This document discusses planning a secure Windows Server 2003 network. It covers selecting server and desktop computers, operating systems, and security features. Some key points include categorizing computers by role, standardizing hardware, selecting an operating system based on applications and costs, and configuring security permissions for files, folders, and the registry. Domain controllers require additional security as the failure of one could disrupt the whole network. The document also discusses infrastructure servers like DNS and DHCP and how to secure them.

1. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 1 of 38
Session 9
Planning a Secure
Baseline Installation

2. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 2 of 38
 Windows Server 2003 provides two tools to
analyze the server performance:
 Performance Console
 Network Monitor
 The types of counter logs are:
 trace
 counter
 Alert
Review

3. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 3 of 38
Review Contd…
 Two filters provided by the Network monitor are
 Capture Filter
 Display Filter
 Network services are applications that always run in the
background
 Four services that enable us to monitor the network
server are:
 DHCP
 DNS
 WINS
 Routing and Remote Access

4. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 4 of 38
Review Contd…
 DNS server hosts the information that enables
client computers to resolve memorable,
alphanumeric DNS names to the IP addresses that
computers use to communicate with each other
 WINS uses a distributed database that is
automatically updated with the names of computers
currently available and the IP address assigned to
each one

5. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 5 of 38
Objectives
 Select Computers on a Network
 Select Operating System in Network
 Discuss security issues
 Set permissions
 Work with Group Policy Object
 Explain domain controller
 Secure servers

6. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 6 of 38
Selecting Computers in a
Network
 Each machine in a network performs a certain
role
 Standardizing the hardware and software
depending on the roles of computer in the network
enables:
 Administration of several computers manageable in a
network
 Easier to troubleshoot the network
 Computers in a network are classified as:
 Server
 Desktop Workstation
 Portable Workstation

7. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 7 of 38
Server
 Server is a centralized computer in a network which
performs different roles on a network
 Server is a computer having a faster processor,
larger memory size, and hard disk space
 Depending on the roles servers on a network are
classified as follows:
 Backup server
 Database server
 Domain Controller
 Web server
 E-mail server
 File and Print server
 Infrastructure server

8. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 8 of 38
Hardware Specifications for
the Server
 Depends on the requirements and capabilities of
the applications that will be running on the server
 Computers designed to be a server usually have
more robust power supplies than personal
computers or workstations

9. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 9 of 38
Desktop
 Desktop workstation can have a wide range of
roles ranging from simple systems designed to
run one or two small applications to high-
powered computers performing complex
graphics, video and computer-aided functions
 Workstation may work without CD-ROM and
floppy disk drives. Such workstation cannot
install their own applications.

10. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 10 of 38
Hardware Specifications for
the Desktop
 While designing the hardware
specifications for a desktop workstation,
the objective is to create hardware
specifications suitable for a wide variety
of jobs

11. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 11 of 38
Selecting Operating System
 While selecting the operating system in a
network, we must match up it with the hardware
specifications
 Some of the important factors are as follows:
 Application Compatibility
 Support issues
 Security features
 Cost

12. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 12 of 38
Security Design Team
 Security team must be a well balanced team consisting
of people from technical, management, and financial
backgrounds
 Security team should consider the following issues:
 Identifying the most valuable resources
 Identifying danger to the resources
 Significant resources
 Analyzing different security resources available
 Deciding the security features
 Impact of the security features on the administrator, managers,
and the users

13. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 13 of 38
Security Life Cycle
 The security life cycle consists of the following:
 Security Infrastructure
 Access Control
 Auditing
 Authentication
 Encryption
 Firewalls
 Implementation of security features
 Security Management

14. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 14 of 38
Managing Security
 Managing the security in a network is
continuous process
 Network must after a certain period of time the
network according to the latest technology
available
 Administrator must monitor the user accounts
 Network traffics must be maintained
 If several users on a network try to access the
network, sometimes the network may crash due
to heavy traffic

15. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 15 of 38
Modifying Permissions of a File
or Folder
 We can set different
permissions for a file
 File permissions serve
as an important security
tool on a network

16. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 16 of 38
Sharing File Permissions
 We can assign permissions
to the desired group or users
 When the Windows 2003
operating system is installed,
the windows share program
creates administrative share
by default

17. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 17 of 38
Registry Permissions
 Registry gets modified when
we install different
applications
 Registry also gets modified if
we configure the operating
system
 We can also manually edit this
registry
 Administrator has the rights to
modify the contents of the
registry

18. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 18 of 38
Group Policy Object
 Group policy Object enables us
to configure the security
parameters
 It performs the functions such as
distributing new software for
configuring system settings and
remapping directories
 Group Policy Object is
associated with an Active
Directory container object

19. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 19 of 38
Event Log
 Event log enables us to control the log
performance

20. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 20 of 38
System Services
 Certain programs are
continuously running at
the background
 Windows 2003 assigns
default values to the
services

21. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 21 of 38
Domain Controller
 Requires more security, as the failure of domain
controller may be a disaster to the network
 Performs the following functions:
 Provides authentication
 Stores group policies
 Distributes group policies
 To provide security these domain controllers must be in
a secured location
 We must provide a password for domain controller, so
that unauthorized users will not get access to the domain
controller

22. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 22 of 38
Debug Programs
 Debug Programs provides a
debugging tool
 This tool enables the software
developers to debug
applications during process of
creating
 It enables us to access any
process on the computer. We
can even access the kernel of
the operating system.

23. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 23 of 38
Services for a Domain
Controller
 Domain controller requires additional
services along with the member services
 These services are as follows:
 Distributed file system
 File replication service
 Intersite messaging
 Kerberos key distribution center
 Remote procedure call locator

24. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 24 of 38
Adding Workstations to the
Domain
 Authenticated users have the rights to add
computers to the domain up to 10 ten
computers to an Active Directory

25. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 25 of 38
Allow Log On Locally
 Facilitates users and groups to log on
the computer from the console
 Users having this right also have the
right to access some of the important
operating system elements

26. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 26 of 38
Shut Down the Domain
Controller
 It is necessary to carefully shut down the
system as this would affect the systems over
the network
 Default Domain Controller grants this right to
the following groups:
 Administrators
 Backup operators
 Print operators
 Server operators

27. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 27 of 38
Securing Infrastructure
Servers
 Infrastructure servers are the computers that run
network support services such as, DNS, DHCP, and
Windows Internet Name Service.
 Services that we must include using the automatic
startup type are as follow:
 DHCP server
 DNS server
 NT LM security support provider
 Windows internet name service

28. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 28 of 38
Configuring DNS Security
 DHCP servers centrally manage IP
addresses and related information and
provide it to clients automatically
 If you want this computer to distribute IP
addresses to clients, then configure this
computer as a DHCP server

29. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 29 of 38
Protecting Active Directory-
Integrated DNS
 When we create Active Directory-
integrated zones on the DNS server, the
zone database is stored as part of the
Active Directory database
 Groups such as, DnsAdmins, Domain
Admins, and Enterprise Admins groups
have full permission for the MicrosoftDNS
container

30. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 30 of 38
Protecting DNS Database
Files
 Active Directory does not have all the DNS
zones integrated. For such DNS zones the
zone databases are simple text files.
 System creates DNS logs files
 There are no file system permissions to
maintain the DNS zone databases using the
DNS zone databases using the DNS console
or for accessing DNS server information
using a client

31. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 31 of 38
Configuring DHCP Security
 Several techniques can be used against
denial of service attacks, they are as
follows:
 Use the 80/20 address allocation method
 Create a DHCP server cluster

32. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 32 of 38
Monitoring DHCP Activity
 We are able to monitor the activity of a DHCP
sever with the help of different tools
 Performance console and Network Monitor tools
enables to monitor the activity of the DHCP
server
 Windows 2003 server operating system directly
integrates the DHCP audit log facility. We can
enable DHCP audit logging using group policies.

33. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 33 of 38
Summary
 We can categorize the computers in a network as
follows:
 Server
 Desktop workstation
 Portable workstation
 While selecting the operating systems consider
the following:
 Application compatibility
 Support issues
 Security features
 Cost

34. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 34 of 38
Summary Contd…
 The security team should identify the
following issues:
 Identify the most valuable resources
 Identify danger to the resources
 Analyze different security resources
available
 Decide the security features
 Impact of the security features on the
administrator, managers, and the users

35. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 35 of 38
Summary Contd…
 File permissions serve as an important
security tool on a network. Suppose that an
organization stores the information of a
customer in a particular file.
 Registry of windows gets modified when we
install different applications. It also gets
modified if we configure the operating system.

36. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 36 of 38
Summary Contd…
 Group policy Object enables us to configure
the security parameters
 We can configure the Windows Server 2003
operating system to audit the events
 Active directory permission enables us to
modify the permissions for accessing and
managing objects in the Active Directory
database

37. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 37 of 38
Summary Contd…
 Most important server on the windows 2003
server operating system using the active
Directory is the domain controllers
 Domain controller requires more security, as
the failure of domain controller may be a
disaster to the network

38. Microsoft Windows Server 2003 Network Infrastructure – Planning and Maintenance/ Session 9 / Slide 38 of 38
Summary Contd…
 Authenticated users have the rights to add
computers to the domain. They can add up to
10 ten computers to an Active Directory
 Infrastructure servers are the computers that
run network support services such as, DNS,
DHCP, and Windows Internet Name Service