September 18, 2002 Introduction to Windows 2000 Server Components Ryan Larson David Greer

September 18, 2002 Win2K Components Overview Monitoring Components User and Group Management Group Security Policies Windows 2000 Security Services

September 18, 2002 Monitoring Components Monitoring Components Computer Management –Click Start, Settings, Control Panel, Administrative Tools, Computer Management Event Viewer Performance Log Shared Folders Services

September 18, 2002 Computer Management Computer Management

September 18, 2002 Event Viewer The Event Viewer gathers information about hardware, software, and system problems and monitor Windows 2000 security events Application Log –Events logged by applications or programs. Security Log –Records security events such as valid and invalid logon attempts, as well as events related to resource use, such as creating, opening, or deleting files. System Log –Events logged by the Windows 2000 system components.

September 18, 2002 Performance Log Performance Logs and Alerts contains features for logging counter and event trace data and for generating performance alerts. Can record data about hardware usage and the activity of system services from local or remote computers. Logging can occur manually on demand, or automatically based on a user-defined schedule

September 18, 2002 Shared Folders Create, view, and set permissions for shares, including shares on computers running Windows NT 4.0. View a list of all users who are connected to the computer over a network and disconnect one or all of them. View a list of files opened by remote users and close one or all of the open files. Configure Services for Macintosh. This enables personal computer users and Macintosh users to share files and other resources, such as printing devices, through a computer running Windows 2000 Server.

September 18, 2002 Services Using Services, you can start, stop, pause, or resume services on remote and local computers, and configure startup and recovery options. You can also enable or disable services for a particular hardware profile. With Services, you can: –Manage services on local and remote computers, including remote computers running Windows NT 4.0. –Set up recovery actions to take place if a service fails, such as restarting the service automatically or restarting the computer (on computers running Windows 2000 only). –Create custom names and descriptions for services so that you can easily identify them (on computers running Windows 2000 only).

September 18, 2002 Users and Groups Overview Administrator Account Guest Account Managing User Accounts Group Types Managing Groups

September 18, 2002 Administrator Account Administrator Account Admins can do the following: Access any file or directory Create and delete users and groups Establish trust relationships Manage printers and print sharing Assign operators Create and modify logon scripts Set default account policies Set and change passwords Manage auditing and security logs Not be deleted

September 18, 2002 Administrator Account (cont.) Admins are by default in the following groups: Administrators Domain Admins Domain Users Enterprise Admins Group Policy Admins Schema Admins

September 18, 2002 Guest Account Guest account is disabled by default Enable the Guest account only in low-security networks Always assign a password Can rename Guest account, but cannot delete it Should only have low privileges

September 18, 2002 Managing User Properties Managing User Properties

September 18, 2002 Manage User Options

September 18, 2002 Managing User Accounts Managing User Accounts Managing User Accounts Click Start, Settings, Control Panel, Administrative Tools, Computer Management Expand System, Local Users and Groups Creating User Accounts Right-Click Users, and then click New User Fill in the appropriate fields Managing User Properties Right-Click on a User, and then click Properties Modify the appropriate fields

September 18, 2002 Group Types Domain Local Group –Open membership: members can come from any domain –Members can access resources only in the local domain Global Group –Limited membership: members only come from local domain –Members can access resources in any domain Universal Group –Open membership: members can come from ay domain –Members can access resources in any domain

September 18, 2002 Groups Types (cont.) Points to keep in mind… Local groups on domain controllers have rights only on the domain where they were created. Local groups on Windows 2000 Workstation computers and member servers (non-Domain Controllers) have rights on the computer where they were created. Local groups cannot contain other local groups; they can contain only user accounts or global groups from the same domain or other domains. Global groups contain user accounts from only one domain. They cannot contain local groups or other global groups. Universal groups contain user accounts from any domain. They can contain universal accounts, global groups, local groups, and user accounts.

September 18, 2002 Predefined Groups

September 18, 2002 Predefined Group (cont.) Predefined Group (cont.)

September 18, 2002 Special Groups

September 18, 2002 Managing Groups Click Start, Settings, Control Panel, Administrative Tools, Computer Management Expand System, Local Users and Groups Creating Groups Right-Click Groups, and then click New Group Fill in the appropriate fields Add Members to Group Right-Click on a Group, and then click Add to Group Click Add, Select User(s), Click Add, Click OK

September 18, 2002 Security Policy Password Policy Account Lockout Policy Audit Policy User Rights Assignment Security Options Encrypting File System Properties Kerberos Properties IPSec Properties Configuring and Analyzing by Templates

September 18, 2002 Opening MMC Snap-Ins To open Microsoft Management Console Snap- ins Click start, run Type “mmc” and hit enter Under the “Console” menu, click “Add/Remove Snap-in” Click “Add”, select Snap-in, click “Add” Opt: Fill any options, click “ok” Click “close”, click “ok”

September 18, 2002 Security Policy It is important to notice: Almost all of these settings can be enforced at the local level, or at the domain level, if the computer is on a domain (in which case the domain settings would be taken from Active Directory) Settings at higher levels of the Active Directory Tree override those at lower levels

September 18, 2002 Password Policy Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Account Policies Controls the formation and changing of user passwords Age, Length, History, Complexity

September 18, 2002 Account Lockout Policy Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Account Policies Controls the lockout settings for incorrect passwords

September 18, 2002 Audit Policy Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Local Policies Controls which system events are recorded in the Event Log, to be viewed in the Eventviewer later For all events, successes and/or failures may be logged Must be careful not to audit too much

September 18, 2002 Audit Policy (Example) By double clicking on Audit Account Logon Events and checking “success” and “failure”, you can log to the Event Log every attempt at access to the computer

September 18, 2002 User Rights Assignment Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Local Policies Controls which users and groups have access to special system-level commands, such as shutting down the computer

September 18, 2002 Security Options Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Local Policies Controls miscellaneous other security options, especially the permissions of remotely connected users.

September 18, 2002 Security Options

September 18, 2002 Security Options (Examples) Using “Rename Administrator Account”, you can change the admin name and create a dummy “Administrator” account with no privileges, that is heavily logged Set “Clear memory pagefile when system shuts down” to prevent the swap file from being recovered (easily)

September 18, 2002 Encrypting File System Properties Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Public Key Policies Or open “Certificates” Snap-in Controls the certificates (public keys) of Encrypted Data Recovery Agents Whenever a file is encrypted by a user, there must be a recovery agent

September 18, 2002 Encrypting File System (Examples) Under certificates for a File Recovery Agent (default Admin), Personal/Certificates, Right click on the file recovery certificate and click All Tasks, export. You can export and delete the recovery agent private key, and store it in a secure location for later recovery Thus, one cannot get the recovery agent key, even by breaking the account password

September 18, 2002 Kerberos in W2K Windows 2000 uses Kerberos V for authenticating computers and users between domains The domain controller acts as the KDC (a trusted third party) in mutually authenticating clients to servers in inter- and intra domain communication Secret-key tickets are given to communicating parties

September 18, 2002 Kerberos Settings Open “Group Policy” snap-in Under Computer Configuration/Windows Settings/Security Settings/Account Policies/Kerberos Policy Only for computers on Domains Controls the details of Kerberos tickets and authentication Microsoft says, and NSA agrees, the default settings are OK

September 18, 2002 IPSec Settings Open “Group Policy” snap-in Computer Configuration/Windows Settings/ Security Settings/IP Security Policy Controls the policies for secure communication via IPSec and its cryptographic settings Allows filtering of packets of various protocols without authentication and IPSec Can require that all communication be Secured (Secure Server)

September 18, 2002 Configuring and Analyzing Security Properties by Templates Open “Security Configuration and Analysis” snap-in Right click “Security Configuration and Analysis” and click “open database”, make a new database file, click “open”, and select a template, such as “hisecws.inf” (high secure workstation/server) and click open Right click “Security Configuration and Analysis” again and choose to configure (set your settings to template) or to analyze (compare your settings to template

September 18, 2002 Any Questions?