OReilly windows server 2008 the definitive guide mar 2008 ISBN 0596514115

Inside, you'll find step-by-step procedures for using all of the major components, along withdiscussions on complex concepts such as Active Directory replication, DFS namespaces and repl

by Jonathan Hassell

Publisher: O'Reilly Pub Date: March 15, 2008 Print ISBN-13: 978-0-59-651411-2 Pages: 492

Table of Contents | Index

Overview

This practical guide has exactly what you need to work withWindows Server 2008 Inside, you'll find step-by-step

procedures for using all of the major components, along withdiscussions on complex concepts such as Active Directory

replication, DFS namespaces and replication, network accessprotection, the Server Core edition, Windows PowerShell, serverclustering, and more All of this with a more compact

Installing the server in a variety of different environmentsFile services and the Windows permission structure

How the domain name system (DNS) works

course in OS theory If you intend to work with this server, this

is the only book you need

Section 14.4 The Last Word

Colophon

Index

most titles (safari.oreilly.com) For more information, contactour corporate/institutional sales department: (800) 998-9938 orcorporate@oreilly.com

albatross, and related trade dress are trademarks of O'ReillyMedia, Inc

Many of the designations used by manufacturers and sellers todistinguish their products are claimed as trademarks Wherethose designations appear in this book, and O'Reilly Media, Inc.was aware of a trademark claim, the designations have beenprinted in caps or initial caps

While every precaution has been taken in the preparation of thisbook, the publisher and author assume no responsibility for

errors or omissions, or for damages resulting from the use ofthe information contained herein

This book uses RepKover™, a durable and flexible lay-flat

binding

ISBN: 978-0-596-51411-2

[M]

Microsoft's server-oriented Windows operating systems havegrown by leaps and bounds in capabilities, complexities, andsheer number of features since the release of Windows NT

Server in the early 1990s With each release, system

administrators have found themselves grappling with new

concepts, from domains, directory services, and virtual privatenetworks, to client quarantining, disk quota, and universal

groups Just when you've mastered one set of changes, anothercomes along and suddenly you're scrambling once again to get

up to speed A vicious cycle this IT business is

One source of help for the beleaguered administrator has

always been the technical book market and its communities ofauthors, publishers, and user groups Major releases of popularoperating systems have always been accompanied by the

as much detritus, as the operating systems they explain Younow see on the shelves of your friendly local bookstores 1,200-plus-page monstrosities that you might find useful, but only ifyou enjoy dealing with 30 pounds of paper in your lap or onyour desk, and only if you find it productive to wade throughreferences to "how things worked" four versions of Windows NTago After all, there's a limit to how many times you can revisesomething before it's best to simply start from scratch Do youneed all of that obsolete information to do your job efficiently?I'm wagering that you don't (my luck in Las Vegas

notwithstanding), and it was in that spirit that I set out to write

Windows Server 2008: The Definitive Guide I have trimmed the

content of this volume to include just enough background on asubject for you to understand how different features and

away from reading sections with a firm understanding of what'shappening under the hood of the system, but without the sensethat you're taking a graduate course in OS theory Most of all, Iwant this book to be a practical guide that helps you get yourwork done—"here's how it works; here's how to do it."

The book you're either holding in your hands right now or

reading online provides a more compact presentation, a lowerprice, and a tighter focus on tasks than other books on the

market

I hope that this work meets your expectations, and I hope youturn to it again and again when you need to understand themassive product that is Windows Server 2008

P2.1 Audience

Beginning-to-intermediate system administrators will find thisbook a very helpful reference to learning how Windows Server

2008 works and the different ways to administer machines

running that operating system This book has step-by-step

procedures, discussions of complex concepts such as ActiveDirectory replication, DFS namespaces and replication, networkaccess protection, the Server Core edition, Windows

PowerShell, and server clustering Although I've eliminated

material that isn't relevant to day-to-day administration, youwill still find the chapters full of useful information

Advanced system administrators will also find this book usefulfor discovering new concepts and components outside of theirrealm of expertise I've found that senior system administratorsoften focus on one or two specific areas of a product and areless familiar with other areas of the OS This book provides astepping-stone for further exploration and study of secondaryparts of the operating system

One other item to mention: throughout the book I've tried tohighlight the use of the command line in addition to (or in some

Command lines, in my opinion, are fabulous for quickly and

efficiently getting things done, and they provide a great basisfor launching into scripting repetitive tasks Microsoft has done

an excellent job of integrating command-line functions into thisrevision of Windows, and I've attempted to do the effort justicewithin the text But none of this should make you shy away

from this book if you are a GUI aficionado: you'll still find

everything you're accustomed to within this volume

P2.2 Organization and Structure

In structuring the contents of this book I have tried to make alogical progression through the product, from a high-level

overview through complete discussions and treatments of all itsmajor components Here's how this book is organized:

Chapter 1

Covers the product on a very general basis, from Microsoft'sphilosophy behind the product itself and the different

versions of the product that are available, to an overview ofthe features in this release that are new or otherwise

improved and a complete overview of the system design.This chapter is designed to give the administrator a

complete and systematic overview of the product

Chapter 2

Provides a detailed guide to installing the product in a

variety of environments I also include information on massdeployments using Windows Deployment Services, a vastimprovement over previous image installation options

offered in the box

Chapter 3

to creating shares, publishing them to Active Directory,mapping drives, using the My Network Places applet, andaccessing shares from the Start Run command and fromwithin Internet Explorer Then I dive into a detailed

discussion of the Windows permission structure, includingpermission levels, "special" permissions, inheritance, andownership Here, you'll also find a guide to settings

permissions Also covered in this chapter is an overview ofthe Distributed File System (DFS), and how to set it up andmanage it

Chapter 4

Covers the domain name system, or DNS Because DNS issuch a fundamental component of Active Directory, I

wanted to include a separate treatment of how it works,including a discussion of the different types of resourcerecords and zone files supported, integration with ActiveDirectory, the split DNS architecture, and backup and

recovery of DNS data

Chapter 5

Most installations of Windows Server 2008 will include

installation of the Active Directory technology because somany products that require the server OS are tightly

integrated with Active Directory Chapter 5 provides a

complete guide to the technical portion of Active Directory,including its logical and physical structure, hierarchical

components (domains, trees, forests, and organizationalunits), scalability, and replication Coverage of the LDAPstandards is included, as well as a discussion of migrationand security considerations Then I move into planning

Chapter 6

Discusses Group Policy (GP), one of the most

underappreciated management technologies in any serverproduct Chapter 6 is dedicated to introducing GP and itsstructure and operation I begin with a survey of GP andActive Directory interaction, objects, and inheritance Then Iprovide a practical guide to implementing GP through userand computer policies and administrative templates,

installing software through GP, administration through

scripting, and redirecting folders and other user interfaceelements I also discuss IntelliMirror, a cool technology forapplication distribution (similar to ZENworks from Novell)

Chapter 7

Helps ensure that you are well versed in locking down yoursystems to protect both your own computers and the

Internet community as a whole I cover security policy,

including ways to manage it using predefined templates andcustomized policy plans, and an overview of the SecurityConfiguration and Analysis Tool, or SCAT Then I provide acomplete procedural guide to locking down both a Windowsnetwork server and a standard Windows client system

(despite the fact that this is a server book, administratorsoften are responsible for the entire network, and client andserver security go hand in hand)

Chapter 8

Covers the details of the major IIS revamp in this release

Chapter 9

Covers the new Server Core editions of Windows Server

2008, including deployment, activation, and using thesenew GUI-less versions of the operating system

Chapter 10

Provides a guide to Terminal Services, including an overviewfrom the server administrator's perspective and a similaroverview from a typical user's point of view Then I cover

how to install both Terminal Services itself and applications

such as Microsoft Office and other tools inside the TerminalServices environment A guide to configuring Terminal

Services follows, including procedures for general

configuration, remote control options, environment settings,logons, sessions, and permission control Concluding thechapter is a guide to daily administration using TerminalServices Manager, the Active Directory user tools, Task

Manager, and command-line utilities

Chapter 11

Covers the standard networking architecture of the

operating system, including addressing and routing issues.Then I move into a discussion of the various network

subsystems: the Domain Name System (DNS), the DynamicHost Configuration Protocol (DHCP), and a discussion ofVPN connectivity, the different phases of VPN, tunneling and

Server, the Internet Authentication Service (IAS) Finishing

up the chapter, I discuss IPSec, its support from within the

OS, and how to install, configure, use, and administer it.Coverage of client quarantining is also included

Chapter 12

Covers Windows clustering services First, a discussion ofthe different types of clustering services is provided, andthen I cover successfully planning a basic cluster and itsdifferent elements: the applications, how to group the

machines, capacity and network planning, user accountmanagement, and the possible points of failure A

treatment of Network Load Balancing clusters follows, and Iround out the chapter with a guide to creating and

managing server clusters, as well as an overview of theadministrative tools bundled with the OS

Chapter 13

Discusses Windows PowerShell, the powerful object-basedscripting and command-line technology now bundled withWindows Server 2008

Chapter 14

Covers the fundamentals of Microsoft's currently prereleasevirtualization solution called Hyper-V, including its structure,operation, and setup on Windows Server 2008 We'll alsolook at creating virtual machines, and we'll wrap up withwhat to expect upon Hyper-V's official release

P2.3 Conventions Used in This Book

Plain text

Indicates menu titles, menu options, menu buttons, andkeyboard accelerators (such as Alt and Ctrl)

Italic

Indicates new terms, URLs, email addresses, filenames, fileextensions, pathnames, directories, and command-line

utilities

Constant width

Indicates commands, options, switches, variables,

attributes, keys, functions, types, classes, namespaces,methods, modules, properties, parameters, values, objects,events, event handlers, XML tags, HTML tags, macros, thecontents of files, or the output from commands

This icon indicates a warning or caution

P2.4 Using Code Examples

This book is here to help you get your job done In general, youcan use the code in this book in your programs and

documentation You do not need to contact O'Reilly for

permission unless you're reproducing a significant portion of thecode For example, writing a program that uses several chunks

of code from this book does not require permission Selling or

distributing a CD-ROM of examples from O'Reilly books does

require permission Answering a question by citing this bookand quoting example code does not require permission

permissions@oreilly.com

P2.5 We'd Like to Hear from You

Please address comments and questions concerning this book to

To comment or ask technical questions about this book, sendemail to:

bookquestions@oreilly.com

For more information about our books, conferences, ResourceCenters, and the O'Reilly Network, see the O'Reilly web site at:http://www.oreilly.com

P2.6 Safari® Books Online

When you see a Safari® Books Online icon on the cover of yourfavorite technology book, that means the book is available

online through the O'Reilly Network Safari Bookshelf

Safari offers a solution that's better than e-books It's a virtuallibrary that lets you easily search thousands of top tech books,cut and paste code samples, download chapters, and find quickanswers when you need the most accurate, current information.Try it for free at http://safari.oreilly.com

P2.7 Acknowledgments

John Osborn at O'Reilly was instrumental in getting this processorganized and off the ground and provided very welcome

guidance and feedback during the initial stages of writing thisbook

Errors and shortcomings were dutifully found by the technicalreview team, which consisted of IT professionals Dan Green,Eric Rezabek, and Debbie Timmons

Edstrom with whom I worked during the development of thebook—their assistance and timely information was quite helpful

Special thanks to the many folks at Microsoft and Waggener-in putting together this project

Of course, my family is also to thank: particularly my wife, Lisa,who patiently accepted the insufficient answer of "not yet"

repeatedly to her reasonable question of "Aren't you done withthat book?"

Chapter 1 Introducing Windows Server 2008

It all started with Windows NT, Microsoft's first serious entryinto the network server market Versions 3.1 and 3.5 of

dominated world because they were sluggish and refused toplay well with others Along came Windows NT 4.0, which usedthe new Windows 95 interface (revolutionary only to those whodidn't recognize Apple's Macintosh OS user interface) to put afriendlier face on some simple yet fundamental architecturalimprovements With version 4.0, larger organizations saw thatMicrosoft was serious about entering the enterprise computingmarket, even if the product currently being offered was still

Windows NT didn't garner very much attention in a NetWare-limited in scalability and availability For one, Microsoft madeconcessions to NetWare users, giving them an easy way to

integrate with a new NT network The company also included arevised security feature set, including finely grained permissionsand domains, which signified that Microsoft considered

enterprise computing an important part of Windows

After a record six and one-half service packs, NT 4.0 is

considered by some to be the most stable operating systemever to come out of Redmond However, despite that, most

administrators with Unix experience required an OS more

credible in an enterprise environment—one that could compare

to the enormous Unix machines that penetrated that marketlong ago and had unquestionably occupied it ever since It

wasn't until February 2000, when Windows 2000 Server wasreleased, that these calls were answered Windows 2000 was acomplete revision of NT 4.0 and was designed with stability andscalability as first priorities

However, something was still lacking Sun and IBM includedapplication server software and developer-centric capabilitieswith their industrial-strength operating systems, Solaris andAIX Windows 2000 lacked this functionality In addition, the

Windows 2000 web server, Internet Information Services (IIS),cast an ominous cloud over the thought that Windows couldever be a viable Internet-facing enterprise OS Given that manysaw Microsoft as "betting the company" on a web services

initiative called NET, it was critical that Microsoft save face and

do it right the next time It wasn't too late, but customers werevery concerned about the numerous security vulnerabilities andthe lack of a convenient patch management system to applycorrections to those vulnerabilities Things had to change

From stage left, enter Windows Server 2003 What

year difference in release dates? Security, primarily WindowsServer 2003 came more secure out of the box and was heavilyinfluenced by the month-long halt of new development in March

distinguished the release other than a longer name and a three-2002, referred to by Microsoft as the beginning of the

Trustworthy Computing Initiative, wherein all developers andproduct managers did nothing but review existing source codefor security flaws and attend training on new best practices forwriting secure code Performance was also improved in the

Windows Server 2003 release, focus was put on making theoperating system scalable, and in general enterprise

administration was made more efficient and easier to automate.Microsoft also updated some bundled software via the WindowsServer 2003 R2 release, making it more straightforward to

manage identities over different directory services and securityboundaries, distribute files and replicate directory structuresamong many servers, and more

But as always, no software is perfect, and there's always roomfor improvement As business requirements have changed,

Microsoft developers worked in tandem on Windows Vista andthe next release of Windows on the server When Windows Vistawas released to manufacturing, the teams split again, and theWindows Server 2008 group added a few new features and thenfocused on performance and reliability until the release

Unlike the transition from Windows 2000 Server to WindowsServer 2003, which was a fairly minor "point"-style update,

Windows Server 2008 is a radical revision to the core code basethat makes up the Windows Server product Windows Server

through an unattended configuration file According to

Microsoft:

Server Core is designed for use in organizations that eitherhave many servers, some of which need only to perform

dedicated tasks but with outstanding stability, or in

environments where high security requirements require aminimal attack surface on the server

Accordingly, there are limited roles that Core servers can

perform They are:

Dynamic Host Configuration Protocol (DHCP) server

Domain Name System (DNS) server

IIS, although only with a portion of its normal abilities—namely only static HTML hosting, and no dynamic web

application support

Windows Media Services (WMS)

Additionally, Server Core machines can participate in Microsoftclusters, use network load balancing, host Unix applications,encrypt their drives with Bitlocker, be remotely managed usingWindows PowerShell on a client machine, and be monitored

through Simple Network Management Protocol, or SNMP

Most administrators will find placing Server Core machines inbranch offices to perform domain controller functions is an

excellent use of slightly older hardware that might otherwise bediscarded The smaller footprint of Server Core allows the OS to

do more with fewer system resources, and the reduced attacksurface and stability make it an excellent choice for an

appliance-like machine Plus, with a branch office, you can

combine Server Core with the ability to deploy a read-only

domain controller and encrypt everything with BitLocker, givingyou a great, lightweight, and secure solution

1.1.2 IIS Improvements

The venerable Microsoft web server has undergone quite a bit of

Newly rearchitected componentized structure

For the first time in IIS history, administrators exercise

complete control over exactly what pieces of IIS are

installed and running at any given time You can run theexact services you require—no more, no less This is of

course more secure, not to mention easier to manage andbetter performing

Flexible extensibility model

IIS 7 allows developers to access a brand-new set of APIsthat can interact with the IIS core directly, making moduledevelopment and customization much easier than it everhas been Developers can even hook into the configuration,scripting, event logging, and administration areas of IIS,which opens a lot of doors for enterprising administratorsand third-party software vendors to extend IIS' capabilitiessooner rather than later

Simplified configuration and application deployment

Configuration can be accomplished entirely through XMLfiles Central IIS configuration can be spread across multiplefiles, allowing many sites and applications hosted by thesame server to have independent but still easily managedconfigurations One of Microsoft's favorite demos of IIS 7 issetting up a web farm with identically configured machines;

as new members of the farm are brought online, the

administrator simply uses XCOPY and moves existing

meaningful, and most welcome, change in IIS 7

Delegated management

Much like Active Directory allows administrators to assignpermissions to perform certain administrative functions toother users, IIS administrators can delegate control of somefunctions to other people, like site owners

Efficient administration

IIS Manager has been completely redesigned and is joined

by a new command-line administration utility, appcmd.exe

Chapter 1 Introducing Windows Server 2008

It all started with Windows NT, Microsoft's first serious entryinto the network server market Versions 3.1 and 3.5 of

dominated world because they were sluggish and refused toplay well with others Along came Windows NT 4.0, which usedthe new Windows 95 interface (revolutionary only to those whodidn't recognize Apple's Macintosh OS user interface) to put afriendlier face on some simple yet fundamental architecturalimprovements With version 4.0, larger organizations saw thatMicrosoft was serious about entering the enterprise computingmarket, even if the product currently being offered was still

Windows NT didn't garner very much attention in a NetWare-limited in scalability and availability For one, Microsoft madeconcessions to NetWare users, giving them an easy way to

integrate with a new NT network The company also included arevised security feature set, including finely grained permissionsand domains, which signified that Microsoft considered

enterprise computing an important part of Windows

After a record six and one-half service packs, NT 4.0 is

considered by some to be the most stable operating systemever to come out of Redmond However, despite that, most

administrators with Unix experience required an OS more

credible in an enterprise environment—one that could compare

to the enormous Unix machines that penetrated that marketlong ago and had unquestionably occupied it ever since It

wasn't until February 2000, when Windows 2000 Server wasreleased, that these calls were answered Windows 2000 was acomplete revision of NT 4.0 and was designed with stability andscalability as first priorities

However, something was still lacking Sun and IBM includedapplication server software and developer-centric capabilitieswith their industrial-strength operating systems, Solaris andAIX Windows 2000 lacked this functionality In addition, the

Windows 2000 web server, Internet Information Services (IIS),cast an ominous cloud over the thought that Windows couldever be a viable Internet-facing enterprise OS Given that manysaw Microsoft as "betting the company" on a web services

initiative called NET, it was critical that Microsoft save face and

do it right the next time It wasn't too late, but customers werevery concerned about the numerous security vulnerabilities andthe lack of a convenient patch management system to applycorrections to those vulnerabilities Things had to change

From stage left, enter Windows Server 2003 What

year difference in release dates? Security, primarily WindowsServer 2003 came more secure out of the box and was heavilyinfluenced by the month-long halt of new development in March

distinguished the release other than a longer name and a three-2002, referred to by Microsoft as the beginning of the

Trustworthy Computing Initiative, wherein all developers andproduct managers did nothing but review existing source codefor security flaws and attend training on new best practices forwriting secure code Performance was also improved in the

Windows Server 2003 release, focus was put on making theoperating system scalable, and in general enterprise

administration was made more efficient and easier to automate.Microsoft also updated some bundled software via the WindowsServer 2003 R2 release, making it more straightforward to

manage identities over different directory services and securityboundaries, distribute files and replicate directory structuresamong many servers, and more

But as always, no software is perfect, and there's always roomfor improvement As business requirements have changed,

Microsoft developers worked in tandem on Windows Vista andthe next release of Windows on the server When Windows Vistawas released to manufacturing, the teams split again, and theWindows Server 2008 group added a few new features and thenfocused on performance and reliability until the release

Unlike the transition from Windows 2000 Server to WindowsServer 2003, which was a fairly minor "point"-style update,

Windows Server 2008 is a radical revision to the core code basethat makes up the Windows Server product Windows Server

through an unattended configuration file According to

Microsoft:

Server Core is designed for use in organizations that eitherhave many servers, some of which need only to perform

dedicated tasks but with outstanding stability, or in

environments where high security requirements require aminimal attack surface on the server

Accordingly, there are limited roles that Core servers can

perform They are:

Dynamic Host Configuration Protocol (DHCP) server

Domain Name System (DNS) server

IIS, although only with a portion of its normal abilities—namely only static HTML hosting, and no dynamic web

application support

Windows Media Services (WMS)

Additionally, Server Core machines can participate in Microsoftclusters, use network load balancing, host Unix applications,encrypt their drives with Bitlocker, be remotely managed usingWindows PowerShell on a client machine, and be monitored

through Simple Network Management Protocol, or SNMP

Most administrators will find placing Server Core machines inbranch offices to perform domain controller functions is an

excellent use of slightly older hardware that might otherwise bediscarded The smaller footprint of Server Core allows the OS to

do more with fewer system resources, and the reduced attacksurface and stability make it an excellent choice for an

appliance-like machine Plus, with a branch office, you can

combine Server Core with the ability to deploy a read-only

domain controller and encrypt everything with BitLocker, givingyou a great, lightweight, and secure solution

1.1.2 IIS Improvements

The venerable Microsoft web server has undergone quite a bit of

Newly rearchitected componentized structure

For the first time in IIS history, administrators exercise

complete control over exactly what pieces of IIS are

installed and running at any given time You can run theexact services you require—no more, no less This is of

course more secure, not to mention easier to manage andbetter performing

Flexible extensibility model

IIS 7 allows developers to access a brand-new set of APIsthat can interact with the IIS core directly, making moduledevelopment and customization much easier than it everhas been Developers can even hook into the configuration,scripting, event logging, and administration areas of IIS,which opens a lot of doors for enterprising administratorsand third-party software vendors to extend IIS' capabilitiessooner rather than later

Simplified configuration and application deployment

Configuration can be accomplished entirely through XMLfiles Central IIS configuration can be spread across multiplefiles, allowing many sites and applications hosted by thesame server to have independent but still easily managedconfigurations One of Microsoft's favorite demos of IIS 7 issetting up a web farm with identically configured machines;

as new members of the farm are brought online, the

administrator simply uses XCOPY and moves existing

meaningful, and most welcome, change in IIS 7

Delegated management

Much like Active Directory allows administrators to assignpermissions to perform certain administrative functions toother users, IIS administrators can delegate control of somefunctions to other people, like site owners

Efficient administration

IIS Manager has been completely redesigned and is joined

by a new command-line administration utility, appcmd.exe

The Windows Server 2008 team has made a special effort atimproving network performance and efficiency For the first

time, there is a dual-IP layer architecture for native IPv4 andIPv6 support together, simultaneously (If you've ever

configured IPv4 and IPv6 on a Windows Server 2003 machine,you'll know what a pain it is to get them to interoperate withoutfalling all over each other.) Communications security is

enhanced through better IPsec integration throughout the

various pieces of the TCP/IP stack Hardware is used more

efficiently and robustly to speed up performance of networktransmissions, intelligent tuning and optimization algorithmsrun regularly to ensure efficient communication, and APIs to thenetwork stack are more directly exposed, making it easier fordevelopers to interact with the stack Let's take a look at some

of the improvements in what the team is calling Next

Generation Networking

1.2.1 TCP/IP Stack Enhancements

As I alluded to earlier, many changes in Windows Server 2008were made to the TCP/IP stack itself One such improvement isthe auto-tuning TCP window size: Windows Server 2008 canautomatically tune the size of the receive window by each

individual connection, increasing the efficiency of large datatransfers between machines on the same network Microsoftquotes the following example: " on a 10 Gigabit Ethernetnetwork, packet size can be negotiated up to 6 Megabytes insize."

The dead gateway detection algorithm present in Windows

Server 2003 has been slightly improved: Windows Server 2008now tries every so often to send TCP traffic through what it

thinks to be a dead gateway If the transmission doesn't errorout, then Windows automatically changes the default gateway

to the previously detected dead gateway, which is now live AndWindows Server 2008 supports offloading network processing

There are also improvements to network scaling For example,

in previous versions of Windows Server, one NIC was associatedwith one single, physical processor However, with the right

network card, Windows Server 2008 supports scaling NICs andtheir associated traffic among multiple CPUs (a feature called

receive-side scaling), permitting much higher amounts of traffic

to be received by one NIC on a highly loaded server This

particularly benefits multiprocessor servers, since more scalecan be added simply by adding processors or NICs and not byadding entirely new servers

1.2.2 Changes to Terminal Services

Network applications are growing in popularity with each

passing week Windows Server 2008 sees more work in theTerminal Services/Remote Desktop area than might have beenexpected, and some of the new capabilities are very welcomeimprovements Aside from the three new features, the teamworked on improving the core processes that make TS tick,

including single sign-on to Terminal Services sessions, monitorspanning and high-resolution support for sessions, integrationwith the Windows System Resource Manager to better monitorperformance and resource usage, and themes that make TSsessions seamless to the client

There are three key new features added in the Windows Server

2008 release The first is Terminal Services RemoteApp Likethe functionality offered by Citrix MetaFrame years ago,

Windows Server 2008 will support—out of the box—the ability

to define programs to be run directly from a TS-enabled serverbut be integrated within the local copy of Windows, adding

independent taskbar buttons, resizable application window

areas, Alt-Tab switching functionality, remote population of

system tray icons, and more Users will have no idea that their

.RDP files, which are essentially text-based profiles of a

Terminal Services connection that the client reads and uses toconfigure an RDP session for that particular program They can

firewalls and correctly navigate NAT translation situations thatstymied the use of this technology before This saves

corporations from having to deploy VPN access to remote usersfor the sole purpose of accessing a Terminal Services machine;plus, since the data is sent over HTTPS, almost anyone can

access the sessions, even at locations where the RDP protocol isblocked by the firewall Administrators can set connection

authorization policies, or CAPs, that define user groups that arepermitted to access TS through the TS Gateway machine

Finally, in conjunction with the Terminal Services RemoteAppfeature, there is also in Windows Server 2008 the TS Web

Access feature, which lets administrators publicly display

available TS Remote Programs on a web page Users can

browse the list for the application they want to run, click on it,and then be seamlessly embedded in the application—using allthe features of TS Remote Programs—while retaining the ability

to launch other programs from the same Web Access site Theservice is smart enough to know that multiple programs

launched by the same user should reside in the same TerminalServices session, making resource management a bit simpler.And, you can even integrate TS Web Access within SharePoint

1.2.3 Active Directory: Read-Only Domain

Controllers

Windows Server 2008 introduces the concept of a read-onlydomain controller (RODC), which is great for branch offices andother locations where the machines hosting the domain

controller role can't be physically protected in the same way as

a machine in a datacenter might be RODCs hold a read-onlycopy of Active Directory, which allows for the immediate

benefits of faster logons and quicker authentication turnaroundtimes for other network resources, but also for the long-termsecurity benefits No attacker can create changes in an easilyaccessible DC in a branch office that will then replicate up to themain tree at the corporate office, since the DC is read-only TheRODC can also cache the credentials of branch office users and,with just one contact to a regular, writeable domain controller

up the tree, can directly service users' logon requests However,this caching is left off by default in the Password ReplicationPolicy for security reasons

Security problems have plagued Microsoft since the Windowsinception, but only in the last few years, as more people havebecome connected, have those flaws been exploited by

malcontents Indeed, some of the vulnerabilities in productsthat we see patches for on "Patch Tuesdays" are the results ofpoor design decisions These types of flaws are the ones

Microsoft is hoping to stamp out in the release of Windows

Server 2008 You'll see quite a bit of change to the architecture

of services in Windows Server 2008, including increasing thenumber of layers required to get to the kernel, segmenting

services to reduce buffer overflows, and reducing the size of thehigh-risk, privileged layers to make the attack surface smaller.While fundamentally changing the design of the operating

system, the Windows Server 2008 team has also included

several features designed to eliminate security breaches andmalware infestations, as well as capabilities meant to protectcorporate data from leakage and interception Let's take a look

change, the operating system will know and halt the boot

process so you can repair the problem

Operating system file protection also extends to each binaryimage that resides on the disk drive OS file protection in thismode consists of a filesystem filter driver that reads every pagethat is loaded into memory, checking its hashes, and validatingany image that attempts to load itself into a protected process

attacks) These hashes are stored in a specific system catalog,

or in an X.509 certificate embedded within a secure file on thedrive If any of these tests result in failure, OS file protectionwill halt the process to keep your machine secure This is activeprotection against problematic malware

Windows Server 2003 went a step farther, actually scramblingbits on the drive, but the keys to decrypt the files weren't asprotected as they should have been With BitLocker, the keysare stored within either a Trusted Platform Module (TPM) chip

on board your system, or a USB flash drive that you insert uponboot up

BitLocker is certainly complete: when enabled, the feature

encrypts the entire Windows volume including both user dataand system files, the hibernation file, the page file, and

temporary files The boot process itself is also protected by

BitLocker—the feature creates a hash based on the properties

of individual boot files, so if one is modified and replaced by, forexample, a Trojan file, BitLocker will catch the problem and

prevent the boot It's definitely a step up from the limitations ofEFS, and a significant improvement to system security over

unencrypted drives

1.3.3 Device Installation Control

Another security problem plaguing businesses everywhere is the

information that ideally should never leave the corporate

campus, but they're just as often found on keychains that arelost, inside computer bags left unattended in an airport lounge,

or in some equally dangerous location The problem is

significant enough that some business have taken to disablingUSB ports by pouring hot glue into the actual ports Effective,certainly, but also messy

In Windows Server 2008, an administrator will have the ability

to block all new device installs, including USB thumb drives,external hard drives, and other new devices You can simplydeploy a machine and allow no new devices to be installed

You'll also be able to set exceptions based on device class ordevice ID—for example, to allow keyboards and mice to be

added, but nothing else Or, you can allow specific device IDs,

in case you've approved a certain brand of product to be

installed, but no others This is all configurable via Group Policy,and these policies are set at the computer level

1.3.4 Windows Firewall with Advanced Security

The Windows Firewall version included with Windows Server

2003 Service Pack 1 was exactly the same as that included inWindows XP Service Pack 2 Microsoft bundled that firewall withService Pack 1 as a stopgap measure—deploy this firewall now,Microsoft said, so you will be protected, and we will work toimprove the firewall in the next version of Windows

That time is here The new Windows Firewall with AdvancedSecurity combines firewall and IPsec management into one

convenient MMC snap-in The firewall engine itself has been

AD computer or user group basis Outbound filtering has beenenabled; there was nothing but internal filtering in the previousversion of Windows Firewall And finally, profile support has

been improved as well—on a per-computer basis, there is now aprofile for when a machine is connected to a domain, a profilefor a private network connection, and a profile for a public

network connection, such as a wireless hotspot Policies can beimported and exported easily, making management of multiplecomputers' firewall configuration consistent and simple

1.3.5 Network Access Protection

Viruses and malware are often stopped by software defensesbefore they can run within a user's session, but the ultimateprotection would be if they never even got access to the

network In Windows Server 2008, Microsoft has created a

platform whereby computers are examined against a baselineset by the administrator, and if a machine doesn't stack up inany way against that baseline, that system can be preventedfrom accessing the network—quarantined, as it were, from thehealthy systems until the user is able to fix his broken machine.This functionality is called Network Access Protection

NAP can be broken down into three key components:

Health policy validation

Validation is the process wherein the machine attempting toconnect to the network is examined and checked againstcertain health criteria that an administrator sets

Health policy compliance

Compliance policies can be set so that managed computers