Chapter 9 Deploying IIS and Active Directory Certificate Services MCITP Guide to Microsoft Windows Server 2008 Server Administration (Exam #70-646) Chapter 9 Deploying IIS and Active Directory Certificate Services

Learning Objectives Install, configure, and troubleshoot Microsoft Internet Information Services (IIS) Install, configure, and troubleshoot Active Directory Certificate Services MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Implementing Microsoft Internet Information Services Internet Information Services (IIS) Included with Windows Server 2008 Offer a complete Web site Benefits Fast Use of software applications to coordinate with an IIS server Internet Server Application Programming Interface (ISAPI) Group of DLL (dynamic link library) files that are applications and filters MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Implementing Microsoft Internet Information Services (cont’d.) Web Server (IIS) role Contains the World Wide Web services which are vital for a Web site File Transfer Protocol (FTP) service TCP/IP-based application protocol that handles file transfers over a network Simple Mail Transfer Protocol (SMTP) Works with e-mail services to accept incoming e-mail from the Internet and forward it to the recipient MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Implementing Microsoft Internet Information Services (cont’d.) Reasons Windows Server 2008 is a good candidate for a Web server Privileged-mode architecture Fault-tolerance capabilities Compatible with small and large databases Users can log into a database through the IIS Open Database Connectivity (ODBC) drivers Compatible with: Microsoft Point-to-Point Encryption (MPPE) security IP Security (IPsec) Secure Sockets Layer (SSL) encryption technique MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Implementing Microsoft Internet Information Services (cont’d.) IIS newly designed for Windows Server 2008 Broken into modules or features (role services) Install only the features you need Smaller attack surface More efficient MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Implementing Microsoft Internet Information Services (cont’d.) Table 9-1 Internet Information Services features (role services) MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Installing a Web Server Requirements Windows Server 2008 installed on the computer to host IIS TCP/IP installed on the IIS host Access to an Internet Service Provider (ISP) Sufficient disk space for IIS and for Web site files Method for resolving IP addresses to computer or domain names DNS and WINS MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Installing a Web Server (cont’d.) Activity 9-1: Installing IIS Objective: Learn how to install IIS MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Internet Information Services (IIS) Manager Capabilities Connect to a Web server Manage a Web server Manage ASP.NET Manage authorization for users and for specific Web server roles Manage Web server logging Compress Web server files Manage code modules and worker processes Manage server certificates Troubleshoot a Web server MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Internet Information Services (IIS) Manager (cont’d.) Figure 9-1 Using IIS Manager Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Creating a Virtual Directory Physical folder or a redirection to a Uniform Resource Locator (URL) that points to a folder Can be accessed over the Internet, an intranet, or VPN Reason for creating a virtual directory Provide a shortcut path to specific IIS server content Steps to set up a virtual directory MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Creating a Virtual Directory (cont’d.) Table 9-2 Virtual directory security options MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Creating a Virtual Directory (cont’d.) Figure 9-2 Properties of a virtual directory Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Creating a Virtual Directory (cont’d.) Set up the virtual directory to be shared So that users who need access to add contents to the directory can do this over the network Activity 9-2: Create a Virtual Directory Objective: Set up a virtual directory MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Creating a Virtual Directory (cont’d.) Table 9-3 Virtual directory share permissions MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Figure 9-3 Creating a virtual directory Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Managing and Configuring an IIS Web Server Manage IIS components including: Application pools Group similar Web applications for management Sites Manage multiple Web sites from one administrative Web server SMTP E-mail Manage Internet e-mail Certificates Configure and monitor certificate security used with other Web sites MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Managing and Configuring an IIS Web Server (cont’d.) Figure 9-5 Application Pools in IIS Manger Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Managing and Configuring an IIS Web Server (cont’d.) Table 9-4 Web site features to configure MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Managing and Configuring an IIS Web Server (cont’d.) Activity 9-3: Configuring a Web Site Objective: Learn basic Web site configuration Figure 9-6 Enabling directory browsing Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Troubleshooting a Web Server Table 9-5 Troubleshooting IIS MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Active Directory Certificate Services Public key infrastructure (PKI) Linking a public key or a combination of public and private keys to a user or network entity Uses a certificate authority to issue public key-based digital certificates to trustworthy network entities Certificate authority (CA) Network entity or host that issues digital certificates of trust verifying certificate holders’ legitimacy MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Active Directory Certificate Services (cont’d.) Public key Encryption method that uses a public key and private key combination Asymmetric encryption One key used to encrypt the data, and the other key used to decrypt it Public key/private key method Uses an encryption algorithm developed by Whitfield Diffie and Martin Hellman MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Active Directory Certificate Services (cont’d.) X.509 standards for digital certificates Developed by International Organization for Standardization (ISO) Function as proof of identity for a specific network entity MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Active Directory Certificate Services (cont’d.) X.509 certificate contains: Certificate format version Certificate serial number Signature algorithm identifier Certificate authority (certificate issuer) Length of time the certificate is valid ID of the certificate holder Public key data MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Active Directory Certificate Services (cont’d.) Active Directory Certificate Services role Available in Windows Server 2008 Standard, Enterprise, and Datacenter Editions Online Responder Service Determines the status of digital certifications Uses the Online Certificate Status Protocol (OCSP) to obtain and decode status information MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Planning Active Directory Certificate Services Understand the four kinds of CAs that can be set up in a Microsoft server environment Enterprise root CA Enterprise subordinate Standalone root Standalone subordinate Root CA is always configured before any other CAs MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Planning Active Directory Certificate Services (cont’d.) Figure 9-7 CA hierarchy Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Planning Active Directory Certificate Services (cont’d.) Implement enterprise root CA and enterprise subordinates Not standalone model Take into account the ways in which an organization can make most use of AD CS PKI with multiple subordinate CAs has built-in redundancy MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Planning Active Directory Certificate Services (cont’d.) Role services for Active Directory Certificate Services: Certificate Authority Certification Authority Web Enrollment Online Responder Network Device Enrollment service MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Certificate Services Roles Recommended to divide responsibilities for handling money and important security tasks in an organization AD CS enables dividing CA responsibilities into two roles: CA administrator Person or persons who manage the CA server Certificate manager Given to those who determine which users to enroll for certificates and when to revoke certificates MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Installing Active Directory Certificate Services Active Directory Certificate Services installed in the same way as other server roles Using Server Manager Activity 9-4: Installing Active Directory Certificate Services Objective: Learn how to install Active Directory Certificate Services MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Installing Active Directory Certificate Services (cont’d.) Figure 9-8 Configuring an enterprise CA Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Managing Active Directory Certificate Services Certification Authority tool tasks Set up CA security Assign certificate managers Start or stop the CA Back up the CA Restore the CA Renew a CA certificate View revoked, issued, failed, and pending certificates MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Managing Active Directory Certificate Services (cont’d.) Activity 9-5: Using the Certification Authority Tool Objective: Learn how to use the Certification Authority tool MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Figure 9-11 Security tab Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Autoenrollment Clients automatically enrolled for appropriate certificates as specified by certificate template Set up in a two-step process Configure autoenrollment in a certificate template Configure a group policy to enable autoenrollment Three levels of certificate templates Level 1 does not support autoenrollment MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Autoenrollment (cont’d.) Activity 9-6: Configuring a Certificate Template for Autoenrollment Objective: Set up an existing certificate template for autoenrollment Activity 9-7: Configuring a Group Policy for Autoenrollment Objective: Set up the autoenrollment group policy MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Autoenrollment (cont’d.) Figure 9-15 Configuring the autoenrollment policy Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Credential Roaming When user logs into the network Digital certificate information stored on the user’s computer is automatically synchronized with the digital certification information for that user stored in Active Directory Configured as a group policy MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Credential Roaming (cont’d.) Circumstances that launch synchronization through credential roaming When the client or Active Directory synchronize group policy settings When digital certificate information is updated When a user unlocks an account that has been automatically locked MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Using Credential Roaming (cont’d.) Activity 9-8: Configuring a Group Policy for Credential Roaming Objective: Set up a group policy for credential roaming Figure 9-16 Enabling credential roaming Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Network Device Enrollment Service Enables routers, switches, and other network devices to be enrolled for digital certificates through a CA Uses the Simple Certificate Enrollment Protocol (SCEP) and standardized X.509 digital certificates MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Web Enrollment Service For organizations that enable users to access network resources through the Web Rather than through user accounts Requires IIS be installed before installing Web Enrollment Clients must use Internet Explorer version 6 or higher Can be used only with Level 1 or 2 certificate templates MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Online Responder Service Service relies on OCSP (Online Certificate Status Protocol) Determine if a certificate is revoked One of two ways network applications determine which network entities have revoked certificates Other way is to use certificate revocation lists (CRLs) Benefits Faster determination and better security Can be used in conjunction with CRLs MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Online Responder Service (cont’d.) Benefits (cont’d.) Can be used with Kerberos password security Compatible with Web enrollment Uses CryptoAPI 2.0 infrastructure to provide high level of security MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Certificate Revocation Lists List of certificates that have been revoked CRL issuer is a CA CRL issued to client applications and devices which cache the CRL for future reference until the next CRL is issued Default method for determining certificates that have been revoked MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Figure 9-17 Extensions tab Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Figure 9-18 Configuring the CRL publication interval and delta CRLs Courtesy Course Technology/Cengage Learning MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Summary Implement Internet Information Services (IIS) Create a Windows Server 2008 Web server After installing a Web server, configure it to customize features Public key infrastructure (PKI) Use public and private keys through digital certificates Ensure users can be trusted Active Directory Certificate Services (AD CS) Implements a PKI using enterprise root and enterprise subordinate certificate authorities MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)

Summary (cont’d.) Certification Authority tool Manage a CA Configure Network Device Enrollment Service for added security Credential roaming Enables a user to log on from any computer and still operate with the same digital certificates Online Responder Service and CRLs Provide information about revoked digital certificates MCITP Guide to Microsoft Windows Server 2008, Server Administration (Exam #70-646)