70-290 70-270, MCSE/MCSA Guide to Installing and Managing Microsoft Windows XP Professional and Windows Server 2003
Chapter Eleven
Windows Security Features
Objectives
Use the Security Configuration and Analysis tools to configure and review security settings Audit access to resources and review Security log settings Install, configure, and manage Microsoft Software Update Services
Guide to MCSE 70-270, 70-290
2
Using the Security Configuration Management Tools
Prior versions of Window had inadequate tools for administering security Security Configuration Manager tools: Used to maintain security configurations
With Active Directory's group policies, enables administrators to configure specific group of security settings to form a security template
Can be administered centrally and applied throughout Active Directory
Can analyze and implement security settings
Guide to MCSE 70-270, 70-290 3
Using the Security Configuration Management Tools (continued)
Core components:
Security templates Security settings in Group Policy Objects (GPOs) Security Configuration and Analysis tool Secedit command-line tool
Guide to MCSE 70-270, 70-290
4
Security Templates
Baseline: Set of security policy settings to be used throughout network Security template: Used to define, edit, and save baseline security policy settings Activity 11-1: Browsing Security Templates
Objective: Explore settings for built-in security templates
Guide to MCSE 70-270, 70-290
5
Security Templates (continued)
Figure 11-1: The Security Templates MMC snap-in
Guide to MCSE 70-270, 70-290 6
Analyzing Preconfigured Security Templates
First step in configuring/implementing security templates sorting network computers into three main categories:
Client computers, servers, and domain controllers Correspond to default security templates
The Default Template: Default security settings stored in Setup Security.inf
Stores original computer security settings
Guide to MCSE 70-270, 70-290
7
Analyzing Preconfigured Security Templates (continued)
Figure 11-2: Account Lockout Policy settings in the Securedc template
Guide to MCSE 70-270, 70-290 8
Analyzing Preconfigured Security Templates (continued)
Incremental Templates: Modify security settings based on specific security levels
Apply only to machines already running default security settings Default incremental templates:
Compatws.inf Securews.inf and Securedc.inf Hisecws.inf and Hisecdc.inf Iesacls.inf DC Security.inf Rootsec.inf
9
Guide to MCSE 70-270, 70-290
Applying Security Templates
Security templates applied to local machine or domain via GPOs Security settings applied via group policies override local settings Activity 11-2: Creating a Security Template
Objective: Define a new security template to meet custom requirements
Activity 11-3: Applying Security Template Settings to GPOs
Objective: Deploy security template settings by using group policies
Guide to MCSE 70-270, 70-290 10
Applying Security Templates (continued)
Figure 11-3: Importing settings from a security template
Guide to MCSE 70-270, 70-290 11
Security Configuration and Analysis
Security Configuration and Analysis MMC snap-in: Compare current system settings to previously configured security template
Identifies changes and weaknesses Uses a container ("database") to store imported templates to be compared to current system
Activity 11-4: Analyzing Security Settings in Security Configuration and Analysis
Objective: Use the Security Configuration and Analysis tool to compare group policy and security template settings
Guide to MCSE 70-270, 70-290 12
Security Configuration and Analysis (continued)
Figure 11-5: The Security Configuration and Analysis MMC snap-in
Guide to MCSE 70-270, 70-290 13
Security Configuration and Analysis (continued)
The Secedit Command-line Tool:
Secedit.exe: Used for creating and applying security templates and analyzing security settings Switches:
/configure /analyze /export /import /validate /generaterollback
14
Guide to MCSE 70-270, 70-290
Auditing Access to Resources and Analyzing Security Logs
Auditing: Monitor and track activities on a network
Can specify events to monitor Records of audited events written to Security log Use Event Viewer to view audit entries
Before auditing, must set up an audit policy
Determine events to track and whether to track successes and/or failures
Activity 11-5: Exploring Default Audit Settings
Objective: Explore the default audit settings configured on a Windows Server 2003 domain controller
Guide to MCSE 70-270, 70-290 15
Auditing Access to Resources and Analyzing Security Logs (continued)
Figure 11-9: Windows Server 2003 Audit Policy settings
Guide to MCSE 70-270, 70-290 16
Auditing Access to Resources and Analyzing Security Logs (continued)
Figure 11-10: The Audit account logon events Properties dialog box
Guide to MCSE 70-270, 70-290 17
Auditing Access to Resources and Analyzing Security Logs (continued)
Table 11-1: Auditing events that can be monitored
Guide to MCSE 70-270, 70-290 18
Configuring Auditing
Requirements:
Member of Administrators group or assigned Manage Auditing and Security Log user right If auditing files and folders, they must reside on NTFS volume
Configuring an Audit Policy:
Choose events and decide whether to monitor successes and/or failures If auditing access to files, folders, printers, and Active Directory objects, must configure auditing settings on specific resources
Guide to MCSE 70-270, 70-290 19
Configuring Auditing (continued)
Activity 11-6: Configuring and Testing New Audit Policy Settings
Objective: Configure and test new audit policy settings
Windows Server 2003 automatically refreshes audit policy settings periodically
Can force changes to be applied immediately:
Restart computer Gpupdate.exe command
Guide to MCSE 70-270, 70-290
20
Configuring Auditing (continued)
Auditing Object Access: Useful for tracking which users attempt to access files or folders containing sensitive data
Can be configured on Active Directory objects
Activity 11-7: Configuring Auditing on an NTFS Folder
Objective: Audit failed and successful access attempts to an NTFS folder
Guide to MCSE 70-270, 70-290
21
Configuring Auditing (continued)
Figure 11-12: The Auditing Entry dialog box
Guide to MCSE 70-270, 70-290 22
Configuring Auditing (continued)
Best Practices:
Enable auditing for only events that supply useful information Review audit entries regularly Enable auditing for sensitive and confidential information Audit Everyone group instead of Users group Audit user rights assignments so that administrators are accountable for granting any special rights to user accounts Always audit Administrators group
Guide to MCSE 70-270, 70-290 23
Analyzing Security Logs
Figure 11-14: Viewing the contents of the Security log in Event Viewer
Guide to MCSE 70-270, 70-290 24
Analyzing Security Logs (continued)
Figure 11-15: Viewing the properties of a Success event
Guide to MCSE 70-270, 70-290 25
Analyzing Security Logs (continued)
Can search a log using the Find option in Event Viewer
For specific events or types of events
Can filter Events Activity 11-8: Configuring Security Log Properties
Objective: Configure properties for log files in Event Viewer
Guide to MCSE 70-270, 70-290
26
Analyzing Security Logs (continued)
Figure 11-17: Filtering events by various criteria
Guide to MCSE 70-270, 70-290 27
Configuring Event Viewer
Log files can easily become too large, or even full
To keep size of Security log file down:
Audit only essential events Adjust Security Log's default properties Review Security Log frequently
Activity 11-9: Editing Security Log Settings and Saving Events
Objective: Edit security log settings and save events for archiving purposes
Guide to MCSE 70-270, 70-290
28
Configuring Event Viewer (continued)
Figure 11-18: Configuring the properties of the log
Guide Security to MCSE 70-270, 70-290 29
Configuring Event Viewer (continued)
Table 11-2: Security log configuration options
Guide to MCSE 70-270, 70-290 30
Securing the Registry
Registry should be edited only by qualified people
Permissions can be assigned to hives and keys within Registry
Protect from editing by certain people or groups Allow viewing of Registry without making changes
Activity 11-10: Setting Regedit Security
Objective: Set permissions in Regedit to restrict access to editing the Registry
Guide to MCSE 70-270, 70-290
31
Using Update Services
Past methods for updating systems with security patches (hot fixes) and service packs:
Manual download and installation Installation using scripting techniques Automated deployment Installation using Windows Upd
Software Update Services (SUS): Enables administrators to control how updates deployed
Offers more control than any other technique
Windows Update Services (WUS): Builds on basic SUS features
Guide to MCSE 70-270, 70-290 32
Using Software Update Services
SUS consists of two main elements:
Server component can be installed on Windows 2000 Server or Windows Server 2003 Servers Client component allows clients to contact SUS server to determine:
Available updates Which server to obtain updates from How to install updates
Installing SUS:
Available for download from Microsoft Web site
Guide to MCSE 70-270, 70-290 33
Using Software Update Services (continued)
Installing SUS (continued):
SUS server component requirements:
Pentium III 700 MHz or higher processor 512 MB of RAM 6 GB of free disk space Dedicated SUS server recommended Windows 2000 Server (SP2 or later), Windows Server 2003, or Microsoft Small Business Server 2000 (SP1 or later) Internet Information Services (IIS) 5.0 or later Internet Explorer 5.5 or later
Guide to MCSE 70-270, 70-290 34
Using Software Update Services (continued)
Activity 11-11: Installing Software Update Services
Objective: Install the server component of Software Update Services
How SUS Works:
When SUS installed, SUS server can download updates Network clients connect to SUS server to download and install approved (and tested) updates Gives administrators flexibility Administrator must approve updates before clients can install them
Guide to MCSE 70-270, 70-290 35
Using Software Update Services (continued)
Configuring SUS: By default, SUS server ready to deploy updates immediately after installation
Updates must first be approved Default configuration:
Updates downloaded from Web-based Windows Update download servers Proxy server settings set to Automatic Downloaded content stored locally on SUS server Available packages downloaded in all supported languages Packages approved and then later updated by Microsoft are not automatically approved
Guide to MCSE 70-270, 70-290 36
Using Software Update Services (continued)
Table 11-3: SUS configuration settings
Guide to MCSE 70-270, 70-290 37
Using Software Update Services (continued)
Activity 11-12: Configuring SUS Settings
Objective: Configure Software Update Services settings
SUS servers must be synchronized regularly Activity 11-13: Synchronizing SUS Content
Objective: Synchronize Software Update Services content
Automatic Updates: For client systems to obtain security updates from SUS server, must have updated version of Automatic Updates client installed
Guide to MCSE 70-270, 70-290 38
Using Software Update Services (continued)
Automatic Updates (continued):
Following systems already have updated Automatic Updates software installed:
All Windows Server 2003 systems Windows XP systems with SP1 installed Windows 2000 systems with SP3 installed
For other systems, install manually via Wuau22.msi To configure clients to connect to internal SUS server to obtain updates, administrator must manually configure client system's Registry or configure Automatic Updates settings in a group policy
Guide to MCSE 70-270, 70-290 39
Using Software Update Services (continued)
Figure 11-27: The Automatic Updates tab for a Windows XP SP2 client system
Guide to MCSE 70-270, 70-290 40
Using Software Update Services (continued)
Figure 11-28: The Automatic Updates tab for a Windows Server 2003 system
Guide to MCSE 70-270, 70-290 41
Using Software Update Services (continued)
Automatic Updates (continued):
In Active Directory environment, using group policies to configure Automatic Updates is preferred method In nondomain environments, administrator can configure Automatic Updates by:
Manually configure Automatic Updates Registry entries Installing XP clients using scripted installation that includes proper Registry settings Use Group Policy Object Editor to configure necessary settings on individual systems
Guide to MCSE 70-270, 70-290 42
Using Software Update Services (continued)
Table 11-4: Automatic Updates group policy settings
Guide to MCSE 70-270, 70-290 43
Using Software Update Services (continued)
Activity 11-14: Reviewing Automatic Updates Group Policy Settings
Objective: Review Automatic Updates group policy settings
Figure 11-29: The Add/Remove Templates dialog box
Guide to MCSE 70-270, 70-290 44
Introduction to Windows Update Services
Table 11-5: WUS components
Guide to MCSE 70-270, 70-290 45
Introduction to Windows Update Services (continued)
WUS builds on SUS features by offering:
Increased support
Connectors Guidance Tools
Update filtering Language support for international customers Bandwidth efficiency and flexibility Update targeting Update analysis
46
Guide to MCSE 70-270, 70-290
Introduction to Windows Update Services (continued)
WUS builds on SUS features by offering (continued):
Deployment flexibility Reporting options API management Database options Command-line tools
Guide to MCSE 70-270, 70-290
47
Planning an SUS Infrastructure
One of main advantages of implementing SUS is that many deployment configurations supported Small Networks: Only a single server running SUS is usually required
Main requirement is that SUS server has Internet connectivity to perform synchronization tasks If multiple SUS servers, each managed independently
SUS clients assigned to specific SUS server
Guide to MCSE 70-270, 70-290
48
Planning an SUS Infrastructure (continued)
Enterprise Networks: Typically multiple SUS servers deployed
Often only one server synchronizes from Windows Update servers
Other internal SUS servers connect to that server for updates
High-security Networks: Typically corporate intranet disconnected from public Internet, and clients may have no Internet connectivity
Typically deploy many SUS servers, but only one with Internet connectivity
Guide to MCSE 70-270, 70-290 49
Planning an SUS Infrastructure (continued)
Activity 11-15: Uninstalling SUS and IIS
Objective: Uninstall SUS and IIS
Guide to MCSE 70-270, 70-290
50
Summary
Windows Server 2003 and XP have a number of security-related features that can be used to ensure a high level of system and network security, including authentication, access control, encryption, security policies, service packs, and hot fixes Security policies give administrators a way to configure a variety of security-related settings on Windows Server 2003 and Windows XP systems The primary tools for configuring security policy settings include the Local Security Policy tool and the Group Policy Object Editor
Guide to MCSE 70-270, 70-290 51
Summary (continued)
With the Security Configuration Manager tools, administrators can compare a server's current security policy settings to those stored in security templates Auditing is a Windows feature for tracking a wide range of security-related events The Event Viewer Security log is used to view events related to audit settings Software Update Services can allow administrators to control and manage the deployment of security patches and hot fixes for network systems
Guide to MCSE 70-270, 70-290 52