Configuring Availability of Network Resources

Backing Up Data

Windows Server 2008 has an additional role installed called Windows Server Backup (WSB). Backup consists of a Microsoft Management Console (MMC) snap-in, command-line tools, and Windows PowerShell cmdlets.

New Windows Server Backup (WSB) Features

• You can protect the entire server without using a separate backup and recovery technology
• Backup entire server or selected volumes
• Use wizards, tools, and the Complete PC Restore feature to assist in recovering a server
• Full support for Volume Shadow Copy service (VSS)
• Easier to restore to a point in time
• Can use Backup to provide application recovery
• Improved scheduling utility
• Better remote administration both from the GUI and through Windows PowerShell
• Windows PowerShell brings us extensive command line support
  
  

Storage Management and FSRM

File Server Resource Manager (FSRM) is a new suite of storage management tools in Windows Server 2008 R2.

There are many challenging aspects to storage management:

• Some organizations have growth requirements anywhere from 60-100 percent per year
• Critical data must always be available
• Organizations must comply with regulatory requirements
• The amount of storage-intensive apps on the market has increased
• How to determine existing storage capacity and usage trends
• How to determine whether usage supports organizational goals
• Defining and implementing storage policies
• Adjusting policies such as restricting employee personal file storage as capacity needs grow

How do we address capacity and storage management?

Network File and Print Services

Configuring and Troubleshooting File Shares 

What is a File Share?

A file share is a folder that has been configured so that it can be accessed over a network.

In Windows Server 2008, to configure a file share, install the File Service server role. The File Service server role automatically configures Windows Firewall to allow file sharing.

File Services Role

Windows Server 2008 has a new tool called Share and Storage Management that is used to create and configure file shares. To do this, you can also use the Computer Management tool that is available in previous versions of Windows Server and the command line tool, Net use.

Share and Storage Management

Configure and Manage Distributed File System (DFS)

If you have multiple file servers deployed, how do you connect to the file servers?

DFS is a service that connects file shares together into a single namespace. The files can reside on different computers and provides client access to the files in a transparent manner.

According to Windows® Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition:

Troubleshooting IPSEC

IPSec Monitoring Tools

Tool	Description
IP Security Monitor	Used as a MMC snap-in with Windows XP and higher Administrators can use it locally or remotely to monitor IPSec policy
Ipsecmon	Command-line tool Only available in Windows 2000
Windows Firewall with Advanced Security	New to Windows Vista and Windows Server 2008
Netsh	Perform a trace, located in systemroot\debug\oakley.log Enabled in Windows XP and Windows 2000 with registry modification

IP Security Monitor

The IP Security Monitor snap-in is used to view and monitor IP-Sec policy. The IP Security Monitor can be used to troubleshoot and test IPSec policies you create. 

In previous versions of Windows, we used IP Security Monitor as a snap-in in the MMC. With Windows Server 2008, the IP Security Monitor is now integrated with the Windows Firewall with Advanced Security (WFAS). 

Configuring IPSec

Even though you can encrypt your data stored on your hard drive, how do you protect the data while it is in transmission? IPSec can do this. 

IPSec (Internet Protocol Security) is a set of protocols that give you a level of encryption between two computers while it is being transferred over an unsecured network.  IPSec uses security services and digital certificates with public and private keys. As stated in Mark Russinovich's and David Solomon's Windows Internals Book:

Internet Protocol Security (IPSec), which is integrated with the Windows TCP/IP stack, helps to protect unicast (IPSec itself supports multicast, but the Windows implementation does not) IP data against attacks such as eavesdropping, sniffer attacks, data modification, IP address spoofing, and man-in-th-middle attacks (when the identity of the remote machine can be verified, like a VPN). You can use IPSec to provide defense-in-depth against network-based attacks from untrusted computers; certain attacks that can result in the denial-of-service of applications, services, or the network; data corruption, data theft, and user-credential theft; and the administrative control over servers, other computers, and the network. IPSec helps defend against network-based attacks through cryptography-based security services, security protocols, and dynamic key management.

IPSec was originally designed to secure traffic over public networks. However, IPSec is being used increasingly on private networks. Windows Server 2008 provides enhancements to the IPSec rules.

Windows Internals Book

Configuring Network Access Protection (NAP)

How do you protect yourself from computers that do not meet your health requirements on your network?

Network Access Protection (NAP) with Windows Server 2008:

• A feature of Windows server 2008 that enforces health-requirement policies on client computers running:
  • Windows XP (SP3)
  • Vista
  • Windows 7
  • Windows server 2008
  • Windows server 2008 R2
• Ensures client computers are compliant with policies such as anti-virus and security policies on a granular level, based on who the client is and the group to which the client belongs.
• Remediation servers can offer support for computers not meeting health requirements, and to automatically bring the client back into compliance and dynamically increase its level of network access.
• You are able to integrate NAP’s features with software from other vendors or with custom programs.
• You can customize your health enforcement solutions. NAP includes an application programming interface (API) for developers and vendors that allows them to create customized solutions for health-requirements, network-access, and ongoing compliance.

About Network Policy Server Role Service

Installing and Configuring a Network Policy Server

The Network Policy Server (NPS) role in Windows Server 2008 replaces the Internet Authentication Service (IAS). Windows Server 2008 R2 can authenticate clients using Network Policy Server (NPS). NPS provides an additional layer of security for your network.

• NPS provides support for the Remote Authentication Dial-in User Service protocol and can be configured as a RADIUS server or proxy. 
• NPS also provides functionality that is essential for implementation of Network Access Protection (NAP). 
• NPS is used for enforcement for:
•  IPsec traffic
•  802.1X wired and wireless
•  DHCP
•  VPN

About Routing and Remote Access in Server 2008

Components of a Network Access Services Infrastructure

In Windows Server 2008, Network Access Service includes the following:

• VPN Server
• Active Directory Domain services (AD DS)
• IEEE 802.1X Devices – provides port based authentication of users
• Dynamic Host Configuration Protocol (DHCP) Server – Responsible for leasing IP addresses
• NAP Health Policy Server – Provides authentication services for other network access components
• Health Registration Authority – Obtains health certificates for clients passing the health policy verification
• Remediation Servers – A new server for Windows Server 2008 on a limited network, designed to treat machines that do not have the latest antivirus or Windows updates, by pushing the updates down to the NAP client sitting in the restricted network before the client accesses the main network

Network Policy and Access Services

About IPv6 TCP/IP and Windows Server 2008

Overview

Web Running Out of Addresses

In the mid 1990s, we started to run into an ever shrinking pool of IPv4 addresses. According to the Wall Street Journal, February 1, 2011, was the week the last batch of Internet addresses was doled out.

IPv4_address_exhaustion

Because of the growing proliferation of network devices and the expanding Internet, Internet Protocol version 6 (Ipv6), is built into Windows Server 2008. Ipv6 is a new suite of protocols developed to ensure growing Internet client needs. The IPv4 scalability will no longer meet the challenges ahead.

Configuring and Troubleshooting DHCP

Overview of the DHCP Server Role

One of the major problems in networks when the move was made to the TCP/IP protocol, was getting the IP address input onto each machine.

The solution is DHCP (Dynamic Host Configuration Protocol). The DHCP server maintains a pool of IP addresses and DHCP leases out an IP address for a period of time to DHCP-enabled host machines on the network. DHCP provides the IP address along with the subnet mask and default gateway (router). The IP addresses are returned to the pool to be reallocated, when they are no longer in use. DHCP waits for the client to request an IP address using network Broadcasts.

WINS and Server 2008

Overview of the Windows Internet Name Service 

WINS is a NetBIOS Name Server (NBNS). Windows hosts support two types of names, host names and NetBIOS names. 

In a Windows OS, network services can be requested using Windows Sockets, Winsock Kernel, or NetBIOS. If Windows Sockets or Winsock Kernel is requested, the host name is used. Windows Sockets is used to access network services in many applications. The newer applications that were designed for Windows 7 and Windows Server 2008 R2 use Winsock Kernel.  If NetBIOS is used, the application uses a NetBIOS name.

Troubleshooting tips for DNS

Time to Live, Aging, and Scavenging

Feature	Description
Time to Live (TTL)	How long a DNS record will be valid
Aging	When records inserted into the DNS server reach expiration and are removed
Scavenging	Remove old DNS records

Time to Live – TTL depends on the type of DNS record. MX records have a longer TTL than a host A record, for example. The TTL can be modified.
Resource Record Types

Aging – DNS record removal helps to keep DNS accurate and using less disk space.

Scavenging – If DNS records have not been aged, we can force a database cleanup by removing stale records. This can be done by scavenging DNS records. Stale resource records can slow down DNS lookups and cause errors.

Tips on How to Configure DNS Zones

DNS zones allow domains to be logically configured and managed in a structured way. A zone hosts all of a domain or parts of a domain and its subdomains.

Take for example, pcrepairnorthshore.com. Imagine pcrepairnorthshore.com is divided into two zones. The first zone hosts www.pcrepairnorthshore.com and ftp.pcrepairnorthshore.com.  Let’s pretend we have a site called offsite.pcrepairnorthshore.com. We delegate it to a new zone that hosts the offsite.pcrepairnorthshore.com and its subdomains ftp.offsite.pcrepairnorthshore.com and www.offsite.pcrepairnorthshore.com.

Configure the DNS Server Role

Components of a DNS Solution

• DNS Clients. Windows, Unix, Linux, Macs operating systems. Windows systems also maintain a local DNS Resolver cache.
• DNS Servers. Host a distributed heirarchical database of resource records stored by the DNS zone and include: