetworkConfiguring the Internet ConnectionConfiguring the Remote Access Server as a RouterConfiguring PPTP PortsConfiguring PPTP FiltersElements of a Router-to-Router VPN ConnectionVPN ClientsVPN ServersLAN and Remote Access ProtocolsTunneling ProtocolsDemand-Dial InterfacesUser AccountsStatic Routes or Routing ProtocolsSecurity OptionsAdding a Demand-Dial InterfaceSetting Up Static Routes and Routing ProtocolsUsing the Internet Authentication ServiceInstalling and Configuring IASInstalling IASConfiguring IASConfiguring Clients for IASUsing RADIUS for Multiple Remote Access ServersConfiguring a Remote Server for RADIUS AuthenticationConfiguring the Remote Server for RADIUS AccountingConfiguring the IAS Server for RADIUSUsing the RADIUS ProxySummary
26. Implementing Wireless Security
Understanding 802.11 Protocols802.11802.11a802.11b802.11g802.11h802.11i802.11e802.11nEncryption and AuthenticationWPA and WPA2Data EncryptionData IntegrityUser AuthenticationWPA2Deployment ScenariosEnterprise Deployment with 802.1XGuest AccessManaged ClientsUnauthorized Wireless Access PointsSmall and Medium Business Deployment with WPAGuest AccessManaged ClientsUnauthorized Wireless Access PointsSummary
V. Support Services and Features
27. Interoperability
UNIX InteroperabilityPermissions and Security ConceptsA UNIX File ListingSymbolic LinksPrivilege LevelsBasic ConnectivityFile Transfer ProtocolTelnetFile SystemsThe Network File SystemServer Message BlockPrintingMicrosoft Services for NFSConfiguring User Name MappingConnecting to an NFS ShareConfiguring Client for NFSCreating an NFS ShareConfiguring Server for NFSUNIX Identity Management ServicesWindows Subsystem for UNIX-Based ApplicationsMacintosh InteroperabilityNovell Netware InteroperabilitySummary
28. Managing Software
Using the Group Policy Software Installation ExtensionFinding the Right Mix of ServicesNatively Authored Windows Installer PackagesZap FilesRepackaged ApplicationsDeciding Whether to Publish or Assign ApplicationsUpdating Applications Deployed via Group PolicySetting Up the Group Policy Software Installation ExtensionCreating a Software Distribution PointCreating a GPO for Application DeploymentConfiguring the Group Policy Software Installation ExtensionSetting Software Installation OptionsChanging Software Installation Behavior over Slow LinksWorking with PackagesAdding a Package to a Group PolicyChanging Application PropertiesApplying Package UpgradesApplying Package ModificationsRemoving and Redeploying PackagesUsing Software Restriction PoliciesHow Software Restriction Policies WorkCreating Software Restriction PoliciesRemote Installation ServicesHow RIS WorksRIS Requirements and System RecommendationsInstalling RISAdministering RISChanging RIS SettingsChanging Client Group Policy SettingsManaging Operating System ImagesAdding CD-Based ImagesAdding a Windows Server 2003 R2 ImageAdding Unattended Answer Files to Existing ImagesSetting Permissions for ImagesChanging Image PropertiesAdding RIS ToolsUsing Remote Installation PreparationPerforming User InstallationsPrestaging a ClientCreating a Remote Boot DiskPerforming a Remote Operating System InstallationSummary
29. Application Compatibility and Virtual Server
Virtual Server OverviewInstalling Virtual ServerInstalling Internet Information Services for Virtual ServerPerforming the InstallationConfiguring Virtual ServerConfiguring Virtual NetworksConfiguring the Internal NetworkConfiguring External NetworksConfiguring Server PropertiesEnabling Virtual Machine Remote ControlSetting Search PathsCreating Virtual MachinesInitial Configuration of a Virtual MachineConfiguring CD/DVDStarting the Virtual Machine for the First TimeInstalling an Operating SystemInstalling SCSI Shunt DriverUsing Virtual Machine Remote ControlConfiguring Virtual MachinesConfiguring Running Virtual MachinesConfiguring Stopped Virtual MachinesInstalling Virtual Machine AdditionsAdministering Virtual ServerAlternatives to Virtual ServerVirtual PCVMWareSummary
30. Deploying Terminal Services
ConceptsRemote AccessCentral ManagementRequirementsRAMCPUNetwork UtilizationCapacity PlanningInstallationEnabling Remote Desktop for Administration ModeInstalling ProgramsInstall Mode vs. Execute ModeUsing Add/Remove Programs to Install ApplicationsThe Change CommandUsing the Change Command to Install an ApplicationAdministrationTerminal Services ManagerOverviewFinding ServersMaking ConnectionsManaging ConnectionsDisconnecting SessionsResetting SessionsLogging Off a SessionViewing Processes and Other Information About a SessionManaging User SessionsSending a Message to a SessionControlling a SessionConnecting to a SessionTerminal Services ConfigurationConnection PropertiesTerminal Services LicensingInstalling Terminal Server LicensingTo Install Terminal ServicesTo Activate the License ServerTo Install Windows Terminal Server Client Access LicensesRemote Desktop ClientSummary
31. Using the Indexing Service
Understanding the Indexing ServiceDefining TermsHow Indexing WorksPlanning Your Indexing ServiceMerging IndexesSetting the Time to Start a Master MergeManually Merging IndexesSetting Up an Indexing ConsoleCreating and Configuring CatalogsCreating a CatalogConfiguring a CatalogIncluding or Excluding a DirectoryConfiguring the Property CacheAdding a PropertyRunning a Scan of the IndexRegistry Entries for the Indexing ServiceQuerying the IndexCreating Query FormsIndexing a New SiteExamining PerformanceModifying the Indexing Service’s PerformanceUsing Performance MonitorTroubleshooting the Indexing ServiceNo Documents Matched the QueryPDF Files Aren’t IndexedQuery Produces Inconsistent ResultsCatalog Is Reportedly CorruptedIndexing Is Slow and Some Documents Aren’t IndexedSummary
VI. Internet Servers and Services
32. Basics of Internet Information Services
Protocols SupportedHTTPFTPSMTPNNTPOther ProtocolsAdministration ToolsAdding the Application Server RoleInternet Information ServicesRemote AdministrationAdministration ScriptsThe WWW Publishing ServiceThe Default Web SiteConnecting to a Web SiteOther Web SitesUsing the Web Site Creation WizardTesting the New Web SiteVirtual DirectoriesLocal Virtual Directories vs. Remote Virtual DirectoriesThe Virtual Directory Creation WizardWeb SharingVirtual Directories, Physical Directories, and IconsThe FTP Publishing ServiceThe Default FTP SiteOther FTP SitesUsing the FTP Site Creation WizardTesting the New FTP SiteVirtual DirectoriesUsing the Virtual Directory Creation WizardTesting the New Virtual DirectoryBasic Administrative TasksConfiguring PermissionsUnderstanding IIS 6 SecuritySetting PermissionsStopping, Starting, and Pausing IIS ServicesUsing FrontPage Server ExtensionsSummary
33. Advanced Internet Information Services
Server-Level AdministrationConnecting to an IIS ServerCreating Configuration BackupsBacking Up a Server ConfigurationRestoring a Server ConfigurationConfiguring Server PropertiesEditing the MetabaseMetabase HistorySite-Level AdministrationDirectory-Level AdministrationFile-Level AdministrationManaging WWW SitesWeb Site TabWeb Site IdentificationConfiguring Multiple IP Addresses on the Server’s Network CardConfiguring Only One IP Address for the Server’s Network CardConfiguring One IP Address and Leaving the TCP Port Set to DefaultConnectionsIIS LoggingPerformance TabISAPI Filters TabHome Directory TabHome DirectoryAccess PermissionsApplication SettingsDocuments TabDirectory Security TabAnonymous Access and Authentication ControlIP Address and Domain Name RestrictionsSecure CommunicationsHTTP Headers TabContent ExpirationCustom HTTP HeadersContent RatingMIME TypesCustom Errors TabManaging FTP SitesServer-Wide FTP PropertiesConfiguring Individual FTP Site PropertiesFTP Site TabIdentificationCurrent SessionsSecurity Accounts TabMessages TabHome Directory TabAccess PermissionsDirectory Listing StyleDirectory Security TabConfiguring FTP Directory PropertiesManaging NNTP Virtual ServersWhat NNTP Service DoesNNTP Service WizardsNew NNTP Virtual Server WizardNew Virtual Directory WizardNew Expiration Policy WizardNew Newsgroup WizardConfiguring the Default NNTP Virtual ServerThe General TabAccess TabSettings TabSecurity TabManaging NewsgroupsConnecting to the Default NNTP Virtual ServerDisplaying NNTP SessionsRebuilding an NNTP Virtual ServerManaging SMTP Virtual ServersWhat SMTP Service DoesSMTP DirectoriesConfiguring the Default SMTP Virtual ServerGeneral TabIdentificationConnectionsIIS LoggingAccess TabAccess ControlSecure CommunicationConnection ControlRelay RestrictionsMessages TabDelivery TabLDAP Routing TabSecurity TabSMTP DomainsThe New Domain WizardWeb Service ExtensionsRemote AdministrationAdministration Web SiteEnabling Remote AdministrationTesting Remote AdministrationSummary
34. Internet Security and Acceleration Server 2004
ConceptsNetwork Address TranslationPacket Filtering and Application Layer FilteringCachingClient TypesInstallation and ConfigurationSystem RequirementsInstallationSecuring Your ISA 2004 ServerInitial Configuration of ISA Server 2004Defining Your ISA 2004 Network TopologyCreate Firewall Policy RulesDefine Caching RulesAdditional Configuration TasksDefine VPN AccessSetup MonitoringPublishing Servers (Reverse Proxy)Additional ConfigurationThe ToolboxDefining Network EntitiesDefining UsersISA Firewall ClientImport, Export, Backup, and RestoreSummary
VII. Tuning, Maintenance, and Repair
35. Performance Monitoring and Tuning
Documenting the Network, Policies, and ProceduresDocumenting the NetworkEvaluating Policies and ProceduresSelecting a Monitoring MethodDetermining How Often to MonitorMonitoring Memory UsageMonitoring Processor ActivityMonitoring Disk ActivityMonitoring Network ActivityUsing Event ViewerEvent Log FilesComponents of an EventThe Event HeaderThe Event DescriptionViewing an Event Log on Another ComputerChanging Event Log SettingsArchiving an Event LogUsing the Microsoft Windows Server 2003 Performance AdvisorOverviewRecording and Viewing DataMonitoring Multiple ServersUsing System MonitorAdding CountersMatching Counters to Graph LinesModifying the DisplayChoosing the Sampling IntervalChanging Grid Lines and Graph ScalesPerformance Logs and AlertsCreating Counter and Trace LogsSaving Log and Alert File SettingsUsing AlertsUsing Network MonitorCapturing FramesViewing the Capture WindowViewing the Frame Viewer WindowConfiguring and Customizing Network MonitorModifying the Capture BufferEditing the Address DatabaseAdding a Comment Frame to a CapturePrinting Captured FramesDesigning a Capture FilterSpecifying Capture Filter ProtocolsSpecifying Address PairsDefining Pattern MatchesDesigning a Display FilterSetting a Capture TriggerMemory and Network TuningChanging File System Cache SettingsOptimizing the Page FileTuning Network PerformanceSummary
36. Disaster Planning
Planning for DisasterIdentifying the RisksIdentifying the ResourcesDeveloping the ResponsesStandard Operating ProceduresStandard Escalation ProceduresTesting the ResponsesIteratingPreparing for a DisasterSetting Up a Fault-Tolerant SystemBacking Up the SystemCreating Automated System Recovery DisksCreating a Boot DiskInstalling the Recovery ConsoleSpecifying Recovery OptionsCreating and Using a Recovery DriveSummary
37. Using Backup
Selecting a Backup MediumUsing Removable StorageBacking Up to FilesUsing CD-ROMsDeveloping a Backup StrategyThe Backup WindowBackup TypesNormal BackupIncremental BackupDifferential BackupDaily BackupCopy BackupMedia RotationBacking Up DataUsing Windows Server 2003 BackupCreating Selection ScriptsAccessing Files and Folders for BackupSelecting the Storage MediumConfiguring Backup OptionsLogging BackupsExcluding FilesRunning a JobScheduling a JobUsing the Windows Server 2003 Backup WizardExecuting Jobs from the Command LineRestoring DataSelecting Files to Be RestoredSelecting Destinations for Restored FilesSetting Restore OptionsPlanning for FailureBacking Up the System StateHandling Backup and Restore ProblemsBacking Up Exchange ServersBacking Up Encrypted FilesRestoring the System StateDirectory Services Restore ModeAuthoritative RestoreNtdsutilPreserving NTFS PermissionsThird-Party Backup UtilitiesSummary
38. Planning Fault Tolerance and Avoidance
Mean Time to Failure and Mean Time to RecoverProtecting the Power SupplyLocal Power Supply FailureVoltage VariationsSpikesSurgesSagsBrownoutsShort-Term Power OutagesLong-Term Power OutagesDisk ArraysHardware vs. SoftwareRAID Levels for Fault ToleranceIntended UseFault ToleranceAvailabilityPerformanceCostHot-Swap and Hot-Spare Disk SystemsDistributed File SystemClusteringNetwork Load BalancingServer ClustersSummary
39. Using the Registry
Introducing the RegistryThe Origins of the RegistryWhat Registry Data Is Used ForUnderstanding the Registry’s StructureThe Root KeysMajor SubkeysHKLM\HARDWAREHKLM\SAMHKLM\SECURITYHKLM\SOFTWAREHKLM\Software\Wow6432NodeHKLM\SYSTEM\CurrentControlSetHKLM\SYSTEM\MountedDevicesHow Data Is StoredUseful Data TypesVolatile KeysDisk-Based KeysWhere Data Goes on DiskUsing the Registry EditorsA Whirlwind Tour of the Registry EditorSearching for Keys and ValuesEditing Value ContentsAdding and Removing Keys and ValuesImporting and Exporting Registry DataLoading and Unloading HivesConnecting to a Remote Machine’s RegistryRenaming Keys and ValuesManaging Security on Registry KeysA Whirlwind Tour of RegBacking Up and Restoring the RegistryChoosing a Backup MethodBackup UtilityThird-Party ProductsDo-It-Yourself BackupsBacking Up the RegistryUsing the Backup UtilityAutomated System RecoverySummary
40. Troubleshooting and Recovery
Triaging the SituationPerforming a System RecoveryIdentifying Possible CausesUsing the Last Known Good ConfigurationUsing Safe ModeUsing a Boot Disk to Recover the SystemBooting from Mirrored Boot PartitionsPerforming an In-Place UpgradeUsing the Automated System Recovery ProcessFixing the Underlying ProblemRolling Back Recently Installed DriversUsing Help And Support to Gather Basic InformationUsing System Information to Gather Advanced InformationChecking ServicesUsing the System Configuration UtilityUsing the System File CheckerRestoring from a BackupReinstalling WindowsEmergency Management Services and Headless ServersEMS OverviewHardware and Software RequirementsSetting Up EMSConfiguring the Firmware for EMSManually Installing Windows on a Headless ServerInstalling Windows Using RIS on a Headless ServerInstalling Windows Using an Answer File on a Headless ServerEnabling EMS during Windows UpgradesEnabling EMS after SetupUsing EMS for Out-of-Band AdministrationMiscellaneous ChallengesUsing the Shutdown Event TrackerAdding a Processor to the SystemTroubleshooting Shutdown ProblemsUninstalling WindowsSummary
VIII. Appendixes
A. Interface Changes from Windows 2000 Server
B. Interface Changes from Windows NT 4
Clipboard ViewerCompression AgentComputers Near MeDevicesDial-Up NetworkingDisk AdministratorFindMS-DOS PromptMy BriefcaseMy DocumentsNetwork NeighborhoodPersonalized MenusStart MenuSystem InformationTCP/IPUser ManagerUser Manager for DomainsView OptionsWindows NT Explorer
C. Optional Components
Accessories and UtilitiesAccessibility WizardAccessoriesCommunicationsActive Directory ServicesApplication ServerCertificate ServicesDistributed File System (DFS)E-mail ServicesFax ServicesIndexing ServiceInternet Explorer Enhanced Security ConfigurationManagement and Monitoring ToolsMicrosoft .NET Framework 2.0Networking ServicesOther Network File and Print ServicesRemote Installation ServicesRemote StorageSecurity Configuration WizardSubsystem for UNIX-Based ApplicationsTerminal ServerTerminal Server LicensingUDDI ServicesUpdate Root CertificatesWindows Media ServicesWindows SharePoint Services
D. Using the Microsoft Windows Server 2003 Recovery Console
Recovery Console LimitationsStarting the Recovery ConsoleUsing Recovery Console Commands
E. Using the Microsoft Windows Server 2003 Support Tools
Glossary
F. About the Authors
G. Microsoft Press Support Information
H. Additional Windows (R2) Resources for Administrators
I. Additional SQL Server Resources for Administrators
Index
About the Authors
Copyright

Overview

Get the ideal one-volume guide for the IT professional who administers Windows Server 2003. Now fully updated for Windows Server 2003 with Service Pack 1 (SP1) and Windows Server 2003 R2, this ADMINISTRATOR’S COMPANION offers up-to-date information on core system administration topics for Microsoft Windows®, including Microsoft Active Directory® directory service, security issues, disaster planning and recovery, and interoperability with Novell NetWare and UNIX. It includes all-new sections on SP1 security updates and new features for R2. Featuring easy-to-use procedures and handy workarounds, this book provides ready answers, practical solutions, and clear procedures for on-the-job results.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Windows Server® 2008 Administrator’s Companion

Publisher Resources

ISBN: 0735620474Errata

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills