1. Objectives Install, configure, and troubleshoot DNS
Install, configure, and troubleshoot DHCP
Install, configure, and troubleshoot Microsoft Internet Information Services

2. Implementing Microsoft DNS
Domain Name System (DNS)
A TCP/IP application protocol that enables a DNS server to resolve (translate):
Domain and computer names to IP addresses
IP addresses to domain and computer names
DNS servers provide the DNS namespace for an enterprise
One of the requirements for using Active Directory on a Windows Server 2008 network is to have a DNS server on the network
Hands-On Microsoft Windows Server 2008

3. Installing DNS Services
DNS is installed as a server role in Windows Server 2008
The installation steps for DNS are similar to those for DHCP
Both are installed as Windows components
Hands-On Microsoft Windows Server 2008

4. DNS Zones
DNS name resolution is enabled through the use of tables of information
That link computer names and IP addresses
The tables are associated with partitions in a DNS server that are called zones
Contain resource records
Forward lookup zone
The zone that links computer names to IP addresses
Holds host name records called address records
Hands-On Microsoft Windows Server 2008

5. DNS Zones (continued)
In IP version 4, a host record is called a host address (A) resource record
An IPv6 record is called an IPv6 host address (AAAA) resource record
When you install DNS on a domain controller (DC) in a domain
A forward lookup zone is automatically created for the domain with the DNS server’s address record already entered
Hands-On Microsoft Windows Server 2008

6. Hands-On Microsoft Windows Server 2008

7. Using the DNS Dynamic Update Protocol
Microsoft DNS is also called Dynamic DNS (DDNS)
A modern form of DNS that enables client computers and DHCP servers to automatically register IP addresses
DNS dynamic update protocol
Enables information in a DNS server to be automatically updated in coordination with DHCP
Hands-On Microsoft Windows Server 2008

8. DNS Replication Primary DNS server Secondary DNS server
The DNS server that is the main administrative server for a zone and thus is also the authoritative server for that zone
Secondary DNS server
Contains a copy of the primary DNS server’s zone database, but is not used for administration (is not authoritative)
Obtains that copy through a zone transfer over the network
Hands-On Microsoft Windows Server 2008

9. DNS Replication (continued)
Vital services performed by secondary DNS servers:
To make sure that there is a copy of the primary DNS server’s data
To enable DNS load balancing among a primary DNS server and its secondary servers
To reduce congestion in one part of the network
If you use Active Directory and have two or more DCs
Plan to set up Microsoft DNS services on at least two of the DCs
Hands-On Microsoft Windows Server 2008

10. Stub Zone
Stub zone has only the bare necessities for DNS functions, which are copies of the following:
SOA record zone
Name server (NS) records to identify authoritative servers
A record for name servers that are authoritative
One common use for a stub zone is to help quickly resolve computer names
Between two different namespaces
Hands-On Microsoft Windows Server 2008

11. Additional DNS Server Roles
It is common to designate one DNS server to forward name resolution requests to a specific remote DNS server
A DNS server can function as a caching server
A caching server is used to provide fast queries because the results of each query are stored in RAM
One limitation of using caching servers is that it takes time for each one to build up a comprehensive set of resolved names to IP addresses
Hands-On Microsoft Windows Server 2008

12. Hands-On Microsoft Windows Server 2008

13. Creating a DNS Implementation Plan
Recommendations
Implement Windows Server 2008 DNS servers instead of other versions of DNS, and use Active Directory
Plan to locate a DNS server across most site links
Create two or more DNS servers to take advantage of the load balancing
Designate one DNS server as a forwarder to reduce traffic
The number of DNS servers that you set up can be related to your analysis of an organization
Hands-On Microsoft Windows Server 2008

14. DNS Enhancements Microsoft DNS servers now include support for IPv6
Background zone loading
This means that a DNS server that has a large number of entries in its zones can load those entries as a background process
DNS server can be housed on a Read-Only Domain Controller (RODC) for branch offices
Hands-On Microsoft Windows Server 2008

15. Troubleshooting DNS (continued)
Hands-On Microsoft Windows Server 2008

16. Implementing Microsoft DHCP
Dynamic Host Configuration Protocol (DHCP)
Enables a Windows Server 2008 server with DHCP services to detect the presence of a new workstation
Assign an IP address to that workstation
The DHCP server has a pre-assigned range of IP addresses that it can give to a new client
Microsoft DHCP server can support the following:
Dynamic configuration of DNS server forward and reverse lookup zone records
Up to 1000 different scopes
Up to 10,000 DHCP clients
Hands-On Microsoft Windows Server 2008

17. Implementing Microsoft DHCP (continued)
A Windows Server 2008 server can be configured in the role of a DHCP server using Microsoft DHCP services
The DHCP server automatically updates the DNS server at the time it assigns an IP address
Using dynamic DNS updates can significantly save time in creating DNS lookup zone records
Hands-On Microsoft Windows Server 2008

18. Implementing Microsoft DHCP (continued)
A Microsoft DHCP server can also:
Reserve an IP address for a specific computer
Update all computers on a network for a particular change in DHCP settings
Provide DHCP services to multiple subnetworks
Omit certain IP addresses from a scope
Hands-On Microsoft Windows Server 2008

19. Configuring a DHCP Server
First, set up one or more scopes of contiguous address ranges and activate each scope
Configuring a scope includes the following:
Obtain the range of addresses to be used
Determine the subnet mask for the range of addresses
Decide on a name for the scope, such as naming it to reflect the name of a department or division in your organization
Decide how long to lease IP addresses
Determine whether to exclude specific addresses
Hands-On Microsoft Windows Server 2008

20. Configuring a DHCP Server (continued)
Second, authorize the DHCP server
The process of authorizing the server is a security precaution to make sure IP addresses are only assigned by DHCP servers that are managed by network and server administrators
Third, a step that is not required, but that saves time in managing DNS, is to configure the DHCP server and its clients to automatically update DNS records
Hands-On Microsoft Windows Server 2008

21. DHCPv6 Support
Windows Server 2008 and Windows Vista both enable a network to use Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
For networks that are working to implement IPv6
The Microsoft implementation of DHCPv6
Follows the official standard for DHCPv6
Supports both stateful and stateless autoconfiguration
Hands-On Microsoft Windows Server 2008

22. Hands-On Microsoft Windows Server 2008

23. Implementing Microsoft Internet Information Services
Microsoft Internet Information Services (IIS)
Software included with Windows Server 2008 that enables you to offer a complete Web site
Internet Server Application Programming Interface (ISAPI)
A group of DLL (dynamic link library) files that are applications and filters
Web Server (IIS) role services
World Wide Web
File Transfer Protocol (FTP)
Simple Mail Transfer Protocol (SMTP)
Hands-On Microsoft Windows Server 2008

24. Implementing Microsoft Internet Information Services (continued)
Windows Server 2008 is a good candidate for a Web server for several reasons
Windows Server 2008’s privileged-mode architecture and fault-tolerance capabilities
Windows Server 2008 is compatible with small and large databases
Users can log in to a database through the IIS Open Database Connectivity (ODBC) drivers
Compatible with Microsoft Point-to-Point Encryption (MPPE) security, IP Security (IPsec), and the Secure Sockets Layer (SSL) encryption technique
Hands-On Microsoft Windows Server 2008

25. Implementing Microsoft Internet Information Services (continued)
IIS is newly designed for Windows Server 2008
Broken into modules or features so that you can install only the features you need
Presents a smaller attack surface and makes IIS more efficient
Hands-On Microsoft Windows Server 2008

26. Hands-On Microsoft Windows Server 2008

27. Internet Information Services (IIS) Manager
Through this tool, you can do the following:
Connect to a Web server on your computer or remotely connect to a Web server, an application, or site
Have connections to multiple Web servers, applications, and sites
Manage a Web server
Manage ASP.NET
Manage authorization for users and for specific Web server roles
Hands-On Microsoft Windows Server 2008

28. Internet Information Services (IIS) Manager
Through this tool, you can do the following: (continued)
Manage Web server logging
Compress Web server files
Manage code modules and worker processes
Manage server certificates
Troubleshoot a Web server
Hands-On Microsoft Windows Server 2008

29. Hands-On Microsoft Windows Server 2008

30. Creating a Virtual Directory
A physical folder or a redirection to a Uniform Resource Locator (URL) that points to a folder
So that it can be accessed over the Internet, an intranet, or VPN
The reason for creating a virtual directory is to provide a shortcut path to specific IIS server content
When you set up a virtual directory, you give it an alias
A name to identify it to a Web browse
Hands-On Microsoft Windows Server 2008

31. Creating a Virtual Directory (continued)
Hands-On Microsoft Windows Server 2008

32. Creating a Virtual Directory (continued)
After a virtual directory is created, you can modify its properties in IIS Manager
You can set up the virtual directory to be shared
So that users who need access to add contents to the directory can do this over the network
Hands-On Microsoft Windows Server 2008

33. Hands-On Microsoft Windows Server 2008

34. Creating a Virtual Directory (continued)
Hands-On Microsoft Windows Server 2008

35. Managing and Configuring an IIS Web Server
The Internet Information Services tool enables you to manage IIS components including the following:
Application pools
Sites
SMTP
Certificates
Application pools enable you to group similar Web applications into pools or groups for management
Sites is a folder used to manage multiple Web sites from one administrative Web server
Hands-On Microsoft Windows Server 2008

36. Managing and Configuring an IIS Web Server (continued)
The SMTP Page feature is used to manage Internet via programs
Takes advantage of the application programming interface, system.net.mail
Through the certificates feature, you can configure and monitor certificate security that is used with other Web sites
Hands-On Microsoft Windows Server 2008

37. Hands-On Microsoft Windows Server 2008

38. Hands-On Microsoft Windows Server 2008

39. Troubleshooting a Web Server
Occasionally a Web server can experience problems, such as users not being able to connect to the server
Table 8-8 lists possible problems and their solutions
Hands-On Microsoft Windows Server 2008

40. Hands-On Microsoft Windows Server 2008

41. Using Active Directory Certificate Services
Public key infrastructure (PKI)
Linking a public key or a combination of public and private keys to a user or network entity
Uses a certificate authority to issue public key-based digital certificates to trustworthy network entities
Certificate authority (CA)
Network entity or host that issues digital certificates of trust verifying certificate holders’ legitimacy

42. Using Active Directory Certificate Services (cont’d.)
Public key
Encryption method that uses a public key and private key combination
Asymmetric encryption
One key used to encrypt the data, and the other key used to decrypt it
Public key/private key method
Uses an encryption algorithm developed by Whitfield Diffie and Martin Hellman

43. Using Active Directory Certificate Services (cont’d.)
X.509 standards for digital certificates
Developed by International Organization for Standardization (ISO)
Function as proof of identity for a specific network entity

44. Using Active Directory Certificate Services (cont’d.)
X.509 certificate contains:
Certificate format version
Certificate serial number
Signature algorithm identifier
Certificate authority (certificate issuer)
Length of time the certificate is valid
ID of the certificate holder
Public key data

45. Using Active Directory Certificate Services (cont’d.)
Active Directory Certificate Services role
Available in Windows Server 2008 Standard, Enterprise, and Datacenter Editions
Online Responder Service
Determines the status of digital certifications
Uses the Online Certificate Status Protocol (OCSP) to obtain and decode status information

46. Planning Active Directory Certificate Services
Understand the four kinds of CAs that can be set up in a Microsoft server environment
Enterprise root CA
Enterprise subordinate
Standalone root
Standalone subordinate
Root CA is always configured before any other CAs

47. Planning Active Directory Certificate Services (cont’d.)
Figure 9-7 CA hierarchy
Courtesy Course Technology/Cengage Learning

48. Planning Active Directory Certificate Services (cont’d.)
Implement enterprise root CA and enterprise subordinates
Not standalone model
Take into account the ways in which an organization can make most use of AD CS
PKI with multiple subordinate CAs has built-in redundancy

49. Planning Active Directory Certificate Services (cont’d.)
Role services for Active Directory Certificate Services:
Certificate Authority
Certification Authority Web Enrollment
Online Responder
Network Device Enrollment service

50. Certificate Services Roles
Recommended to divide responsibilities for handling money and important security tasks in an organization
AD CS enables dividing CA responsibilities into two roles:
CA administrator
Person or persons who manage the CA server
Certificate manager
Given to those who determine which users to enroll for certificates and when to revoke certificates