SECURING WINDOWS SERVER 2008
CHAPTER 1 MICROSOFT WINDOWS SERVER 2008: AN OVERVIEW INTRODUCTION SERVER MANAGER USING SERVER MANAGER TO IMPLEMENT ROLES SERVER CORE USING SERVER CORE AND ACTIVE DIRECTORY WHAT IS SERVER CORE? USES FOR SERVER CORE ACTIVE DIRECTORY CERTIFICATE SERVICES CONFIGURING A CERTIFICATE AUTHORITY CERTIFICATE AUTHORITIES STANDARD VS ENTERPRISE ROOT VS SUBORDINATE CERTIFICATE AUTHORITIES CERTIFICATE REQUESTS REQUEST A CERTIFICATE FROM A WEB SERVER CERTIFICATE PRACTICE STATEMENT KEY RECOVERY ACTIVE DIRECTORY DOMAIN SERVICES WHAT IS NEW IN THE AD DS INSTALLATION? SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 MICROSOFT WINDOWS SERVER 2008: PKI-RELATED ADDITIONS WHAT IS PKI? THE FUNCTION OF THE PKI COMPONENTS OF PKI HOW PKI WORKS PKCS STANDARDS PUBLIC KEY FUNCTIONALITY DIGITAL SIGNATURES AUTHENTICATION SECRET KEY AGREEMENT VIA PUBLIC KEY BULK DATA ENCRYPTION WITHOUT PRIOR SHARED SECRETS CONTENTS DIGITAL CERTIFICATES USER CERTIFICATES MACHINE CERTIFICATES APPLICATION CERTIFICATES WORKING WITH CERTIFICATE SERVICES BACKING UP CERTIFICATE SERVICES RESTORING CERTIFICATE SERVICES ASSIGNING ROLES ENROLLMENTS REVOCATION WORKING WITH TEMPLATES GENERAL PROPERTIES REQUEST HANDLING CRYPTOGRAPHY SUBJECT NAME ISSUANCE REQUIREMENTS SECURITY TYPES OF TEMPLATES USER CERTIFICATE TYPES COMPUTER CERTIFICATE TYPES OTHER CERTIFICATE TYPES CUSTOM CERTIFICATE TEMPLATES CREATING A CUSTOM TEMPLATE SECURING PERMISSIONS VERSIONING KEY RECOVERY AGENT CHAPTER 3 MICROSOFT WINDOWS SERVER 2008: ACTIVE DIRECTORY DOMAIN SECURITY CHANGES CONFIGURING AUDIT POLICIES LOGON EVENTS DIRECTORY SERVICE ACCESS CONFIGURING DIRECTORY SERVICE ACCESS AUDITING IN GROUP POLICY CONFIGURING ACTIVE DIRECTORY OBJECT AUDITING FINE-GRAIN PASSWORD AND ACCOUNT LOCKOUT POLICIES CONFIGURING A FINE-GRAIN PASSWORD POLICY APPLYING USERS AND GROUPS TO A PSO WITH ACTIVE DIRECTORY USERS AND COMPUTERS READ-ONLY DOMAIN CONTROLLERS (RODCS) INTRODUCTION TO RODC AN RODC’S PURPOSE IN LIFE RODC FEATURES CONFIGURING RODC REMOVING AN RODC DIGITAL RIGHTS MANAGEMENT SERVICE CHAPTER 4 MICROSOFT WINDOWS SERVER 2008: NETWORK SECURITY CHANGES NETWORK POLICY SERVER CONFIGURING POLICIES AND SETTINGS FOR NAP ENFORCEMENT METHODS IN NPS NETWORK POLICY AND ACCESS SERVICES ROLE NTLMV2 AND KERBEROS AUTHENTICATION 802 1X WIRED AND WIRELESS ACCESS WLAN AUTHENTICATION USING 802 1X AND 802 3 WIRELESS AND WIRED AUTHENTICATION TECHNOLOGIES IMPLEMENTING SECURE NETWORK ACCESS AUTHENTICATION CONFIGURING 802 1X SETTINGS IN WINDOWS SERVER 2008 CONFIGURING WIRELESS ACCESS SET SERVICE IDENTIFIER (SSID) WI-FI PROTECTED ACCESS (WPA) WI-FI PROTECTED ACCESS 2 (WPA2) AD HOC VS INFRASTRUCTURE MODE WIRELESS GROUP POLICY CREATING A NEW POLICY CHAPTER 5 MICROSOFT WINDOWS SERVER 2008: DATA PROTECTION BITLOCKER TRUSTED PLATFORM MODULES A PRACTICAL EXAMPLE FULL VOLUME ENCRYPTION STARTUP PROCESS INTEGRITY VERIFICATION RECOVERY MECHANISMS REMOTE ADMINISTRATION SECURE DECOMMISSIONING BITLOCKER ARCHITECTURE KEYS USED FOR VOLUME ENCRYPTION HARDWARE UPGRADES ON BITLOCKER PROTECTED SYSTEMS BITLOCKER AUTHENTICATION MODES TPM ONLY TPM WITH PIN AUTHENTICATION TPM WITH STARTUP KEY AUTHENTICATION STARTUP KEY-ONLY WHEN TO USE BITLOCKER ON A WINDOWS 2008 SERVER SUPPORT FOR MULTIFACTOR AUTHENTICATION ON WINDOWS SERVER 2008 PIN AUTHENTICATION STARTUP KEY AUTHENTICATION ENABLING BITLOCKER PARTITIONING DISKS FOR BITLOCKER USAGE CREATING PARTITIONS FOR A BITLOCKER INSTALLATION INSTALLING BITLOCKER ON WINDOWS SERVER 2008 TURNING ON AND CONFIGURING BITLOCKER TURNING ON BITLOCKER FOR DATA VOLUMES CONFIGURING BITLOCKER FOR TPM-LESS OPERATION TURNING ON BITLOCKER ON SYSTEMS WITHOUT A TPM ADMINISTRATION OF BITLOCKER USING GROUP POLICY WITH BITLOCKER STORING BITLOCKER AND TPM RECOVERY INFORMATION IN ACTIVE DIRECTORY STORAGE OF BITLOCKER RECOVERY INFORMATION IN ACTIVE DIRECTORY STORAGE OF TPM INFORMATION IN ACTIVE DIRECTORY PREREQUISITES EXTENDING THE SCHEMA SETTING REQUIRED PERMISSIONS FOR BACKING UP TPM PASSWORDS ENABLING GROUP POLICY SETTINGS FOR BITLOCKER AND TPM ACTIVE DIRECTORY BACKUP RECOVERING DATA TESTING BITLOCKER DATA RECOVERY DISABLING BITLOCKER ACTIVE DIRECTORY RIGHTS MANAGEMENT SERVICES MANAGING TRUST POLICIES EXCLUSION POLICIES CONFIGURING POLICY TEMPLATES MANAGING YOUR AD RMS CLUSTER SUPER USER REMOVING AD RMS REPORTING TRANSPORT SECURITY ADDING A NEW SECURITY CERTIFICATE CONSIDERATIONS WHEN USING CLIENT CERTIFICATES AUTHORIZATION URL AUTHORIZATION IP AUTHORIZATION REQUEST FILTERING 237 NET TRUST LEVELS CHAPTER 6 MICROSOFT WINDOWS SERVER 2008: NETWORKING ESSENTIALS NOT YOUR FATHER’S TCP/IP STACK INTRODUCTION OF IPV6 AND DUAL STACK IPV6 ADDRESSING CONVENTIONS IPV6 ASSIGNED UNICAST ROUTABLE ADDRESS PREFIXES IPV6 AUTO-CONFIGURATION OPTIONS IPV6 TRANSITION TECHNOLOGIES CONFIGURING IPV6 SETTINGS USING THE NETWORK AND SHARING CENTER USING NETWORK MAP CONNECT TO A NETWORK MANAGE NETWORK CONNECTIONS DIAGNOSE AND REPAIR MANAGING WIRED CONNECTIONS MANAGING WIRELESS CONNECTIONS CHANGING FROM A PRIVATE TO A PUBLIC NETWORK LOCATION OTHER TROUBLESHOOTING METHODS CHAPTER 7 MICROSOFT WINDOWS SERVER 2008: SERVER CORE SERVER CORE FEATURES SERVER CORE HAS MINIMAL ATTACK VECTOR OPPORTUNITIES SERVER CORE REQUIRES LESS SOFTWARE MAINTENANCE SERVER CORE USES LESS DISK SPACE FOR INSTALLATION SERVER CORE COMPONENTS WHAT IS THERE? WHICH ROLES CAN BE INSTALLED? WHAT IS MISSING? SERVER CORE BEST PRACTICES INSTALLING SOFTWARE CHANGING BACKGROUND SETTINGS AND MORE ENABLING REMOTE CMD EXE WITH TERMINAL SERVICES CHANGING THE COMMAND PROMPT ADMINISTRATING SERVER CORE WITH RDP CREATING BATCH MENUS COMBINING SERVER CORE, READ-ONLY DOMAIN CONTROLLER, AND BITLOCKER SERVER CORE ADMINISTRATION INSTALLING SERVER CORE STEPS FOR A NORMAL INSTALLATION STEPS FOR AN UNATTENDED INSTALLATION CONFIGURING SERVER CORE CONFIGURING THE IPV4 IP-STACK CONFIGURING WINDOWS FIREWALL CHANGING THE HOSTNAME JOINING A DOMAIN ACTIVATING THE SERVER ENABLING AUTOMATIC UPDATES SWAPPING MOUSE BUTTONS CHANGING THE REGIONAL SETTINGS CHANGING THE DATE/TIME OR TIMEZONE CHANGING THE ADMINISTRATOR PASSWORD ADDING USERS TO THE LOCAL ADMINISTRATOR GROUP SETTING THE PAGEFILE INSTALLING SERVER CORE ROLES ADMINISTRATING SERVER CORE REMOTE SERVER ADMINISTRATION TOOLS (RSAT) WINRM/WINRS MANAGING SERVER CORE WITH GROUP POLICY POWERSHELL INSTALLING ACTIVE DIRECTORY DOMAIN SERVICES ON SERVER CORE CHAPTER 8 CONFIGURING WINDOWS SERVER HYPER-V AND VIRTUAL MACHINES ADVANCING MICROSOFT’S STRATEGY FOR VIRTUALIZATION UNDERSTANDING VIRTUALIZATION UNDERSTANDING THE COMPONENTS OF HYPER-V CONFIGURING VIRTUAL MACHINES INSTALLING HYPER-V INSTALLING AND MANAGING HYPER-V ON WINDOWS SERVER CORE INSTALLATIONS VIRTUAL NETWORKING VIRTUALIZATION HARDWARE REQUIREMENTS VIRTUAL HARD DISKS ADDING VIRTUAL MACHINES INSTALLING HYPER-V AND CREATING VIRTUAL MACHINES MIGRATING FROM PHYSICAL TO VIRTUAL MACHINES PLANNING A P2V MIGRATION BACKING UP VIRTUAL MACHINES BACKING UP A VIRTUAL HARD DRIVE VIRTUAL SERVER OPTIMIZATION CHAPTER 9 MICROSOFT WINDOWS SERVER 2008: TERMINAL SERVICES CHANGES TERMINAL SERVICES REMOTEAPP CONFIGURING TS REMOTEAPP TERMINAL SERVICES GATEWAY TERMINAL SERVICES WEB ACCESS CONFIGURING TS REMOTE DESKTOP WEB CONNECTION