Windows 2000 Security Yingzi Jin

Introduction n Active Directory n Group Policy n Encrypting File System

What is a Directory Service n A directory is an information source used to store information about objects. n Users want to find and use these objects n Directory Service makes the information available and usable to the users.

What is Active Directory n Essential and inseparable part of the Windows 2000 network architecture n Provide a directory service for distributed networking environment

Active Directory - Structure n Tree structure make up of objects and containers n Objects represent network resources –users, groups, devices, applications n Containers represent organizations or collections of related objects –marketing department, printers

Active Directory Security n An access-control list(ACL) protects all objects in AD. n An ACL is stored as a binary value, called a security descriptor. n Every object in AD is protected by its own security descriptor.

Active Directory - Authentication n Several options for user authentication: –Kerberos: verifies the clients right to access the network and authenticates the server to the client. –Public Key Infrastructure(PKI): normally done to authenticate external users.

Group Policy n New Capability in Win2K n Defines, manages, and enforces the environment settings for both computer and user objects. n Integrates with AD and can be assigned to AD sites, domains, and organizational units(OUs) n contained in Group Policy Objects(GPO)

Security-related Policies n Account policies - password policies n Local policies - audit policy n File system - permissions for folders and files n System services - permission for system services

Group Policy Objects(GPO’s) n Contain a set of “rules”. n To specify account and password setting, audit capabilities, etc. n Can be applied to Windows 2000 sites, domains, or OU’s.

Active Directory and Group Policy n Group Policy Objects are created to set the rules that govern the domain. n A Default Domain Policy GPO at the highest lever. n Additional GPO’s can be created and applied for each “child OU”

Implement Group Policy n Account policies are domain-wide –GPO’s for account settings defined for lower level OU’s will not work for domain users. n No Override and Block Inheritance Settings n Policy Processed in a hierarchy: –Local GPO’s –GPO’s applied to Sites –GPO’s applied to domain –GPO’s applied to OU’s

Encrypting File System n Integral part of the new NTFS file system. n Users can encrypt/decrypt files on the fly to protect sensitive data from unauthorized access. n Uses a combination of symmetric key and public key encryption.

Encrypting File System n A random file encryption key (FEK) is generated for each file. n Using the FEK, the file is encrypted using DESX n The FEK is encrypted with the user’s public key n Decryption uses the user’s or recovery agent’s private key to get the FEK

Encrypting File System n Protect sensitive files and folders. n Encrypting a directory/folder encrypts all subsequent files n EFS does not cache any of the keys onto the hard disk n EFS does not encrypt required system files and folders

Encrypting File System n EFS need a strong password policy n A Windows 2000 user can delete files encrypted by another user