uCertify Articles » MCSE 2000 Security http://www.ucertify.com/article Just another WordPress weblog Wed, 04 Nov 2009 00:00:00 +0000 http://wordpress.org/?v=2.8.4 en hourly 1 How to create a baseline report? http://www.ucertify.com/article/how-to-create-a-baseline-report.html http://www.ucertify.com/article/how-to-create-a-baseline-report.html#comments Sun, 01 Nov 2009 00:00:00 +0000 uCertify 2101031

Take the following steps to create a baseline report:

  1. Run Performance from Start Menu > Programs > Administrative Tools > Performance.

  2. In the Performance console, click Performance Logs and Alerts to expand the tree, right-click Counter Logs, and click New Log Settings.

  3. In the New Log Settings dialog box, specify a name for the new counter log, and click the OK button.

  4. On the General tab page of the <counterlogname> dialog box, click the Add button.

  5. In the Add Counters dialog box, select a performance object from the Performance object drop down list box, and counters from the Select counters from list section, and click the Add button. Click the Close button.

  6. In the <counterlogname> dialog box, set the counter to sample data every 5 seconds, and click the Log Files tab.

  7. On the Log Files tab page, specify location for the log file, and uncheck the End file names with check box, and click the OK button.

  8. In the Performance console, click the View Log File Data button on the toolbar to view the log file.

  9. Close the Performance console.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-create-a-baseline-report.html/feed 0 What is Remote Desktop for Administration? http://www.ucertify.com/article/what-is-remote-desktop-for-administration.html http://www.ucertify.com/article/what-is-remote-desktop-for-administration.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1301178

Remote Desktop for Administration is a component of Windows Server 2003 Terminal Services, which is designed for server management. It is a convenient and efficient service for remote management, as it can be used on an already busy server without noticeably affecting CPU performance. Administrators can fully administer computers running Windows Server 2003 family operating systems from computers running earlier versions of Windows by installing the Remote Desktop Connection.

Note: Remote Desktop for Administration does not require purchasing special licenses for client computers that access the server.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-remote-desktop-for-administration.html/feed 0 What is Automated System Recovery? http://www.ucertify.com/article/what-is-automated-system-recovery.html http://www.ucertify.com/article/what-is-automated-system-recovery.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1301163

Automated System Recovery (ASR) is a feature of Windows Server 2003. It is used to perform a restore of the system state data and services in the event of a major system failure. An ASR restore includes the configuration information for devices. ASR backs up the system data and local system partition. It does not back up folders and files.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-automated-system-recovery.html/feed 0 Site and Replication http://www.ucertify.com/article/site-and-replication.html http://www.ucertify.com/article/site-and-replication.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1401271

What is a Site?

A site is a collection of one or more well-connected (usually a local area network) TCP/IP subnets. The network between the subnets must be highly reliable and fast (512 Kbps and higher). Although the sites are generally defined on the basis of location, they can be spanned over more than one location. A site structure corresponds to the physical environment, whereas a domain is the logical environment of the network. A site can contain single or multiple domains, and a domain can contain single or multiple sites.

The sites are created to physically group the computers and resources to optimize network traffic. Administrators can configure Active Directory access and replication technology to take advantage of the physical network by configuring sites. When a user logs on to the network, the authentication request searches for the domain controllers in the same site as the user. A site prevents the network traffic from traveling on slow wide area network (WAN) links.

What are Directory Tree, Directory Partition, and Replica?

Directory tree is a hierarchy of objects and containers of Active Directory, which represents all the objects in the forest. Each domain controller stores a copy of a specific part of the directory tree, called a directory partition (sometimes called naming context). The copy of the directory partition is called a replica. A replica contains all attributes for each directory partition object. Each domain controller in the forest stores a replica.

What is replication?

Replication is a process through which the changes made to a replica on one domain controller are synchronized to replicas on all the other domain controllers in the network. Each domain controller stores three types of replicas:

  • Schema partition: This partition stores definitions and attributes of objects that can be created in the forest. The changes made in this partition are replicated to all the domain controllers in all the domains in the forest.

  • Configuration partition: This partition stores the logical structure of the forest deployment. It includes the domain structure and the replication topology. The changes made in this partition are replicated to all the domain controllers in all the domains in the forest.

  • Domain partition: This partition stores all the objects in a domain. Changes made in this partition are replicated to all the domain controllers within the domain.

Note: Windows Server 2003 supports a new type of directory partition named Application directory partition. This partition is available only to Windows 2003 domain controllers. The applications and services use this partition to store application-specific data.

Creating, modifying, moving, and deleting an object trigger a replication between domain controllers. Replications are of two types:

  • Intrasite: An intrasite (within a site) replication mostly uses LAN connections. As intrasite replication does not compress data, it saves a computer’s CPU time. In an intrasite replication, the replication partners poll each other periodically and notify each other when changes need to be replicated, and then pull the information for processing. Active Directory uses a remote procedure call (RPC) transport protocol for intrasite replication.

  • Intersite: As an intersite (between sites) replication uses WAN connections, a large amount of data is compressed to save WAN bandwidth. For the same reason, the replication partners do not notify each other when changes need to be replicated. Instead, administrators configure the replication schedule to update the information. Active Directory uses an IP or SMTP protocol for intersite replication.

For intrasite replication to take place, connection objects are required. The Active Directory automatically creates and deletes connection objects as and when required. Connection objects can be created manually to force replication.

What are Site Links?

Site links are logical, transitive connections between two or more sites. For intersite replication to take place, site links are required to be configured. Once a site link has been configured, the knowledge consistency checker (KCC) then automatically generates the replication topology by creating the appropriate connection objects. Site links are used to determine the paths between two sites. They must be created manually.

Site links are transitive in nature. For example, if Site 1 is linked with Site 2 and Site 2 is linked with Site 3, then Site 1 and Site 3 are linked transitively. The administrators can control transitivity of the site link. By default, transitivity is enabled. Site link transitivity can be enabled or disabled through a bridge.

What is Site Link Bridge?

A site link bridge is created to build a transitive and logical link between two sites that do not have an explicit site link. The site link bridge is created only when the transitivity of the site link is disabled.

What is Site Link Cost?

Site link cost is an attribute of a site link. Each site link has been assigned a default cost of 100. The knowledge consistency checker (KCC) uses the site link cost to determine which site links should be preferred for replication. It should be remembered that the lower the site link cost, the more preferred is the link.

For example, an administrator has to configure the site link cost of links between Site 1 and Site 2. There are two site links available as shown in the image below:

S1S2 is a T1 site link that uses T1 lines for replication, whereas S1S2DU uses a dial-up connection for replication. If the administrator requires that the KCC should prefer the S1S2 site link to the S1S2DU site link for replication, he will have to configure the SIS2 link with a lower cost than that of the S1S2DU link. Any site link configured with the site link cost of one (1) will always get preference over the other site links with a higher cost.

What is Bridgehead Server?

A bridgehead server is a domain controller in each site, which is used as a contact point to receive and replicate data between sites. For intersite replication, KCC designates one of the domain controllers as a bridgehead server. In case the server is down, KCC designates another one from the domain controller. When a bridgehead server receives replication updates from another site, it replicates the data to the other domain controllers within its site.

What is Preferred Bridgehead Server?

A preferred bridgehead server is a domain controller in a site, specified by an administrator, to act as a bridgehead server. Administrators can specify more than one preferred bridgehead server, but only one server is active at a time in a site. A preferred bridgehead server is designated to take advantage of a certain domain controller having the appropriate bandwidth to transmit and receive information.

Note: If only one preferred bridgehead server is configured in a site, and it fails, then no replication will take place for that site.

Share/Bookmark]]> http://www.ucertify.com/article/site-and-replication.html/feed 0 Secure Internetwork Communication By Using Packet Filtering http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html#comments Thu, 29 Oct 2009 00:00:00 +0000 uCertify 1401369

The Windows Server 2003 operating system is designed to work on a network. It receives traffic from other computers over the network. Based on the request made, it takes a decision to route packets to use its services, and processes the request sent by the client. Any computer, when accessible for communication, is also a security risk, if it is accessible from the Internet too. A server accessible from the Internet is open to all clients that can connect to it. An unauthorized user can attempt to access the system for many destructive purposes. The most common of them are listed below:

  • Accessing confidential data.

  • Implementing software of its own.

  • Preventing others from using the server.

The most used technique to prevent such intrusions is to use packet filtering.

Packet Filtering

Packet filtering is a method that allows or restricts the flow of specific types of packets to provide security. It analyzes the incoming and outgoing packets and lets them pass or stops them based on the IP addresses of the source and destination. Packet filtering provides a way to define precisely which type of IP traffic is allowed to cross the firewall of an intranet. IP packet filtering is important when users from private intranets connect to public networks, such as the Internet.

A server implementing the filter examines each packet as it arrives and determines whether it meets the criteria for fulfilling its request. Packets that do not meet the criteria are discarded. For example, if an administrator is configuring a server that will be used as an e-mail server, he should create a filter to allow packets that are addressed to port number 25 and port number 110. This is because e-mail servers use the Simple Mail Transfer Protocol (SMTP) and the Post Office Protocol 3 (POP3). The SMTP and POP3 protocols use ports 25 and 110 respectively for communication. If a suspected intruder tries to attack the server, the server will examine the packets sent by him and discard the packets that are not addressed to use ports 25 and 110.

Ports and Protocols

Some of the important applications and the port numbers they use are summarized in the table below:

Application Protocol Port Number
File Transfer Protocol (Control) TCP 21
Telnet TCP 23
Simple Mail Transfer Protocol TCP 25
Domain Name Service TCP/UDP 53
Dynamic Host Configuration Protocol (Server) UDP 67
Dynamic Host Configuration Protocol (Client) UDP 68
World Wide Web HTTP TCP 80
Post Office Protocol 3 TCP 110
Simple Network Management Protocol UDP 161

Note: The listed port numbers in the above table are also called well-known ports. The complete and updated list of well-known port numbers is available at http://www.iana.org/assignments/port-numbers.

Packet filtering is mostly configured on routers or firewalls that connect a private network to the public network such as the Internet. However, it can be configured inside the network to protect a server with confidential information from being accessed by other users on the network.

Packet Filtering Criteria

Administrators can configure packet filtering inclusively or exclusively:

  • Start with a network connection that is completely blocked and use filters to specify that the traffic can pass through.

  • Start with a completely open connection and specify the types of traffic to be blocked.

The criteria used for packet filtering are as follows:

  • Port Numbers: This is the most common type of packet filtering criteria. Port numbers can be used to block or allow packets using certain ports.

  • Protocol Identifiers: Protocol identifiers can be used to filter packets based on an entire protocol. Administrators can use this filter to block packets that are intended to use certain protocols. For example, an administrator can block all UDP and ICMP traffic. This prevents attackers from using applications that are based on these protocols.

  • IP Address: IP address filtering is used by administrators to limit network access to specific computers. IP address filtering is useful for protecting a part of a private network from users on another part of the network. It should be noted that IP address filtering is not considered to be a very secure method for securing a network. Intruders can get into the network using a technique called spoofing.

  • Hardware addresses: Filtering can be done through hardware addresses. Each network interface adapter at the factory is coded with the media access control (MAC) address known as hardware address. It works in the same way as IP address filtering. However, it is more difficult to spoof a hardware address than an IP address.

Packet Filtering in Windows Server 2003

Windows Server 2003 uses two packet filtering options:

  • TCP/IP Packet Filtering: In Windows Server 2003, take the following steps to implement TCP/IP filtering:
    1. Run Network Connections from Start Menu > Settings > Network Connections.

    2. In the Network Connections folder, right-click the Local Area Connection icon, and click Properties.

    3. In the Local Area Connection Properties dialog box, select Internet Protocol (TCP/IP), and click the Properties button.

    4. In the Internet Protocol (TCP/IP) Properties dialog box, click the Advanced button.

    5. In the Advanced TCP/IP Settings dialog box, click the Options tab. On the Options tab page, select TCP/IP filtering, and click the Properties button.

    6. In the TCP/IP Filtering dialog box, click the Enable TCP/IP Filtering (All adapters) check box. Click the appropriate Permit Only radio button to specify the port, and click the Add button.

    7. In the Add Filter dialog box, specify the port number in the TCP Port section, and click the OK button.

    8. In the TCP/IP Filtering dialog box, click the OK button.

  • Routing and Remote Access Service Packet Filtering: This option is more capable than TCP/IP packet filtering. However, administrators can use this type of filtering only when a server running Windows Server 2003 is configured as a router. By using this filter, you can use many criteria that TCP/IP filtering does not have. Some of the important capabilities of this type of filtering are as follows:
    • It can create filters based on the IP addresses, protocols, and port numbers of a packet’s source or destination.

    • It can create inclusive or exclusive filters.

    • It can create filters for ICMP messages, specified by the message type and code values.

    • It can create multiple filters of the same type.

Although packet filters can prevent a network from unauthorized intrusion, this technique cannot be used for safe and secure communications.

Share/Bookmark]]> http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html/feed 0 What is 802.11g? http://www.ucertify.com/article/what-is-80211g.html http://www.ucertify.com/article/what-is-80211g.html#comments Wed, 28 Oct 2009 00:00:00 +0000 uCertify 1401425

The 802.11g standard, defined by IEEE, is an extension to the 802.11b standard of wireless network. It operates in 2.4-GHz band and brings data rates up to 54Mbps using Orthogonal Frequency-Division Multiplexing (OFDM) technology. Since the 802.11g standard is backward compatible with 802.11b, an 802.11b device can interface directly with an 802.11g access point.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-80211g.html/feed 0 How to configure a RAS connection? http://www.ucertify.com/article/how-to-configure-a-ras-connection-3.html http://www.ucertify.com/article/how-to-configure-a-ras-connection-3.html#comments Sun, 27 Sep 2009 00:00:00 +0000 uCertify 3601018

Take the following steps to configure a Remote Access Server (RAS) connection:

  1. Run Control Panel from Start Menu > Settings > Control Panel.

  2. In Control Panel, double-click the Network Connections icon.

  3. In the Network Connections folder, click the Create a new connection in the Network Tasks section.

  4. In the welcome screen of the Network Connection Wizard, click the Next button.

  5. In the Network Connection Type page, click the Connect to the network at my workplace radio button.

  6. In the Network Connection page, click the Dial-up connection radio button.

  7. In the Connection Name page, type the name of the company.

  8. On the Phone Number to Dial page, specify the information about the phone number, and click the Next button.

  9. On the Completing the New Connection Wizard page, click the Finish button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-configure-a-ras-connection-3.html/feed 0 What is the Last Known Good Configuration? http://www.ucertify.com/article/what-is-the-last-known-good-configuration-2.html http://www.ucertify.com/article/what-is-the-last-known-good-configuration-2.html#comments Tue, 15 Sep 2009 00:00:00 +0000 uCertify 2500231

The Last Known Good Configuration is an advanced boot option. It starts a Windows operating system by using the Registry information that was saved at the last successful logon. The configuration is stored in the HKLMSystemCurrentControlSet registry key. Although the Last Known Good Configuration option does not solve problems caused by corrupted or missing drivers or files, it enables a user to revert to the previous working state in case there are problems with the drivers. When a user opts for this boot option, he loses any modifications made since the last successful logon. A user can view this boot option by pressing the F8 key during the Windows XP boot process.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-the-last-known-good-configuration-2.html/feed 0 What is the Roll Back Driver feature? http://www.ucertify.com/article/what-is-the-roll-back-driver-feature-2.html http://www.ucertify.com/article/what-is-the-roll-back-driver-feature-2.html#comments Sun, 13 Sep 2009 00:00:00 +0000 uCertify 2500194

Roll Back Driver is a feature of Device Manager that restores the previous device driver that was installed on a computer before the driver was updated. Windows supports driver rollback for all devices except printers. Rolling back a driver is available only on devices that have new drivers installed. When a driver is updated, the previous version is stored in the %system_root%system32
einstallbackups folder. Rolling back a driver uses this folder to revert to a previous version. A user should roll back a driver when he does not want to affect other system configurations or drivers and is assured that the current driver is causing problems.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-the-roll-back-driver-feature-2.html/feed 0 In Windows XP Professional, what is the use of StickyKeys? http://www.ucertify.com/article/in-windows-xp-professional-what-is-the-use-of-stickykeys-2.html http://www.ucertify.com/article/in-windows-xp-professional-what-is-the-use-of-stickykeys-2.html#comments Fri, 11 Sep 2009 00:00:00 +0000 uCertify 2500115

StickyKeys is a feature of Windows XP that is found on the Keyboard tab page of the Accessibility Options dialog box, which can be accessed from the Control Panel. It is a keyboard feature that can be enabled or disabled by a user to change the behavior of the keyboard of a computer. Enabling this feature allows a user to press multiple key combinations, one key at a time. This proves to be very useful for such users who are not ambidextrous or find difficulties in pressing multiple keys simultaneously. By default, StickyKeys can be enabled by pressing the SHIFT key five times. A user can also configure the default shortcut key for StickyKeys.

Share/Bookmark]]> http://www.ucertify.com/article/in-windows-xp-professional-what-is-the-use-of-stickykeys-2.html/feed 0