Week #12 CIS 173 OBJECTIVES Chapter #10 Network Administration

Chapter #10 Network Administration & Support

Purpose Make sure –all users can access what they need –don’t access what they don’t need or SHOULD NOT be accessing –Establish Groups and or Individual User Accounts

User Accounts NT Server User Account –Account Name –Associated password NT can handle up to 128 characters but dialog box will only accept 14 Case Sensitive –Access permissions for network resources Group Account –Named collection of User Accounts –Created for resource sharing specific to that group Access rights

Before Making User Accounts Decide On Passwords –NO NAMING SCHEME –YES to a Naming CONVENTION Users change their own? How often should they change? How many letters? Reusing Passwords? Failed Attempts lead to LOCKOUT? Logon Hours –Security situations

Auditing Actions recorded for review later. Tracking users –Logon? When How many times –Limit how many times –Logoff? Security –If not off can be accessed –Object access? Who is trying to access what Are they supposed to be there Policy Changes?

Administrator Account Used for management duties Should be DISABLED AFTER an individual account has been established with Administrative privileges, but WITH A DIFFERENT NAME AND PASSWORD

Setting User Rights Groups makes management easier Local Groups –Intended for local Domain only Global Groups –Access across domains Default Groups have pre-assigned rights that apply to ALL group members NT Server Default Local Groups (pg.286 Table 1-10) –Administrators Complete Control of PC and DOMAIN –Account Operators Admin. User & Grp. Accts. For local Domain –Backup Operators Back Up & Restore files members don’t have access to normally –Guests Permitted guest access (not secure) –Print Operators Add, Delete, & manage domain printers –Server Operators Admin. Domain servers –Users Ordinary User Accounts

Default Global Groups Domain Administrators Domain Users Domain Guests

Trust Relationships One Domain permits members of another Domain to access its resources –One-Way –Two-Way First PERMIT one Domain to trust it THEN Establish the trust –A trusts B, B trusts C, but A does not trust C until you establish it. Until you give an account on one domain some kind of account on the other “trusted” domain the trust means nothing

Disabling vs. Deleting User Accounts Disabled –It remains in system –BUT unusable –For a temp. position You know it will be filled again in a few weeks. Deleting –IT’S GONE –CAN’T be restored –For a terminated employee, not going to be replaced –Even if you create a similar acct with same name & same grp membership it appears the same BUT the security ID information will change. This means any adjustments you made to the account group membership or individual membership will NOT be seen

Renaming & Copying User Accounts Rename account changes the user name and keeps all privileges Copy the account makes all privileges the same but creates a second account In either case –Must Change the name –Must Change the password

Renaming & Copying Accounts Renaming –Go to User Manager for Domains –Go to RENAME option –Provide the new user name & click OK –When the user properties displays change the Full Name and Password –Click OK and changes take effect immediately Copying

Managing Network Performance Cables are operational –Physical checks Must get out there and check Network cards –Are seated properly –NOT in conflict

Managing Network Performance Queued commands –Commands awaiting execution –Never more than the # of network cards in the server OR a bottleneck will occur Data read from and written to the server each second –Give useful measure of server activity Do you need additional server?

Managing Network Performance Ethernet –Number of collisions/second –After 1st collision speed of network slows exponentially One main reason is a network segment that is too long Or some other segment problem Security errors –Failed logons or Failed access to objects Security risk on network Set up auditing so you can SEE WHO’S causing errors Server Sessions –Rate at which connections are currently made to server and broken

3 Tools to Monitor Performance Performance Monitor –Recording & viewing trends Chart, Alert, Log, Report –Can give you insight as to what hardware needs to be upgraded Objects –Portion of software that works with other software to provide services Counters –Certain part of an object Network Monitor –Not installed automatically during NT setup (Pg. 296 shows setup) –Records reports & graphs form the data collected Event Viewer –Event logs Security Info Log –Logs based on filters you set up in the User Manager for Domains –Gives info on failed attempts System Info Log –Events logged by Windows NT system components –Shows if hardware is working properly –Check here to see if everything that should be running is Application Events Log

Performance Monitor Continued Establish a BASESLINE first –Logical or physical disk on sever –Network Interface –Protocol Counters Datagrams/Second –Redirectors –Server –Server Work Queues Managing Network Performance

Total System Management Hard Drive Performance –Disk Space Remaining –Speed at which requests are serviced –How often the disk is busy How often it is running and the average number of requests queued Maintaining Network History –Archiving –DON’T go overboard Information will become useless

Network Security Planning –What am I trying to protect? –Whom or what do I need to protect data from? –How likely is it that this threat will manifest itself? –What is the cost of breached security? –How can I protect the data in a cost effective manner? At some point it costs more to protect data than it does to lose it.

Security Models Physical Security –Hardware Intruders away from tapping into cables Away from PC’s Isolate servers Lock them up Limit physical access Data Security –Software Share-Oriented –Security attached to the object User-Oriented –Rights & Permissions of each user

Maintaining Security Modify plan after you implement and see what works and what needs to be changed. Constantly update this Review regularly

BACKUP Tape Backup –Full backup all files to tape –Incremental backup all files changed since the last full or incremental backup –Differential backup all files changed since last full backup

UPS For each device if affordable SERVER Definately NEVER plug a laser printer into a UPS –It draws to many amps and will drain battery FAST

Disk Mirroring Two disks in tandem Two hard drives on single controller

Disk Duplexing Same as mirroring but has two drives on two controllers

Disk Striping with Parity Array of disks At least 3 All three treated as a single logical drive When data is written it looks like it is writing to one drive