uCertify Articles » MCSE 2003 Messaging http://www.ucertify.com/article Just another WordPress weblog Wed, 04 Nov 2009 00:00:00 +0000 http://wordpress.org/?v=2.8.4 en hourly 1 How to create a baseline report? http://www.ucertify.com/article/how-to-create-a-baseline-report.html http://www.ucertify.com/article/how-to-create-a-baseline-report.html#comments Sun, 01 Nov 2009 00:00:00 +0000 uCertify 2101031

Take the following steps to create a baseline report:

  1. Run Performance from Start Menu > Programs > Administrative Tools > Performance.

  2. In the Performance console, click Performance Logs and Alerts to expand the tree, right-click Counter Logs, and click New Log Settings.

  3. In the New Log Settings dialog box, specify a name for the new counter log, and click the OK button.

  4. On the General tab page of the <counterlogname> dialog box, click the Add button.

  5. In the Add Counters dialog box, select a performance object from the Performance object drop down list box, and counters from the Select counters from list section, and click the Add button. Click the Close button.

  6. In the <counterlogname> dialog box, set the counter to sample data every 5 seconds, and click the Log Files tab.

  7. On the Log Files tab page, specify location for the log file, and uncheck the End file names with check box, and click the OK button.

  8. In the Performance console, click the View Log File Data button on the toolbar to view the log file.

  9. Close the Performance console.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-create-a-baseline-report.html/feed 0 What is Remote Desktop for Administration? http://www.ucertify.com/article/what-is-remote-desktop-for-administration.html http://www.ucertify.com/article/what-is-remote-desktop-for-administration.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1301178

Remote Desktop for Administration is a component of Windows Server 2003 Terminal Services, which is designed for server management. It is a convenient and efficient service for remote management, as it can be used on an already busy server without noticeably affecting CPU performance. Administrators can fully administer computers running Windows Server 2003 family operating systems from computers running earlier versions of Windows by installing the Remote Desktop Connection.

Note: Remote Desktop for Administration does not require purchasing special licenses for client computers that access the server.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-remote-desktop-for-administration.html/feed 0 What is Automated System Recovery? http://www.ucertify.com/article/what-is-automated-system-recovery.html http://www.ucertify.com/article/what-is-automated-system-recovery.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1301163

Automated System Recovery (ASR) is a feature of Windows Server 2003. It is used to perform a restore of the system state data and services in the event of a major system failure. An ASR restore includes the configuration information for devices. ASR backs up the system data and local system partition. It does not back up folders and files.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-automated-system-recovery.html/feed 0 Site and Replication http://www.ucertify.com/article/site-and-replication.html http://www.ucertify.com/article/site-and-replication.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1401271

What is a Site?

A site is a collection of one or more well-connected (usually a local area network) TCP/IP subnets. The network between the subnets must be highly reliable and fast (512 Kbps and higher). Although the sites are generally defined on the basis of location, they can be spanned over more than one location. A site structure corresponds to the physical environment, whereas a domain is the logical environment of the network. A site can contain single or multiple domains, and a domain can contain single or multiple sites.

The sites are created to physically group the computers and resources to optimize network traffic. Administrators can configure Active Directory access and replication technology to take advantage of the physical network by configuring sites. When a user logs on to the network, the authentication request searches for the domain controllers in the same site as the user. A site prevents the network traffic from traveling on slow wide area network (WAN) links.

What are Directory Tree, Directory Partition, and Replica?

Directory tree is a hierarchy of objects and containers of Active Directory, which represents all the objects in the forest. Each domain controller stores a copy of a specific part of the directory tree, called a directory partition (sometimes called naming context). The copy of the directory partition is called a replica. A replica contains all attributes for each directory partition object. Each domain controller in the forest stores a replica.

What is replication?

Replication is a process through which the changes made to a replica on one domain controller are synchronized to replicas on all the other domain controllers in the network. Each domain controller stores three types of replicas:

  • Schema partition: This partition stores definitions and attributes of objects that can be created in the forest. The changes made in this partition are replicated to all the domain controllers in all the domains in the forest.

  • Configuration partition: This partition stores the logical structure of the forest deployment. It includes the domain structure and the replication topology. The changes made in this partition are replicated to all the domain controllers in all the domains in the forest.

  • Domain partition: This partition stores all the objects in a domain. Changes made in this partition are replicated to all the domain controllers within the domain.

Note: Windows Server 2003 supports a new type of directory partition named Application directory partition. This partition is available only to Windows 2003 domain controllers. The applications and services use this partition to store application-specific data.

Creating, modifying, moving, and deleting an object trigger a replication between domain controllers. Replications are of two types:

  • Intrasite: An intrasite (within a site) replication mostly uses LAN connections. As intrasite replication does not compress data, it saves a computer’s CPU time. In an intrasite replication, the replication partners poll each other periodically and notify each other when changes need to be replicated, and then pull the information for processing. Active Directory uses a remote procedure call (RPC) transport protocol for intrasite replication.

  • Intersite: As an intersite (between sites) replication uses WAN connections, a large amount of data is compressed to save WAN bandwidth. For the same reason, the replication partners do not notify each other when changes need to be replicated. Instead, administrators configure the replication schedule to update the information. Active Directory uses an IP or SMTP protocol for intersite replication.

For intrasite replication to take place, connection objects are required. The Active Directory automatically creates and deletes connection objects as and when required. Connection objects can be created manually to force replication.

What are Site Links?

Site links are logical, transitive connections between two or more sites. For intersite replication to take place, site links are required to be configured. Once a site link has been configured, the knowledge consistency checker (KCC) then automatically generates the replication topology by creating the appropriate connection objects. Site links are used to determine the paths between two sites. They must be created manually.

Site links are transitive in nature. For example, if Site 1 is linked with Site 2 and Site 2 is linked with Site 3, then Site 1 and Site 3 are linked transitively. The administrators can control transitivity of the site link. By default, transitivity is enabled. Site link transitivity can be enabled or disabled through a bridge.

What is Site Link Bridge?

A site link bridge is created to build a transitive and logical link between two sites that do not have an explicit site link. The site link bridge is created only when the transitivity of the site link is disabled.

What is Site Link Cost?

Site link cost is an attribute of a site link. Each site link has been assigned a default cost of 100. The knowledge consistency checker (KCC) uses the site link cost to determine which site links should be preferred for replication. It should be remembered that the lower the site link cost, the more preferred is the link.

For example, an administrator has to configure the site link cost of links between Site 1 and Site 2. There are two site links available as shown in the image below:

S1S2 is a T1 site link that uses T1 lines for replication, whereas S1S2DU uses a dial-up connection for replication. If the administrator requires that the KCC should prefer the S1S2 site link to the S1S2DU site link for replication, he will have to configure the SIS2 link with a lower cost than that of the S1S2DU link. Any site link configured with the site link cost of one (1) will always get preference over the other site links with a higher cost.

What is Bridgehead Server?

A bridgehead server is a domain controller in each site, which is used as a contact point to receive and replicate data between sites. For intersite replication, KCC designates one of the domain controllers as a bridgehead server. In case the server is down, KCC designates another one from the domain controller. When a bridgehead server receives replication updates from another site, it replicates the data to the other domain controllers within its site.

What is Preferred Bridgehead Server?

A preferred bridgehead server is a domain controller in a site, specified by an administrator, to act as a bridgehead server. Administrators can specify more than one preferred bridgehead server, but only one server is active at a time in a site. A preferred bridgehead server is designated to take advantage of a certain domain controller having the appropriate bandwidth to transmit and receive information.

Note: If only one preferred bridgehead server is configured in a site, and it fails, then no replication will take place for that site.

Share/Bookmark]]> http://www.ucertify.com/article/site-and-replication.html/feed 0 Secure Internetwork Communication By Using Packet Filtering http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html#comments Thu, 29 Oct 2009 00:00:00 +0000 uCertify 1401369

The Windows Server 2003 operating system is designed to work on a network. It receives traffic from other computers over the network. Based on the request made, it takes a decision to route packets to use its services, and processes the request sent by the client. Any computer, when accessible for communication, is also a security risk, if it is accessible from the Internet too. A server accessible from the Internet is open to all clients that can connect to it. An unauthorized user can attempt to access the system for many destructive purposes. The most common of them are listed below:

  • Accessing confidential data.

  • Implementing software of its own.

  • Preventing others from using the server.

The most used technique to prevent such intrusions is to use packet filtering.

Packet Filtering

Packet filtering is a method that allows or restricts the flow of specific types of packets to provide security. It analyzes the incoming and outgoing packets and lets them pass or stops them based on the IP addresses of the source and destination. Packet filtering provides a way to define precisely which type of IP traffic is allowed to cross the firewall of an intranet. IP packet filtering is important when users from private intranets connect to public networks, such as the Internet.

A server implementing the filter examines each packet as it arrives and determines whether it meets the criteria for fulfilling its request. Packets that do not meet the criteria are discarded. For example, if an administrator is configuring a server that will be used as an e-mail server, he should create a filter to allow packets that are addressed to port number 25 and port number 110. This is because e-mail servers use the Simple Mail Transfer Protocol (SMTP) and the Post Office Protocol 3 (POP3). The SMTP and POP3 protocols use ports 25 and 110 respectively for communication. If a suspected intruder tries to attack the server, the server will examine the packets sent by him and discard the packets that are not addressed to use ports 25 and 110.

Ports and Protocols

Some of the important applications and the port numbers they use are summarized in the table below:

Application Protocol Port Number
File Transfer Protocol (Control) TCP 21
Telnet TCP 23
Simple Mail Transfer Protocol TCP 25
Domain Name Service TCP/UDP 53
Dynamic Host Configuration Protocol (Server) UDP 67
Dynamic Host Configuration Protocol (Client) UDP 68
World Wide Web HTTP TCP 80
Post Office Protocol 3 TCP 110
Simple Network Management Protocol UDP 161

Note: The listed port numbers in the above table are also called well-known ports. The complete and updated list of well-known port numbers is available at http://www.iana.org/assignments/port-numbers.

Packet filtering is mostly configured on routers or firewalls that connect a private network to the public network such as the Internet. However, it can be configured inside the network to protect a server with confidential information from being accessed by other users on the network.

Packet Filtering Criteria

Administrators can configure packet filtering inclusively or exclusively:

  • Start with a network connection that is completely blocked and use filters to specify that the traffic can pass through.

  • Start with a completely open connection and specify the types of traffic to be blocked.

The criteria used for packet filtering are as follows:

  • Port Numbers: This is the most common type of packet filtering criteria. Port numbers can be used to block or allow packets using certain ports.

  • Protocol Identifiers: Protocol identifiers can be used to filter packets based on an entire protocol. Administrators can use this filter to block packets that are intended to use certain protocols. For example, an administrator can block all UDP and ICMP traffic. This prevents attackers from using applications that are based on these protocols.

  • IP Address: IP address filtering is used by administrators to limit network access to specific computers. IP address filtering is useful for protecting a part of a private network from users on another part of the network. It should be noted that IP address filtering is not considered to be a very secure method for securing a network. Intruders can get into the network using a technique called spoofing.

  • Hardware addresses: Filtering can be done through hardware addresses. Each network interface adapter at the factory is coded with the media access control (MAC) address known as hardware address. It works in the same way as IP address filtering. However, it is more difficult to spoof a hardware address than an IP address.

Packet Filtering in Windows Server 2003

Windows Server 2003 uses two packet filtering options:

  • TCP/IP Packet Filtering: In Windows Server 2003, take the following steps to implement TCP/IP filtering:
    1. Run Network Connections from Start Menu > Settings > Network Connections.

    2. In the Network Connections folder, right-click the Local Area Connection icon, and click Properties.

    3. In the Local Area Connection Properties dialog box, select Internet Protocol (TCP/IP), and click the Properties button.

    4. In the Internet Protocol (TCP/IP) Properties dialog box, click the Advanced button.

    5. In the Advanced TCP/IP Settings dialog box, click the Options tab. On the Options tab page, select TCP/IP filtering, and click the Properties button.

    6. In the TCP/IP Filtering dialog box, click the Enable TCP/IP Filtering (All adapters) check box. Click the appropriate Permit Only radio button to specify the port, and click the Add button.

    7. In the Add Filter dialog box, specify the port number in the TCP Port section, and click the OK button.

    8. In the TCP/IP Filtering dialog box, click the OK button.

  • Routing and Remote Access Service Packet Filtering: This option is more capable than TCP/IP packet filtering. However, administrators can use this type of filtering only when a server running Windows Server 2003 is configured as a router. By using this filter, you can use many criteria that TCP/IP filtering does not have. Some of the important capabilities of this type of filtering are as follows:
    • It can create filters based on the IP addresses, protocols, and port numbers of a packet’s source or destination.

    • It can create inclusive or exclusive filters.

    • It can create filters for ICMP messages, specified by the message type and code values.

    • It can create multiple filters of the same type.

Although packet filters can prevent a network from unauthorized intrusion, this technique cannot be used for safe and secure communications.

Share/Bookmark]]> http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html/feed 0 What is 802.11g? http://www.ucertify.com/article/what-is-80211g.html http://www.ucertify.com/article/what-is-80211g.html#comments Wed, 28 Oct 2009 00:00:00 +0000 uCertify 1401425

The 802.11g standard, defined by IEEE, is an extension to the 802.11b standard of wireless network. It operates in 2.4-GHz band and brings data rates up to 54Mbps using Orthogonal Frequency-Division Multiplexing (OFDM) technology. Since the 802.11g standard is backward compatible with 802.11b, an 802.11b device can interface directly with an 802.11g access point.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-80211g.html/feed 0 Managing Public folders in Exchange Server 2003. http://www.ucertify.com/article/managing-public-folders-in-exchange-server-2003.html http://www.ucertify.com/article/managing-public-folders-in-exchange-server-2003.html#comments Wed, 28 Oct 2009 00:00:00 +0000 uCertify 2500270

Public folders in an Exchange Server 2003 organization enable a member to access the e-mails sent by any other user of the organization. They are used to permanently store information, such as e-mail messages, graphics, and sound bites. The information stored in public folders is available to all the users of the organization. On an Exchange 2003 server, public folders are stored in the public information store (ExchsrvrMdbdataPub.edb). In an Exchange organization with multiple servers, public folders can be replicated to other servers for the purpose of load balancing and easy manageability of messages in the folders. The replication can occur among servers that reside either within a site or across multiple sites. With public folders, users can manage their messages very easily. They can be created from either Outlook or Exchange System Manager. Exchange administrators can use Exchange System Manager to create public folders.

Creating a Public folder from Exchange System Manager:

  1. Open Exchange System Manager, navigate to an administrative group, expand Folders, right-click Public Folders, and click New > Public Folder.

  2. In the Properties dialog box, provide the necessary entries in the text boxes, and click the OK button.

Exchange Server 2003 supports two types of public folder trees, which are displayed when a user browses the All Public Folders container. These are: default public folder tree and general purpose public folder trees.

Default public folder tree: It is automatically created when the first Exchange Server 2003 server is installed. It is listed as Public Folders in Exchange System Manager and is displayed in Outlook as All Public Folders. The tree contains a list of all public folders. In an Exchange organization with multiple servers, the default public folder tree is replicated to each server that contains a public folder store associated with the tree.

General purpose public folder trees: Similar to the default public folder tree, it is an additional public folder tree that is replicated on servers running at least Exchange 2000 Server that contains the public folder store associated with that tree. Since general purpose public folder trees do not support Message Application Programming Interface (MAPI) clients, they are invisible or inaccessible to Outlook users. Only NNTP or HTTP clients can access them. If a user wants to access this folder from a Web browser, the organization must have an HTTP virtual server put into service. General Purpose public folder trees are normally used to store custom applications. Another use of such trees is to make the public folder data available to users outside the organization. Although users can create any number of General Purpose Public Folder trees depending on the need, they must be associated with public folder stores before they can be used. Users should first create a public folder tree, then a public store, and finally associate the store with the tree.

Creating a Public folder tree from Exchange System Manager: A Public Folder Tree can be created in the following way:

  1. In Exchange System Manager, navigate to an administrative group, right-click the Folders container, and select New > Public Folder Tree.

  2. In the Properties dialog box, provide a name of the tree in the Name section, and click the OK button.

Since Public folders created in Exchange System Manager are not mail-enabled by default, they must be manually mail-enabled from the console after their creation. If a newly created public folder is not mail-enabled, it cannot be used to receive e-mails. A user can mail-enable a public folder by right-clicking a public folder in Exchange System Manager, and clicking All Tasks > Mail Enable. Mail-enabling a public folder creates e-mail addresses for X.400 and SMTP.

Configuring storage limits on public folders: Since public folders are open to users outside the Exchange organization, they are highly vulnerable to quick growth in their sizes. Therefore, it is necessary for administrators to set storage limits on the folders so that their unlimited growth can be restricted. They can configure storage limits in three ways: by setting limits on an entire public store or individual public store, or by creating a public store policy and applying it to multiple public stores. When administrators set limits on a public store, all the folders in that store inherit those settings. When administrators want to apply common storage limit settings to multiple public stores, they can create a public store policy and apply it to as many public stores as required. When a policy is applied to a public store, the storage limits cannot be overridden at either the store level or the individual public folder level. However, if the limits are configured on a public store, they can be overridden on an individual public folder basis. Setting age limits for public folders is a very important task that an administrator must perform specially when users outside the Exchange organization access public folders. Setting age limits on public folders automatically deletes specified items of the folders when the specified time or duration is over.

Exchange Server 2003 also allows administrators to move public folders within a tree, thereby enabling them to modify the public folder structure as per the requirement of the organization. However, a public folder cannot be copied or moved between trees. In an organization containing multiple sites, it is generally inefficient, and sometimes proves to be costly for users at remote sites to access public folders in other sites, which are usually connected via a slow WAN link. Replication proves to be a remedy in such situations. Public folders in a public store can be replicated to other public stores on a server in another site. Administrators can also schedule the replication process as per their requirements. Since Exchange Server 2003 uses a multimaster replication model, all the replicas of a public folder are equal, and modifications performed to any replica are automatically reflected to other replicas exactly. However, administrators can restrict the replication process if they do not want it to be done as per schedule. They can manually adjust the replication process.

When a user connects to a public folder store and does not find the required information there, Exchange Server 2003 automatically redirects the user to the server that contains the requested information. This process occurs in the background and is referred to as referral.

Configuring security on public folders: Since public folders are most likely vulnerable to security threats due to the fact that users outside an organization can access them, proper security mechanism must be adopted to control the level and type of public folder access. This can be implemented by applying the public folder-permissions in an appropriate way. There are three categories of public folder permissions used to control the accessibility of public folders. The following table displays the categories of permissions and their roles:

Permission Roles
Client permissions Controls the permissions of the users accessing the public folder.
Directory rights Controls which user can manipulate a mail-enabled public folder object stored in Active Directory
Administrative rights Controls the assignment of specific administrative permissions to specific administrators.

Administrators frequently work with client permission that can be configured from Exchange System Manager by opening the Client Permissions for Public folder dialog box. This dialog box is opened by right-clicking a public folder, clicking Properties, clicking on the Permissions tab, and then clicking the Client Permissions button.

Directory rights can also by configured from Exchange System Manager. Only the Administrator account and members of the Administrators, Enterprise Admins, Exchange Domain Servers, and Exchange Enterprise Servers groups have these rights (permissions).

Administrative rights control the users and groups that can use Exchange System Manager, or any other administrative utility to configure the replication, storage limits, and other public folder-related settings. By default, only administrators in the Active Directory domain and enterprise have administrative rights to a public folder.

Share/Bookmark]]> http://www.ucertify.com/article/managing-public-folders-in-exchange-server-2003.html/feed 0 How to block an e-mail address on an Exchange Server 2003 server? http://www.ucertify.com/article/how-to-block-an-e-mail-address-on-an-exchange-server-2003-server.html http://www.ucertify.com/article/how-to-block-an-e-mail-address-on-an-exchange-server-2003-server.html#comments Tue, 27 Oct 2009 00:00:00 +0000 uCertify 2500335

Take the following steps to block an e-mail address:

  1. Run System Manager from the Start menu.

  2. In the Exchange System Manager console, click Global Settings.

  3. In the details pane, right-click Message Delivery, and then click Properties.

  4. On the Sender Filtering tab page of the Message Delivery dialog box, click the Add button.

  5. In the Add Sender dialog box, type the address to be blocked, and click the OK button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-block-an-e-mail-address-on-an-exchange-server-2003-server.html/feed 0 How to configure a RAS connection? http://www.ucertify.com/article/how-to-configure-a-ras-connection-3.html http://www.ucertify.com/article/how-to-configure-a-ras-connection-3.html#comments Sun, 27 Sep 2009 00:00:00 +0000 uCertify 3601018

Take the following steps to configure a Remote Access Server (RAS) connection:

  1. Run Control Panel from Start Menu > Settings > Control Panel.

  2. In Control Panel, double-click the Network Connections icon.

  3. In the Network Connections folder, click the Create a new connection in the Network Tasks section.

  4. In the welcome screen of the Network Connection Wizard, click the Next button.

  5. In the Network Connection Type page, click the Connect to the network at my workplace radio button.

  6. In the Network Connection page, click the Dial-up connection radio button.

  7. In the Connection Name page, type the name of the company.

  8. On the Phone Number to Dial page, specify the information about the phone number, and click the Next button.

  9. On the Completing the New Connection Wizard page, click the Finish button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-configure-a-ras-connection-3.html/feed 0 What is public key encryption? http://www.ucertify.com/article/what-is-public-key-encryption-2.html http://www.ucertify.com/article/what-is-public-key-encryption-2.html#comments Thu, 17 Sep 2009 00:00:00 +0000 uCertify 2500319

Public key encryption is one of the encryption types, which uses a public key that is known to everyone and a private key that is known only to the recipient of the message. When a user wants to send a secure message to another user, the sending user uses the target user’s public key to encrypt the message, and the target user then decrypts the message using his private key, which is known only to the target user. If a public key is used to encrypt a message, only the corresponding private key can be used to decrypt it.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-public-key-encryption-2.html/feed 0