uCertify Articles » 70-293 http://www.ucertify.com/article Just another WordPress weblog Wed, 04 Nov 2009 00:00:00 +0000 http://wordpress.org/?v=2.8.4 en hourly 1 What is Automated System Recovery? http://www.ucertify.com/article/what-is-automated-system-recovery.html http://www.ucertify.com/article/what-is-automated-system-recovery.html#comments Sat, 31 Oct 2009 00:00:00 +0000 uCertify 1301163

Automated System Recovery (ASR) is a feature of Windows Server 2003. It is used to perform a restore of the system state data and services in the event of a major system failure. An ASR restore includes the configuration information for devices. ASR backs up the system data and local system partition. It does not back up folders and files.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-automated-system-recovery.html/feed 0 Secure Internetwork Communication By Using Packet Filtering http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html#comments Thu, 29 Oct 2009 00:00:00 +0000 uCertify 1401369

The Windows Server 2003 operating system is designed to work on a network. It receives traffic from other computers over the network. Based on the request made, it takes a decision to route packets to use its services, and processes the request sent by the client. Any computer, when accessible for communication, is also a security risk, if it is accessible from the Internet too. A server accessible from the Internet is open to all clients that can connect to it. An unauthorized user can attempt to access the system for many destructive purposes. The most common of them are listed below:

  • Accessing confidential data.

  • Implementing software of its own.

  • Preventing others from using the server.

The most used technique to prevent such intrusions is to use packet filtering.

Packet Filtering

Packet filtering is a method that allows or restricts the flow of specific types of packets to provide security. It analyzes the incoming and outgoing packets and lets them pass or stops them based on the IP addresses of the source and destination. Packet filtering provides a way to define precisely which type of IP traffic is allowed to cross the firewall of an intranet. IP packet filtering is important when users from private intranets connect to public networks, such as the Internet.

A server implementing the filter examines each packet as it arrives and determines whether it meets the criteria for fulfilling its request. Packets that do not meet the criteria are discarded. For example, if an administrator is configuring a server that will be used as an e-mail server, he should create a filter to allow packets that are addressed to port number 25 and port number 110. This is because e-mail servers use the Simple Mail Transfer Protocol (SMTP) and the Post Office Protocol 3 (POP3). The SMTP and POP3 protocols use ports 25 and 110 respectively for communication. If a suspected intruder tries to attack the server, the server will examine the packets sent by him and discard the packets that are not addressed to use ports 25 and 110.

Ports and Protocols

Some of the important applications and the port numbers they use are summarized in the table below:

Application Protocol Port Number
File Transfer Protocol (Control) TCP 21
Telnet TCP 23
Simple Mail Transfer Protocol TCP 25
Domain Name Service TCP/UDP 53
Dynamic Host Configuration Protocol (Server) UDP 67
Dynamic Host Configuration Protocol (Client) UDP 68
World Wide Web HTTP TCP 80
Post Office Protocol 3 TCP 110
Simple Network Management Protocol UDP 161

Note: The listed port numbers in the above table are also called well-known ports. The complete and updated list of well-known port numbers is available at http://www.iana.org/assignments/port-numbers.

Packet filtering is mostly configured on routers or firewalls that connect a private network to the public network such as the Internet. However, it can be configured inside the network to protect a server with confidential information from being accessed by other users on the network.

Packet Filtering Criteria

Administrators can configure packet filtering inclusively or exclusively:

  • Start with a network connection that is completely blocked and use filters to specify that the traffic can pass through.

  • Start with a completely open connection and specify the types of traffic to be blocked.

The criteria used for packet filtering are as follows:

  • Port Numbers: This is the most common type of packet filtering criteria. Port numbers can be used to block or allow packets using certain ports.

  • Protocol Identifiers: Protocol identifiers can be used to filter packets based on an entire protocol. Administrators can use this filter to block packets that are intended to use certain protocols. For example, an administrator can block all UDP and ICMP traffic. This prevents attackers from using applications that are based on these protocols.

  • IP Address: IP address filtering is used by administrators to limit network access to specific computers. IP address filtering is useful for protecting a part of a private network from users on another part of the network. It should be noted that IP address filtering is not considered to be a very secure method for securing a network. Intruders can get into the network using a technique called spoofing.

  • Hardware addresses: Filtering can be done through hardware addresses. Each network interface adapter at the factory is coded with the media access control (MAC) address known as hardware address. It works in the same way as IP address filtering. However, it is more difficult to spoof a hardware address than an IP address.

Packet Filtering in Windows Server 2003

Windows Server 2003 uses two packet filtering options:

  • TCP/IP Packet Filtering: In Windows Server 2003, take the following steps to implement TCP/IP filtering:
    1. Run Network Connections from Start Menu > Settings > Network Connections.

    2. In the Network Connections folder, right-click the Local Area Connection icon, and click Properties.

    3. In the Local Area Connection Properties dialog box, select Internet Protocol (TCP/IP), and click the Properties button.

    4. In the Internet Protocol (TCP/IP) Properties dialog box, click the Advanced button.

    5. In the Advanced TCP/IP Settings dialog box, click the Options tab. On the Options tab page, select TCP/IP filtering, and click the Properties button.

    6. In the TCP/IP Filtering dialog box, click the Enable TCP/IP Filtering (All adapters) check box. Click the appropriate Permit Only radio button to specify the port, and click the Add button.

    7. In the Add Filter dialog box, specify the port number in the TCP Port section, and click the OK button.

    8. In the TCP/IP Filtering dialog box, click the OK button.

  • Routing and Remote Access Service Packet Filtering: This option is more capable than TCP/IP packet filtering. However, administrators can use this type of filtering only when a server running Windows Server 2003 is configured as a router. By using this filter, you can use many criteria that TCP/IP filtering does not have. Some of the important capabilities of this type of filtering are as follows:
    • It can create filters based on the IP addresses, protocols, and port numbers of a packet’s source or destination.

    • It can create inclusive or exclusive filters.

    • It can create filters for ICMP messages, specified by the message type and code values.

    • It can create multiple filters of the same type.

Although packet filters can prevent a network from unauthorized intrusion, this technique cannot be used for safe and secure communications.

Share/Bookmark]]> http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html/feed 0 What is NTLM version 2? http://www.ucertify.com/article/what-is-ntlm-version-2-2.html http://www.ucertify.com/article/what-is-ntlm-version-2-2.html#comments Fri, 28 Aug 2009 00:00:00 +0000 uCertify 1401372

NTLM version 2 is an enhanced and most secure form of challenge/response authentication. NTLM version 2 uses 128-bit encryption. It significantly improves both the authentication and session security mechanisms. NTLM 2 has been available for Windows NT 4.0 since Service Pack 4 (SP4) was released, and it is supported natively in Windows 2000 and Windows 2003 operating systems. All client operating systems developed by Microsoft after Windows 2000 Professional support NTLM version 2. NTLM 2 support can be added to Windows 95 and Windows 98 by installing the Directory Services Client.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-ntlm-version-2-2.html/feed 0 How to delete a shadow copy of shared folders? http://www.ucertify.com/article/how-to-delete-a-shadow-copy-of-shared-folders-2.html http://www.ucertify.com/article/how-to-delete-a-shadow-copy-of-shared-folders-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401327

Take the following steps to delete a shadow copy of shared folders:

  1. Run Computer Management from Start Menu > Programs > Administrative Tools > Computer Management.

  2. In the console tree, right-click Shared Folders, select All Tasks, and click the Configure Shadow Copies option.

  3. In the Shadow Copies window, select the version to be deleted, and click the Delete Now button.

  4. Click the OK button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-delete-a-shadow-copy-of-shared-folders-2.html/feed 0 What is forwarder? http://www.ucertify.com/article/what-is-forwarder-2.html http://www.ucertify.com/article/what-is-forwarder-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401335

A forwarder is a DNS server that receives queries from other DNS servers on the network. To configure a forwarder in a network, DNS servers on the network are configured to send DNS queries to a particular DNS server. The DNS server acting as a forwarder need not require any special configuration. A forwarder has no secondary zones.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-forwarder-2.html/feed 0 What is ad hoc network? http://www.ucertify.com/article/what-is-ad-hoc-network-2.html http://www.ucertify.com/article/what-is-ad-hoc-network-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401340

Ad hoc is a basic topology of a wireless network. An ad hoc network consists of two or more wireless devices that communicate directly with each other. The wireless local area network (WLAN) network interface adapters in the wireless devices generate omni directional signals within a limited range called basic service area (BSA). When two wireless devices come within the range of each other, they immediately form a two-node network and are able to communicate with each other.

An ad hoc network is non-transitive.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-ad-hoc-network-2.html/feed 0 What is the Task Manager utility? http://www.ucertify.com/article/what-is-the-task-manager-utility-2.html http://www.ucertify.com/article/what-is-the-task-manager-utility-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401362

Task Manager is a utility that is used for managing applications, processes, and the general system performance and also for viewing the networking and user statistics. The Task Manager utility is used to run or end programs or applications. Administrators use this tool to quickly identify and terminate a rogue application.

This utility can be run by invoking a Windows Security menu by using the Ctrl+Alt+Del key combination and then clicking the Task Manager button or by right-clicking the task bar and then clicking the Task Manager menu option.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-the-task-manager-utility-2.html/feed 0 What is the function of the Server service? http://www.ucertify.com/article/what-is-the-function-of-the-server-service-2.html http://www.ucertify.com/article/what-is-the-function-of-the-server-service-2.html#comments Thu, 27 Aug 2009 00:00:00 +0000 uCertify 1401365

The Server service provides RPC support, file, print, and named pipe sharing over the network. It allows the sharing of local resources, so that other users on the network can access them. If the Server service is stopped on a computer, users will not be able to share files and printers on the computer with other computers on the network. Furthermore, this computer will not be able to satisfy RPC requests. If this service is disabled, any services that explicitly depend on this service will not start.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-the-function-of-the-server-service-2.html/feed 0 How to take a backup of all information in a computer by using Backup Wizard? http://www.ucertify.com/article/how-to-take-a-backup-of-all-information-in-a-computer-by-using-backup-wizard-2.html http://www.ucertify.com/article/how-to-take-a-backup-of-all-information-in-a-computer-by-using-backup-wizard-2.html#comments Wed, 26 Aug 2009 00:00:00 +0000 uCertify 1401318

Take the following steps to take a backup by using the Backup Wizard:

  1. Run Backup from Start Menu > Programs > Accessories > System Tools > Backup.

  2. In the welcome screen of the Backup or Restore Wizard, click the Next button.

  3. On the Backup or Restore page, select the Back up files and settings radio button, and click the Next button.

  4. On the What to Back Up page, select the All information on the computer radio button, and click the Next button.

  5. On the Backup Type, Destination, and Name page, specify the location where the backed up data is to be stored, and click the Next button.

  6. On the Completing the Backup or Restore Wizard page, click the Finish button.

Share/Bookmark]]> http://www.ucertify.com/article/how-to-take-a-backup-of-all-information-in-a-computer-by-using-backup-wizard-2.html/feed 0 What is ADSI EDIT? http://www.ucertify.com/article/what-is-adsi-edit-2.html http://www.ucertify.com/article/what-is-adsi-edit-2.html#comments Tue, 25 Aug 2009 00:00:00 +0000 uCertify 1401278

ADSI EDIT is a Microsoft Management Console (MMC) snap-in. It is used for viewing objects in the directory, modifying objects, and setting access control lists on objects.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-adsi-edit-2.html/feed 0