Configure and Manage Distributed File System (DFS)

If you have multiple file servers deployed, how do you connect to the file servers?

DFS is a service that connects file shares together into a single namespace. The files can reside on different computers and provides client access to the files in a transparent manner.

According to Windows® Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition:

Troubleshooting IPSEC

IPSec Monitoring Tools

Tool	Description
IP Security Monitor	Used as a MMC snap-in with Windows XP and higher Administrators can use it locally or remotely to monitor IPSec policy
Ipsecmon	Command-line tool Only available in Windows 2000
Windows Firewall with Advanced Security	New to Windows Vista and Windows Server 2008
Netsh	Perform a trace, located in systemroot\debug\oakley.log Enabled in Windows XP and Windows 2000 with registry modification

IP Security Monitor

The IP Security Monitor snap-in is used to view and monitor IP-Sec policy. The IP Security Monitor can be used to troubleshoot and test IPSec policies you create. 

In previous versions of Windows, we used IP Security Monitor as a snap-in in the MMC. With Windows Server 2008, the IP Security Monitor is now integrated with the Windows Firewall with Advanced Security (WFAS). 

Configuring IPSec

Even though you can encrypt your data stored on your hard drive, how do you protect the data while it is in transmission? IPSec can do this. 

IPSec (Internet Protocol Security) is a set of protocols that give you a level of encryption between two computers while it is being transferred over an unsecured network.  IPSec uses security services and digital certificates with public and private keys. As stated in Mark Russinovich's and David Solomon's Windows Internals Book:

Internet Protocol Security (IPSec), which is integrated with the Windows TCP/IP stack, helps to protect unicast (IPSec itself supports multicast, but the Windows implementation does not) IP data against attacks such as eavesdropping, sniffer attacks, data modification, IP address spoofing, and man-in-th-middle attacks (when the identity of the remote machine can be verified, like a VPN). You can use IPSec to provide defense-in-depth against network-based attacks from untrusted computers; certain attacks that can result in the denial-of-service of applications, services, or the network; data corruption, data theft, and user-credential theft; and the administrative control over servers, other computers, and the network. IPSec helps defend against network-based attacks through cryptography-based security services, security protocols, and dynamic key management.

IPSec was originally designed to secure traffic over public networks. However, IPSec is being used increasingly on private networks. Windows Server 2008 provides enhancements to the IPSec rules.

Windows Internals Book

Configuring Network Access Protection (NAP)

How do you protect yourself from computers that do not meet your health requirements on your network?

Network Access Protection (NAP) with Windows Server 2008:

• A feature of Windows server 2008 that enforces health-requirement policies on client computers running:
  • Windows XP (SP3)
  • Vista
  • Windows 7
  • Windows server 2008
  • Windows server 2008 R2
• Ensures client computers are compliant with policies such as anti-virus and security policies on a granular level, based on who the client is and the group to which the client belongs.
• Remediation servers can offer support for computers not meeting health requirements, and to automatically bring the client back into compliance and dynamically increase its level of network access.
• You are able to integrate NAP’s features with software from other vendors or with custom programs.
• You can customize your health enforcement solutions. NAP includes an application programming interface (API) for developers and vendors that allows them to create customized solutions for health-requirements, network-access, and ongoing compliance.

About Network Policy Server Role Service

Installing and Configuring a Network Policy Server

The Network Policy Server (NPS) role in Windows Server 2008 replaces the Internet Authentication Service (IAS). Windows Server 2008 R2 can authenticate clients using Network Policy Server (NPS). NPS provides an additional layer of security for your network.

• NPS provides support for the Remote Authentication Dial-in User Service protocol and can be configured as a RADIUS server or proxy. 
• NPS also provides functionality that is essential for implementation of Network Access Protection (NAP). 
• NPS is used for enforcement for:
•  IPsec traffic
•  802.1X wired and wireless
•  DHCP
•  VPN

About Routing and Remote Access in Server 2008

Components of a Network Access Services Infrastructure

In Windows Server 2008, Network Access Service includes the following:

• VPN Server
• Active Directory Domain services (AD DS)
• IEEE 802.1X Devices – provides port based authentication of users
• Dynamic Host Configuration Protocol (DHCP) Server – Responsible for leasing IP addresses
• NAP Health Policy Server – Provides authentication services for other network access components
• Health Registration Authority – Obtains health certificates for clients passing the health policy verification
• Remediation Servers – A new server for Windows Server 2008 on a limited network, designed to treat machines that do not have the latest antivirus or Windows updates, by pushing the updates down to the NAP client sitting in the restricted network before the client accesses the main network

Network Policy and Access Services

About IPv6 TCP/IP and Windows Server 2008

Overview

Web Running Out of Addresses

In the mid 1990s, we started to run into an ever shrinking pool of IPv4 addresses. According to the Wall Street Journal, February 1, 2011, was the week the last batch of Internet addresses was doled out.

IPv4_address_exhaustion

Because of the growing proliferation of network devices and the expanding Internet, Internet Protocol version 6 (Ipv6), is built into Windows Server 2008. Ipv6 is a new suite of protocols developed to ensure growing Internet client needs. The IPv4 scalability will no longer meet the challenges ahead.

Configuring and Troubleshooting DHCP

Overview of the DHCP Server Role

One of the major problems in networks when the move was made to the TCP/IP protocol, was getting the IP address input onto each machine.

The solution is DHCP (Dynamic Host Configuration Protocol). The DHCP server maintains a pool of IP addresses and DHCP leases out an IP address for a period of time to DHCP-enabled host machines on the network. DHCP provides the IP address along with the subnet mask and default gateway (router). The IP addresses are returned to the pool to be reallocated, when they are no longer in use. DHCP waits for the client to request an IP address using network Broadcasts.

WINS and Server 2008

Overview of the Windows Internet Name Service 

WINS is a NetBIOS Name Server (NBNS). Windows hosts support two types of names, host names and NetBIOS names. 

In a Windows OS, network services can be requested using Windows Sockets, Winsock Kernel, or NetBIOS. If Windows Sockets or Winsock Kernel is requested, the host name is used. Windows Sockets is used to access network services in many applications. The newer applications that were designed for Windows 7 and Windows Server 2008 R2 use Winsock Kernel.  If NetBIOS is used, the application uses a NetBIOS name.

Troubleshooting tips for DNS

Time to Live, Aging, and Scavenging

Feature	Description
Time to Live (TTL)	How long a DNS record will be valid
Aging	When records inserted into the DNS server reach expiration and are removed
Scavenging	Remove old DNS records

Time to Live – TTL depends on the type of DNS record. MX records have a longer TTL than a host A record, for example. The TTL can be modified.
Resource Record Types

Aging – DNS record removal helps to keep DNS accurate and using less disk space.

Scavenging – If DNS records have not been aged, we can force a database cleanup by removing stale records. This can be done by scavenging DNS records. Stale resource records can slow down DNS lookups and cause errors.

Tips on How to Configure DNS Zones

DNS zones allow domains to be logically configured and managed in a structured way. A zone hosts all of a domain or parts of a domain and its subdomains.

Take for example, pcrepairnorthshore.com. Imagine pcrepairnorthshore.com is divided into two zones. The first zone hosts www.pcrepairnorthshore.com and ftp.pcrepairnorthshore.com.  Let’s pretend we have a site called offsite.pcrepairnorthshore.com. We delegate it to a new zone that hosts the offsite.pcrepairnorthshore.com and its subdomains ftp.offsite.pcrepairnorthshore.com and www.offsite.pcrepairnorthshore.com.

Configure the DNS Server Role

Components of a DNS Solution

• DNS Clients. Windows, Unix, Linux, Macs operating systems. Windows systems also maintain a local DNS Resolver cache.
• DNS Servers. Host a distributed heirarchical database of resource records stored by the DNS zone and include:

Installing a DNS Server Role in Windows Server 2008

DNS recognizes computers by alphanumeric names and translates the names to the numerical IP addresses recognized by computers and networking equipment. DNS resolves the computer names to the IP addresses.

DNS is installed as a role in Windows Server 2008. It can be installed with Server Manager and with the DNS Server command from the command prompt. The preferred way is to install the DNS Server Role when Active Directory Domain Services is installed, if you want to integrate the DNS domain namespace with the AD DS domain namespace. In addition, Server Core can act as a DNS Server.

Overview of Server Roles and Features in Windows Server 2008

Server Roles describe the primary functions of a server in Windows Server 2008. On a server, there can be one or more server roles. For example, you can have a DNS server or a Web server, or a server comprising multiple roles.

Installing Windows Server 2008

Installing Windows Server 2008 is different from previous installs of Windows Server platforms. There is no text-based phase. The installation is now done in a GUI and the install process is very similar to Windows Vista.

Windows Server 2008 Editions

Edition	Server Core
Windows Server 2008 Standard (small offices or workgroups)	Yes
Windows Server 2008 Enterprise (greater scalability, failover clustering, AD Fed Services)	Yes
Windows Server 2008 DataCenter (larger orgs and server consolidation projects, greater memory and processing power, unlimited virtual image use rights)	Yes
Windows Web Server 2008 (standalone server for IIS)	No
Windows Server 2008 for Itanium-based Systems (highest level of performance and scalabiity, leading rival platform for Risc-based UNIX servers, requires Intel Itanium CPU)	No