CONFIGURING WINDOWS 2000 WITHOUT ACTIVE DIRECTORY
CONTENTS CHAPTER 1 WHY NOT ACTIVE DIRECTORY? INTRODUCTION WHY USE WINDOWS 2000 WITHOUT ACTIVE DIRECTORY? WHY USE WINDOWS 2000? THE ACCEPTANCE OF WINDOWS INTO THE CORPORATE WORKPLACE THE ACCEPTANCE OF MICROSOFT IN THE CORPORATE WORKPLACE THE EMERGENCE OF WINDOWS WINDOWS 2000 TRACK RECORD WINDOWS 2000 TODAY WHY NOT USE ACTIVE DIRECTORY? DESIGNING AND DEPLOYING ACTIVE DIRECTORY: MORE THAN A TECHNICAL CHALLENGE THE PURPOSE OF THIS BOOK WHO SHOULD READ THIS BOOK IT MANAGERS IT IMPLEMENTERS WHAT THIS BOOK WILL COVER CHAPTER 2:WORKSTATIONS CHAPTER 3: LAPTOPS CHAPTER 4: FILE AND PRINT SERVICES CHAPTER 5:TERMINAL SERVICES CHAPTER 6: NETWORKING SERVICES— DNS, DHCP,WINS, NLB CHAPTER 7: INTERNET SERVICES— IIS5 AND CERTIFICATE SERVICES CHAPTER 8: SECURE COMMUNICATION—IPSEC CHAPTER 9: REMOTE ACCESS— RAS,VPN, IAS, AND CMAK CHAPTER 10: INTERNET CONNECTIVITY— ICS, NAT, AND ISA SERVER APPENDIX A:THE WINDOWS MICROSOFT MANAGEMENT CONSOLE WHAT THIS BOOK WON’T COVER EXCHANGE 2000 AND OTHER ACTIVE DIRECTORY DEPENDENT APPLICATIONS INTELLIMIRROR FEATURES ENTERPRISE RELATED GROUP POLICY OBJECTS QUICK RESOURCE SEARCHES ACROSS THE ENTERPRISE NETWORK, WITH THE ABILITY TO EXTEND THE SCHEMA UNIVERSAL GROUPS, GROUP NESTING, AND CHANGES IN GROUP MEMBERSHIP TASK DELEGATION KERBEROS RATHER THAN NTLM AUTHENTICATION AUTOMATIC TRANSITIVE TRUSTS MULTIMASTER DOMAIN CONTROLLERS ENTERPRISE ENCRYPTING FILE SYSTEM (EFS) RECOVERY AGENTS ENTERPRISE CERTIFICATE AUTHORITIES QUALITY OF SERVICE ACTIVE DIRECTORY INTEGRATION MIGRATING NETWORKS FRACTIONAL NETWORKS DANGERS OF FRACTIONAL NETWORKS RUNNING ACTIVE DIRECTORY EXTERNAL NETWORKS WALKTHROUGH: MANAGING USER ACCOUNTS AND SECURING THE LOCAL ADMINISTRATOR ACCOUNT SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 WORKSTATIONS USING LOCAL GROUP POLICY GROUP POLICY OBJECTS LOCATING LOCAL GROUP POLICY LOCAL SECURITY POLICY COMPLETE LOCAL GROUP POLICY SETTINGS CONFIGURING LOCAL GROUP POLICY USEFUL GROUP POLICY OBJECTS COMPUTER STARTUP/SHUTDOWN AND USER LOGON/LOGOFF SCRIPTS PASSWORD OPTIONS INTERNET EXPLORER SETTINGS DISABLING INSTALLATION FROM REMOVABLE MEDIA CONTROLLING ACCESS TO CONTROL PANEL AND COMPONENTS SCREEN SAVER OPTIONS DISABLING THE COMMAND PROMPT, DISABLING THE REGISTRY EDITOR, RUNNING ONLY SPECIFIED WINDOWS APPLICATIONS DEPLOYING LOCAL GROUP POLICY OBJECTS SECURITY CONFIGURATION USING TEMPLATES SECURITY TEMPLATES DEFAULT SECURITY TEMPLATE SECURE SECURITY TEMPLATE HIGHLY SECURE TEMPLATE COMPATIBLE TEMPLATE OUT OF THE BOX TEMPLATES VIEWING AND MODIFYING TEMPLATES VIEWING TEMPLATE SETTINGS MODIFYING TEMPLATE SETTINGS APPLYING TEMPLATES SECURITY CONFIGURATION AND ANALYSIS CONFIGURE COMPUTER NOW ANALYZE COMPUTER NOW DEPLOYING SECURITY TEMPLATES AUTOMATICALLY WITH SECEDIT SECEDIT /CONFIGURE OPTIONS IMPROVEMENTS IN SYSTEM RELIABILITY DEVICE DRIVER SIGNING DRIVER SIGNING OPTIONS DRIVER SIGNING VERIFICATION WINDOWS FILE PROTECTION AND SYSTEM FILE CHECKER HOW WINDOWS FILE PROTECTION AND SYSTEM FILE CHECKER WORK WFP CONFIGURATION OPTIONS WFP LIMITATIONS SERVICE PACK APPLICATION SLIP-STREAMING SERVICE PACKS LIMITATIONS OF SERVICE PACKS IMPROVEMENTS IN USABILITY DESKTOP CHANGES PERSONALIZED MENUS START MENU SETTINGS DISPLAY OPTIONS FOLDER OPTIONS HARDWARE SUPPORT WIZARDS AND HELP WIZARDS HELP WALKTHROUGH: CONFIGURING LOCAL GROUP POLICY CHAPTER 3 LAPTOPS INTEGRATING MOBILE COMPUTING WITH THE CORPORATE NETWORK SWITCHING BETWEEN WORKING ENVIRONMENTS POWER MANAGEMENT AND PRESERVATION OFFLINE FILES AND SYNCHRONIZING DATA DIALUP ACCESS SECURING DATA OUTSIDE THE COMPANY ENVIRONMENT ENCRYPTING FOLDERS AND FILES LIMITATIONS AND CONSIDERATIONS WHEN USING EFS DISABLING EFS REMOTE ACCESS SECURITY MOBILE MAINTENANCE AND TROUBLESHOOTING SAFE MODE AND THE RECOVERY CONSOLE USING THE RECOVERY CONSOLE TASK SCHEDULER CONFIGURING SCHEDULED TASKS TASK MANAGER WALKTHROUGH: USING OFFLINE FILES CHAPTER 4 FILE AND PRINT SERVICES SHARING DATA: STORING AND RETRIEVING DISTRIBUTED FILE SYSTEM (DFS) CONFIGURING DFS VOLUME MOUNT POINTS CONFIGURING MOUNTED DRIVES CONFIGURING INDEX CATALOGS SHARING PRINTERS: INSTALLING AND MANAGING STANDARD TCP/IP PORT MONITOR IP PRINTING PRINTING PERMISSIONS OVER THE INTERNET BETTER MONITORING USER OPTIONS MANAGING SERVERS DISK MANAGEMENT USING THE DISK MANAGEMENT UTILITY DATA MANAGEMENT REMOTE STORAGE WINDOWS 2000 BACKUP UTILITY DISK QUOTAS CONFIGURING DISK QUOTAS MONITORING COUNTER LOGS ALERTS TRACE LOGS USING PERFORMANCE DATA AUDITING EVENTS AND THE SECURITY LOG AUDITING THE REGISTRY AUDITING ADMINISTRATIVE ACTIONS CONFIGURING COUNTER AND ALERT LOGS CONFIGURING AND USING THE EVENT LOGS WALKTHROUGH: SETTING AN AUDIT POLICY CHAPTER 5 TERMINAL SERVICES WHY USE WINDOWS 2000 TERMINAL SERVICES? FAST CONNECTIONS OVER LOW BANDWIDTHS REMOTE ADMINISTRATION REMOTE ADMINISTRATION USING TERMINAL SERVICES TERMINAL SERVICES REMOTE MANAGEMENT LIMITATIONS RECOVERING FROM DISCONNECTED SESSIONS TIGHTER SECURITY USING THE APPLICATION SECURITY TOOL SHADOWING USERS SEAMLESS INTEGRATION BETWEEN PC AND SERVER CLIPBOARD COPY AND PASTE DRIVE MAPPINGS LOCAL PRINTER SUPPORT PROFILES HOME DIRECTORIES MULTILANGUAGE SUPPORT PREINSTALLATION CONSIDERATIONS LICENSING INSTALLING TERMINAL SERVICES LICENSING HOW TERMINAL SERVICE LICENSING WORKS ACTIVATING A TERMINAL SERVICES LICENSE SERVER UPGRADING FROM TSE UNATTENDED INSTALLATIONS APPLICATION SUITABILITY CAPACITY AND SCALING LIMITATIONS CONFIGURING AND MANAGING WINDOWS TERMINAL SERVICES CONFIGURING CLIENTS TO USE TERMINAL SERVICES TERMINAL SERVICES CLIENT TERMINAL SERVICES ADVANCED CLIENT AUTOMATING TERMINAL SERVICES CLIENT SETUP USING TSAC AS A DIAGNOSTIC UTILITY WALKTHROUGH: REMOTELY ADMINISTERING A WINDOWS 2000 SERVER WITH TERMINAL SERVICES CHAPTER 6 NETWORKING SERVICES NAME RESOLUTION WITH DNS DO YOU NEED TO RUN DNS? ADVANTAGES OF MICROSOFT’S WINDOWS DNS DYNAMIC UPDATES WINS INTEGRATION SERVICE RECORDS UNICODE AND THE UNDERSCORE INCREMENTAL TRANSFERS EASY TO USE GUI ADMINISTRATION INTEGRATING MICROSOFT DNS AND UNIX DNS SERVER ROLES AND ZONES TRANSFERRING ZONES IMPORTING ZONE FILES DHCP FOR CENTRAL CONFIGURATION AND CONTROL OF ADDRESSES TCP/IP CONFIGURATION OPTIONS VENDOR AND USER CLASS OPTIONS BOOTP AND MULTICAST SCOPES AUTOMATIC PRIVATE IP ADDRESSING (APIPA) SUPERSCOPES MULTINETS SERVER CONSOLIDATION MIGRATING USERS FROM ONE SCOPE TO ANOTHER (ADDRESS REALLOCATION) NAME RESOLUTION WITH WINS IMPROVED WINS MANAGER DATA INTEGRITY BACKUP POLICY CONTROLLING REPLICATION PARTNERS REPLICATION POLICY REMOVING OLD MAPPINGS DATABASE VERIFICATION HIGH PERFORMANCE BURST MODE HANDLING PERSISTENT CONNECTIONS HIGH AVAILABILITY WITH NETWORK LOAD BALANCING (NLB) NETWORK LOAD BALANCING COMPONENTS ADDRESSES AND PRIORITIES PORT RULES THE WLBS COMMAND LINE UTILITY CONFIGURING NETWORK LOAD BALANCING CONFIGURING CLUSTER PARAMETERS CONFIGURING HOST PARAMETERS CONFIGURING PORT RULES MONITORING AND ADMINISTERING NETWORK LOAD BALANCING WALKTHROUGH: CONFIGURING DNS PRIMARY AND SECONDARY ZONES CHAPTER 7 INTERNET SERVICES IMPROVEMENTS IN RELIABILITY APPLICATION PROTECTION SETTING APPLICATION PROTECTION IISRESET RESTARTING IIS FROM THE INTERNET INFORMATION SERVICES SNAP-IN RESTARTING IIS USING THE COMMAND LINE ADDITIONAL CONTROL WHEN STOPPING IIS SERVICES BACKUP/RESTORE CONFIGURATION LIMITATIONS OF BACKUP/RESTORE CONFIGURATION FTP RESTART LIMITATIONS OF FTP RESTART IMPROVEMENTS IN ADMINISTRATION AND MANAGEMENT WIZARDS AND TOOLS SECURITY SETTINGS PERMISSION WIZARD WINDOWS 2000 INTERNET SERVER SECURITY CONFIGURATION TOOL CERTIFICATE WIZARD AND CERTIFICATE TRUST LISTS WIZARD IIS MIGRATION WIZARD IMPROVED LOGGING FOR PROCESS ACCOUNTING IMPROVED REMOTE ADMINISTRATION WEB SITE OPERATORS IMPROVEMENTS IN SECURITY WINDOWS INTEGRATED DIGEST FORTEZZA IMPROVEMENTS IN PERFORMANCE HTTP COMPRESSION CONFIGURING HTTP COMPRESSION ASP IMPROVEMENTS BANDWIDTH THROTTLING CONFIGURING BANDWIDTH THROTTLING PROCESS THROTTLING SOCKET POOLING DOCUMENT COLLABORATION WITH WEBDAV USING WEBDAV CERTIFICATE SERVICES CERTIFICATE AUTHORITIES AND ROLES INSTALLING AND CONFIGURING A STANDALONE CA SERVER CERTIFICATES INSTALLING THE WEB SERVER’S CERTIFICATE OFFLINE WITH A STANDALONE CA HOW USERS REQUEST AND MANAGE CERTIFICATES USING SECURE COMMUNICATION (SSL) ON THE WEB SERVER CLIENT CERTIFICATE MAPPING CONFIGURING ONE-TO-ONE ACCOUNT MAPPINGS CONFIGURING MANY-TO-ONE ACCOUNT MAPPINGS WALKTHROUGH: CONFIGURING MULTIPLE WEB SITES ON A SINGLE WEB SERVER CHAPTER 8 SECURE COMMUNICATION IPSEC PLANNING—WORKING OUT WHAT YOU WANT TO SECURE AND HOW PASSWORD BASED CERTIFICATE BASED IP SECURITY UTILITIES—FOR CONFIGURING AND MONITORING SECURE COMMUNICATION USING IP SECURITY POLICIES ON LOCAL MACHINES USING IP SECURITY MONITOR USING THE IPSEC POLICY AGENT SERVICE USING TCP/IP | ADVANCED | OPTIONS USING CERTIFICATES SNAP-IN USING THE SECURITY LOG USING THE NETDIAG SUPPORT TOOL IPSEC BUILT-IN POLICIES—FOR MINIMAL ADMINISTRATOR CONFIGURATION CLIENT (RESPOND ONLY) SERVER (REQUEST SECURITY) SECURE SERVER (REQUIRE SECURITY) IPSEC POLICY COMPONENTS IP FILTER RULES AND LISTS RECOMMENDATIONS FOR DEFINING FILTER LISTS IP FILTER ACTIONS RECOMMENDATIONS FOR DEFINING FILTER ACTIONS OTHER IP RULE COMPONENTS— AUTHENTICATION,TUNNEL SETTING, AND CONNECTION TYPE SETTING COMPUTER AUTHENTICATION USING PRESHARED KEYS SETTING AUTHENTICATION USING CERTIFICATES IP SECURITY PROTOCOLS AND ALGORITHMS DATA AUTHENTICATION ALGORITHMS DATA ENCRYPTION ALGORITHMS KEY EXCHANGE AND MANAGEMENT CONFIGURING SESSION KEY SETTINGS SECURITY ASSOCIATIONS WALKTHROUGH 8 1: SETTING AND TESTING CUSTOM IPSEC POLICIES WALKTHROUGH 8 2: USING IPSEC TO PROTECT A WEB SERVER CHAPTER 9 REMOTE ACCESS USING AND CONFIGURING REMOTE ACCESS POLICIES REMOTE ACCESS ADMINISTRATION MODELS GRANTING REMOTE ACCESS AUTHORIZATION—BY USER ACCESS BY POLICY ON A STANDALONE SERVER IN A WORKGROUP ACCESS BY POLICY ON A MEMBER SERVER IN AN NT4 DOMAIN REMOTE ACCESS POLICY COMPONENTS CONFIGURING WINDOWS 2000 ROUTING AND REMOTE ACCESS CONFIGURING GENERAL SERVER PROPERTIES CONFIGURING SECURITY SERVER PROPERTIES CONFIGURING IP SERVER PROPERTIES AUTOMATIC PRIVATE IP ADDRESS DHCP ADDRESS ALLOCATION CONFIGURING IPX SERVER PROPERTIES CONFIGURING NETBEUI SERVER PROPERTIES CONFIGURING PPP SERVER PROPERTIES CONFIGURING EVENT LOGGING SERVER PROPERTIES CONFIGURING DIALUP AND VPN CONNECTIONS CONFIGURING L2TP VPN CONNECTIONS MODIFYING THE DEFAULT L2TP/IPSEC POLICY USING AND CONFIGURING INTERNET AUTHENTICATION SERVICE (IAS) CONFIGURING RRAS AND IAS IAS CONFIGURATION WITH ISPS CONFIGURING REMOTE CLIENTS WITH THE CONNECTION MANAGER ADMINISTRATION KIT MANUALLY DEFINING CONNECTIONS USING THE CONNECTION MANAGER ADMINISTRATION KIT PREPARATION: CREATING A STATIC PHONE BOOK PREPARATION: CREATING A DYNAMIC PHONE BOOK RUNNING THE CONNECTION MANAGER ADMINISTRATION KIT REFINING DETAILS HOW USERS INSTALL AND USE CONNECTION MANAGER WALKTHROUGH: CONFIGURING REMOTE ACCESS POLICIES CHAPTER 10 INTERNET CONNECTIVITY USING AND CONFIGURING INTERNET CONNECTION SHARING (ICS) ICS SETTINGS USING AND CONFIGURING RRAS NETWORK ADDRESS TRANSLATION (NAT) INSTALLING NAT ADDING NAT TO RRAS CONFIGURING NAT CONFIGURING GLOBAL NAT PROPERTIES CONFIGURING NAT INTERNET INTERFACE PROPERTIES MONITORING NAT CONTROLLING CONNECTIONS CONFIGURING DEMAND-DIAL RESTRICTIONS CONFIGURING INTERNET FILTERS USING AND CONFIGURING INTERNET SECURITY AND ACCELERATION (ISA) SERVER SECURITY FEATURES CACHING FEATURES ADDITIONAL FEATURES REPORTING FEATURES BANDWIDTH PRIORITIES EXTENSIBLE PLATFORM ISA CLIENTS WEB PROXY CLIENT SECURENAT CLIENT FIREWALL CLIENTS UPGRADING ISSUES WALKTHROUGH: CONFIGURING NAT TO PUBLISH A WEB SERVER