This document discusses several topics related to deploying and securing a branch office network using Windows Server 2008, including: 1. Deploying a branch office server and configuring DNS, Active Directory, and file services. 2. Improving security through technologies like Read-Only Domain Controllers, Windows Firewall, IPSec, and BitLocker Drive Encryption. 3. Enforcing security policies and monitoring network access using Network Access Protection.

1. Module 3 Windows Server 2008 Branch Office Scenario

2. Clinic Outline Branch Office Server Deployment and Administration Branch Office Security Branch Corp RODC

3. Branch Office Server Deployment and Administration

4. Domain Name System (DNS) Server Role Background zone loading Read-only domain controller support Global Names zone DNS client changes Link-Local multicast name resolution (LLMNR) Domain controller location

5. AD Domain Services New AD MMC Snap-In Features Find Command New Options for Unattended Installs

6. Restartable AD Domain Services (AD DS) 3 Possible States: AD DS Started AD DS Stopped Active Directory Restore Mode

7. Demonstration: Branch Office Server Deployment and Administration AD DS Installation Wizard Stopping and restarting AD DS

8. AD Domain Services Auditing What changes have been made to AD DS auditing?

9. AD Domain Services Backup and Recovery Considerations What’s New? General Requirements

10. Improved Server Deployment (Windows Server Virtualization) Addresses the following challenges: Server Consolidation Development and Testing Business Continuity/Disaster Recovery 64-bit Next Generation technology Server Core as a host system

11. File Services DFS Names Spaces Replication SYSVOL Server Message Block (SMB) 2.0

12. Next Generation TCP/IP Stack Receive Windows Auto-Tuning Compound TCP Throughput Optimization in High-Loss Environments Neighbor Unreachability Detection Changes in Dead Gateway Detection Changes in PTMU Black Hole Router Detection Routing Compartments ESTATS Support Network Diagnostics Framework Support New Packet Filtering Model with Windows Filtering Platform

13. Read-Only Domain Controller (RODC) New Functionality AD Database Unidirectional Replication Credential Caching Password Replication Policy Administrator Role Separation Read-Only DNS Requirements/Special Considerations RODC

14. Read-only DC, RODC 管理員的處置方式 入侵者看到的資訊

15. Implementation/Usage Scenarios Maintain physical security of data at the branch office Maintain physical security of servers at the branch office Provide secure IP-based communications with the branch office Control which computers can communicate on the branch office network

16. Recommendations Implement a Password Replication Policy Deploy a Read-Only Domain Controller at the branch office Implement administrator role separation Implement BitLocker Drive Encryption; do not require a PIN or USB device if no local admin Implement Network Access Protection Use IPSec for network communications

17. Module 4 Security and Policy Enforcement in Windows Server 2008

18. Overview Methods of Security and Policy Enforcement Network Location Awareness Network Access Protection Windows Firewall with Advanced Security (WFAS) Internet Protocol Security (IPSec) Windows Server Hardening Server and Domain Isolation Active Directory Domain Services Auditing Read-Only Domain Controller (RODC) BitLocker Drive Encryption Removable Device Installation Control Enterprise PKI

19. Technical Background Windows Firewall with Advanced Security Internet Security Protocol (IPSec) Active Directory Domain Services Auditing Read-Only Domain Controller (RODC) Enterprise PKI BitLocker Drive Encryption

20. Windows Firewall with Advanced Security

21. Demonstration: Windows Firewall with Advanced Security Creating Inbound and Outbound Rules Creating a Firewall Rule Limiting a Service

22. IPSec Integrated with WFAS IPSec Improvements Simplified IPSec Policy Configuration Client-to-DC IPSec Protection Improved Load Balancing and Clustering Server Support Improved IPSec Authentication Integration with NAP Multiple Authentication Methods New Cryptographic Support Integrated IPv4 and IPv6 Support Extended Events and Performance Monitor Counters Network Diagnostics Framework Support

23. BitLocker Drive Encryption (BDE) Data Protection Drive Encryption Integrity Checking BDE Hardware and Software Requirements

24. Implementation/Usage Scenarios Enforce Security Policy Improve Domain Security Improve System Security Improve Network Communications Security

25. Recommendations Implement Network Access Protection Use Windows Firewall and Advanced Security to implement IPSec Deploy Read-Only Domain Controllers, where appropriate Implement BitLocker Drive Encryption Carefully test and plan all security policies Take advantage of PKI improvements

26. Network Access Protection in Windows Server 2008

27. Overview Network Access Protection Net work Access Protection Network Access Quarantine Control Internal, VPN and Remote Access Client Only VPN and Remote Access Clients IPSec, 802.1X, DHCP and VPN DHCP and VPN NAP NPS and Client included in Windows Server 2008 ; NAP client included in Vista Installed from Windows Server 2003 Resource Kit

28. NAP Infrastructure Health Policy Validation Health Policy Compliance Automatic Remediation Limited Access

29. NAP Enforcement Client 802.1X VPN IPSec DHCP NPS RADIUS

30. Demonstration: Network Access Protection Create a NAP Policy Using the MMC to Create NAP Configuration settings Create a new RADIUS Client Create a new System Health Validator for Windows Vista and Windows XP SP2

31. Implementation/Usage Scenarios Ensuring the Health of Corporate Desktops Checking the Health and Status of Roaming Laptops Determining the Health of Visiting Laptops Verify the Compliance of Home Computers

32. Recommendations Carefully test and verify all IPSec Policies Use Quality of Service to improve bandwidth When using IPSec – employ ESP with encryption Plan to Prioritize traffic on the network Apply Network Access Protection to secure client computers Consider Using Domain Isolation