Upload
stephany-harrington
View
218
Download
4
Tags:
Embed Size (px)
Citation preview
Windows Server 2003:Advanced administration and Troubleshooting, or:”How to make your Kung-Fu stronger”
Morgan Simonsen
Ementor
What Will We Cover?
• Tips and tricks for managing Windows
Server 2003
• Improvements in Service Pack 2
• Security tidbits
• Important tools
Administering W2K3 Server: Tools
• Support Tools• Resource Kit Tools• Group Policy Management Console• Sysinternals• PowerShell/Scripting
demonstrationSysinternals Tools“My Kung-Fu is stronger than your Kung-Fu”
Process ExplorerProcess MonitorAccessEnumAutoRuns
W2K3 Server Well Kept Secrets
• Access Based Enumeration
• Diskpart kung-fu
• Replmon.exe/repadmin.exe
• User Profile Hive Cleanup Service
MMC 3.0Start Pages
Consistent UI & Structure• Views• Start Pages• Richer Snap-ins
Improved Usability
Improved Reliability
Easier Development
Shipped with WS03R2
Goals
List View with Roll-Ups
MMC .0List View with Preview
Pane
Utility Improvements
> DCDiag.exe /x /xsl:file.xsl or .xslt
> ICacls c:\windows\* /save AclFile /T
> MSConfig.exe
Plus – New Cluster Service Event ID 1239
XMLLite New XML API• Part of Vista Beta 2 SDK• Parser native in SP2
Goals of XMLLite• Separate, independent DLL• Adhere’s to XML 1.0 standard• Easy to use• High performance
Usage Scenarios• Document format (Office 2007)• Business Transactions• Standard XML Scnearios
Security Features• Per Port Firewall Authentication
–Currently WS03 Windows Firewall supports an authenticated IPSec bypass feature. However, once past the firewall, it is possible to jump to and compromise other applications behind the firewall.
–Instead of only exempting authenticated IPSec traffic from the entire firewall, it will now be possible to exempt authenticated traffic for a particular port or application exception
• IPsec Filter Management–Simple IPSec Policy Update
• Significantly Reduces IPsec filter set• Fallback to clear is 500ms
Wi-Fi Protected Access 2• Current Server 2003 SP1 / XP64 Wireless Group Policy does not support WPA2
• WPA2 Enterprise using IEEE 802.1X authentication and WPA2 Personal using a preshared key (PSK)
•Uses Advanced Encryption Standard (AES)
•Use of Pairwise Master Key (PMK) caching and opportunistic PMK caching
Windows Deployment Services
Deliver Great “in-the-box” provisioning solutionDeliver components to enable custom solutionPlug in model for PXE Server extensibilityUnify on single image format – WIMImprove management experience Provide migration and co-existence path from RIS
Goals Scenarios
Windows Deployment Services
New machine deployment
End-to-end solution for clean installs PXE Boot of WinPE
Custom deployment solution or recovery envrionment Extensibility Points
Scalable PXE server built on a unified architecture
Goals Scenarios
WDS Client
WDS Client
Setup application runs within WinPE
Special mode of Windows Vista• Image Based Setup (IBS)• Logic to communicate with WDS
server• Drives the client setup experience
(unique to WDS)
Regional and Language options• May be configured at setup
Automated using unattend.xml
Transition from RIS
Transition
WDS: Modes of Operation
LegacyWDS Binaries but RIS functionalityRISETUP and RIPREPManagement through RIS utilities
Best of BothWinPE and OSChooserRISETUP, RIPREP and WIMMGMT of new: WDS MMC / CLIMGMT of legacy: RIS utilities
MixedNo RIS functionalityWinPE onlyWIM onlyMGMT through WDS MMC / CLI
Native
Longhorn Server Only
Windows Server 2003
Only
Scalability Networking Pack
ChallengesTo Faster
Networking
Increasing processor loadsExcessive context switchingLack of effective scalingMemory overhead and latency
Scalable Networking
Pack
Reduces packet processingOffloads network processingShares network processing
TCP Chimney Offload
TOE-CapableNetwork Adaptor
Applications
TCP
Intermediate Protocols
Switch
NDIS
NDIS miniport driver
Tcpip.sys
Data Transfer Interfaces
Sta
te U
pdat
e In
terf
aces
Network APIs
TCP Chimney
Received Side ScalingProcessors
Network Card
NDIS 5.1 allows for only a single deferred Procedure Call
Doesn’t scale well for Multiprocessor/multi-core systems under heavy workloads
DPE In SP2 an adaptor is not associated with a single processor
NDIS 5.2 and RSS is supported
Allows for more traffic to be processed
DPE
NetDMA Support• Offloads processing of memory-to-
memory transfers• Without NetDMA
–Processor is heavily invoiced in moving data from NIC buffers to application buffers
• With NetDMA–DMA engine and transfers are managed–Minimizes CPU processing of data transfers from NIC buffers to application buffers
Customer Driven Improvements
Virtualization SQL Server 2005
Message Queuing
Improves the performance under high APIC access rate for Windows Server 2003 running as a guest operating system under Windows Virtualization
Under workloads with high kernel time, some due to network traffic
Fixes Winsock issue that caused system wide dispatch locks
Search Microsoft.com for SAPSales
Default storage limit changed to 1 GB
MSMQ v3.0 may be set too high for certain customers which may experience problems which appear due to low available memory
10 ways to make your network secure:1. Defense-in-depth
2. Defense-in-depth
3. Defense-in-depth
4. Defense-in-depth
5. Defense-in-depth
6. Defense-in-depth
7. Defense-in-depth
8. Defense-in-depth
9. Defense-in-depth
10. Defense-in-depth
Tips for greater security
• Never run as local administrator
• Anti-Virus does not protect against a
directed attack
Security Configuration Wizard (SCW)
• Part of SP1
• Developed to make defense-in-depth
easier
• Integrates with Group Policy
• Should be run on all Windows 2003
servers
Domain isolation
• Another part of defense-in-depth
• IPSec policies control communication on
internal network
• Enforced by Group Policy
• Easy and cheap to implement
Wireless Security
• W2K3 Server has easy to use RADIUS
server (IAS)
• Group Policy deplyment of Wireless
policies (WPA2)
Private Key Infrastructure
• Run your own Certificate Authority!• W2K3 Server supports 4 different
configurations:–Root AD integrated (Enterprise Root CA)–Subordinate AD integrated (Enterprise Subordinate CA)–Stand-alone Root CA–Stand-alone Subordinate CA
Private Key Infrastructure - continued
• Group Policy supports auto-enrollement
for certificates for users and computers
• Trust hierarchy established through
Group Policy
• CRLs published to AD and IIS ++
RDP Security
• RDP protocol does not protect password
• SP1 introduces TLS for RDP
• Very easy to implement
Secure through Group Policy
• Microsoft have security guides for almost
all server products
• Includes Group Policy security templates
specifically desgined for product
• Easy to implement, gives good baseline
for security configuration