E Windows Server 2008 V Security E R 0 - Donna Warren's...
62
DPW © 2005-2010 DPW © Donna Warren W I N D O W S S E R V E R 2 0 0 8 Windows Server 2008 Security UNIT 11
Transcript of E Windows Server 2008 V Security E R 0 - Donna Warren's...
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Windows Server 2008
Security
UNIT 11
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
What is Group Policy?
• A group of policies applied directly to
Active Directory Objects
• Policies can be linked to:
– Sites
– Domains
– OUs
• Policies are applied by assigning them
to the objecta do they apply to specific
users or groups
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Functions
• Control the user environment.
– Manipulate Start menu options, wallpaper, colors, and so on.
– Prevent users from using the Control Panel.
• Control the computer settings.
– Configure DNS client settings.
– Configure the time server client computers use.
• Distribute software.
– Force software installation.
– Allow for easy optional software installation through Add/Remove Programs.
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Settings
• Registry-based – control the user environment
that are stored in HKEY_CURRENT_USER
and HKEY_LOCAL_MACHINE
• Software installations and repairs – to keep
patches up to date and fix broken apps
• Folder redirection and offline storage – force
use of network drive for backup
• Disk quotas – can enforce quotas
• Offline file storage works with folder
redirection to provide the ability to cache files
locally. This allows files to be available even
when the network is inaccessible
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy• Run Scripts – Including logon, logoff, startup,
and shutdown scripts
• Windows Deployment Services (WDS) –rebuilding or deploying workstations quickly and efficiently
• Microsoft Internet Explorer settings
– Provide quick links and bookmarks for user accessibility
– Enforce browser options such as proxy use, acceptance of cookies, and caching options
• Security settings – Protect resources on computers in the enterprise.
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Benefits• Company benefits
– Reduce Total Cost of Ownership (TOC)
– Improve Return on Investment (ROI)
• User benefits
– Access to files either offline or online.
– Consistent environment.
– Files are centrally backed up.
• Administrator benefits
– Centralized management of computer and user settings.
– Centralized application distribution.
– Centralized backup.
– Centralized security enforcement.
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Default Group Policies
• Two Default group policies are created
when active directory is installed
• Default Domain Policy - affects all users
and computers in the domain
• Default Domain Controllers Policy -
affects all domain controllers within this
object
• As domain controllers are added to the
domain, they are automatically placed in
this OU and are affected by any settings
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Objects (GPOs)
• Contain all of the Group Policy settings
that you wish to implement to user and
computer objects within a site, domain,
or OU
• Must be associated (linking) with the
container to which it is applied
• There are three types of GPOs:
– Local GPOs
– Domain GPOs
– Starter GPOs
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Objects (GPOs)
• Local GPO
– Gpedit.msc (Local Computer Policy)
– Local Security Policy
• Non-Local Group Policy Objects
– Not inherited from the domain
– Stored in Sysvol
– Linked to sites, domains, or OUs
– Applied to all users and computers in the
container
– If conflict with local AD based group
policies, non-local take precedence
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policies in Active Directory
• Linked to site—Affects all users and
computers in the site to which the
policy is linked, regardless of domain
membership
• Linked to domain—Affects all users
and computers in the domain to which
the policy is linked
• Linked to OU—Affects all users and
computers in the OU to which the
policy is linked
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy
• Group Policies can be linked to sites, domains, or OUs (not groups) to apply those settings to all users and computers within these Active Directory containers
• You can use security group filtering, which allows you to apply GPO settings to specific users or groups within a container by selectively granting the ―Apply Group Policy‖ permission to one or more users or security groups
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Local GPO
• The local GPO settings are stored on the
local computer in the
%systemroot%/System32/GroupPolicy folder
• Local GPOs contain fewer options
– They do not support folder redirection or
Group Policy software installation
– Fewer security settings are available
• When a local and a nonlocal (Active
Directory–based) GPO have conflicting
settings, the local GPO is overwritten by the
nonlocal GPO
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Nonlocal GPOs• Nonlocal GPOs are created in Active Directory
• They are linked to sites, domains, or OUs.
– Once linked to a container, the GPO is applied to
all users and computers within that container by
default
• GPOs are stored in two places:
– Group Policy container (GPC) — An Active
Directory object that stores the properties of the
GPO
– Group Policy template (GPT) — Located in the
Policies subfolder of the SYSVOL share, the GPT
is a folder that stores policy settings, such as
security settings and script files
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Starter GPOs
• A new feature in Windows Server 2008
• Used as GPO templates within Active
Directory
• Allow you to configure a standard set of
items that will be configured by default
in any GPO that is derived from a
starter GPO
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Creating & Managing Group Policies
• The Group Policy Management Console
(GPMC) is the Microsoft Management
Console (MMC) snap-in that is used to
create and modify Group Policies and
their settings
• When you configure a GPO, you will use
the Group Policy Management Editor,
which can be accessed through the
GPMC or through Active Directory Users
and Computers
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Settings
• Configuring Group Policy settings
enables you to customize the
configuration of a user’s desktop,
environment, and security settings.
• The actual settings are divided into two
subcategories:
– Computer Configuration
– User Configuration
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Settings
• The Computer Configuration and the User Configuration nodes contain three subnodes
– Software Settings
• Used to install software
– Windows Settings
• Used for define security settings and scripts
– Administrative Templates
• Includes thousands of Administrative Template policies, which contain all registry-based policy settings
• They are used to generate the user interface for the Group Policy setting
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
GPO Inheritance
• You link a GPO to a domain, site, or
OU or create and link a GPO to one of
these containers in a single step
• The settings within that GPO apply to
all child objects within the object
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
How Group Policies are Used• During computer startup, a list of GPOs for the computer
is obtained.
• Computer settings are applied during startup.
• Startup scripts are run.
• Windows Logon prompt appears when step 3
completes.
• Upon successful validation of user, the user profile
loads.
• A list of GPOs for the user is obtained.
• Logon scripts are run.
• The user interface appears.
• At log off and shutdown any log off and shutdown scripts
are run
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Processing Group Policy
• Processing Order
1. Local Policies
2. Site Policies
3. Domain Policies
4. OU Policies
• Multiple policies at the same level applied
bottom up
• If there is a conflict on a particular setting
– By default, the last policy applied wins
– Exceptions: No Override, Block Policy
Inheritance, and User Group Policy
loopback processing mode
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
No Override
• Ensures policy is applied, regardless of
priority, hierarchy, inheritance blocking,
or conflicting settings
• Configured on a per-policy basis
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Block Policy Inheritance
• Prevents policies from being inherited
from higher levels in the Active
Directory hierarchy
• Can be used at the Domain or OU level
only—not per policy
• Cannot stop a policy marked as No
Override
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Security Settings
• Account – password and account lock out
and user authentication) for the domain
• Local – audit, user rights and security for the
local Machine
• Event Log Policy – size, history and
accessibility
• Restricted Groups – control the ―members‖
and ―members of‖ properties in security
groups (used to populate local machines
groups with the domain values)
• System Services – control service startup
mode and access permissions
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Security Settings
• Registry & File System – access permissions and
audit setting per key or per file system object
• Wireless network – preferred networks,
authentication types, etc.
• Public Key - Encrypted File System, automatic
request certificate request, trusted root certificates,
and an enterprise trust list
• Software Restriction – allow or disallow application
redirection for specific applications, folder
redirection, offline files control and disk quotas
• IPSec for AD – assign policies based on IP
address
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Account Policies
• Account policies influence how a user
interacts with a computer or a domain
• By default, they are linked to the Default
Domain Policy
• This account policy is applied to all accounts
throughout the domain by default, unless you
create one or more Fine-Grained Password
Policies (FGPP) that override the domain-
wide policy.
• These Fine-Grained Password Policies can
be applied
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Fine-Grained Password Policy• Prior to Windows Server 2008 Active Directory
domain you were only able to configure a
single
– Password Policy
– Account Lockout Policy
• The only choice was configuring a separate
domain or forcing all users within the domain
to conform to a single password policy
• Beginning in Windows Server 2008, you can
configure Fine-Grained Password Policies,
which allow you to define multiple password
policies within a single domain
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Kerberos Policy• Kerberos is the default mechanism for
authenticating domain users in Windows Server
2008, Windows Server 2003, and Microsoft
Windows 2000
• Kerberos is a ticket-based system that allows
domain access by using a Key Distribution Center
(KDC)
– These tickets have a finite lifetime and are based in
part on system time clocks
– Note that Kerberos has a 5-minute clock skew
tolerance between the client and the domain
controller
– If the clocks are off by more than 5 minutes, the
client will not be able to log on
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Kerberos Policy• Enforce User Logon Restrictions tells
Windows Server 2008 to validate each
request for a session ticket against the
rights associated with the user account
• Although this process can slow the
response time for user access to
resources, it is an important security
feature that should not be overlooked or
disabled
• Enforce User Logon Restrictions is
enabled by default
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Local Policies
• Allow administrators to set user
privileges on the local computer that
govern what users can do on the
computer and determine if these
actions are tracked within an event log
(auditing):
– User Rights Assignment.
– Security Options.
– Audit Policy.
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Audit Policy
• System events — Events that trigger a log
entry include
– system startups and shutdowns
– system time changes
– system event resources exhaustion, such
as when an event log is filled and can no
longer append entries
– security log cleaning
– any event that affects system security or
the security log
• In the Default Domain Controllers GPO, this
setting is set to log successes by default
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Policy Change Events• By default, this policy is set to audit
successes in the Default Domain
Controllers GPO.
• Policy change audit log entries are
triggered by
– user rights assignment changes
– establishment or removal of trust
relationships
– IPSec policy agent changes
– grants or removals of system access
privileges
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Account Management Events
• This policy setting is set to audit
successes in the Default Domain
Controllers GPO
• This setting triggers an event based on
changes to account and group
properties
– user or group account creation
– Deletion
– Renaming
– Enabling
– Disabling
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Logon Events
• This setting logs events related to
successful user log-ons on a computer
– The event is logged on the computer that
processes the request
– The default setting is to log successes in
the Default Domain Controllers GPO.
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Audit Policy
• Audit Directory Service Access —logs user access to Active Directory objects, such as other user objects or OUs
• Audit Object Access —logs user access to files, folders, registry keys, and printers, etc.
• You MUST enable Audit Object Access
• Then specify what objects you want to audit
• Audit results are written to the Event Viewer security log
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Configuring Object Access Auditing
• Right-click the file or folder you want to
audit.
• Select Properties
• On the Security tab, click Advanced
• In the Advanced Security Settings
dialog box, select the Auditing tab
• Select the appropriate user or group
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Restricted Groups Policy
• Allows an administrator to specify
group membership lists
• You can control membership in
important groups, such as the local
Administrators
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Folder Redirection Policy
• Folder redirection redirects the contents of
certain folders to a network location or to
another location on the user’s local computer
• Contents of folders on a local computer
located in the Documents and Settings folder
can be redirected
– Basic – Redirects Everyone's Folder To The
Same Location and you must specify the Target
folder location in the Settings dialog box
– Advanced – can Specify Locations For Various
User Groups and you must specify the target
folder location for each group that you add in the
Settings dialog box
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Offline Files Policy• Can allow files to be available to users, even when
the users are disconnected from the network.
– The Offline Files feature works well with Folder
Redirection
– When Offline Files is enabled, users can access
necessary files as if they were connected to the network
– When the network connection is restored, changes made
to any documents are automatically updated to the server
– Folders can be configured so that either all files or only
selected files within the folder are available for offline use
– When it is combined with Folder Redirection, users have
the benefits of being able to redirect files to a network
location and still have access to the files when the network
connection is not present
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Disk Quotas
• Limit the amount
of space available
on the server for
user data
• Can be enforce
on all users
domain wide
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Refresh
• Computer configuration group policies
are refreshed every 90 minutes (+/- 30
minutes) by default
• Domain controller group policies are
refreshed every 2 minutes
• You can force group policies by using
the gpupdate command:
gpupdate /force
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
GPUpdate Command
• If you make changes to a group policy, users may not see changes take effect until
– They log off or log back in
– They Reboot the computer
– They wait 90 minutes (+/- 30 minutes) for stand-alone servers/workstations and 2 minutes for domain controllers
• To manually push group policies, you need to use the gpupdate command
Gpupdate /force
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
AD Rights Management
• A new feature that allows users to
provide better security for Microsoft
applications
• Basically a second level of protection
beyond the normal access list
permission restrictions
• It chief advantage is the ability to block
document forwarding and printing
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Feature AD RMS
Secure/Multipurpose Internet Mail
Extension (S/MIME) Signing
S/MIME Encryption
Access control lists (ACLs)
Encrypting File Systems
(EFS)
Attests to the identity of the publisher
Differentiates permissions by a user
Prevents unauthorized viewing
Encrypts protected content
Offers content expiration
Controls content reading
Modifying, or printing by user
Extends protection beyond initial publication
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Software Lifecycle
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Group Policy Software Management
• Group Policy can be used to
– Install
– Upgrade
– Patch
– remove software applications
• Under the following conditions
– when a computer is started
– when a user logs on to the network
– when a user accesses a file associated with a
program that is not currently on the user’s computer
• Group Policy can be used to fix problems
associated with applications
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Windows Installer Service .MSI File
• Is a relational database file that is copied to the
target computer system with the program files it
deploys
• Assists in the self-healing process for damaged
applications and clean application removal
• Consists of external source files that may be
required for the installation or removal of software
• Includes summary information about the software
and the package
• Includes reference point to the path where the
installation files are located
• is responsible for automating the installation and
configuration of the designated software
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
.MST File
• You may need to modify Windows
Installer files to better suit the needs of
your corporate network.
• Modifications to .msi files require
transform files, which have an .mst
extension
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Patch file (.msp)
• Patch files are used to apply service packs
and hot fixes to installed software
• Instead, it contains, at minimum, a database
transform procedure that adds patching
information to the target installation package
database
• .msp files should be located in the same
folder as the original .msi file when you want
the patch to be applied as part of the Group
Policy software installation
• This allows the patch file to be applied to the
original package or .msi file
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Software Distribution Point
• Before deploying software using Group
Policy, you must create a distribution
share/Software distribution point
• Users who are affected by the Group
Policy assignment should be assigned
NTFS Read permission to the folder
containing the application and package
files
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Assigning and Publishing Software
• Assigning Software
– If you assign the program to a user, it is installed when the user logs on to the computer
– If you assign the program to a computer, it is installed when the computer starts, and it is available to all users who log on to the computer
– When a user first runs the program, the installation is finalized.
• Publishing Software
– You can publish a program distribution to users.
– When the user logs on to the computer, the published program is displayed in the Add or Remove Programs dialog box, and it can be installed from there
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Software Restrictions Policies
• Provides methods to control the use of
software applications through Group Policy
• Strategy
– Unrestricted - Allow all except explicitly
denied (default)
– Disallowed - Deny all except explicitly
allowed
– Basic User – block applications that require
administrative rights, but allows programs
that are accessible by normal users
• Default Software Restriction Policy -
Unrestricted
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Software Restrictions Policies
• Four types of software restriction exist
– Hash rule - attaches hash that
governs whether it can run
– Certificate rule – allows execution to
specific file types
– Path rule - can bypass default
security setting for specific files
– Network zone rule – determine if the
application is allowed to be installed
(.msi only)
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
EFS
• Encrypting File System (EFS) sets up a
unique, private encryption key
associated with the user account that
encrypted the folder or file
• When you move an encrypted fi le to
another folder on the same computer,
that file remains encrypted, even if you
rename it
• The cipher command line utility can
encrypt or decrypt folders and files
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
BitLocker
• Trusted Platform Module (TPM) must
be available (chip or controller on
motherboard) – transparent to user
• Can also use a USB drive with the
necessary identification info to access
hard disks
• You must create an operating system
partition no less than 1.5 GB in size
• A second primary partition for bitlocker
• Bit locker has it own control panel
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Network Access Protection• Ipsec - can prevent non-co,pliant computers
from communication with complient computers
using a network policy server
• NAT – prevents outsiders from knowing a
computer’s IP address
• VPN – secure encrypted network access through
the internet
• DHCP – configured through the network policy
server
• Terminal Services Gateway – uses a network
policy server
• 802.1x – verifies client and provides a secure
port
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Case Study
• You are a computer consultant
• The Park Publishing network consists of a
single Active Directory domain with four
domain controllers running Windows Server
2008, three file servers, and 300 clients that
are evenly divided between Windows XP
Professional and Windows 7
• Recently, data was lost when an employee's
laptop was stolen and other data was lost
during a fire sprinkler system incident in
which the employee's computer was
destroyed
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Case Study (cont)
• Employees typically store documents in their
My Documents folder
• All client computers have P drive mappings
that are supposed to be used for storing files
• Editors frequently work on sensitive
documents that should not be accessible to
anyone else
• Given Park Publishing's concerns, answer
the following questions:
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Case Study (cont)
1. How would you assure that employees
store their data on the server in the
future?
2. How can you address the situation
concerning the sensitive data editors use?
3. How would you address the users with
mobile computers so that they could work
on their files while traveling while keeping
the files safe on the server?
4. What could you do about the existing data
in employees My Documents folder?
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Summary
• Microsoft provides several security
options to protect both protect data nad
monitor who is accessing it
• Group Policies can be assigned to
sites, domains, and Ous
• By default, there is one local policy per
computer and a Default Domain Policy
and a Default Domain Controller Policy
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Summary
• Group Policy processing order
– Local
– Site
– Domain
– OU
• Group Policies applied to parent
containers are inherited by all child
containers and objects
• Inheritance Exceptions No Overide,
Block Policy Inheritance, or Loopback
settings
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Summary
• Auditing object access and user rights
• Account policies
• Object auditing
• Bit Locker
• AD Rights management (AD RMS)
• Offline file protection
• Disk quotas
• Network Access Protection
DPW© 2005-2010
DPW© Donna Warren
W
I
N
D
O
W
S
S
E
R
V
E
R
2
0
0
8
Lab 11
• Do all the activities in chapter 13 of the
text book
• Take a screen shot of the results of
each activity and paste it into a word
document titles Lab 11
• Email you completed lab 11 document
