main

• | Table of Contents
• | Index
• | Examples
Implementing and Administering Security in a Windows® Server™ 2003 Network Exam Cram™ 2 (Exam 70-299)
By Diane Barrett, Bill Ferguson, Don Poulton
Publisher | : Que
Pub Date | : May 25, 2004
ISBN | : 0-7897-3138-X
Pages | : 384

The 70-299 exam measures your ability to implement, manage, maintain, and troubleshoot security in a Windows Server 2003 network infrastructure and also plan and configure a Windows Server 2003 PKI. The MCSE 70-299 Exam Cram 2 gives you the essential information you need to know to learn how to implement, manage, and troubleshoot security policies, patch management infrastructure, security for network communications, as well as how to plan, configure and troubleshoot authentication, authorization, and PKI. This book can be used as a sole study guide for those experienced with Windows 2003 security or it is the perfect supplement guide for more comprehensive training materials, instructor-led classes, and/or computer-based training.


Table of Contents

• | Table of Contents
• | Index
• | Examples
Implementing and Administering Security in a Windows® Server™ 2003 Network Exam Cram™ 2 (Exam 70-299)
By Diane Barrett, Bill Ferguson, Don Poulton
Publisher | : Que
Pub Date | : May 25, 2004
ISBN | : 0-7897-3138-X
Pages | : 384

Copyright
The 70-299 Cram Sheet
 | IMPLEMENTING AND MANAGING SECURITY POLICIES
 | IMPLEMENTING, MANAGING, AND TROUBLESHOOTING PATCH MANAGEMENT INFRASTRUCTURE
 | IMPLEMENTING AND MANAGING SECURITY FOR NETWORK COMMUNICATIONS
 | PLANNING AND CONFIGURING AUTHENTICATION AND AUTHORIZATION FOR REMOTE ACCESS USERS
 | PLANNING, CONFIGURING, AND TROUBLESHOOTING PKI
 | TROUBLESHOOTING SECURITY POLICIES AND IPSEC
 | PLANNING AND IMPLEMENTING SECURITY FOR WIRELESS NETWORKS
A Note from Series Editor Ed Tittel
About the Authors
About the Technical Editors
Acknowledgments
We Want to Hear from You!
Introduction
 | Taking a Certification Exam
 | Arriving at the Exam Site
 | In the Exam Room
 | How to Prepare for an Exam
 | Notes on This Book's Organization
 | How This Book Helps You
Self-Assessment
 | MCSAs and MCSEs in the Real World
 | The Ideal MCSA or MCSE Candidate
 | Put Yourself to the Test
 | Assessing Readiness for Exam 70-299
 | Take the Challenge!
Chapter 1. Implementing and Managing Security Policies
 | Managing Security Mechanisms in Windows Server 2003
 | Planning and Deploying Security Templates
 | Configuring Extra Security Based on Server Roles
 | Planning Security for the DHCP and DNS Infrastructure Services
 | Configuring Extra Security Based on Client Roles
 | Planning and Configuring Auditing and Logging Computer Roles
 | Analyzing Security Configuration
 | Exam Prep Questions
Chapter 2. Implementing, Managing, and Troubleshooting Patch Management Infrastructure
 | Planning, Evaluating, and Testing the Deployment of Service Packs and Hotfixes
 | Using MBSA to Assess the Current Status of Service Packs and Hotfixes
 | Troubleshooting Patch Management Infrastructure
 | Exam Prep Questions
Chapter 3. Implementing and Managing Security for Network Communications
 | Planning an IPSec Deployment
 | Configuring IPSec Policies
 | Deploying and Managing IPSec Policies
 | Exam Prep Questions
Chapter 4. Planning and Configuring Authentication and Authorization for Remote Access Users
 | Deploying, Managing, and Configuring SSL Certificates
 | Configuring Security and Authentication for Remote Access Users
 | Configuring and Troubleshooting Virtual Private Network (VPN) Protocols
 | Managing Client Configuration for Remote Access Security
 | Exam Prep Questions
Chapter 5. Planning, Configuring, and Troubleshooting PKI
 | Public Key Infrastructure (PKI) and Certification Authority (CA) Hierarchies
 | Managing CAs
 | Backing Up and Restoring the CA
 | Troubleshooting Authentication, Authorization, and PKI
 | Exam Prep Questions
Chapter 6. Troubleshooting Security Policies and IPSec
 | Troubleshooting Security Policies
 | Troubleshooting IPSec
 | Exam Prep Questions
Chapter 7. Planning and Implementing Security for Wireless Networks
 | Planning the Authentication Methods for a Wireless Network
 | Planning the Encryption Methods for a Wireless Network
 | Planning and Configuring Wireless Access Policies
 | Configuring SSL Certificates for Wireless Networks
 | Configuring Wireless Encryption
 | Installing and Configuring Wireless Support for Client Computers
 | Exam Prep Questions
Chapter 8. Practice Exam #1
Chapter 9. Answer Key to Practice Exam #1
Chapter 10. Practice Exam #2
Chapter 11. Answer Key to Practice Exam #2
Appendix A. CD Contents and Installation Instructions
 | Multiple Test Modes
 | Random Questions and Order of Answers
 | Detailed Explanations of Correct and Incorrect Answers
 | Attention to Exam Objectives
 | Installing the CD
 | Technical Support
Appendix B. Suggested Reading and Resources
 | General Resources
 | Chapter 1
 | Chapter 2
 | Chapter 3
 | Chapter 4
 | Chapter 5
 | Chapter 6
 | Chapter 7
Glossary
Index


Copyright

Copyright © 2004 by Que Publishing

All rights reserved. No part of this book shall be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without written permission from the publisher. No patent liability is assumed with respect to the use of the information contained herein. Although every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information contained herein.

Library of Congress Catalog Card Number: 2003115432

Printed in the United States of America

First Printing: June 2004

07 06 05 04 4 3 2 1

Trademarks

All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Que Publishing cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark.

Warning and Disclaimer

Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information provided is on an "as is" basis. The author and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the CD or programs accompanying it.

Bulk Sales

Que Publishing offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales. For more information, please contact

U.S. Corporate and Government Sales
1-800-382-3419
corpsales@pearsontechgroup.com

For sales outside of the U.S., please contact

International Sales
1-317-428-3341
international@pearsontechgroup.com

Credits

Publisher

Paul Boger

Executive Editor

Jeff Riley

Acquisitions Editor

Jeff Riley

Development Editor

Steve Rowe

Managing Editor

Charlotte Clapp

Project Editor

Tricia Liebig

Copy Editor

Benjamin Berg

Indexer

Ken Johnson

Proofreader

Linda Seifert

Technical Editors

David Neilan

Marc Savage

Team Coordinator

Pamalee Nelson

Multimedia Developer

Dan Scherf

Interior Designer

Gary Adair

Cover Designer

Anne Jones

Page Layout

Susan Geiselman

Dedication

To the memory of my brothers, Steven and Ronald.

—Diane Barrett

This book is dedicated to my mother, Suanne. Her creative spirit and her accomplishments as a writer and a teacher have been a constant source of encouragement to me.

—Bill Ferguson

To my wife Terry, who has stood by me during the hours involved over the holidays as I worked hard to make this book a reality.

—Don Poulton


The 70-299 Cram Sheet

This Cram Sheet contains the distilled, key facts you need for Exam 70-299, Implementing and Administering Security in a Microsoft Windows Server 2003 Network. Review this information as the last thing you do before you enter the testing center, paying special attention to those areas in which you feel that you need the most review. You can transfer any of these facts from your head onto a blank sheet of paper given to you by the testing center, immediately before you begin the exam.


IMPLEMENTING AND MANAGING SECURITY POLICIES

  1. Groups can be defined as either security or distribution. Security groups can be assigned permissions to resources through access control entries (ACEs). Distribution groups are used for membership purposes only. A security group can also be used as an email entity.

  2. A group can be converted from a security group to a distribution group, and vice versa, only if the domain functional level is set to Windows 2000 native or higher. Security groups with universal scope cannot be created in mixed mode. Universal scope is supported only in domains in which the functional level is set to native mode.

  3. A group's scope dictates who can be a member of the group and what resources the group has access to. Local requires access to the specific computer where the local group is created. Domain local groups can contain user, global, and universal groups. Global groups can contain global groups from the same domain. Universal groups can contain other universal and global groups from any domain but not domain local groups.

  4. The predefined security templates are stored in Systemroot\Security\Templates. These have .inf extensions and include Setup security and DC security (default security settings used when an OS is installed or a server promoted), Compatws (compatible with most legacy applications), Securews and Securedc (limit use of LAN Manager and NTLM authentication), Hisecws and Hisecdc (highly secure), Rootsec (changes the root directory permissions), and Notssid (removes the unnecessary Terminal Server SIDs).

  5. Three account policy areas can be configured: Password, Account Lockout, and Kerberos policies. Only one domain account policy can exist. The policy is applied at the root of the domain and becomes the policy for any system that is a member of the domain. When an account policy is configured for an OU, these settings affect the local policy settings on the computers contained in the OU.

  6. The Members list defines who belongs to a restricted group while the Member Of list states which other groups a restricted group belongs to. When a group is added to the Restricted Groups portion of a security template, only group members listed in the template will remain once the template is applied.

  7. The Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts and Shares and Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts policies replace the Windows 2000 Additional Restrictions for Anonymous Connections that managed the Registry value called Restrict Anonymous.

  8. Gpupdate replaces the Windows 2000 command secedit /refreshpolicy. The syntax is as follows: gpupdate [/target: computer] [/force] [/wait:Value] [/logoff] [/boot].

  9. Use the command-line tool Secedit.exe in a batch file or script to configure security on multiple computers at scheduled times. The commands are secedit /analyze, secedit /configure, secedit /export, secedit /import, secedit /validate, and secedit /GenerateRollback.

  10. Use loopback policy to override user-based Group Policy with computer-based Group Policy. This makes the desktop configuration the same regardless of who logs on.

  11. Use software restriction policies for more control over who receives what software. A default security level of Unrestricted (allowed) or Disallowed (not allowed) for a Group Policy object (GPO) is defined. You can create the following types of rules for exceptions: Hash, certificate, path, and Internet rules.

  12. If you do not want the software restriction policies to apply to local administrators, click All Users Except Local Administrators under the Enforcement object of Group Policy.


IMPLEMENTING, MANAGING, AND TROUBLESHOOTING PATCH MANAGEMENT INFRASTRUCTURE

  1. You can now use QChain.exe to chain Windows 2000 post-SP2 updates together and the latest version of a file is installed, regardless of the order the updates are installed. To install multiple updates with only one restart, run the update installer using the -z switch.

  2. You can use Group Policy to distribute service pack installations by making a new software installation package (.msi file) and linking it to a GPO through the computer configuration settings.

  3. MBSA references an Extensible Markup Language (XML) file called Mssecure.xml. When you run MBSA for the first time, it obtains a copy of this Mssecure.xml file in a digitally signed .cab file. The Mssecure.cab file ensures that only the signed .cab file is used and prevents the downloading of an out-of-date XML file.

  4. The Microsoft Network Security Hotfix Checker (HFNetChk) tool can be used to scan for missing security updates and service packs by using mbsacli.exe /hf with the appropriate pararmeters.

  5. Qfecheck.exe has the ability to track and verify installed Windows 2000 and Windows XP hotfixes by reading the information that is stored the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates Registry key.

  6. Software Update Services (SUS) allows each software update to be approved before it is installed in the environment, and deploys Windows-related security patches and updates to any computers running Windows 2000, Windows XP Professional, or Windows Server 2003.

  7. In WU and SUS environments, some Microsoft products must be updated by using other services or by manually applying software updates. SMS does not have this limitation and can be used to update any software product on an SMS client.

  8. Slipstreaming simultaneously installs service packs with an operating system. The installation includes the components and updates as entries in the Svcpack.inf file. Copy the installation files for the operating system and the updates to a shared distribution folder, create the package, and then run Setup to deploy the installation either from the shared distribution folder or a CD-ROM.

  9. All SUS updates downloaded to your server need to be approved before the server makes them available to computers running the Automatic Updates client. The approval process is done through the Approve Updates page.

  10. To configure automatic updates through Group policy, add the Wuau.adm template to the GPO.


IMPLEMENTING AND MANAGING SECURITY FOR NETWORK COMMUNICATIONS

  1. IPSec can now function through Network Address Translation (NAT) as long as it is configured to allow UDP traffic. The Internet Key Exchange (IKE) protocol will detect the presence of NAT and use UDP-ESP encapsulation to allow the traffic to pass through.

  2. AH and ESP provide for authentication, integrity, and anti-replay of each packet. ESP also provides for confidentiality. ESP does not sign the entire packet; only the IP payload itself is encrypted.

  3. Transport mode IPSec is used for secure communication between clients and servers on a LAN, and tunnel mode is used for secure communication between networks.

  4. Kerberos is the default authentication method for Windows 2000 Server and Windows Server 2003. It can only be used with Microsoft clients later than Windows 2000 Professional. Using Kerberos requires the least administrative effort.

  5. If you use more than one filter in a single IPSec policy rule, the IPSec Policy Agent reads the policy. Filters are processed into one ordered list that is sorted from the most to the least specific.

  6. Each IPSec policy consists of rules that are configured on the Rules tab of the properties of an IPSec policy. Each rule can contain settings for Filter list, Filter action, Authentication methods, Tunnel endpoint, and Connection type. Know how to use the Edit button to modify filter properties.

  7. Create, modify, and deploy IPSec policies using the IP Security Policy Management console.

  8. Group Policies are created in a domain and then linked to the appropriate container. Group Policies are processed in the order of local, site, domain, OU, and then child OU. IPSec policies that conflict will be overridden by the next level of processing.

  9. PPTP is the recommended protocol when tunneling with NAT using Microsoft servers earlier than Windows Server 2003. Windows Server 2003 allows IPSec to be used through a NAT via IP NAT Traversal.

  10. If all computers belong to the Windows Server 2003 family, you can deploy IPSec using the netsh ipsec command. Netsh ipsec static can create, modify, and assign IPSec policies without immediately affecting the active IPSec policies. Netsh ipsec dynamic displays the active state of IPSec and immediately affects the configuration of the active IPSec policy.


PLANNING AND CONFIGURING AUTHENTICATION AND AUTHORIZATION FOR REMOTE ACCESS USERS

  1. Open port 1723/tcp to allow PPTP traffic and port 1701/udp to allow L2TP traffic to pass through a firewall. Secure Sockets Layer (SSL) traffic uses the HTTPS protocol and port 443.

  2. MS-CHAPv2 is supported by Windows XP, 2000, 98, Me, and NT 4.0. Windows 95 clients support MS-CHAPv2 for virtual private networking (VPN) connections but not for dial-up connections.

  3. Two types of EAP authentication are built in to Windows Server 2003: MD5 Challenge and TLS.

  4. EAP-TLS is supported only on servers that run Routing and Remote Access, that are configured to use Windows Authentication, and that are members of a domain.

  5. Windows Server 2003 supports PPTP and L2TP, but L2TP can be used only by Windows 2000 Professional and newer clients.

  6. Remote access policies consist of conditions, permissions, and profile components that work together to allow or deny a connection. If multiple policies are configured, they will be processed in order from the top down. Place the policy that is most specific at the top of the list.

  7. MPPE is the main encryption protocol used in PPTP tunnels. You cannot use CHAP authentication when using MPPE.

  8. Multifactor authentication works on the premise that a user can prove his identity in three ways: something he knows (password or a PIN),something he has (smart card), and something he is (fingerprint or retinal scan).

  9. You can use Connection Manager Administration Kit (CMAK) to fully customize a connection and provide additional functionality for users.


PLANNING, CONFIGURING, AND TROUBLESHOOTING PKI

  1. Only one root CA exists in any hierarchy. You must always install the root CA first. In any hierarchy, the root CA is always the most trusted authority.

  2. Windows Server 2003 supports two versions of certificate templates. Version 1 are read-only and can be used with client computers running Windows 2000 and later. Version 2 are editable and support autoenrollment. They can only be used on client computers running Windows XP or Windows Server 2003.

  3. Only version 2 certificates support autoenrollment, and require that users have the Read, Enroll, and Autoenroll permissions to autoenroll certificates.

  4. The Request Handling tab enables you to configure the following certificate template properties for version 2 templates: Purpose (encryption, signature, and signature and encryption), Minimum key size (512 to 16,384 bits), Do the Following When the Subject Is Enrolled and When the Private Key Associated with This Certificate Is Used (options for the amount of user input required), and CSPs (cryptographic service providers that are used in certificate requests).

  5. You can control the issuance of certificate requests by configuring permissions on the template from the Security tab, preventing the CA from issuing that certificate type (by deleting the template from the list in the CA snap-in), or by configuring the permissions on the CA.

  6. When you revoke a certificate, the revoked certificate is published in the CRL. Windows Server 2003 has added a delta CRL (a list of certificates that have been revoked since the last publication of a full CRL). Using delta CRLs, you can publish CRL information more frequently with less replication traffic.

  7. To revoke a certificate, select the Issued Certificates node of the Certification Authority snap-in. Right-click the certificate to be revoked and select All Tasks, Revoke Certificate. Select a reason code from those displayed in the drop-down list of the Certificate Revocation dialog box, and then click Yes.

  8. Using Ntbackup to back up the system state data will back up the Certificate Services database. Also back up IIS because the proper functioning of the certificate server depends on the Web enrollment pages. You can back up Certificate Services by itself, which also provides a restore wizard.

  9. When problems occur with authentication, authorization, or PKI, you should follow general troubleshooting practices by examining event logs. Ensure that IIS is operating properly and is configured for execution of scripts.


TROUBLESHOOTING SECURITY POLICIES AND IPSEC

  1. Troubleshooting of Group Policy security templates and other security settings involves the logging mode of RSoP. You use RSoP in logging mode only when the specified user has logged on to the specified computer.

  2. You cannot use Group Policy to apply security templates to computers running Windows NT 4.0 or 9x. To manage Windows 9x computers, use System Policy Editor to create Config.pol files. To manage Windows NT 4.0 computers, use a NTconfig.pol file.

  3. The Block Policy inheritance and No Override settings can be used to control what policies apply. A No Override attribute has precedence over all the policies that are applied thereafter. The Block Policy inheritance attribute blocks all Group Policy settings that are passed down to the site, domain, or OU from a parent. Blocking does not affect local GPOs.

  4. You can run the IP Security Monitor snap-in on Windows Server 2003 or Windows XP Professional computers only. If you run this snap-in on a Windows 2000 computer, you will receive the error "The IPSec server is unavailable or incompatible with the IPSec monitor."

  5. Know which types of actions to audit for different scenarios. The 70-299 exam presents a drag-and-drop interface in which you must select success and failure actions to achieve a given objective.

  6. You can use the Gpresult command-line utility to perform nearly all actions that are available in RSoP logging mode. One exception: Gpresult does not provide policy precedence information.

  7. When applying SCA, you might encounter the error message "Access is denied. Import failed. You do not have administrative rights. Error 1208: An extended error has occurred. Error opening." The error message indicates that the database may be configured with read-only permissions.

  8. When a security policy won't take, one of the first places you should check is the Event Viewer logs. Errors with event IDs 1000 and 1001 that repeat at 5- to 7-minute intervals indicate problems with applying Group Policy.

  9. Client computers configured with the Hisecws.inf or Securews.inf template cannot communicate with servers running Windows 2000 if their clocks differ by more than 30 minutes.

  10. If you are using preshared keys as a means of authenticating IPSec across a VPN, you can use the CMAK to configure a connection that includes a preshared key.

  11. Use of the highly secure templates (Hisec*.inf) prevents most communication between Windows Server 2003 computers and computers running Windows NT 4.0 or earlier.

  12. Windows 9x computers support NTLM v2 authentication only when the Active Directory Client Extensions Pack is installed.

  13. Windows XP and Windows Server 2003 record IPSec policy agent events in the security log. IKE events are recorded in the Oakley log, and IPSec driver events are logged to the system log.


PLANNING AND IMPLEMENTING SECURITY FOR WIRELESS NETWORKS

  1. Three means of wireless device authentication are currently used: open authentication (anyone providing the correct service set identifier [SSID] or wired equivalent privacy [WEP] key for the access point), shared key authentication (client sends a request for access to the access point, access point returns a challenge, and client returns an encrypted response), and 802.1x authentication standard (EAP integrated with an authenticating server such as a RADIUS server).

  2. Windows Server 2003 uses the 802.1x standard for authenticating access to wired Ethernet networks and wireless 802.11 networks. It provides support for EAP used in conjunction with these methods for wireless computers: EAP-TLS, EAP-MS-CHAPv2, and Protected EAP.

  3. EAP-TLS uses certificate-based mutual authentication, negotiation of the encryption method, and encrypted keys. Smart cards use EAP-TLS.

  4. EAP-MS-CHAPv2 provides mutual authentication based on password-based user and computer authentication.

  5. Protected EAP (PEAP) provides these benefits within TLS: an encrypted authentication channel, dynamic keying material from TLS, fast reconnect using cached session keys, and server authentication to protect against the setup of unauthorized access points.

  6. PEAP with EAP-MS-CHAPv2 uses less effort to deploy because you do not need certificates or smart cards. PEAP with EAP-TLS provides the highest level of security because it uses certificates and smart cards.

  7. You can duplicate a version 1 certificate template to obtain a version 2 copy, and then add certificate purposes to the copied template as necessary.

  8. CAs on a server running Windows Server 2003, Standard Edition can only issue certificates based on version 1 templates. If you need to issue a certificate based on a version 2 template, you must install the CA on a server running Windows Server 2003, Enterprise Edition.

  9. WEP alone does not protect data very well. If available, use 128-bit WEP and change the keys frequently. Use dynamic WEP keys if possible (requires access points that can provide them and wireless clients that can support them). Select the The Key Is Provided Automatically option to provide dynamic WEP keys.

  10. Only Windows XP computers natively support 802.1x authentication. Microsoft provides an 802.1x Authentication Client download that allows Windows 2000 computers to use the 802.1x standard, and provides 802.1x Authentication Clients for Windows 98 and NT 4.0 Workstation to customers with Premier and Alliance support contracts.


A Note from Series Editor Ed Tittel

Que Certification • 800 East 96th Street • Indianapolis, Indiana 46240

You know better than to trust your certification preparation to just anybody. That's why you, and more than 2 million others, have purchased an Exam Cram book. As series editor for the new and improved Exam Cram 2 Series, I have worked with the staff at Que Certification to ensure you won't be disappointed. That's why we've taken the world's best-selling certification product—a two-time finalist for "Best Study Guide" in CertCities' reader polls—and made it even better.

As a two-time finalist for the "Favorite Study Guide Author" award as selected by CertCities readers, I know the value of good books. You'll be impressed with Que Certification's stringent review process, which ensures the books are high quality, relevant, and technically accurate. Rest assured that several industry experts have reviewed this material, helping us deliver an excellent solution to your exam preparation needs.

This Exam Cram 2 book also features a preview edition of Measure Up's powerful, full-featured test engine, which is trusted by certification students throughout the world.

As a 20-year-plus veteran of the computing industry and the original creator and editor of the Exam Cram Series, I've brought my IT experience to bear on these books. During my tenure at Novell from 1989 to 1994, I worked with and around its excellent education and certification department. At Novell, I witnessed the growth and development of the first really big, successful IT certification program—one that was to shape the industry forever afterward. This experience helped push my writing and teaching activities heavily in the certification direction. Since then, I've worked on nearly 100 certification related books, and I write about certification topics for numerous Web sites and for Certification magazine.

In 1996, while studying for various MCP exams, I became frustrated with the huge, unwieldy study guides that were the only preparation tools available. As an experienced IT professional and former instructor, I wanted "nothing but the facts" necessary to prepare for the exams. From this impetus, Exam Cram emerged: short, focused books that explain exam topics, detail exam skills and activities, and get IT professionals ready to take and pass their exams.

In 1997 when Exam Cram debuted, it quickly became the best-selling computer book series since "...For Dummies," and the best-selling certification book series ever. By maintaining an intense focus on subject matter, tracking errata and updates quickly, and following the certification market closely, Exam Cram established the dominant position in cert prep books.

You will not be disappointed in your decision to purchase this book. If you are, please contact me at etittel@jump.net. All suggestions, ideas, input, or constructive criticism are welcome!

—Ed Tittel, Series Editor


About the Authors

Diane Barrett (MCSE, CISSP, CCNA, A+, Net+, iNet+, and Security+) has spent the last 11 years in the IT profession. She works at a local college where she taught in the computer networking program for two years before becoming a director. She teaches online classes that include networking, security, and virus protection, and is the president of a security awareness corporation that specializes in training. Diane has also co-authored other security and networking books and is currently volunteering on ISSA's Generally Accepted Information Security Principles Project in the ethical practices working group.

Bill Ferguson (MCT, MCSE, MCSA, MCP+I, CCSI, CCNA, A+, Network+, Server+, Security+) has been in the computer industry for more than 15 years. Originally in technical sales and sales management with Sprint, Bill made his transition to Certified Technical Trainer in 1997 with ExecuTrain. Bill now runs his own company as an independent contractor from Birmingham, Alabama, teaching classes for most of the national training companies and some regional training companies. In addition, Bill writes and produces technical training videos for Virtual Training Company, Inc. and Specialized Solutions, Inc. His videos include A+, Network+, Windows 2000 Management, Windows XP Management, Windows Server 2003 Management, Windows 2000 Security, Server+, and Interconnecting Cisco Network Devices. Bill keeps his skills sharp by being a technical reviewer for books and sample tests for Que Certification and McGraw Hill Technical. He authored the 70-298 Exam Cram 2 for Que Publishing and produced a training video for the 70-296 MCSE Skills Upgrade test for Virtual Training Company. Bill says, "My job is to understand the material so well that I can make it easier for my students to learn than it was for me to learn."

Don Poulton (A+, Network+, MCSA, MCSE) has been involved with computers since the days of 80-column punch cards. After a career of more than 20 years in environmental science, Don switched careers and trained as a Windows NT 4.0 MCSE. He has been involved in consulting with a couple of small training providers as a technical writer, during which time he wrote training and exam prep materials for Windows NT 4.0, Windows 2000, and Windows XP.

In addition, he has worked on programming projects, both in his days as an environmental scientist, and more recently with Visual Basic to update an older statistical package used for multivariate analysis of sediment contaminants.

When not working on computers, Don is an avid amateur photographer who has had his photos displayed in international competitions and published in magazines such as Michigan Natural Resources Magazine and National Geographic Traveler. Don also enjoys traveling and keeping fit.

Don lives in Burlington, Ontario with his wife Terry.


About the Technical Editors

David Neilan is an experienced MCSE (+Security) who has been working in the computer/network industry for more than 12 years—the last 6 years dealing primarily with network/Internet connectivity and security. He is currently running a business, Security Technologies, in the network/security realm, working with local companies to enable and secure their networks. He has been designing network infrastructures to support secure LAN/WAN connectivity for various companies utilizing Microsoft 2000 and Cisco products, and the Internet to create secure virtual private networks. David is currently involved in many infrastructure upgrades, including domain and email systems.

David has also been beta testing Microsoft operating systems since Windows for Workgroups (WFW3.11), and has worked as a technical editor on numerous Microsoft/networking/security books.

David and his wife Susan (also in the computer industry) live in Winnipeg, Canada. They and their two dogs love spending time at the cabin in the great outdoors.

Marc Savage is the senior national technical advisor and technical trainer for Polar Bear Corporate Education Solutions. Combined with more than seven years experience in microcomputer training and systems development in the private, public, and non-profit organization sectors, his professional expertise is focused particularly on providing companies with a clear vision and direction in regards to Microsoft products. Marc currently holds the following certifications: MCT, MCSE NT4, MCSE W2K, MCSA, CNE 4.11, A+, NETWORK+. Marc lives in Ottawa, Canada with his lovely wife Lynne and two daughters Isabelle and Carolyne.


Acknowledgments

Thank you to everyone who was involved in making this book possible, starting with Que Publishing. Everyone at LANWrights, especially Ed Tittel and Kim Lindros, deserve thanks for keeping us all on track. To co-authors Don Poulton and Bill Ferguson, thank you for your outstanding and timely contributions. Special thanks to my husband, Bill and my Dad; for without them I wouldn't be the person I am today.

—Diane Barrett

I'd like to first thank Que Publishing and LANWrights for giving me the opportunity to write this book. Thanks to Jeff Riley for having faith me in me and giving me the green light. Thanks to Kim Lindros for "cracking the whip" (in a very nice way) to make sure that we stayed on schedule.

Finally, thanks to all who have encouraged me as a technical instructor and as a Sunday School teacher and given me the determination to tackle something new. I sincerely appreciate all of your thoughts and prayers.

—Bill Ferguson

Many thanks to the guidance and help offered me by Kim Lindros, Diane Barrett, and the tech editing/copy editing team at Que who provided their technical expertise and suggestions for improvement of this manuscript.

—Don Poulton


We Want to Hear from You!

As the reader of this book, you are our most important critic and commentator. We value your opinion and want to know what we're doing right, what we could do better, what areas you'd like to see us publish in, and any other words of wisdom you're willing to pass our way.

As an executive editor for Que, I welcome your comments. You can email or write me directly to let me know what you did or didn't like about this book—as well as what we can do to make our books better.

Please note that I cannot help you with technical problems related to the topic of this book. We do have a User Services group, however, where I will forward specific technical questions related to the book.

When you write, please be sure to include this book's title and author as well as your name, email address, and phone number. I will carefully review your comments and share them with the author and editors who worked on the book.

Email: | feedback@quepublishing.com
Mail: | Jeff Riley Executive Editor Que Publishing 800 East 96th Street Indianapolis, IN 46240 USA

For information about the Exam Cram 2 series, visit www.examcram2.com. Type the ISBN (excluding hyphens) or the title of a book in the Search field to find the page you're looking for.


Introduction

Welcome to the Exam Cram 2 series. The purpose of this book is to prepare you to take Microsoft certification exam 70-299 "Implementing and Administering Security in a Microsoft Windows Server 2003 Network."

Books in the Exam Cram 2 series are designed to help you understand the material you will encounter on the exams. The purpose of the series is to cover the topics you are likely to encounter on the exams, but the books do not teach you everything you need to know about a topic. This book contains as much information as possible about the 70-299 exam.

This book begins by providing useful information about how to prepare for the exam and what to expect on your exam day. To begin, we recommend that you take the self-assessment included in the book. This will help you to evaluate your current knowledge base against what is required for a Microsoft Certified Systems Engineer (MCSE) candidate. Then you can you determine where your training should begin, which may include some classroom training or reading one of the several study guides available.

We also strongly recommended that you gain some hands-on experience with the technologies being covered on the exam. Again, this may be through classroom training or by installing and configuring the software on a home system. In any case, nothing beats hands-on experience when it comes to learning essential exam topics.

Passing this exam can earn you credit toward the following certifications:

  • Microsoft Certified Systems Administrator (MCSA) on Microsoft Windows Server 2003— This exam can be used as one of the electives required to achieve MCSA on Windows Server 2003 status.

  • MCSA: Security on Microsoft Windows Server 2003— This is one of the core exams required to achieve MCSA: Security on Windows Server 2003 status.

  • MCSE on Microsoft Windows Server 2003— This is one of the elective exams required to obtain MCSE on Windows Server 2003 status.

  • MCSE: Security on Microsoft Windows Server 2003— This is one of the core exams required to obtain MCSE: Security on Windows Server 2003 status.


Taking a Certification Exam

This section provides information on the exam registration process. Keep in mind that Que Publishing is a sister company to Virtual University Enterprise (VUE) Testing. Be sure to check with us at www.examcram2.com for any discount test vouchers that might be available exclusively to Exam Cram 2 readers

After you've fully prepared for an exam and feel that you are ready for the next step, you need to register with a testing center to take the exam. Contact one of the following testing centers for current pricing and registration information, as pricing and testing centers can change over time. In the United States and Canada, exams are administered by Prometric and VUE. Here's how you can contact them:

  • Prometric— You can register for an exam online at www.prometric.com. You can also register by phone at 1-800-755-3926 (within the United States and Canada). If you are outside of these two countries, call 1-410-843-8000.

  • VUE— You can register online at www.vue.com/ms or call a local testing center. Testing centers local to your region can also be located on the Web site.

You can register for an exam by contacting either of the parties just listed. You must register at least one day in advance and any cancellations must be made by 7 a.m. the day before you are scheduled to take the test.

To make the registration process go more smoothly, make sure you have the following required information handy:

  • Your name, organization, and mailing address.

  • Microsoft Test I.D. In the United States, this is your Social Security number. In Canada, this is your Social Insurance number.

  • The specific number of the exam you want to take.

  • A method of payment. Credit card is usually the easiest method, although other arrangements can be made.

After you register, you will be given the date, time, and location of where you are to take the exam.


Arriving at the Exam Site

It is generally a good idea to arrive at the exam site at least 15 minutes before you are scheduled to take the exam. Make sure you bring two pieces of identification with you, one of which must be a photo I.D., such as a driver's license. You must show the identification when you sign in.


In the Exam Room

Although the pressures and environment of actually being in the exam room with a live exam in front of you cannot be mimicked, this section does try to detail what being in the exam room is like.

After you've signed in for the exam, you'll be directed into an exam room. You will not be permitted to take anything into the exam room with you. You will be given a few blank pieces of paper and pen upon entering the room. This is when the facts on the Cram Sheet can be very handy. If you read over the distilled facts prior to the exam, this is a good time to write down as many of them as you can remember.

After you complete the exam, your score will be tabulated and you will know immediately whether you passed or failed. If you need to retake the exam, contact VUE or Prometric to schedule a new exam (and, unfortunately, this also means paying the price of another exam).

If you fail an exam, you can retake the exam as soon as you are ready, even the same day. If you fail the same exam a second time, you must wait at least 14 days before you will be allowed to reschedule.


How to Prepare for an Exam

All Microsoft exams have a set of objectives outlining the topics you need to understand to achieve exam success. This is a good place to start to give yourself a general idea of the topics you can expect to encounter and for which you should obtain study material.

An abundance of resources are available both online and in print that can be used to prepare for an exam. The Microsoft Web site is a good source of information pertaining to both the exam itself and for in-depth coverage of exam topics. Due to the popularity of the MCSE certification, a number of printed study guides and online resources are also available. Some of the resources you may find useful include the following:

  • The Windows Server 2003 product CD has one of the best resources you can use when preparing for an exam—the Help included with the operating system. It usually covers different aspects of all the technologies included with the operating system.

  • The Microsoft Training and Certification Web site at www.microsoft.com/traincert/default.asp provides links to exam resources and outlines how an individual should prepare for an exam.

  • The InformIT Web site at www.informit.com/examcram2/index.asp provides an abundance of information about certification exams and how to prepare for them.

  • Microsoft Training Kits are published by Microsoft Press and include study guides for the different certification exams, including exam 70-299. You can find more information about the training kit at www.mspress.microsoft.com/findabook/list/series_ak.htm.

  • Microsoft TechNet is a monthly publication that provides information on the latest technologies and topics, some of which pertain to the exam topics covered in 70-299.

  • Classroom training is offered by many companies that design courses to prepare students to pass the various exam.

  • The Exam Cram 2 series has always been a popular resource for exam preparation.


Notes on This Book's Organization

This section highlights the different elements and pieces that can be found in your Exam Cram 2. Items such as Exam Alerts, Tips, Notes, practice questions, and so on are explained here:

  • Terms you'll need to understand— Each chapter begins with a list of terms that you must learn and understand to fully grasp the content being covered; each of these terms is defined in the Glossary.

  • Techniques you'll need to master— Following the important terms is a list of concepts/tools/techniques that need to be understood before attempting to challenge the exam.

  • Chapter content— The introductory paragraph alerts you to the topics that are covered throughout the chapter. Following this, a number of topics relating to the chapter title are covered in detail.

  • Exam Alerts— Concepts and topics that are likely to appear on the exam are highlighted in a special layout known as an Exam Alert. An Exam Alert appears within the chapter content like this:

    Exam Alerts are included in each chapter to point your attention to a particular concept or topic that you are likely to encounter on the exam. As you work through the chapter, make sure you pay close attention to the topics addressed in the alerts. Exam Alerts can also be a good way to refresh your memory with important information right before taking the exam, although this information is usually included in the Cram Sheet.

    This is not to say that the general content within a chapter is not important—it is. However, Exam Alerts flag the information that is more likely to appear in an exam question.

  • Tips and Notes— Throughout a chapter, you might also find information highlighted in the special layouts of Tips and Notes. The layout and purpose of each is as follows:

    Tips are designed to give the reader some added piece of information pertaining to a topic being covered, such as an alternative or more efficient way of performing a certain task.

    Notes are designed to alert you to a piece of information related to the topic being discussed.

  • Exam prep questions and answers— At the end of each chapter, a series of 10 questions are designed to test your understanding of the topics covered throughout the chapter. Detailed explanations are provided for each of the 10 questions, explaining both the correct and incorrect answers.

Other elements of the book worth mentioning are the Practice Exams and Answer Keys found in Chapters 8 through 11. These questions cover all of the topics covered throughout the book. The questions can be used for review purposes and to determine exam readiness.

In addition, you'll find Appendix A, which covers what's on the CD; Appendix B, which lists additional readings and resources that you may find valuable; and a glossary of key terms used throughout the book.

Last but not least, mention must be made of the Cram Sheet included with this book. The Cram Sheet distills all the important facts and topics covered and summarizes them in a few short pages. These are the facts that we feel should be memorized for the exam. The Cram Sheet is the last thing you should review before going into the exam room. When you enter the exam room, the first thing you should do is to write down these important facts on the piece of paper provided.


How This Book Helps You

The topics in this book have been structured around the objectives outlined by Microsoft for exam 70-299. This ensures that you are familiar with the topics that you'll encounter on the exam.

Some of the topics covered later in the book might require an understanding of topics covered in earlier chapters. Therefore, it's recommended that you read the book from start to finish for your initial reading. When it comes time to brush up on or review certain topics, you can always use the index to go directly to specific sections while omitting others.

In preparing for exam 70-299, we think you'll find this book a very useful reference to some of the most important topics and concepts of Designing Security for a Microsoft Windows Server 2003 Network. It prepares you for the exam day by outlining what you can expect. It covers all the important topics you can expect to find on the exam. Also, it provides many sample exam questions to help you evaluate exam readiness and understanding of the material as well as to familiarize yourself with the Microsoft testing format.


Self-Assessment

The reason we include a self-assessment in this Exam Cram 2 book is to help you evaluate your readiness to tackle MCSA and MCSE certification. It should also help you to understand what you need to know to master the main topic of this book—namely, Exam 70-299, "Implementing and Administering Security in a Microsoft Windows Server 2003 Network." Before you tackle this self-assessment, let's talk about concerns you might face when pursuing an MCSA or MCSE credential on Windows Server 2003, and what an ideal MCSA or MCSE candidate might look like.


MCSAs and MCSEs in the Real World

In the next section, we describe the ideal MCSA and MCSE candidates. Keep in mind that only a few real candidates will meet that ideal. In fact, our description of ideal candidates might seem a bit intimidating, especially with the changes that have been made to the Microsoft Certified Professional program to support Windows Server 2003 and Windows XP. But take heart—although the requirements to obtain MCSA and MCSE certification might seem difficult, they are by no means impossible to attain. However, you need to be keenly aware that getting through the process takes time, involves some expense, and requires genuine effort.

Increasing numbers of people are achieving Microsoft certifications. You can get all the real-world motivation you need from knowing that many others have gone before you, allowing you to follow in their footsteps. If you're willing to tackle the process seriously and do what it takes to obtain the necessary experience and knowledge, you can take—and pass—all the certification tests involved in obtaining the MCSA or MCSE credentials. In fact, at Que Publishing, we've designed the Exam Cram 2 series and the MCSE Training Guide series to make it as easy for you as possible to prepare for these exams. We've also greatly expanded our Web site, www.examcram2.com, to provide a host of resources to help you prepare for the complexities of Windows Server 2003 and Windows XP.


The Ideal MCSA or MCSE Candidate

To give you an idea of what an ideal MCSA or MCSE candidate is like, here are some relevant statistics about the background and experience such an individual might have:

Don't worry if you don't meet these qualifications exactly or come extremely close—this world is far from ideal, and in the areas in which you fall short, it simply means these are the areas in which you'll have more work to do.

  • Academic or professional training in network theory, concepts, and operations, including everything from networking media and transmission techniques through network operating systems, services, and applications.

  • Two or more years of professional networking experience including familiarity with Ethernet, remote access, wireless, and various other networking media types. This must include installation, configuration, upgrade, and troubleshooting experience.

    The Windows Server 2003 MCSA and MCSE programs are similar to the Windows 2000 Server certification program, yet a bit more rigorous and definitely more interactive than the Windows NT certification program—you really need some hands-on experience if you want to become certified. Some of the exams require you to solve real-world case studies as well as security and network design issues, so the more hands-on experience you have, the better.

  • Two or more years in a networked environment that includes hands-on experience with Windows Server 2003, Windows 2000 Server, Windows 2000/XP Professional, and Windows NT 4.0 Server, Windows NT 4.0 Workstation, Windows 98, or Windows 95. A solid understanding of each system's architecture, installation, configuration, maintenance, and troubleshooting is also essential.

  • In-depth knowledge of the various methods for installing Windows Server 2003, Windows XP, and Windows 2000 operating systems, including manual and unattended installations.

  • A thorough understanding of name resolution, networking protocols, and addressing, specifically, the following: TCP/IP, IPX/SPX, and NetBEUI.

  • A comprehensive understanding of users, groups, naming conventions, browsing, and file and print services.

  • Familiarity with key Windows Server 2003 and Windows 2000 Server based TCP/IP utilities and services, including HTTP, DHCP, WINS, and DNS, plus familiarity with all of the following: Internet Information Services (IIS), Internet Protocol Security (IPSec), Routing and Remote Access Services (RRAS), Internet Security and Acceleration Server (ISA), Internet Authentication Service (IAS), and Terminal Services.

  • An understanding of how to implement security for key network data in a Windows Server 2003 and a Windows 2000 Server environment, including smart cards, Certificate Services and Public Key Infrastructure (PKI).

  • A basic understanding of NetWare and Unix operating systems and how to integrate both with a Windows 2003 network.

  • A solid operational understanding of Active Directory. The more you work with Windows Server 2003 or Windows 2000 Server, the more you'll realize that as technology has evolved, so have Microsoft operating systems and with the introduction of Active Directory, configuration is very different from what it was in Windows NT. We recommend that you find out as much as you can about Active Directory and acquire as much experience using this technology as possible. The time you take learning about Active Directory is essential to understanding how the operating system works.

The Windows Server 2003 MCSA and MCSE programs allow for specialization in either messaging or security. Should you be interested in either of these, you can visit the Microsoft Web site to determine the specific areas on which you should concentrate.

These qualifications amount to a bachelor's degree in information systems or computer science plus three years work experience in PC networking design, installation, administration, and troubleshooting. We believe that well under half of all certification candidates meet these requirements. In fact, most meet less than half of these requirements when they begin the certification process. Everyone who has already been certified survived this ordeal, and you can too. All you have to do is heed what this self-assessment chapter tells you about what you already know and what topics you need to learn.


Put Yourself to the Test

The following series of questions and observations is designed to help you determine how much work you must do to pursue Microsoft certification and what kinds of resources you may consult on your quest. Be brutally honest in your answers, because otherwise you'll end up wasting time and money on exams that you're not yet ready to take. There are no right or wrong answers; these are simply steps along the way to certification. Only you can decide where you really belong in the broad range of hopeful candidates. Two things should be clear from the beginning, however:

  • Even a modest background in networking technologies or information systems is helpful.

  • Hands-on installation and administration experience with Microsoft products and technologies is an essential ingredient in certification success.

Educational Background

The following questions assess your educational background. Depending upon your answers, you might need to review some additional resources to get yourself up to speed for the types of questions that you will encounter on Microsoft certification exams.

  1. Have you ever taken any computer-related classes? [Yes or No]

    If Yes, proceed to Question 2; if No, proceed to Question 3.

  2. Have you taken any classes on computer operating systems? [Yes or No]

    If Yes, you will probably be able to handle the Microsoft architecture and system component discussions. If you're rusty, brush up on basic operating system concepts, especially virtual memory, multitasking regimes, user-mode versus kernel-mode operation, and general computer security topics.

    If No, consider doing some basic reading in this area. We strongly recommend a good general operating systems book, such as Operating System Concepts by Abraham Silberschatz and Peter Baer Galvin (John Wiley & Sons). If this book doesn't appeal to you, check out reviews for other, similar, books at your favorite online bookstore.

  3. Have you taken any networking concepts or technologies classes? [Yes or No]

    If Yes, you will probably be able to handle the Microsoft networking terminology, concepts, and technologies (brace yourself for frequent departures from normal usage). If you're rusty, brush up on basic networking concepts and terminology, especially networking media, transmission types, the OSI reference model, and networking technologies such as Ethernet, wide area network (WAN) links, and wireless technologies.

    If No, you might want to read one or two books in this topic area. The two best books that we know of are Computer Networks by Andrew S. Tanenbaum (Prentice-Hall) and Computer Networks and Internets by Douglas E. Comer and Ralph E. Droms (Prentice-Hall).

    For those of you specifically interested in security issues and Internet-related topics, consider Practical Unix and Internet Security by Garfunkel, Spafford, and Schwartz (O'Reilly) and Network Security Essentials by William Stallings (Prentice-Hall). Both books offer a comprehensive view of security even though they are discussed in the context of the Unix environment.

Hands-on Experience

The most important key to success on all the Microsoft exams is hands-on experience, especially when it comes to Windows Server 2003, Windows 2000, Windows XP, and the many services and components around which many of the Microsoft certification exams are centered. If we leave you with only one insight after you take this self-assessment, it should be that there's no substitute for time spent installing, configuring, and using the various Microsoft products on which you'll be tested. The more in-depth understanding you have of how these software products work, the better your chance in selecting the correct answers on the exam.

  1. Have you installed, configured, and worked with the following:

    • Windows Server 2003? [Yes or No]

      If Yes, make sure you understand basic concepts as covered in Exams 70-290 and 70-291. You should also study the TCP/IP interfaces, utilities, and services for Exam 70-293, and you should implement security features for Exam 70-298.

      If No, you must obtain one or two machines and a copy of Windows Server 2003. A trial version can be downloaded or a CD-ROM ordered from the Microsoft Web site. Then, you should learn about the operating system and any other software components on which you'll be tested by installing the operating system and practicing the objectives specified in the exam preparation guide. In fact, it is a good idea to have two computers, each with a network interface, that can be used to set up a small network on which to practice. This practice network can be invaluable when it comes to learning the skills necessary to pass the exams. With decent Windows Server 2003-capable new computers selling for about $500 to $600 each these days and used ones available for less, this shouldn't be too much of a financial hardship. If you search the Microsoft Web site, you can usually find low-cost options to obtain evaluation copies of most of the software that you'll need.

    • Windows 2000 Server? [Yes or No]

      If Yes, make sure you understand the concepts covered in Exams 70-215, 70-216, and 70-220.

      If No, you should consider acquiring a copy of Windows 2000 Server and learning how to install, configure, and administer it. To learn about the operating system and other software components, you can either use the objectives specified in the exam preparation guide or purchase a well-written book to direct you in your studies such as MCSE Windows 2000 Server Exam Cram 2.

      You can download objectives, practice exams, and other data about Microsoft exams from the Training and Certification page at www.microsoft.com/learning/mcpexams/prepare/default.asp. You can use the links to obtain specific exam, reference, or training information.

    • Windows XP/2000 Professional? [Yes or No]

      If Yes, make sure you understand the concepts covered in Exams 70-270 and 70-210.

      If No, you should obtain a copy of Windows XP and Windows 2000 Professional and learn how to install, configure, and maintain each system. Practice the exam objectives relating to client systems or purchase a well-written book to guide your activities and studies such as MCSE Windows XP Professional Exam Cram 2.

    Use One Computer to Simulate Multiple Machines

    If you own a computer that has plenty of available disk space, lots of RAM, and at least a Pentium 4-compatible processor, you may want to consider VMware or Virtual PC. These software programs create an emulated computer environment within separate windows that are hosted by your computer's main operating system. You can have several different operating systems such as Windows Server 2003, Windows XP, and Windows 2000, running simultaneously in different windows on a single computer. VMware is published by VMware, Inc. More information is available on their Web site at www.vmware.com. Virtual PC is published by Connectix Corporation. Microsoft acquired Connectix Corp.'s Virtual PC products in early 2003.

    For any and all of these Microsoft operating systems exams, the Resource Kits for the topics involved always make good study resources. You can purchase the Resource Kits from Microsoft Press(you can search for them at http://microsoft.com/mspress), but they also appear on the TechNet CDs, DVDs, and Web site (www.microsoft.com/technet/default.mspx). Along with the Exam Cram 2 books, we believe that the Resource Kits are among the best tools you can use to prepare for Microsoft exams.

  2. For any specific Microsoft product that is not itself an operating system, such as SQL Server, Exchange Server, or IIS, have you installed, configured, used, and upgraded this software? [Yes or No]

    If Yes, skip to the next section, "Testing Your Exam-Readiness." If No, you must get some experience. Read on for suggestions about how to do this.

    Experience is a must with any Microsoft product exam, be it something as simple as FrontPage 2002 or as challenging as Exchange Server 2003. For trial copies of other software, you can search Microsoft's Web site using the name of the product as your search term. Also, you can search for bundles such as "BackOffice," "Enterprise Servers," "Windows Server System," or "Small Business Server."

    If you have the funds, or if your employer is willing to pay your way, you should consider taking a class at a Microsoft Certified Technical Education Center (CTEC) or a Microsoft IT Academy. In addition to classroom exposure to the topic of your choice, you might receive a copy of the software that is the focus of your course, along with a trial version of whatever operating system it needs, as part of the training materials for that class.

    Before you even think about taking any Microsoft exam, you should make sure you've spent enough time with the related software to understand how it can be installed and configured, how to maintain such an installation, and how to troubleshoot the software when things go wrong. This will help you in the exam—and in real life!

Testing Your Exam-Readiness

Whether you attend a formal class on a specific topic to get ready for an exam or use written materials to study on your own, some preparation for the Microsoft certification exams is essential. The cost is $125 per exam, whether you pass or fail, so you'll want to do everything you can to pass on your first try. That's where studying comes in.

We have included two practice exams in this book. If you don't score very well on these exams, you can study a bit more and then take the practice exams again. Keep in mind that practice exams are designed to measure your skills in the areas that are tested on the exam. Even if get a 100% on the practice exams, it is not a guarantee that you will pass the real exam. The more you practice, the better you get.

Be careful not to memorize the answers. This can trip you up on the actual exam. You need to know the theory behind why the answer is correct.

We also have practice questions that you can sign up for online through www.examcram2.com/. The Measure Up CD-ROM included with this book has sample questions and you might be able to download demos or purchase additional questions for your exams at www.measureup.com. If you still don't score at least 70% after practicing with these exams or it takes many tries to achieve a good score, it might be time to investigate some of the other practice exam resources that are mentioned in this section.

For any given subject, you should consider taking a class if you've reviewed the self-study materials, taken the exam, and failed anyway. The opportunity to interact with an instructor and fellow students can make all the difference in the world. For information about Microsoft classes, visit the Training and Certification page at www.microsoft.com/traincert/training/find/findcourse.asp to locate the nearest CTEC that offers courses you are interested in.

If you can't afford to take a class, you should still visit the Training and Certification pages because they include pointers to free practice exams, approved study guides, and other self-study tools. In addition, you should consider investing in some low-cost practice exams from commercial vendors. The Microsoft Training and Certification "Assess Your Readiness" page at www.microsoft.com/learning/assessment/default.asp offers several skills assessment evaluations that you can take online to show you how far along you are in your certification preparation.

The next question deals with your personal testing experience:

  1. Have you taken a practice exam on your chosen test subject? [Yes or No]

    If Yes, and if you scored 70% or better, you're probably ready to tackle the real thing. If your score isn't above that threshold, you should keep at it until you can easily take the exam with a good passing score.

    If No, you should obtain all the free and low-budget practice exams you can find and get to work. You should keep at it until you can break the passing threshold comfortably.

When it comes to assessing your test-readiness, there is no better way than to take a good-quality practice exam and pass with a score of 70% or better. When we're preparing ourselves, we shoot for 80% or higher, just to leave room for the "obscurity factor" that sometimes shows up on Microsoft exams.


Assessing Readiness for Exam 70-299

In addition to the general exam-readiness information in the previous section, you can do several things to prepare for Exam 70-299. As you're getting ready for the exam, you should visit the Exam Cram 2 Web site at www.examcram2.com.

We also suggest that you join an active MCSE/MCSA email list or email newsletter that is relevant to the exam. For example, Sunbelt Software has a weekly e-zine pertaining to Windows news. You can sign up at www.sunbelt-software.com. You can also find security-specific mailing lists managed by www.ntbugtraq.com or newsletters and articles at www.sans.org.

Microsoft exam mavens also recommend that you check the Microsoft Knowledge Base, which is available on its own CD as part of the TechNet collection or on the Microsoft Web site, at http://support.microsoft.com. The knowledge base offers information that may pertain to technical support issues that relate to your exam's topics. These articles are a result of real-life situations and resolutions for Microsoft products.


Take the Challenge!

After you've assessed your readiness, done the right background studies, obtained the proper hands-on experience, and reviewed various sources of information to help you prepare for an exam, you'll be ready for a round of practice exams. When your scores are high enough to get you through the exam, you're ready to go after the real thing. If you follow our assessment regime, you'll not only know what you need to study, but you'll know when you're ready to set a test date at Prometric (www.prometric.com) or Pearson VUE (www.vue.com). Good luck!


Chapter 1. Implementing and Managing Security Policies

Terms you'll need to understand:

  • Restricted group

  • Group Policy object (GPO)

  • Policy files

  • Loopback policy

  • Computer role

  • Privilege

  • Permission

  • Logon right

  • Security baseline

  • Internet Information Services (IIS)

  • Internet Authentication Service (IAS)

  • Remote Access Service (RAS)

  • Secedit

  • Security Configuration and Analysis (SCA)

  • Microsoft Baseline Security Analyzer (MBSA)

Techniques you'll need to master:

  • Developing a network security structure

  • Understanding how security mechanisms can be applied through a planned organizational unit (OU) architecture

  • Using Active Directory Group Policy Objects (GPOs), scripting, and command-line tools to apply security templates

  • Defining and building security templates for different computer roles such as Exchange, SQL, IIS, and IAS

  • Configuring auditing and logging based on computer roles

  • Recognizing and planning restriction policies based on client computer roles

  • Using the Security and Configuration Analysis Microsoft Management Console (MMC) to determine the quality of security on a machine

  • Using Microsoft Baseline Security Analyzer (MBSA) GUI and command-line tools to determine the security settings of a computer

Security is important to every IT professional. As new software and hardware products are planned and developed, manufacturers should keep security in mind. This book discusses how to manage security aspects of a Microsoft Windows Server 2003 network. This includes network protection via templates, secure communications, proper authentication, and policies. The chapters herein will cover these concepts and help prepare you for the Microsoft 70-299 certification exam, and also give you guidance and serve as a reference when you are faced with security issues in a Windows Server 2003 network.

This chapter covers a variety of topics that focus on policies and procedures that should be in place based on server or client roles, deploying security templates based on these roles, and using tools to analyze the security configuration to see where weaknesses may be. According to the Microsoft outline for the 70-299 exam, implementing, managing, and troubleshooting security policies will be a significant part of the exam.


Managing Security Mechanisms in Windows Server 2003

A large part of Windows Server 2003 is based on Active Directory. When designing Active Directory structure, the object is to create a securely structured organization that can grow without having to redesign the layout unless there are major changes to the environment, such as a merger or acquisition. To accomplish this, Active Directory allows for several types of boundaries such as forests, domains, site topologies, and delegation of permissions. This structure includes security and administrative boundaries.

Planning Security Group Scope

When you create an Active Directory group, you can define it as either a security or a distribution group. Security groups can be assigned permissions to resources through access control entries (ACEs). Distribution groups are used for membership purposes only. These are actually an extension of Microsoft Exchange distribution lists. Security groups can be members of distribution groups, but distribution groups cannot be members of security groups. A group can be converted from a security group to a distribution group, and vice versa, only if the domain functional level is set to Windows 2000 native or higher.

A security group can also be used as an email entity. Even though it is a security group, it can be used as a distribution group. This does not work the other way around—a distribution group cannot be used as a security group.

Beginning with Windows 2000, Microsoft added hierarchical abilities to the group concept by allowing nesting. (Nesting will be discussed in further detail in the next section.) By doing so, this allows one group to contain other groups in its scope of authority. A group's scope dictates who can be a member of the group and what resources the group has access to, and the domain or forest functional level will affect which group scopes can be used. The following are the group scopes that can be created:

  • Local— Creation of local groups requires the resource manager to access the specific computer where the local group is to be created.

  • Domain local groups— Domain local groups can contain users, global groups, and universal groups. They are not visible at the forest level.

  • Global groups— Global groups can contain other global groups from the same domain. They organize domain user objects and are visible at the forest level.

  • Universal groups— Universal groups can contain other universal groups or global groups from any domain but not domain local groups. They are defined and visible at the forest level.

A policy outlining security group naming, security group nesting, and security group retirement along with who can create security groups and when they should be created should be clearly established to be sure that groups are managed properly.

Planning Nested Group Structure

Security group nesting occurs when one security group is made a member of another security group. The nested group inherits all of the privileges and permissions that are granted to the parent. Nested groups are used to consolidate group management by reducing the number of times permissions are granted and reducing replication traffic that is caused by replication of group membership changes.

Four domain functional levels are available: Windows 2000 mixed, which is the default; Windows 2000 native; Windows Server 2003 interim; and Windows Server 2003. Your nesting options depend on which domain functional level your Windows Server 2003 domain is set to. Security groups in a Windows 2000 mixed domain are restricted. A domain must be configured at the Windows 2000 native or Windows Server 2003 functional level for global groups to be nested within global groups or for domain local groups to be nested within domain local groups. For additional information, see Microsoft Knowledge Base Article 322692.

Security groups with universal scope cannot be created in mixed mode because universal scope is supported only in domains in which the functional level is set to native mode or 2003 mode.

The default group membership limitation is 120 groups. A user's Kerberos access token is built primarily from the security identifiers (SIDs) of the groups to which the user belongs. Because this token contains the SIDs for each group of which the user is a member, uncontrolled group nesting may result in access token size problems. Additionally, if there is not a nesting policy in place, it becomes difficult to know exactly which permissions members of nested groups might inherit. Although there may be concerns with group membership, you don't have any limitations as to the number of users in a group.

Table 1.1 lists a recap of the domain functionality level features described in the previous two sections.

Table 1.1. Domain Functionality Level Features

Feature

Windows 2000 Mixed

Windows 2000 Native and Windows Server 2003

Creation of universal groups

Available for distribution groups only

Allows both security and distribution groups

Group nesting

Available for distribution groups and domain local groups that can contain global groups

Allows full group nesting

Converting groups

No group conversions allowed

Allows for conversion between security groups and distribution groups

SID history

No SID history migration

Allows for migration of security principals from one domain to another

Configuring Windows Server 2003 Security Mechanisms

All of the settings listed in this section can be configured through security templates. Windows Server 2003 comes with several predefined templates. These predefined security templates are provided as a starting point for creating custom security policies to meet the diverse requirements of organizations. You can customize the templates by using the Security Templates snap-in. Once you customize the security templates, they can be used to configure security on any number of computers. By default, the predefined security templates are stored in %systemroot%\Security\Templates. Table 1.2 lists the predefined templates.

Table 1.2. Windows Server 2003 Predefined Security Templates

Template

Purpose

Setup security.inf

Characterizes the settings that are applied during installation of the operating system for servers or client computers

DC security.inf

Enhances the domain controller default security settings installed when a server is promoted to a domain controller

Compatws.inf

Changes the default file and Registry permissions to be compatible with the requirements of most legacy applications

Securews.inf

Defines enhanced security settings for servers and workstations by limiting the use of LAN Manager and NTLM authentication protocols.

Securedc.inf

Defines enhanced security settings for domain controllers

Hisecws.inf

Imposes highly secure settings for clients and servers

Hisecdc.inf

Imposes highly secure settings for domain controllers

Rootsec.inf

Reapplies or modifies the root directory permissions

Notssid.inf

Removes the unnecessary Terminal server SIDs from the file system and Registry locations if a Terminal server will not be used

Security template settings can be viewed through the Security Templates MMC snap-in or viewed as text files. The text files are located in %windir%\Security\Templates.

It is important to ensure that the templates used in a production environment are first tested and then securely stored to prevent unauthorized changes to them. The folder listed in the previous paragraph does not replicate, so be sure that all templates are stored on the same domain controller to ensure version control.

Registry and File System Permissions

After you apply a template, you can change the settings to suit the needs of the organization. Registry and file permissions are changed in the Registry and File sections of the templates. After you add the file or Registry key, the Database security window appears. Here you can set the permissions. The effective inheritance permissions are set by the following selections:

  • Propagate Inheritable Permissions to All Subfolders and Files— If child objects are protected or if there is a conflict, the permissions on the child object take precedence.

  • Replace All Permissions on All Subfolders and Files With Inheritable Permissions— Child object permissions will be overridden.

  • Do Not Allow Permissions on This File or Folder to be Replaced— Any settings made on a folder or Registry key above this one will not be inherited.

Should you choose to remove Registry settings in the templates, the settings are embedded in the templates and must be removed manually by using a Registry editor. In addition, if you choose to add new settings, the sceregvl.inf file is edited and scecli.dll needs to be re-registered. The sceregvl.inf file is located in the %windir%\inf folder.

Account Policies

Account policies are policies defined on computers that affect how user accounts can interact with the computer or domain. The effectiveness of these policies depends on how and where they are applied. The three areas that can be configured are Password, Account Lockout, and Kerberos policies. When configuring these settings, keep in mind that you can have only one domain account policy. The policy is applied at the root of the domain and becomes the policy for any system that is a member of the domain. Of course, there is always the exception, and that is when there is an account policy configured for an OU. These settings will affect the local policy settings on the computers contained in the OU.

Password policies control the complexity and lifetime settings for passwords so that they become more complex and secure. This reduces the likeliness of a successful password attack. Table 1.3 lists the default settings.

Table 1.3. Default Password Policy Settings

Option

Default Setting

Possible Values and Recommended Values

Enforce password history

0 passwords remembered

0 to 24Set to 24 to limit password reuse

Maximum password age

42 days

0 to 999 Set to either 30 or 60 days

Minimum password age

0 days

0 to 998 Set to 2 days, this disallows immediate changes

Minimum password length

0 characters

0 to 14 Set to at least 8

Passwords must meet complexity requirements

Disabled

Set to Enabled

Store password using reversible encryption

Disabled

Set to Disabled

All of the settings in Table 1.3 should be configured as per the organization's security policy. Also, setting the change frequency and password complexity too strictly can cause user frustration, leading to passwords being written down.

The Account lockout policy can be used to secure the system against attacks by disabling the account after a certain number of attempts, for a certain period of time.

The Kerberos policy settings are used for authentication services. In most environments, the default settings should be sufficient. Should they need to be changed, keep in mind that they are applied at the domain level.

Policy (.pol) Files

Although Group Policy has pretty much replaced System Policy Editor since Windows 2000 operating systems came into being, there are situations in which you will still have to configure a policy file (config.pol):

  • Computers that run Windows 95 and 98— To manage these computers, you must run System Policy Editor to create config.pol files that are compatible with the local operating system.

  • Computers that run Windows NT 4.0 Workstation and Server— To manage these computers, you must use NTconfig.pol.

  • Windows 2000 standalone computers— Because the only Group Policy that applies in this situation is local Group Policy, use a Registry.pol file if you want to provide settings for multiple users. Only the Windows 2000 version of System Policy Editor is compatible with Windows 2000.

The Administrative Templates extension of Group Policy saves customized Registry settings in Registry.pol files. The file containing settings that are specific to the HKEY_LOCAL_MACHINE key is stored in the GPT\Machine folder. The file that contains Registry settings that are specific to the HKEY_CURRENT_USER key is stored in the GPT\User subdirectory.

Audit Policies

Local policies apply to a computer and contain the audit policy, user rights assignments, and security options. Auditing should be built around security goals and policies. Do not monitor everything; instead, monitor what's really important. It is also important to set the proper size of the security log based on the number of audit events that you generate. Table 1.4 lists what can be audited under this policy and a description of each policy.

Table 1.4. Local Audit Policies

Policy

Description

Audit account logon event

These events occur when a domain user account is authenticated on a domain controller.

Audit account management

This event includes user account or group creation, modification, or deletion; user accounts being renamed or disabled; or a password being set or changed.

Audit directory service access

This shows the event of a user accessing an Active Directory object that has its own system access control list (SACL).

Audit logon events

These events are generated on domain controllers for domain account activity and on local computers for local account activity.

Audit object access

Tracks when a user accesses an object such as a file, folder, Registry key, or printer that has its own SACL specified.

Audit privilege use

This security setting determines whether to audit each instance of a user exercising a right.

Audit process tracking

Shows detailed tracking information on program activation, process exit, handle duplication, and indirect object access.

Audit system events

Logs when an event occurs that affects either the system security or the security log, such as when a user restarts or shuts down the computer.

To audit objects on a member server or a workstation, turn on the audit object access. To audit objects on a domain controller, turn on the audit directory service access.

User Rights Assignment

User rights define capacity at the local level. The user rights assignment is two-fold: It can grant specific privileges and it can grant logon rights to users and groups in your computing environment. Logon rights control who and how users log on to the computer, such as the right to log on to a system locally, whereas privileges allow users to perform system tasks such as the right to back up files and directories. Although user rights can apply to individual user accounts, they are best administered by using group accounts. Keep in mind that privileges and permissions are different and sometimes privileges can override permissions set on an object. For example, a user logged on to a domain account as a member of the Backup Operators group has the right to restore files and folders. This requires the capability to read files on which their owners may have set permissions that explicitly deny access to all users. The user right assignment allows the backup operator to bypass file and directory permissions when restoring backed-up files and directories. Figure 1.1 shows the rights assignments available and the default settings.

Figure 1.1. User rights assignments.

[View full size image]

Windows Server 2003 has three built-in local accounts used as logon accounts for different services: Local System, Local Service, and Network Service. These accounts are used by system processes, should never have a user assignment, and should not have the default setting changed. You should be familiar with these as well as the Microsoft-recommended setting for each. These can be found in Chapter 4 of the "Threats and Countermeasures Guide" available on the Microsoft Web site.

Security Options

Security Options, which are the last of the local policies, enable or disable security settings for the computer. You use these policies to enhance security. The policies include how the Administrator and Guest account names are managed, access to the floppy drive and CD-ROM, installation of drivers, digital signing of data, and logon prompts. Many Security Options policies are available, as shown in Figure 1.2.

Figure 1.2. Security options.

[View full size image]

Microsoft expanded this category and added about 20 new settings to Windows Server 2003. Although these settings can be set in the Registry, the recommended method for setting them is through a template. For a list of the recommended settings for each of these security options, see Chapter 5 of the "Threats and Countermeasures Guide."

The Security Options settings Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts and Shares and Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts replace the Windows 2000 Security Options setting Additional Restrictions for Anonymous Connections that managed the Registry value called Restrict Anonymous.

System Services

The System Services policies allow an administrator to determine how services will start and who has access permissions. The startup mode can be configured using one of the three following settings:

  • Automatic— Service automatically starts when computer is restarted

  • Manual— Service does not start unless it is started manually

  • Disabled— Service does not start at all

Changing the default settings for services might prevent these or other key services from running correctly, especially if the service you are stopping is a service that other services are dependent on. Verify service dependencies before starting or stopping a service. You can view service dependencies on the Dependencies tab of the chosen service from the Services icon in Administrative Tools.

You can start a service manually by using the Services icon in Administrative Tools or by using the net start command. You can also use the sc.exe command at the command prompt to configure services. You can use parameters with this command that stop and start a service and show the current status of a service, as well as listing any services dependencies.

The Edit Security option is the other configuration piece of System Services. This determines who can control services. To configure this, add Security templates to a MMC, expand the appropriate template, choose System Services, select the service you want to configure, and then click the Edit Security button. Figure 1.3 shows both configuration options.

Figure 1.3. System Services options.

Restricted Groups

This security setting allows an administrator to define the following two properties for security groups: Members and Member Of. The Members list defines who belongs to the restricted group, whereas the Member Of list states which other groups the restricted group belongs to. When a Restricted

Groups policy is defined, any user on the Members list who is not currently a member of the group is added and any current member of the group who is not on the Members list is removed. Any members who are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to allow only Jane and John to be members of the Administrators group. In the meantime, Joe adds himself as a member of the Administrators group, but not via the template settings. When the Security policy is refreshed, only Jane and John will remain as members of the Administrators group, and Joe will no longer be a member of the group.The policy can be defined either in a security template or by defining the setting on a Group Policy Object (GPO).

If the Members list is empty, this means that the restricted group has no members. If the template is applied this way, any current member not on the Restricted Groups policy members list is removed. This can include default members, including administrators.

Figure 1.4 shows where the Members and Member Of members are added in the security template.

Figure 1.4. Restricted Groups Members and Member Of configuration.

The Members list defines who belongs to the restricted group while the Member Of list states which other groups the restricted group belongs to.

Event Logs

The Event Log security area defines characteristics that are related to the application, security, and system logs. Figure 1.5 shows the options that are configurable.

Figure 1.5. Event log configuration settings.

[View full size image]

In addition to the settings that are configurable through the template, you can now delegate access to event logs. This is new in Windows Server 2003. The feature allows you to customize the permissions on each event log on a computer by editing the value in the Registry. The ACL is stored as a string in a Reg_SZ value called CustomSD for each event log. For more information on this, see the Microsoft Knowledge Base article (323076) titled "How to Set Event Log Security Locally or by Using Group Policy in Windows Server 2003" on the Microsoft Web site.


Planning and Deploying Security Templates

Security templates can be deployed in a variety of ways, depending on your needs. Before we look at the ways in which security templates can be applied, let's look at some general guidelines for dealing with templates:

  • Never edit the Setup security.inf template. This will eliminate the option to reapply the default security settings.

  • Do not apply the Setup security.inf template through Group Policy. It should only be applied to the local computer.

  • Do not apply the compatws.inf template to domain controllers. This is for workstations only.

  • Instead of modifying a default template, customize it and then save the changes under a different name. This will allow you to keep the original template.

Now that some basics have been established, security templates can be applied via the Security and Configuration Analysis (SCA) console, using the Group Policy Management Console, or by command-line tools and scripts.

Planning the Deployment of Security Templates

If you are applying security settings on a single computer running Windows 2000 or Windows Server 2003, the best method to use is the SCA console. This method allows you to see the effects of the template settings before they are applied, as shown in Figure 1.6. Everywhere a red "X" appears denotes a setting that will change.

Figure 1.6. SCA settings.

[View full size image]

SCA is used to configure security areas that are not affected by Group Policy settings because Group Policy settings override the local settings. This tool is not to be used for configuring security for a domain or an organizational unit; it is used to directly configure local system security.

Although it has limitations for applying security templates, SCA has some good features. When you import security templates and apply them, the system security is immediately changed to the levels specified in the template. Another good feature is the ability to merge templates. If you import more than one template, the database will merge them, create one template, and resolve conflicts according to the order of import. The order of precedence is the last template imported. Importing templates into the SCA database only affects the analysis database not the templates themselves.

Because you will seldom configure one machine at a time, other alternatives are available. Templates can also be applied by using Group Policy and scripts.

Deploying Security Templates by Using Active Directory-Based GPOs

Security templates can also be applied to the GPO. First, we should refresh our memories on the order that policies are applied. Remember that Group Policy can apply to computers or users. The order in which policy settings are applied is

  • Local policy

  • Site-level policy

  • Domain-level policy

  • Domain controller policy only if it is in the domain controller container

  • Organizational unit policy

This means that the local GPO is processed first, and the organizational unit to which the computer or user belongs is processed last. The precedence is determined after the order in which policies apply. This is what makes working with GPOs tricky. GPOs are applied from the bottom up, so when you have several, the one on the top is the last one to be applied.

Block Policy inheritance and No Override are also features that can be used to control what policies apply. A No Override attribute has precedence over all of the policies that are applied thereafter. GPOs cannot be linked directly to users, computers, or security groups. They can only be linked to sites, domains, and OUs. Any GPO that is linked to one of these can be set to No Override with respect to that container so that none of its policy settings can be overridden. When more than one GPO has been set to No Override, the one that is highest in the Active Directory hierarchy takes precedence.

You cannot select which policies you block when you use Block Policy inheritance. Blocking does not affect local GPOs. The Block Policy inheritance blocks all Group Policy settings that would filter down to the site, domain, or OU from a parent, no matter what GPO those settings originate from, but it will not block Group Policy settings from GPOs that are linked directly to the site, domain, or OU.

If you are unsure of how Group Policy works, download and read "Group Policy Infrastructure White Paper," available on the Microsoft Web site. The Microsoft 70-299 exam will test on GPOs.

Security templates can be imported into Group Policy through security settings on the Group Policy tab of the domain or OU. Upon importing a security template, select the Clear This Database Before Importing option to clear the database of any previously stored security templates, as shown in Figure 1.7.

Figure 1.7. Clearing the database in the Import Policy From dialog box.

When Group Policy security settings are changed, by default they are refreshed every 5 minutes on a domain controller and every 90 minutes on a workstation or server. The settings are also refreshed every 16 hours, even if there are no changes.

Gpupdate is a command-line utility that can be used if the policy needs to be refreshed immediately. Gpupdate replaces the Windows 2000 command secedit /refreshpolicy. The syntax is as follows:

gpupdate [/target: computer] [/force] [/wait:Value] [/logoff] [/boot]

The following is a description of the parameters:

  • /target:Computer or User— Processes only the computer or user settings

  • /force— Reapplies all settings

  • /wait:Value— Time in seconds that policy processing waits to finish

  • /logoff— Logs off after the refresh has completed

  • /boot— Restarts the computer after the refresh has completed

There are some new additions to Group Policy that are part of Windows Server 2003. Resultant Set of Policy (RSoP) is a query engine that provides details about all policy settings that are configured for existing policies based on site, domain, domain controller, and OU. RSoP can also help you determine a set of applied policies and their precedence.

The Microsoft Group Policy Management Console (GPMC) is also a new feature in Windows Server 2003 for Group Policy management. It is available as a separate, downloadable component on the Microsoft Web site. GPMC allows administrators to manage Group Policy for multiple domains and sites and integrates the existing Group Policy functionality into a single console with added capabilities including backup, restore, import, copy, reporting of GPOs, RSoP, and Windows Management Instrumentation (WMI) filters. Additional information can be found at http://www.microsoft.com/windowsserver2003/gpmc/default.mspx.

Be familiar with managing Group Policy via the GPMC.

Deploying Security Templates Using Command-Line Tools and Scripting

Sometimes Group Policy can't be used to apply security templates, such as on older systems such as Windows NT. To overcome these limitations, you can apply templates in several ways, including using scripts and command-line tools.

Command-Line Tools

Previously, we discussed that SCA can configure only one computer at a time. By using the command-line tool Secedit in a batch file or script, you can configure security on multiple computers and do so at scheduled times.

First, we will look at the commands available, and then the parameters and proper syntax. The commands that can be run are secedit /analyze, secedit /configure, secedit /export, secedit /import, secedit/validate, and secedit /GenerateRollback. The parameters are as follows:

  • /db FileName.sdb— Specifies the database filename

  • /cfg FileName— Specifies the security template filename

  • /log FileName— Specifies the log filename

  • /quiet— States that screen output should not take place

  • /overwrite— States that the database should be cleared

  • /areas Area1 Area2— Specifies the security sections to be applied such as GROUP_MGMT, USER_RIGHTS and SECURITYPOLICY.

The syntax for issuing a secedit command would be as follows:

secedit /analyze /DB d:\testdir\testfile.sdb /CFG d:\testdir\securedc.inf

Figure 1.8 shows the result of the command being run. Note that because a log file was not specified, the default was used.

Figure 1.8. Results of the secedit command.

Scripting Tools

Besides command-line tools, there are several scripting tools that can be used to deploy security templates. For example, you can write Visual Basic script files and then run them using the Cscript.exe program, or you can use the WMI Command-Line (WMIC) interface. If you grew up on DOS, you should be very familiar with batch files, which you can also use to apply security templates. After the script or batch files are written, you can schedule them to run via Task Scheduler. For example, you can call the Secedit.exe command-line tool from a batch file or configure Task Scheduler to automatically create and apply templates.

You can use the AT command to schedule or delete a task to run. The proper syntax is

AT \\computername time /Every: date command

For example, the command AT 2:00 Every: Monday secedit /analyze /DB c:\testdir\testfile.sdb /CFG c:\testdir\securews.inf will compare the workstation security to the securews template every Monday at 2:00. You can also use the AT command to list the tasks that are scheduled by simply typing AT at a command-line prompt.


Configuring Extra Security Based on Server Roles

Before you begin to configure servers, you must have an Active Directory design in place. The structure of the domains and the OUs determine server roles and how Group Policy is linked to the OUs. Microsoft has defined baseline security settings for templates based on three distinct environments as indicated in the Microsoft guide titled "Windows Server 2003 Security Guide." (See Appendix B for information on accessing the guide.) The objective is to create the security requirements that will be implemented in the initial server installation. By identifying the role that each server plays, it can more easily be determined which settings and software are required. For detailed information on creating a baseline member server and hardening other servers, see the "Windows Server 2003 Security Guide." This guide includes the following security templates:

  • Legacy Client— This is the lowest lockdown level. Templates include Domain Controller, Domain, File server, IIS server, Infrastructure server, Print server, and Member server baseline.

  • Enterprise Client— This is designed to provide solid security. Templates include Domain Controller, Domain, Certificate Services, IAS server, File server, IIS server, Infrastructure server, Print server, and Member server baseline.

  • High Security— This is the highest lockdown level and the settings are so restrictive that many applications might not function with them. Templates include Domain Controller, Domain, File server, Bastion server, IIS server, Infrastructure server, Print server, and Member server baseline.

SQL Server Computer

Notice that in the preceding list of server templates, database servers are not addressed. You should consider the following when implementing SQL Server:

  • Install the most recent service packs

  • Use Windows Authentication mode

  • Assign a strong sa (system administrator) password

  • Limit the privilege level of SQL Server services

  • Check that SQL Server ports are not open on your firewall

  • Audit your SQL Server connections

The Microsoft "SQL Server 2000 SP3 Security Features and Best Practices" paper provides security recommendations on the installation, administration, and deployment of SQL Server. If the security needs to be stronger, download the "SQL Server 2000 C2 Security Admin and User Guide." Both documents are available on the Microsoft Web site. This will provide you with C2-evaluated configuration.

In addition, Microsoft has developed a rights management technology to help protect data called Windows Rights Management Services (WRMS), which is based on usage policies. WRMS can use SQL Server 2000 with SP3 for its policy and configuration information. If you plan to implement the technology, consult the Microsoft white paper titled "Technical Overview of Windows Rights Management Services" because the configuration will be different. The paper is available on the Microsoft Web site.

Exchange Server Computer

An Exchange server is subject to a wider variety of attacks than an infrastructure server. Microsoft has also enhanced the security features of Windows Server 2003 and recommends that Exchange 2003 be run in this type of environment. This allows Exchange to take advantage of WRMS, Kerberos authentication, the IIS Lockdown Wizard, and the URLScan tool. You should also consider the version of Exchange you are running and the role of the server when creating a template. For example, if you are running Exchange 2000 or 2003, the server may be one of the following:

  • Outlook Web Access (OWA) front-end server— This server accepts the request, verifies user credentials, and forwards the request to the back-end server.

  • Exchange back-end server— This server provides access to mailboxes, public folders, and routing.

While adjusting the settings, the following are some considerations that will be different for an Exchange Server server:

  • Additional Restrictions for Anonymous Connections— None, use the default permissions

  • Shut Down Your System Immediately if Unable to Log Security Audits— Disabled

  • Account Logon Event Auditing— Failure

  • Logon Event Auditing— Failure

Domain Controller

The Domain Controller template will differ from that of a member server simply because clients, servers, and applications rely on domain controllers for services such as authentication, Group Policy, and a central lookup directory. The Domain Controller template requires a baseline Group Policy, making it similar in concept to a member server baseline policy. However, the policy is linked to the Domain Controllers OU; therefore, it takes precedence over the Default Domain Controllers policy.

Exercise care when linking a GPO or when modifying the default GPO linked to the Domain Controllers OU. Should you not properly configure and test the GPO, linking it to Domain Controllers OU could adversely affect the operation of the domain.

The settings included in the predefined template will improve the overall security across the domain controllers. You should do the following to improve security:

  • Modify other user rights— Access This Computer from the Network, Add Workstations to Domain, Allow Log On Locally, Allow Log On through Terminal Services, Change the System Time, Enable Computer and User Accounts to be Trusted for Delegation, Load and Unload Device Drivers, Restore Files and Directories, and Shutdown the System.

  • Change the Security Options setting— Network Security: Do Not Store LAN Manager Hash Value on Next Password Change. Enable this setting on domain controllers in the Enterprise Client and High Security environments, and disable it on domain controllers in the Legacy Client environment.

  • Enable the following system services— Distributed File, SystemDNS, ServerFile, Replication, Intersite Messaging, Kerberos, Key Distribution Center, and Remote Procedure Call (RPC) Locator.

  • Make various manual modifications as well as additional settings configurations that could not be done through Group Policy— For details, see Chapter 4 of the "Windows Server 2003 Security Guide."

Keep in mind that domain controllers should be physically secure, only allowing access to authorized administrators. If a domain controller is located in an unsecured area, several security settings can be adjusted to limit the potential damage from physical threats.

Internet Authentication Service (IAS) Server

Internet Authentication Service (IAS) is a Remote Authentication Dial–in User Service (RADIUS) server used for authentication, authorization, and accounting. It has capabilities to authenticate users from Windows NT 4.0, Windows 2000, or Windows Server 2003 domains. It also supports Routing and Remote Access Service (RRAS). The following are some recommended settings for making a template (remember that when a member server baseline policy is established, all unneeded services and executable files are disabled or removed):

  • Enable IAS — This service must be running for an IAS server to respond to client authentication requests.

  • Securing well-known accounts— Two of the most well-known built–in accounts that can be compromised in Windows Server 2003 are Guest and Administrator. Leave the Guest account disabled and rename the Administrator account. In Windows Server 2003, the local Administrator account can be disabled. This provides an additional level of security.

  • Securing service accounts— Never configure a service to run under the security context of a domain account unless absolutely necessary and then create a specific account with only the required privileges.

In the standard edition of Windows Server 2003, IAS can have a maximum of 50 RADIUS clients and two remote RADIUS server groups. In Enterprise and Datacenter Editions, you can configure an unlimited number of RADIUS clients and remote groups along with configuring RADIUS clients by specifying an IP address range.

Internet Information Services (IIS) Server

Internet Information Services (IIS) is not installed by default on Windows Server 2003. When it is installed, it installs in a highly secure mode. Features such as Active Server Pages (ASP), ASP.NET, Server Side includes (SSi), Web Distributed Authoring and Versioning (WebDAV) publishing, and FrontPage Server Extensions are not installed. When a member server baseline policy is established, all unneeded services and executable files are disabled or removed, so to add Web server functionality the following three services must be enabled:

  • HTTP SSL— The HTTP SSL service enables IIS to perform Secure Sockets Layer (SSL) functions. Disabling this service causes any services that explicitly depend on it to fail. The startup mode setting should be configured to Automatic. Group Policy should be used to secure and set the service to grant access solely to server administrators.

  • IIS Admin Service— The IIS Admin Service allows administration of IIS components. If this service is disabled, IIS cannot be configured, and requests for any Web services will be rejected. The startup mode setting should be configured the same as HTTP SSL.

  • World Wide Web Publishing Service— Provides Web connectivity and administration of Web sites. The startup mode setting should be configured the same as the previous two services.

IIS by default serves only static Web content. Each additional IIS feature must be individually enabled. Additional security measures that must be performed manually are listed as follows:

  • Installing only necessary IIS components

  • Enabling only essential Web service extensions

  • Placing content on a dedicated disk volume

  • Securing well-known accounts

  • Securing service accounts

  • Blocking ports with Internet Protocol Security (IPSec) filters

Some of the preceding may be accomplished by using the IIS Lockdown Wizard. The IIS Lockdown Wizard turns off unnecessary features to reduce the options available to attackers. URLscan, which screens incoming requests to an IIS Web server against a ruleset, has been integrated into the wizard. When run, the IIS Lockdown Wizard creates a log file named Oblt-log.log and saves it in the folder that contains Iislockd.exe. The tool is available for download at http://www.microsoft.com/Downloads/Release.asp?ReleaseID=43955. To ensure that IIS servers remain secure, proper monitoring, logging, and auditing procedures should also be implemented.


Planning Security for the DHCP and DNS Infrastructure Services

Infrastructure servers provide services such as Dynamic Host Control Protocol (DHCP), Windows Internet Name Service (WINS), or Domain Name System (DNS). A summary of the recommended settings for infrastructure servers is included in the "Windows Server 2003 Security Guide Settings" Excel workbook (which is included in the "Windows Server 2003 Security Guide" guide). This details the model settings, which should be adjusted for the type of server being implemented. The measures for securing DHCP include the following:

  • Enable the DHCP service— For a client to obtain an IP address configuration, this service must be running. Group Policy should be used to secure and set the service to grant access solely to server administrators.

  • Configure DHCP logging— Event Viewer entries for the DHCP service are limited to startup and shutdown events; therefore, a more detailed log should be enabled on the DHCP server. It is important that access to these logs be limited to server administrators.

  • Properly design DHCP services— Split DHCP server scopes between servers so that 80 percent of the addresses are distributed by one DHCP server and 20 percent by another.

  • Secure well-known accounts— Rename the Administrator and Guest accounts, change their passwords to be more complex, and use different names and passwords on each server.

  • Block ports with IPSec filters— IPSec filters enhance the level of security on servers. For more information on the use of IPSec filters, see Chapter 11 in "Threats and Countermeasures Guide."

Although internal DNS servers can be less susceptible to attacks than external DNS servers, they still need to be secured. The following are some considerations for internal DNS servers:

  • Eliminate any single point of failure— Be sure that the Active Directory structure is planned properly. Analyze where the clients of each DNS zone are located and how will they resolve names if the DNS server is unavailable.

  • Prevent unauthorized access to your servers— Implement Active Directory integrated zones with secure dynamic updates. Keep the list of DNS servers that are allowed to obtain a zone transfer small.

  • Monitor the server events and DNS logs— Proper monitoring of logs and server events can help prevent unauthorized access as well as diagnosis problems.


Configuring Extra Security Based on Client Roles

We have discussed additional security for servers, but what about security of the clients? Client computers come in a variety of forms, and are a bit harder to control because they are used by people who have varying levels of security awareness and who often travel to unknown areas. Keeping this in mind, different settings should be configured for each type of client. In this section, we will look at ways to make this process a bit more manageable. First let's look at the general categories that clients can fall into:

  • Desktop computers— Configuration ranges can vary depending on use. Considerations include how much outside or Internet access such as email- and Web-based applications are needed as well as the methods of access. One word about desktop users: Watch out for alternative methods of communication set up, such as wireless access points and self installed modems.

  • Developer computer— Configurations on these computers will be more liberal than those of desktop computers and the development environment should be separate from the production environment. Most development workers do not need local Administrator rights, and this should be taken into consideration when building the model for this client.

  • Kiosks and email computers— This type of computer should be tightly configured. In fact, you should consider loopback policy. Additional considerations might include no internal or device access.

    Loopback policy is used to override user-based Group Policy with computer-based Group Policy. This makes the desktop configuration the same regardless of who logs on.

  • Mobile computers— Because these computers are susceptible to theft and access the network remotely, encryption, virtual private networks (VPNs), and physical security should be considered when building a template.

As with server installations, Windows 2000 Professional and Windows XP Professional come with security templates. This is a good place to start because many of the settings are configured based on the level of security needed.

Planning and Configuring Security Settings

Windows Server 2003 has more than 220 new administrative policies that were not previously available on Windows 2000. This gives you a wide range of configuration options. Group Policy administrative templates define how the policy settings appear. They are stored in .adm files. The administrative templates and what they are used for are as follows:

  • System.adm— System settings

  • Wmplayer.adm— Windows Media Player settings

  • Inetres.adm— Internet Explorer settings

  • Conf.adm— NetMeeting settings

  • Wuau.adm— Windows update and Automatic update settings

Group Policy user configurations are saved in HKEY_CURRENT_USER and computer configurations are saved in HKEY_LOCAL_MACHINE either under \Software\Policies or \Software\Microsoft\Windows\CurrentVersion\Policies.

Planning Network Zones for Computer Roles

Depending on the role of the computer, it may need more or less security configured, depending on the types of Web sites that your users may access. You can configure four zones for security: Internet, Local intranet, Trusted, and Restricted. These settings can be configured either through Group Policy, as shown in Figure 1.9; through the Internet Explorer Customization Wizard; or through the Internet Explorer Administration Kit 6 (IEAK) Profile Manager. The security levels on each zone can be set to High, Medium, Medium-low, Low, or Custom.

Figure 1.9. Zone configuration settings.

The following list provides an explanation of each zone:

  • Internet zone— This zone allows access to sites that are not included in other zones. You cannot add sites to this zone. By default, it is set to the Medium security level.

  • Local intranet zone— This zone consists of sites with a firewall or those specified to bypass the proxy server. By default, it is set to the Medium security level.

    To configure the Local intranet zone, you must have a good understanding of your existing network configuration, proxy servers, and firewalls. The proxy servers should be configured not to resolve an external Domain Name System (DNS) name to this zone.

  • Trusted sites zone— This zone is intended for sites that can be trusted to never cause harm, such as those of business partners. By default, it is assigned the Low security level.

  • Restricted sites zone— This zone is allowed to perform only minimal, safe operations because the content is questionable. By default, it is assigned the High security level.

Planning and Configuring Software Restriction Policies

Software restriction policies are used for more granular control over who receives what software. Software restriction policies specify the software that is allowed to run. Some of the features include controlling which programs can run on your computer, permitting users to run only specific files on multiple-user computers, and preventing any files from running on your local computer, OU, site, or domain should you get a virus infection. Software restriction policies provide a policy-based method to enforce decisions about whether the software can run, thereby forcing users to follow the parameters that are set by administrators.

Software restriction policies are not meant to replace virus software.

A default security level of Unrestricted (allowed) or Disallowed (not allowed) for a GPO is defined. You can create the following types of rules for exceptions:

  • Hash rules— You can use precalculated hash values or you can create a hash rule to prevent malicious software such as viruses and Trojan horses from running.

  • Certificate rules— Certificate rules are not turned on by default. To do so, change the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled from 0 to 1.

  • Path rules— Specifies a file or folder. Use caution when setting the security level to Disallowed on folders. This can adversely affect the operation of your operating system.

  • Internet zone rules— Zone rules apply to Windows Installer packages only.

For software restriction policies to take effect, users must update policy settings by logging off from and then logging on to their computers.

You can also apply software restriction policies to specific users when they log on to a specific computer by using the lookback Group Policy setting. If you do not want the software restriction policies to apply to local Administrators, you can configure this by selecting the All Users Except Local Administrators option under the Enforcement object of Group Policy, as shown in Figure 1.10.

Figure 1.10. Software restriction policy settings.

Software restriction policies are created through Group Policy Object Editor. In the console tree, go to Group Policy Object Computer_name Policy/Computer Configuration or User/Configuration/Windows Settings/Security Settings/Software Restriction Policies, as shown in Figure 1.10. Click User Configuration to set policies that will be applied to users, regardless of the computer to which they log on. Click Computer Configuration to set policies that will be applied to computers, regardless of the users who log on to them.

You should become familiar with how to create software restriction policies as you might see this type of question on the 70-299 exam.


Planning and Configuring Auditing and Logging Computer Roles

Auditing and logging is an important part of protecting your network. The roles of the computers should determine how you audit and log. For example, auditing a developer's computer might include auditing process tracking, whereas auditing a desktop computer might include auditing directory services access. You can use several tools to track what is happening on the network. These include Windows events, log files, and audit files.

Windows Events

Event Viewer records events in the system event log. Event Viewer allows you to view certain events that occur on the system. Depending on what is configured on your server, Event Viewer maintains a minimum of three log files: one for system processes, one for security information, and one for applications. The security log records security events and is available for view only to administrators. For security events to be monitored, auditing must be enabled. The application and system logs are available to all users to view. The application log can be used to tell how well an application is running. The system log shows events that occur on the individual system. Settings such as the size of the file and the filtering of events can also be configured. Event logging is used for troubleshooting or for notifying administrators of unusual circumstances. It is important to be sure that you have the log file size set properly, that the size is monitored, that the logs are periodically archived and cleared, and that the log files are stored properly to prevent hackers from accessing them in order to cover their tracks.

Internet Information Services (IIS)

IIS logs information specific to the events and processes of the service. Separate logs can be created for each Web site or application. The IIS logs may include information about site visitors and their viewing habits. They can be used to assess content, identify bottlenecks, or to investigate attacks. Plan the selection of the fields that will be logged carefully to limit the size of the logs. IIS uses the W3C Extended Log File Format to create logs. To improve server performance, logs should be stored on a nonsystem striped or striped/mirrored disk volume.

Firewall Log Files

Firewall logs contain entries about the packets that had been handled by the packet filter. The following are some events you want to take a closer look at:

  • Repeated traffic to particular ports— This can indicate a Denial of Service (DoS) or Distributed DoS (DDoS) attack.

  • Blocked attempts— A large number of blocked attempts can indicate an intrusion attempt.

  • Suspicious signatures— These can indicate activity by worms or malicious code.

In ISA Server, by default, only dropped packets are logged. If an administrator wants to log all the packets that are dropped and enabled by the firewall, the option is available in the IP packet filters. However, if you enable this option, the packet filter logs can become quite large depending upon the amount of traffic that Server handles.

Netlogon

In the event you are having issues with accounts being locked out such as in a brute force attack, you should begin your log file analysis by examining the Netlogon.log files. Netlogon output displays the number of unsuccessful logon attempts for a user's account in a certain time period as an 0xC000006A event. If the log files show that most or all the user accounts are locked out in your domain, it is a good idea to do a trace to determine whether the source of the attack is internal or external. If the attacks are from outside your network, this indicates a DoS or brute force attack. If an internal computer is the source, examine the processes running on the computer. It could indicate a common process that is using outdated or wrong account validation. Microsoft Knowledge Base Article 174073 has additional information about auditing user authentication.

Remote Access Service (RAS) Log Files

You can log authentication and accounting information for remote access connections in Routing and Remote Access if Windows Authentication or Windows Accounting is enabled. This helps in tracking remote access usage and authentication attempts, and is useful for troubleshooting remote access policy issues because the name of the remote access policy that either accepted or rejected the connection attempt is recorded based on each authentication attempt. The authentication and accounting information is stored in the %systemroot%\System32\LogFiles folder. To configure authentication and accounting logging, you must first enable either Windows Authentication or Windows Accounting. You can then configure the type of activity to log and log file settings. The log files are saved in IAS or database-compatible format. This allows any database program to read the log file directly for analysis.


Analyzing Security Configuration

Once you have security baseline templates and configurations in place, it's time to analyze the security configuration. This can be done through SCA or by using MBSA.

Using Microsoft Baseline Security Analyzer (MBSA)

The Microsoft Baseline Security Analyzer (MBSA) is a tool that is used to scan one or more Windows-based computers for common security holes. The MBSA will scan a Windows-based computer and check the operating system and other installed components for security along with their current status of recommended security updates. Several parts of the scan are optional, as shown in Figure 1.11, and can be turned on or off in the interface before scanning a computer.

Figure 1.11. The Microsoft Baseline Security Analyzer screen.

[View full size image]

These options and settings as well as the command-line tools will be explained in greater detail in Chapter 3.

Using the MBSA Command-Line Tool

The MBSA command-line interface can perform two types of scans: MBSA scans and HFNetChk scans. The MBSA scan can be run from the command line using the mbsacli.exe command. The parameters will be discussed in Chapter 3. The HFNetChk scan will check for missing security updates and then display the results in the command-line window. The tool can be run from the command line using the mbsacli.exe /hf command followed by any of the parameters. This tool will be explained in greater detail in Chapter 3.

An individual security report is created for each computer scanned when multiple computers are scanned. Reports from a scan are stored under the %userprofile%\SecurityScans folder on the computer on which the MSBA tool is installed.

Using Security Configuration and Analysis

Earlier in the chapter, we discussed using SCA for applying security templates. SCA is also used to analyze security configurations and resolve security discrepancies. Figure 1.6 showed what happens when you analyze the effects of applying a template. Analyzing the current security is done exactly the same way. You can resolve discrepancies between analysis database and system settings by accepting or changing some or all of the values that are flagged or not included in the configuration; just click the group of settings that contains the security attribute you want to edit. These edited values are then updated in the database and applied to the system when you select the Configure Computer Now menu item, as shown in Figure 1.12.

Figure 1.12. The Configure Computer Now menu item.

[View full size image]

The changes you make will not affect system security. They will only affect the analysis database because the purpose of the tool is to help you see how changes in the settings will affect the security of the computer.


Exam Prep Questions

Question 1

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with computers running Windows XP Professional. You want to find out how many user accounts have blank or simple passwords such as god or password. Which of the following tools should you use?

  • A. HFNetChk

  • B. SCA

  • C. MBSA

  • D. Gpupdate

A1:

Answer C is correct. MBSA is a tool that is used to scan one or more Windows-based computers for common security holes. The HFNetChk scan will check for missing security updates; therefore, answer A is incorrect. SCA is used to analyze security configurations and resolve security discrepancies based on Security templates; therefore, answer B is incorrect. Gpupdate is a command-line utility that can be used if the policy needs to be refreshed immediately; therefore, answer D is incorrect.

Question 2

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with computers running Windows XP Professional. You notice that there are no new logon events on one of the servers for the past week. You know users are logging on, and you have verified that the Audit policy is configured correctly. What can you do to correct this situation? (Choose two.)

  • A. Enable the Audit account logon events.

  • B. Increase the size of the log file.

  • C. Change the log setting from Manual to Overwrite Events as Needed.

  • D. Enable Audit process tracking.

A2:

Answers B and C are correct. Auditing is already configured; therefore, answer A is incorrect. Audit process tracking logs detail tracking information on program activation, process exit, handle duplication, and indirect object access; therefore, answer D is incorrect.

Question 3

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with computers running Windows XP Professional. Your company has merged with XYZ company; both domains are running in 2003 native mode. You need to grant access to resources to a group that is a distribution group of XYZ without affecting email distribution. How do you accomplish this with the least amount of administrative effort?

  • A. Create a new security group and add all users.

  • B. Create new distribution and security groups and then add all users.

  • C. Make the distribution group a universal group.

  • D. Convert the distribution to a security group.

A3:

Answer D is correct. A security group can also be used as an email entity. Creating a new security group and adding all users is too much administrative effort; therefore, answer A is incorrect. Creating new distribution and security groups and then adding all users is not necessary; therefore, answer B is incorrect. Making the distribution group a universal group will not allow access to resources; therefore, answer C is incorrect.

Question 4

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with computers running Windows XP Professional. You have several users that need access to stop and start the IIS Admin Service on a Web site on an IIS server. How do you accomplish this?

  • A. Create a template that has permissions to the Web folder containing the site and apply the template.

  • B. Add the users to the Local Administrators group.

  • C. Configure their user accounts as service accounts.

  • D. Create a group that includes the user accounts and allow full control on the Web folder containing the site.

A4:

Answer A is correct. Security templates are created to grant user rights. Adding the users to the Local Administrators group or configuring their user accounts as service accounts are both improper security practices; therefore, answers B and C are incorrect. Allowing full control on the Web folder containing the site only applies to folder permissions and would not accomplish the task; therefore, answer D is incorrect.

Question 5

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with computers running Windows XP Professional. The helpdesk group is reporting that the majority of their calls are from users who have locked themselves out of their accounts. The current account lockout threshold is set to 3. What would be your first step to resolve this issue?

  • A. Set the Maximum Password Age policy to 60 days.

  • B. Set the Enforce Password History policy to 0.

  • C. Set the Account Lockout Duration policy to 20.

  • D. Set the Account Lockout Threshold policy to 5.

A5:

Answers D is correct. Setting the Maximum Password Age policy to 60 days or Enforce Password History policy to 0 affect passwords and not account lockout policies; therefore, answers A and B are incorrect. Although setting the Account Lockout Duration policy to 20 would allow the users' accounts to be reset after 20 minutes. This is not the best solution; therefore, answer C is incorrect.

Question 6

You have configured a new security template with an adjusted password policy to enable complexity requirements for a particular site. You link the policy to the site. You find that the policy has not been completely enforced. Why?

  • A. You did not run secedit/refreshpolicy.

  • B. Account policies are applied at the root of the domain.

  • C. You did not run Gpupdate.

  • D. There is a conflicting policy preventing the new policy from being applied.

A6:

Answer B is correct. The policy is applied at the root of the domain and becomes the policy for any system that is a member of the domain. Gpupdate replaces the Windows 2000 command secedit /refreshpolicy; therefore, answer A is incorrect. Refreshing the policy with Gpupdate will not help because the policy cannot be processed as applied; therefore, answer C is incorrect. The policy will not be enforced as applied so a conflicting policy is not the problem; therefore, answer D is incorrect.

Question 7

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with computers running Windows XP Professional. You have defined a Restricted Groups policy in which Joe, Jane, and Jill are the only members of the Marketing group. Before you made this change, Bill, Bob, and Barbara were members. After the policy is refreshed, who will be members of the Marketing group?

  • A. Bill, Bob, and Barbara

  • B. Bill, Bob, Barbara, Jill, Joe, and Jane

  • C. Jill, Joe, and Jane

  • D. No one; the policy conflicts

A7:

Answer C is correct. When a Restricted Groups policy is defined, any user on the Members list who is not currently a member of the group is added and any current member of the group who is not on the members list is removed; therefore, answers A, B, and D are incorrect.

Question 8

Additional security measures that should be performed on an IIS server would include which of the following? (Choose three.)

  • A. Installing only necessary components

  • B. Enabling IAS

  • C. Securing well-known accounts

  • D. Placing content on a dedicated disk volume

A8:

Answers A, C, and D are correct. Enabling IAS is done on an IAS server not an IIS server; therefore, answer B is incorrect.

Question 9

On which of the following types of client computers are you likely to find a loopback policy?

  • A. Mobile computers

  • B. Kiosks and email computers

  • C. Developer computers

  • D. Desktop computers

A9:

Answer B is correct. Loopback policy is used to override user-based Group Policy with computer-based Group Policy. This makes the desktop configuration the same regardless of who logs on. Answers A, C, and D are incorrect.

Question 10

Which of the following ways can security templates be deployed? (Choose three.)

  • A. SCA console

  • B. Command-line tools

  • C. MBSA

  • D. Group Policy

A10:

Answers A, B, and D are correct. Security templates can be applied via the SCA console, using the Group Policy Management Console, or by command-line tools and scripts. MBSA is a tool that is used to scan one or more Windows-based computers for common security holes; therefore, answer C is incorrect.


Chapter 2. Implementing, Managing, and Troubleshooting Patch Management Infrastructure

Terms you'll need to understand:

  • Software Update Services (SUS)

  • Windows Update

  • Systems Management Server (SMS)

  • QChain.exe

  • Hfnetchk.exe

  • Qfecheck.exe

  • Microsoft Baseline Security Analyzer (MBSA)

  • Remote Installation Services (RIS)

  • Rollback strategy

  • Automatic Updates

Techniques you'll need to master:

  • Understanding how to evaluate patches and software updates

  • Knowing how to test compatibility of applications with patches and updates

  • Understanding how to deploy patches and updates in a pilot as well as a production environment

  • Choosing and implementing the proper tools to update both servers and clients

  • Defining a rollback strategy

  • Knowing how to troubleshoot patch and software updates

In the past, many companies overlooked software patch installation and management. This is obvious when we look at the amount of time between the issuance of a patch and a widespread attack based on the vulnerability the patch fixes. Being proactive in security patch management is necessary to keep your environment secure and functional. Companies should have a process in place for identifying vulnerabilities and responding as quickly as possible, especially since successful attacks often start with one vulnerable computer.

When Microsoft becomes aware of a security vulnerability, the company evaluates and verifies the vulnerability. If necessary, Microsoft creates and tests a security patch, releases a security bulletin, and distributes the software update to customers through the Microsoft Download Center, or other services. This chapter explains how to use the tools provided by Microsoft to implement a patch management strategy that will work for your environment.


Planning, Evaluating, and Testing the Deployment of Service Packs and Hotfixes

Before deploying service packs and hotfixes, it is important to have a strategy in place for evaluating, testing, and planning the deployment. Every company has a different way of dealing with patch management. While the majority of companies wait for security rollups or full service pack releases, some companies don't apply patches until becoming victims, some apply every single hotfix and service pack as they become available, and other companies wait to see how others are affected by the hotfix or service pack before applying them. The Microsoft-recommended patch management process is a four-phase approach designed to give you control over the deployment of service packs and hotfixes:

  1. Assess— Determine what operating systems and applications you have in your production environment.

  2. Identify— Determine whether software updates and hotfixes are pertinent to your environment.

  3. Evaluate and plan— Test the software update in a test environment and then decide how to deploy the update.

  4. Deploy— Effectively roll out the approved update in your production environment.

Based on the preceding list, to formulate a good plan you must first assess your environment. Next, determine whether the hotfix or service pack is needed. Then, test the compatibility of service packs and hotfixes with existing applications. In this step, you will have to plan the deployment for the test environment and then later plan for the production environment. Finally, plan a rollback strategy in the event the process goes awry.

Evaluating the Applicability of Service Packs and Hotfixes

To make the patching process easier, Microsoft releases its patches or hotfixes on a monthly schedule, which is the second Tuesday of every month. Any system running Microsoft products in your enterprise should be regularly evaluated for patch requirements. However, should an attacker learn of a vulnerability and release an exploit for it before the update date, Microsoft will post a hotfix ahead of schedule if the situation warrants.

Microsoft offers a free email notification service to send information to customers about the security of Microsoft products. If you use Microsoft software, you should subscribe to the Microsoft Security Notification Service for notifications of new vulnerabilities and software updates. You can choose to receive either technical or non-technical alerts. You can receive technical alerts by subscribing to Product Security Notification and non-technical alerts by subscribing to Microsoft Security Update.

To register for the Microsoft Security Notification Service, go to the Microsoft Security Notification Service page at www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/notify.asp and click the Register link. You only need to provide an email address and select a location and language preference.

You can also go to www.microsoft.com/technet/security/current.aspx to search Microsoft security bulletins to determine whether issues exist that affect your current status, as shown in Figure 2.1. Each Microsoft security patch comes with two documents: a security bulletin and a Knowledge Base article.

Figure 2.1. Microsoft Security Bulletin search window.

[View full size image]

After you decide how you wish to be informed of new issues that may affect your network, it is important that you have all the information together about the layout of your network so you know whether or not the service pack or hotfix needs to be applied. This should include ensuring that all the computers are at a standard baseline. You can do this by creating an inventory of computers and models, operating systems, and applications. Software such as Microsoft Systems Management Server (SMS) will make this task much easier. Be sure to include software versions along with any applied updates, and then use the inventory information to define standard software baselines for all computers. After the baseline is established, bring the noncompliant computers up to their required status.

Microsoft digitally signs all security bulletins. To verify the signature, download and view the certificate. The key's fingerprint is 5E39 0633 D6B3 9788 F776 D980 AB7A 9432. The Security Bulletin key can be downloaded from www.microsoft.com/technet/security/MSRC.asc and information on the digital signature is found at www.microsoft.com/technet/security/bulletin/notify.asp.

After the baselines are established and you have subscribed to receive alerts, you can then determine whether or not you need to install a service pack or hotfix based on a combination of information. Because a large number of software updates are released regularly, all updates must be checked thoroughly for their significance to the environment. First, determine whether you are running the operating system or application that the update applies to. If you are, determine whether the application or operating system contains the vulnerability the update is addressing. The update might be specific to particular scenarios or configurations; therefore, not every security update that applies to a system in your environment will be relevant. To minimize the effort required to keep your environment current and secure, only deploy updates that affect your environment. Software update dependencies such as features that need to be enabled or disabled or requiring a certain service pack to be installed should also be checked. Identifying dependencies is crucial to your planning for the update and in resolving problems that occur as systems are upgraded from one service pack to another.

Testing the Compatibility of Service Packs and Hotfixes for Existing Applications

After you determine that a service pack or hotfix is necessary, you should test for compatibility with existing applications. Software Update Services (SUS) uses the Windows Automatic Updates service, and allows you to configure a server that contains content from a live Windows Update site in your own environment to update internal servers and clients. There are two recommended ways to test update content before applying it to computers in your production environment:

  1. Use two SUS servers, one for testing and one for production computers. Test the content on the test server and then approve the items on the production server.

  2. Use a manually configured distribution point. Use a test server running SUS with test client computers. After the content is tested, copy the tested content and the list of approved items to a manually configured distribution point.

Using the first option, the IT administrator has two servers running SUS. An Automatic Updates policy is configured to point the test clients to the test server running SUS. Another Automatic Updates policy has the production computers pointed to the production server running SUS. The synchronization feature of SUS downloads updates from Windows Update to the test server. The updates are approved for testing, and when this has been successfully completed, the updates are approved for use on the production server.

Should you choose the second option, you can set up one server in your test lab and then publish the updates to client computers in the lab. If these updates install properly on the client computers, you can then configure your production SUS servers to publish the updates. This way, you can ensure that the changes do not have any adverse effects on your current production environment.

You can control approval of new content during synchronization by selecting one of two options on the Set options page of SUS:

  • Automatically approve new versions of previously approved updates— Allows an approved item to continue to be approved if it is later updated during synchronization

  • Do not automatically approve new versions of previously approved updates. I will manually approve these updates later.— Allows an approved item to be automatically unapproved if it is updated during a synchronization

Figure 2.2 shows where the approval options are located on the Set options page of SUS.

Figure 2.2. Software Update Services Set options page.

[View full size image]

In a testing environment, you should select the second option. This allows the update to be tested before being installed on your client computers. On client computers, there are no built-in features for staging content, so you can either set up a test server running SUS in a lab and have a client computer configured to use the Automatic Updates client download to install the packages you want to test, or you can connect the test client computer to the Windows Update site and apply the packages that you want to test on that client.

Group Policy can configure which SUS server should be used by clients. In the Group Policy Object Editor, click Computer Configuration, expand Administrative Templates, click Windows Components, and then click Windows Update. Two policies appear in the right pane. Click Specify Intranet Microsoft Update Service Location and then add the server information. The other policy is explained in the next section.

Planning Patch Deployment Environments for Both the Pilot and Production Phases

No matter how much testing is done in a test environment, it doesn't always produce the same effects that occur when a software update is rolled out into a production environment. Due to this limitation, administrators should consider rolling out the software update to a pilot group. This can be a group of power users or simply a small sample of computers. Some of the results you would look for include the following:

  • After the software update is installed, the computer should restart properly.

  • The software update has an uninstall program that can successfully remove the update.

  • Business-critical systems and services continue to function normally after the software update has been installed.

  • If the update is targeted at computers connected across slow or unreliable network connections, it must properly download and install.

Before you can achieve the desired results, you must first perform the pilot rollout. During this phase, it is important to collect information about procedures, troubleshooting steps, and methods used so that you have a point of reference when you deploy the software update into production.

Software updates can be rolled out using a variety of methods, such as SMS, Group Policy, SUS, and scripts. One common configuration uses Group Policy in combination with SUS. The recommended steps for performing a pilot rollout are as follows:

  1. Approve the update on the SUS pilot server only.

  2. Create a new site-level Group Policy object (GPO) that is configured so the computers that apply this GPO point to the SUS pilot server for updates.

  3. Only the SUS pilot clients should have Read and Apply policy settings rights to this GPO.

  4. Place the SUS pilot GPO at the top of the list of GPOs assigned to the site and verify that the policy cannot be overridden.

  5. Upon successful deployment in production, the SUS pilot GPO should be deleted. The clients should be directed back to the production SUS server for updates upon Group Policy refresh.

If a pilot test doesn't go as planned or is unsuccessful, it may be necessary to unapprove the update on the pilot SUS server and uninstall it from clients. After everything is functioning properly in the pilot test and the update can be safely installed in the rest of the environment, it's time to move into the deployment phase.

The goal of the deployment phase is to successfully roll out the approved software update in your production environment. This phase includes preparing for and executing the deployment, and then doing a post-deployment review. To prepare for the update, the rollout schedule should be announced to the users and the update should be staged on the SUS server. The announcement to the users can be done through Group Policy. Figure 2.3 shows the available options.

  • Notify for download and notify for installation— The user will be notified about updates and will need to select the options to download and install the updates.

  • Automatically download and notify for installation— Updates automatically downloaded and the user will need to select the option to install the updates.

  • Automatically download and schedule the install— Users will be notified of updates and have the option to install the updates before the scheduled time or delay the restart.

Figure 2.3. Group Policy Configure Automatic Updates window.

After the users are notified, the deployment begins. Using a phased deployment minimizes the impact of any failures or undesirable effects that could happen during the initial distribution of an update. The steps necessary to deploy a software update in production should include advertising the update to the clients, checking the deployment progress, and dealing with any failed deployments. A review of the deployment should be conducted afterward, typically within a few weeks. This will identify any changes or improvements that should be made to the patch management process.

Planning the Batch Deployment of Multiple Hotfixes

Most updates require that the computer be restarted after the update is applied. To apply multiple updates without restarting the computer after each one, you can use a Microsoft command-line tool called QChain.exe. With QChain.exe, updates can be chained together so they install without the need to restart the computer between each installation. The Qchain utility can be used with product updates that use Hotfix.exe or Update.exe, and is included in all Windows XP and Windows 2000 updates that were released since May 18, 2001.

When you install updates, if a file is locked or in use, it cannot be replaced. Instead, it is placed in the Pending File Rename queue and replaced after the computer restarts. If there is no restart, there is a possibility that the wrong file version may end up the machine.

All Windows NT 4.0 and Windows 2000 updates earlier than SP2 use the GetFileVersionInfo function to call the version of a file. The version number is stored in memory then written to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs Registry key. If you install two or more Windows NT 4.0 updates or pre-SP2 Windows 2000 updates, and the updates contain different KnownDLLs for the key, Qchain does not make sure that the latest version file is installed.

A post-SP2 Windows 2000 fix, GetFileVersionInfo, calls a mapped file rather than the KnownDLLs that are loaded in memory. In March 2003, Microsoft released an updated version of QChain.exe. The updated QChain.exe tool cleans the Pending File Rename Operations key in the Registry to make sure that only the latest version of a file is installed after the computer is restarted. Now you can use QChain.exe to chain post-SP2 Windows 2000 updates together and the latest version of a file is installed, regardless of the order the updates are installed. QChain.exe can be used with an optional parameter, qchain [logfilename], creating a file with a before and after snapshot of the Pending File Rename Operations key.

To install multiple updates with only one restart, run the update installer using the -z switch. After you install all the hotfixes, run QChain.exe and restart the computer.

Table 2.1 lists the switches that the Update.exe program supports.

Table 2.1. Update.exe Switches

Switch

Description

/f

Forces closing of programs at shutdown

/n

Provides no backup files for removing hotfixes

/z

No restart after installation

/q

Installs in quiet mode

/m

Uses Windows 2000 unattended Setup mode

/u

Uses Windows XP unattended Setup mode

/l

Displays a list of all installed hotfixes

After the installation is complete, verify that all the packages have installed by using the /l switch. Of course, should you choose not to use the qchain command, you can group multiple updates together in a batch file and install them as one. This will prevent you from having to restart your computer after each update is installed, just as the qchain command does. The following is an example of a Qchain batch file:

@echo off

setlocal

set PATHTOFIXES=J:\Update

%PATHTOFIXES%\WindowsServer2003-KBxxxxxx-Platform-LLL.exe /Z /Q

%PATHTOFIXES%\WindowsServer2003-KBxxxxxx-Platform-LLL.exe /Z /Q

%PATHTOFIXES%\WindowsServer2003-KBxxxxxx-Platform-LLL.exe /Z /Q

Planning Rollback Strategy

After a release reaches the rollout planning stage, the order of rollout as well as a rollback strategy should be determined. If serious problems are encountered during deployment, the cause of the problem must be identified and diagnosed. If an appropriate fix or workaround can be found, it should be documented, a request for change requested, and then deployed in the production environment. If not, it may be necessary to use rollback procedures to remove the release from the environment.

Depending on how the update is deployed, the methods of rollback might differ. If SUS is used, it might be necessary to unapprove the update on the SUS server and uninstall it from clients. The software update should have an uninstall program that can successfully remove the update. You can do this manually using Add or Remove Programs in the Control Panel. Sometimes, updates cannot be uninstalled manually. In this case, to revert the computer back to the Last Known Good Configuration, it is possible to use the backup and restore tools for Windows 2000 and Windows Server 2003 and the System Restore utility for Windows XP Professional.

If you install an update as part of an integrated installation, it might not appear in Add or Remove Programs. You cannot remove updates that were installed as part of an integrated installation unless you reinstall the operating system. If you install multiple updates that replace the same files, and you want to return your computer to its original state, you must remove the most recently installed update first and work your way backward.

No matter what methods you use for rollback, the most important factor is that you have a rollback strategy in place.


Using MBSA to Assess the Current Status of Service Packs and Hotfixes

In Chapter 1, we briefly mentioned the Microsoft Baseline Security Analyzer (MBSA) in reference to using it as a tool to scan computers to check for security holes. It can also be used to assess the status of service packs and updates for Windows, Internet Information Services (IIS), SQL, and Exchange, as shown in Figure 2.4.

Figure 2.4. Microsoft Baseline Security Analyzer (MBSA).

[View full size image]

MBSA was developed for Microsoft by Shavlik Technologies LLC. Additional information about Shavlik Technologies LLC can be found at www.shavlik.com.

MBSA can scan computers that are running Windows NT 4, Windows 2000, Windows XP Professional, and Windows Server 2003, and can be run from Windows 2000 and later. In an environment in which a firewall or filtering router separates two Active Directory domains, TCP ports 139 and 445 and UDP ports 137 and 138 must be open for MBSA to connect and authenticate to the remote network being scanned.

Before we specifically get into how MBSA is used in patch management, Table 2.2 lists what it checks.

Table 2.2. MBSA Security Checks

Windows OS Checks

IIS Checks

SQL Checks

Missing security updates and service packs

IIS Lockdown tool (version 2.1) run

Administrators group belongs to sysadmin role

Expired account passwords

IIS sample applications installed

CmdExec role is restricted to sysadmin only

File system type on hard disks

Parent paths enabled

SQL Server running on a domain controller

Autologon feature enabled

Missing IIS security updates

sa account passwordexposed

Guest account enabled

IIS Admin virtual folder installed

SQL installation folders access permissions

RestrictAnonymous Registry key settings

MSADC and Scripts virtual directories installed

Guest account has database access

Number of local Administrator accounts

IIS logging enabled

Everyone group has access to SQL Registry keys

Blank and/or simple local user account passwords

IIS running on a domain controller

SQL service accounts are members of local Admin

Unnecessary services running

N/A

SQL accounts have blank or simple passwords

Lists the shares present

N/A

Missing SQL security updates

Auditing enabled

N/A

SQL Server authentication mode type

Windows version running

N/A

Number of sysadmin role members

MBSA checks the following desktop application parameters:

  • Internet Explorer security zone settings per local user

  • Outlook security zone settings per local user

  • Office products security zone settings per local user

MBSA can also determine which critical security updates are applied to a system. This is done by referencing an Extensible Markup Language (XML) file named Mssecure.xml. The Mssecure.xml file is continuously updated by Microsoft and contains information pertinent to security updates. When you run MBSA for the first time, it obtains a copy of this Mssecure.xml file in a digitally signed .cab file. MBSA downloads the .cab file, verifies the signature, and then unzips it to the local computer on which MBSA is running. This is shown as the Security Update Database version in Figure 2.5.

Figure 2.5. MBSA scan with updated Mssecure.xml file.

[View full size image]

The Mssecure.cab file is the file offered for download by Microsoft. This is a more secure design by ensuring only the signed .cab file is used, and it prevents customers from downloading a potentially out-of-date XML file.

If you do not have Internet access on the scanning computer, manually download the signed Mssecure.cab file from http://download.microsoft.com/download/xml/security/1.0/nt5/en-us/mssecure.cab onto a computer with Internet access. Copy the file to the MBSA installation folder on the scanning computer. MBSA will search for the Mssecure.cab file in the installation folder.

MBSA then scans the selected computers to determine whether a specific update is installed by evaluating the following three items:

  • The Registry key installed by the update

  • The file version(s)

  • The checksum for each file installed by the update

The update will be marked as missing in the scan report if any one of the previous checks fail. Users must have local administrative privileges on the computer being scanned or they will receive an error, as shown in Figure 2.6.

Figure 2.6. MBSA failed scan.

[View full size image]

You can also run MBSA from a command-line prompt by typing mbsacli. Table 2.3 lists and describes the parameters that you can use with the mbsacli command.

Table 2.3. Mbsacli.exe Command-Line Parameters

Switch

Description

mbsacli (with no switch)

Scans the local computer

R /c domainname\computername

Scans the computer named

/i xxx.xxx.xxx.xxx

Scans the IP address specified

/r xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx

Scans the IP address range specified

/d domainname

Scans the domain named

/n IIS

No IIS checks

/n OS

No Windows operating system checks

/n Password

No password checks

/n SQL

No SQL checks

/n Updates

No security update checks

/sus SUS_servername

Checks for security updates that are approved at the specified SUS server

/s 1

Suppresses security update check notes

/s 2

Suppresses security update check notes and warnings

/nosum

Will not test file checksums on security updates

/o domainname - computername

Specifies the output file name template

/e

Lists errors from the last scan

/l

Lists the reports available

/ls

Lists the reports from the last scan

/lr reportname

Displays an overview report

/ld reportname

Displays a detailed report

Besides using MBSA command-line style scans, the Microsoft Network Security Hotfix Checker (Hfnetchk.exe, or HFNetChk) tool can also be used. HFNetChk scans for missing security updates and service packs. You can run Hfnetchk.exe scans from within MBSA by issuing the mbsacli /hf command. You can also run Hfnetchk.exe at the command line using the hfnetchk command, with the parameters listed in Table 2.4.

The MBSA command-line parameters cannot be used with the /hf switch. Each utility has its own set of parameters.

Table 2.4. HFNetChk Command-Line Parameters

Switch

Description

-h hostname

Scans the named NetBIOS computer. To scan multiple hosts, separate the host names with a comma.

-fh filename

Scans the NetBIOS named computers specified in the named text file

-i xxx.xxx.xxx.xxx

Scans the named IP address. To scan multiple IP addresses, separate addresses with a comma.

-fip filename

Scans the IP addresses that you specified in the named text file

-r xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx

Scans a specified range of IP addresses

-d domainname

Scans a specified domain

-n

Scans all the computers on the local network

-sus SUS_filename_or_server

Specifies a text file or a URL from which to obtain the SUS file

-b

Scans a computer for updates that are marked as baseline critical by the MSRC

-fq filename

Specifies the file that contains the Qnumbers to suppress on output

-s , -s2

Suppresses note messages and/or warnings

-nosum

Will not test file checksums on security updates

-sum

Forces a checksum scan when you scan a non-English language computer

-z

Specifies to not perform Registry checks

-history 1,2,3

Displays those updates that have or/and have not been explicitly installed

-v

Displays the reason why a test did not work in wrap mode

-o tab, wrap, -f filename

Specifies the output format that you want

-t

Displays the number of threads used to run the scan

-u username/-p password

Specifies the user/password name when scanning local or remote computer(s). Must be used together.

-x

Specifies the XML data source containing the update information

-t

Displays the number of threads that are used to run the scan

-ver

Checks if you are running the latest version of HFNetChk

-trace

Creates a debug log

Scan reports are stored on the computer on which the tool is installed in the %userprofile%\SecurityScans folder.

Keep in mind that MBSA scans include the full set of available Windows, IIS, SQL, and security update checks, and updates associated with other products, and stores the results in an individual XML file that can be viewed in the MBSA user interface, whereas HFNetChk-style scans check for missing security updates only and display scan results as text in the command-prompt window. Figure 2.7 shows an example of an HFNetChk-style scan.

Figure 2.7. HFNetChk-style scan.

The current version of MBSA also allows for the security updates portion of a scan to be performed against a list of approved security updates on a local SUS server rather than the list of available security updates in the Mssecure.xml file. In addition, the SMS 2.0 Software Update Services Feature Pack uses MBSA technology for automated scanning of client computers with regard to security updates. It can also be used to select, import, and distribute the latest Windows updates directly from Microsoft.

In addition to Mbsacli.exe and Hfnetchk.exe, Microsoft has released a command-line tool named Qfecheck.exe that has the ability to track and verify installed Windows 2000 and Windows XP hotfixes. Qfecheck.exe checks which hotfixes are installed by reading the information that is stored in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates Registry key. It checks for

  • Files that have been hotfixed, but have an outdated binary file

  • The version number recorded in the Registry and compares it against the current version of the installed file

  • Hotfix files that are listed as current but are not recorded as valid by the installed catalogs

Deploying Service Packs and Hotfixes

As mentioned earlier in the chapter, there are several ways to deploy service packs and hotfixes, such as SMS, SUS, Group Policy, slipstreaming, and custom scripts and implementation during a Remote Installation Services (RIS) installation.

The most popular choices for software update distribution are Windows Update (WU), SUS, and SMS 2.0 with the SUS Feature Pack.

In WU and SUS environments, some Microsoft products must be updated by using other services or by manually applying software updates. SMS does not have this limitation. It can be used to update any software product on an SMS client.

SUS allows each software update to be approved before it is installed in the environment. SUS can be used to deploy Windows-related security patches and updates to any computers running Windows 2000, Windows XP Professional, or Windows Server 2003. It is not intended to replace an enterprise software distribution solution such as SMS or Microsoft Group Policy-based distribution; it is simply a quick means to deliver critical updates. SUS has the following advantages:

  • Updates can be approved individually on each SUS server. This allows various testing environments as well as phased deployments.

  • Clients can be configured to get updates through a SUS server or to download them from Windows Update.

  • SUS is a means to provide updates to computers that don't have Internet access.

  • Updates can be copied from a SUS server that is connected to the Internet to an internal SUS server with no Internet access.

  • The SUS server architecture is made up of parent-child relationships and each SUS server can support up to 15,000 clients.

An SUS server requires.

  • A server with Windows 2000 Server or Server 2003 installed

  • An NTFS file system partition with at least 100MB of free space to install SUS SP1 and a minimum of 6GB of storage to host the updates locally

  • IIS

  • Port 80 to communicate with SUS clients

The administration of SUS is completely Web based; therefore, administration can be performed over a standard HTTP connection or over a secure Secure Sockets Layer (SSL)-enabled HTTPS connection.

Because the SUS server architecture is made up of parent-child relationships, a server can be configured to synchronize approved updates either manually or automatically from its parent server. SUS clients use the same Automatic Updates client that Windows Update uses but they can also have additional configurations such as connecting to specific servers for updates, automatic update installations, or end-user prompting.

With SMS 2.0 and the SUS Feature Pack, you can easily manage security updates and distribute any type of software. The SUS Feature Pack helps condense the security patch management process by using a tool named Distribute Software Updates Wizard. The wizard compares available updates with the inventory of client computers to detect missing and previously installed updates, thereby installing only necessary updates. It offers the following features:

  • Capability to update status for all clients based on new security update information

  • Ability to review and authorize missing updates

  • Tailor-built packages and advertisements for each update or set of updates

  • Ability to update advertisements distributed to computers by using SMS software distribution capabilities

  • Windows Update–style notifications, such as not forcing applications to close when they have not been saved

  • Timers that allow users to save and close applications, enabling users to postpone updates or to choose not to restart their systems

Group Policy is another way in which service packs and hotfixes can be deployed. Updates can be controlled through the Wuau.adm template, which configures Windows Update and Automatic Updates settings. Earlier we looked at the portion of the computer policy that configures Automatic Updates. Figure 2.8 shows the portion of the policy that directs the computer to a location for updates.

Figure 2.8. Group Policy specifies update location.

Use the Reschedule Automatic Updates scheduled installations GPO setting to reschedule the installation on computers that have missed a scheduled installation. This occurs when the Automatic Updates service starts.

If the No Auto-Restart for Scheduled Automatic Updates Installations policy setting has been not been enabled, the Automatic Updates client will inform the user that the system will be shut down within five minutes.

Besides configuring how updates are to be received, an actual package can be used to distribute service packs by making a new software installation package (.msi file) and linking it to a GPO through the computer configuration settings, as shown in Figure 2.9.

Figure 2.9. Group Policy for package installation.

[View full size image]

On New Servers and Client Computers

When you install operating systems on new servers or client computers, sometimes service packs or hotfixes have already been released. Less administrative overhead is necessary if the computers can be installed with the proper service packs and hotfixes. Of course, this depends on your patch management policies. The options to install service packs and hotfixes with the OS include slipstreaming, custom scripts, and implementation during a RIS installation.

Slipstreaming simultaneously installs service packs with an operating system. The installation includes the components that you want to install with the updates as entries in the Svcpack.inf file. To accomplish this, you copy the installation files for the operating system and the updates to a shared distribution folder, create the package, and then run setup to deploy the installation either from the shared distribution folder or a CD-ROM. Here are the steps:

  1. Create a shared folder on the network to be used as the distribution folder.

  2. Restrict access to Full Access for the Administrator and Read and Execute permissions for other users.

  3. Copy the contents of the installation CD to the distribution folder by using xcopy.

  4. Edit the Dosnet.inf file by adding svcpack to the [OptionalSrcDirs] section. If this section does not exist, create it as follows:

[OptionalSrcDirs]

svcpack

  5. Create a svcpack subfolder in the directory.

  6. Copy the update package to the svcpack folder by using a naming format such as WindowsServer2003-KBxxxxx-Platform-LLL.exe.

  7. If you are deploying multiple updates, copy and rename all of the update executable files.

  8. Expand the update to a unique temporary location. When you expand the files, two folders are created: rtmqfe and rtmgdr.

  9. From the rtmqfe folder, for each update, copy the KBxxxxxx.cat catalog file and update binary files to the svcpack folder. Copy the files to the distribution folder only if the file has a higher version number.

  10. For each binary file copied, check Dosnet.inf to determine whether each update binary filename is listed in the [Files] section. All files listed in [Files] are preceded by d1,. If an update binary filename is not listed for each update under the [Files] section, add an entry as follows:

d1,Filename

  11. Delete the Svcpack.inf file.

  12. Create a new Svcpack.inf file by using either the procedure for deploying a single or multiple updates.

RIS can be used to automatically install client operating systems on new machines by connecting to the network via booting, obtaining a DHCP address, and then obtaining the proper image for the machine. Service packs and hotfixes can be added to the image by editing the unattended installation file. These are added in the [GuiRunOnce] section of the file by calling Update.exe for service packs or Hotfix.exe for hotfixes.

On a standalone machine, Update.exe can be used to automatically install updated system files and make the necessary Registry changes. Updates can be installed by running the update package. This extracts the update files and runs the Update.exe installation program. If the service pack is missing or is out of date with the updates, the Update.exe program installs the updates automatically. If your service pack version was released after the updates, the installation will not complete and you will receive an error message stating that the version is incorrect. The Update.exe program registers the updates under the following Registry keys:

  • HKEY_LOCAL_MACHINE \Software\Microsoft\WindowsNT\CurrentVersion\Hotfix\KBxxxxx

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Updates\Windows Server 2003\SP1\KBxxxxxx

Table 2.5 lists the command-line options for update packages.

Table 2.5. Command-Line Options for Update.exe Packages

Command-Line Option

Description

/F

Forces applications to close after installation

/N

No file backups for removing updates

/Z

No restart after the installation

/Q

Installs in quiet mode

/O

Overwrites original equipment manufacturer (OEM) files without prompt

/U

Uses unattended setup mode

/L

Lists installed updates

On Existing Servers and Client Computers

Previously we discussed SUS, Group Policy, and SMS. All of these methods can be used to install updates to existing servers and clients. SUS servers are the core of the update process for existing servers and clients. The SUS Setup utility includes default settings that provide a more secure server. When you install SUS on a computer running Windows 2000 Server or Microsoft Small Business Server 2000 with SP1, the Setup utility installs IIS Lockdown 2.0. This includes installing and configuring IIS URL Scanner 2.5.

If you have previously installed IIS Lockdown or URL Scanner, the SUS Setup utility will not attempt to install the IIS Lockdown tool again, change your IIS Lockdown tool settings, or delete the information in the IIS metabase. This is a new function for SUS SP1.

You should configure only one SUS parent server to automatically download software updates from the Microsoft Windows Update server. This SUS server requires that outbound TCP port 80 be accessible through the firewall. Only updates that have been tested and approved should be approved on the parent server. The SUS parent server should download updates on a daily basis using a synchronization schedule.

With SUS, the server content is synchronized with the Windows Update server. There are two types of content that can be synchronized:

  • Update metadata— Contains descriptions of available updates and the rules that are used to apply them to a target computer. Metadata is always downloaded during a synchronization process.

  • Update files— Contains the files that are installed when an update is approved.

There are two synchronization options:

  • Synchronize Now— Manual synchronization that allows administrators to synchronize at any time

  • Synchronization Schedule— Set to preset a day and time for synchronizing with the Windows Update service via the Internet

If a manual synchronization fails, the event is logged to the synchronization log. If a scheduled synchronization fails, the server will attempt to resynchronize 30 minutes later. By default, the server will retry three times. The number of retries can be configured differently, if needed.

All updates downloaded to your server need to be approved before the server makes them available to computers running the Automatic Updates client. The approval process is done through the Approve Updates page, which lists the updates available on the server. The steps to approve a package are as follows:

  1. Select the check box beside the package(s) you wish to approve.

  2. Click the Approve button located at the bottom of the page.

Files currently being downloaded are not affected by this change. The steps to not approve updates, such as for testing purposes, are as follows:

  1. Clear the check box beside the package(s) you do not wish to approve.

  2. Click the Approve button located at the bottom of the page.

If the update is to be released through a phased rollout, the synchronization of the update approvals list should be disabled from the SUS parent server. This will allow the child server(s) to have a copy of the update without it being deployed to clients.

Windows Update is used to keep Windows computers updated. It can also notify users of critical updates and security patches through the Automatic Updates client. The Automatic Updates client is available in Windows 2000 SP3 and Windows XP. Besides providing notification for updates, it also allows the configuration of automated downloads and installation preferences. It can download packages from either Windows Update site or from a server running SUS. It also runs the cyclic redundancy check (CRC) on each package to verify the package was not tampered with.

The Critical Update Notification (CUN) client is now obsolete. Update to Windows 2000 SP3 or later to use the latest Automatic Updates client.

A Windows Installer-based setup program called WUAU22.msi is available for the Automatic Updates client. This allows you to use several methods to centrally deploy the client, which include Group Policy, SMS, and logon scripts. Prior to using any of these methods, you should create a manually configured content distribution point so that the WUAU22.msi file is available to your Windows clients from a file share. The WUAU22.msi file can also be used to install the Automatic Updates client on a standalone computer running Windows 2000 SP2 or higher and Windows XP. You can download WUAU22.msi from the SUS Web page at www.microsoft.com.


Troubleshooting Patch Management Infrastructure

In an ideal world, everything would go as planned and would work as it is supposed to. This of course doesn't happen. This section covers some of the most common problems encountered and how to resolve them.

Table 2.6 lists some of the common issues and solutions for SUS and the Automatic Updates client.

Table 2.6. SUS and Automatic Updates Client Issues

Issue

Solution

New updates do not appear on the Approve updates page after server synchronization

No new updates are available or the memory caches are not loading new updates. To reload, in the navigation bar, click Monitor server, Refresh.

The SUS Administration Web site is not service functioning correctly

Restart the synchronization by clicking Start, Run, services.msc. In the results pane, right-click Windows Update Synchronization Service, Restart.

The SUS Administration Web site is not available or Automatic Updates clients cannot connect to the SUS server

Restart IIS by clicking Start, Run, services.msc. In the results pane, right-click World Wide Web Publishing Service, Restart.

Security enhancements in Windows Server 2003 might result in problems accessing the SUS site after you install SUS 1.0 SP1

Ensure that http://SUSServer_computername is added to the local intranet site list. This is only necessary if the computer from which you are administering the SUS server is running Windows Server 2002.

Cannot determine whether Automatic Updates service is running

Under Manage my computer, expand Services and Applications and then click Services. Verify that Automatic Updates appears on the list of services, double-click the Automatic Updates entry, and check the Service Status

Automatic Updates client is not getting updates from the SUS server

On the Windows client computer, ensure that the following values exist: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate WUServer=http://<SUSServer>, WUStatusServer=http://<YourServer>, HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU UseWUServer=dword:00000001. Update.log will have a series of log entries, for example: 2003-11-28 18:28:31 Success IUENGINE Querying software update catalog from http://intranetSUS/autoupdate/getmanifest.asp. If entries such as this do not exist, the Automatic Updates service on that client computer has not yet attempted to query the server for updates. The client waits approximately 24 hours between attempts to query the server for updates.

Appendix B, "Software Update Services Event Log Messages" of the SUS_Deployguide_sp1 has a complete list of SUS server event log messages. You should review these briefly before taking the exam.

In addition to troubleshooting SUS and the Automatic Updates client, you might be required to troubleshoot MBSA. A Microsoft Baseline Security Analyzer newsgroup, which can be found at Microsoft.public.security.baseline_analyzer, has been created for users to post questions and obtain additional information. Table 2.7 lists some of the common issues and solutions for MBSA.

Table 2.7. MBSA Issues

Issue

Cause or Solution

No permissions to access database error messages when running the SQL server check

You might not have permissions to the MASTER database.

Error reading Registry when checking the Auto Logon feature

The Remote Registry service might not be enabled

Conflicting results between MBSA and Windows Update

MBSA and WU analyze systems in different ways. Microsoft is working to resolve this so that MBSA, WU, SUS, and SMS security patch management will all use the same rules.

SQL Server security updates detected were previously shown as note messages

Microsoft updated the Mssecure.xml file to include detailed SQL Server security update information.

Incorrect security update reports from MBSA or HFNetChk even after updates are installed

Some security updates issued by Microsoft contain workarounds for items that do not include a patch but rather a tool for users to modify a specific service on their systems.

Certain updates flagged as having greater file versions than expected

MBSA scans for security updates only; it cannot determine whether files have been patched by other non-security updates whose file versions and checksums are not included in the Mssecure.xml file


Exam Prep Questions

Question 1

You are responsible for the deployment of 15 new servers. These servers will be running Windows Server 2003. The servers all have identical hardware. Microsoft has just released a new service pack, which you have already deployed in your environment. Your company policy states all new computers must conform to the standards already in place on the network. Which of the following do you use to automate the installation of the service pack when installing the Windows Server 2003 operating system?

  • A. RIS

  • B. Slipstreaming

  • C. SUS

  • D. WUAU22.msi

A1:

Answer B is correct. Slipstreaming simultaneously installs service packs with an operating system. The installation includes the components that you want to install with the updates as entries in the Svcpack.inf file. RIS is used to automatically install client operating systems on new machines; therefore, answer A is incorrect. SUS is used to install service packs and hotfixes; therefore, answer C is incorrect. WUAU22.msi is a Windows Installer-based setup program for the Automatic Updates client; therefore, answer D is incorrect.

Question 2

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with Windows XP clients. Service Pack 2 for Windows XP was just released. You want to deploy the service pack to all of your client computers with a Group Policy object. Which file would you use?

  • A. Update.xls

  • B. Update.exe

  • C. Update.inf

  • D. Update.msi

A2:

Answer D is correct. Packages can be used to distribute service packs by making a new software installation package (.msi file) and linking it to a GPO through the computer configuration settings. Update.xls is a Microsoft Excel file; therefore, answer A is incorrect. Update.exe can be added in the [GuiRunOnce] section of the unattended file for a RIS install or run by itself on a standalone machine; therefore, answer B is incorrect. Update.inf is used in a slipstream installation; therefore, answer C is incorrect.

Question 3

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with Windows 2000 and XP Professional clients. You have several computers that, for security purposes, are not connected to the Internet. You want to be able to run MBSA on these computers. Which of the following files must you download to analyze the security of the computers?

  • A. Hfnetchk.exe

  • B. Mssecure.xml

  • C. Mssecure.cab

  • D. Mbsacli.exe

A3:

Answer C is correct. The Mssecure.cab file is the official file offered by Microsoft for analyzing the security of computers. This is more secure than using just the XML file because it prevents customers from downloading a potentially out-of-date file. The MBSA automatically checks for the updated file before it runs a scan; therefore, answer B is incorrect. Hfnetchk.exe and Mbsacli.exe will check for missing security updates but both rely on the .XML database file; therefore, answers A and D are incorrect.

Question 4

Your patch management coordinator receives a security bulletin that he suspects was not actually sent by Microsoft and asks for a recommendation on what to do. What is the fastest and most secure method for finding out whether or not the bulletin is valid?

  • A. Verify that the digital signature on the bulletin belongs to Microsoft by downloading and checking the Microsoft security certificate

  • B. Call Microsoft support and verify the information

  • C. Look for a new posting on the TechNet newsgroups

  • D. Verify that the digital signature on the bulletin belongs to Microsoft by downloading the Microsoft SSL key

A4:

Answer A is correct. Microsoft digitally signs all security bulletins. To verify the signature, download the digital certificate. The key's fingerprint is 5E39 0633 D6B3 9788 F776 D980 AB7A 9432. Even though calling Microsoft support to verify the information and looking for a new posting on the TechNet newsgroups may be options, they are not the fastest and most secure method for finding out whether or not the bulletin is valid; therefore, answers B and C are incorrect. The Microsoft SSL key is not available for download; therefore, answer D is incorrect.

Question 5

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with Windows XP Professional clients. You want to check for vulnerabilities on a certain subnet of computers. How do you accomplish this? (Choose two. Each answer is part of the solution.)

  • A. Run hfnetchk.exe –.

  • B. Run the MBSA GUI and choose to scan multiple computers.

  • C. Run Mbsacli.exe from a command-line prompt and specify the IP address of each computer individually.

  • D. In the MBSA GUI, under the IP address range, specify the range of computers that you want to check.

A5:

Answers B and D are correct. To scan multiple computers, you can use the MBSA GUI and then specify the range of computers that you want to check in the IP address range. You can also use hfnetchk.exe -i to scan multiple computers; therefore, answer A is incorrect. By using the Mbsacli.exe from a command-line you could specify each computer individually, but it makes more sense to use a range; therefore, answer C is incorrect.

Question 6

You have set up a SUS server on your network and want to test all service packs and hotfixes before they are put into your environment. How do you configure the Approve Updates page? (Choose two. Each answer is part of the solution.)

  • A. Select the check box beside the package(s) you do not wish to approve

  • B. Clear the check box beside the package(s) you do not wish to approve

  • C. Click the Approve button located at the bottom of the page

  • D. Click the Unapprove button located at the bottom of the page

A6:

Answers B and C are correct. To not approve updates, such as for testing purposes, clear the check box beside the package(s) you do not wish to approve and then click the Approve button located at the bottom of the page. Selecting the check box beside the package(s) you do not wish to approve and clicking the Unapprove button located at the bottom of the page will not unapprove the update because there is no Unapprove button; therefore, answers A and D are incorrect.

Question 7

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with Windows XP and Windows 2000 Professional clients. You receive a new version of a custom application with some additional security features that will benefit the company. You want to update the application with the least amount of administrative effort. Which of the following would you use?

  • A. WU

  • B. SUS

  • C. SMS 2.0 with the SUS Feature Pack

  • D. Group Policy

A7:

Answer C is correct. You can use SMS to update any software product on an SMS client. In WU and SUS environments, custom products must be updated by using other services or by manually applying software updates; therefore, answers A and B are incorrect. Although it may be possible to update the systems by using Group Policy by creating an installation package, this requires more administrative work than using SMS; therefore, answer C is incorrect.

Question 8

You are responsible for checking that all computers on the network are secure and configured to the company security policy. How would you use the command-line version of MBSA to scan only the local computer?

  • A. Run the Mbsacli.exe command-line tool with the /l switch

  • B. Run the Mbsacli.exe command-line tool with the /i switch

  • C. Run the Mbsacli.exe command-line tool with no options

  • D. Run the Mbsacli.exe command-line tool with the domainname\computername switch

A8:

Answer C is correct. Running the Mbsacli.exe command-line tool with no options scans the local computer. The /l switch lists the reports from the last scan; therefore, answer A is incorrect. The /i switch scans the IP address specified; therefore, answer B is incorrect. The domainname\computername switch scans the computer named; therefore, answer D is incorrect

Question 9

You are the network administrator for the Test domain, which consists of a Windows Server 2003 domain with Windows XP and Windows 2000 SP3 Professional clients. You need to install several updates on several computers. You want the updates to install one after the other without having the computers restart after each update. Which of the following can you use to accomplish this?

  • A. Update.exe

  • B. QChain.exe

  • C. Hotfix.exe

  • D. Qfecheck.exe

A9:

Answer B is correct. Using QChain.exe, you can chain updates together so they install without restarting the computer between each installation. QChain.exe can be used with product updates that use Hotfix.exe or Update.exe; therefore, answers A and C are incorrect. Qfecheck.exe tracks and verifies installed Windows 2000 and Windows XP hotfixes; therefore, answer D is incorrect.

Question 10

You are responsible for checking that all computers on the network are secure and configured to the company security policy. Which of the following tools cannot be used to check the status of service packs or hotfixes on computers?

  • A. mbsacli.exe

  • B. Hfnetchk.exe

  • C. Qfecheck.exe

  • D. Update.exe

A10:

Answer D is correct. Update.exe can be added in the [GuiRunOnce] section of the unattended file for a RIS installation or run by itself on a standalone machine to update a computer. However, you cannot use it to check the status of service packs or hotfixes. You can use mbsacli.exe, Hfnetchk.exe, and Qfecheck.exe to check the status of service packs or hotfixes on computers; therefore, answers A, B, and C are incorrect.


Chapter 3. Implementing and Managing Security for Network Communications

Terms you'll need to understand:

  • Internet Protocol Security (IPSec)

  • Authentication

  • Authentication Header (AH)

  • Encapsulating Security Payload (ESP)

  • IPSec certificates

Techniques you'll need to master:

  • Planning and IPSec deployment

  • Configuring IPSec policies

  • Deploying and managing IPSec policies

You should always maintain secure communications within your network and between networks to whatever degree possible. Internet Protocol Security (IPSec) allows you to control security using flexible policies to adapt to any network. IPSec secures data in the private and public environments of your network by providing a strong cryptography-based defense.

In this chapter, we discuss securing your network with IPSec, which includes the following:

  • Planning an IPSec deployment

  • Configuring IPSec policies

  • Deploying and managing IPSec policies


Planning an IPSec Deployment

One of the best features of IPSec is its flexibility. Unfortunately, that's a double-edged sword when it comes to network design. IPSec can be configured for the needs of almost any network, but many decisions must be made regarding its configuration. Some decisions are made for you by the way in which you are using IPSec or by the types of client operating systems that you are running on your network; other decisions are made by you. We now discuss the steps that you must take to deploy IPSec, which include the following:

  • Deciding which IPSec mode to use

  • Planning authentication methods for IPSec

  • Securing authentication with IPSec

  • Testing the functionality of existing applications and services

Deciding Which IPSec Mode to Use

This decision is rather easy because it has already been made for you based on the way you are using IPSec. Basically, two different types of communications exist that you need to secure—communications within a network and communications between networks. You choose one of two modes of IPSec security—transport mode or tunnel mode—based on the type of communication you need to make secure.

Transport Mode

You can use IPSec in transport mode to secure communications between two computers on the same network. This can be server-to-server or server-to-client communications. Once configured, IPSec provides end-to-end security based on the authentication and encryption settings that you apply. Figure 3.1 illustrates the concept of IPSec transport mode.

Figure 3.1. IPSec transport mode provides secure communication from endpoint to endpoint within a network.

Tunnel Mode

You can use IPSec in tunnel mode to secure communications between two networks. You define the endpoints of the tunnel, and the system maintains a secure connection between the endpoints. The endpoints are generally router interfaces. You can specify the types of encryption and authentication protocols that will be required for all traffic. Figure 3.2 illustrates the concept of IPSec tunnel mode.

Figure 3.2. IPSec tunnel mode provides for secure communications between two networks.

Planning Authentication Methods for IPSec

Authentication is the process of a network entity proving its identity in a confidential manner. Because authentication must be confidential, computers need to be able to authenticate to each other using a secure method. IPSec uses three main methods of authentication. You make your choice based on the capabilities of your servers and clients and the requirements of your organization. The three main methods from which you can choose are as follows:

  • Kerberos

  • Certificates

  • Preshared key

Kerberos

Kerberos is the default authentication method for Windows 2000 Server and Windows Server 2003. With Kerberos, the client must prove its identity to the server and the server must also prove its identity to the client. This is referred to as mutual authentication. Kerberos can only be used with Windows 2000 Professional and later clients. You should use Kerberos when all of your clients are in the same domain or Kerberos realm and can authenticate using Kerberos and when you want to use a method that requires the least administrative effort.

Figure 3.3 illustrates that Kerberos is the default protocol in the IP security policy.

Figure 3.3. Kerberos is the default authentication protocol for Windows 2000 Server and for Windows Server 2003 IPSec.

When an exam question specifies an authentication method that requires the least administrative effort, and all of the clients and servers are Windows 2000, Windows Server 2003, or Windows XP Professional, you should first determine whether all of the clients are in the same domain. If so, you should use the default Kerberos authentication method. If not, then other methods will have to be considered.

Certificates

As we discussed earlier, certificates are a method of granting access to a user based on the user's unique identification and whether the user possesses the right keys or algorithms to "unlock" the appropriate doors. You issue a certificate to a computer as a means for it to hold the key and as a means for you to track that the computer has the key. You can stipulate in an IPSec policy, as shown in Figure 3.4, that the computer or user must use a certificate (Secure Server) or that it should use a certificate if it has one (Server).

Figure 3.4. You can require or request certificates as part of an IPSec policy.

[View full size image]

Figure 3.4 illustrates the default policies that are included in Windows Server 2003. Microsoft recommends that you create your own policies by modifying the default polices or by starting from scratch and using the Create IP Security Rule Wizard. Depending on your settings, you will create a policy that must be met in its entirety for communications to continue or a policy that can be negotiated between computers.

Preshared Key

A preshared key is a string that you can use to authenticate computers as a last resort. You should not use a preshared key if any other authentication method is available. A preshared key is a symmetric key, which means that the same key that is used to encrypt can also be used to decrypt. You should configure the same string on all computers that you want to authenticate.

The main problem with a preshared key is that you have no way of knowing whether the key is discovered. Also, the key is not specific to any individual. Therefore, an attacker could use the key to authenticate to a network and you could not trace the attack back to an individual. In addition, the preshared key is stored in the Registry in plain text form. It can be configured from the Authentication Methods tab in the properties of an IPSec policy as shown in Figure 3.5.

Figure 3.5. You can use a string to configure a preshared key when no other authentication options exist.

Security Authentication with IPSec

As mentioned previously, your goal is to allow computers to authenticate to each other without anyone else being able to see the process. To facilitate this, the authentication process must be encrypted. Two main protocols can be used when authenticating with IPSec. These are Secure Hash Algorithm (SHA) and Message Digest 5 (MD5). In addition, after authentication takes place, you can use multiple levels of encryption for the data itself. You should be familiar with the following terms and settings for IPSec encryption. These settings are illustrated in Figure 3.6 and can be located by clicking the General tab of an IPSec policy, then the Settings button, and finally the Methods button.

  • Secure Hash Algorithm (SHA)

  • Message Digest 5 (MD5)

  • Data Encryption Standard (DES)

  • Triple DES (3DES)

Figure 3.6. You can choose the type of encryption used by IPSec during authentication and during data transfer.

Secure Hash Algorithm (SHA)

Secure Hash Algorithm (SHA) is the accepted standard for securing authentication of computers working with government contracts. It is used as part of the Federal Information Processing Standard (FIPS). SHA is a very high-security method that uses a 160-bit encryption key.

Message Digest 5 (MD5)

Message Digest 5 (MD5) is used for most commercial applications. You can use MD5 to secure authentication as well as data. This high-security method uses a 128-bit encryption key. It also has a lower performance overhead than that of SHA.

Data Encryption Standard (DES)

Data Encryption Standard (DES) is the lowest encryption strength of the Diffie-Hellman algorithms. It produces only a 56-bit key and is therefore not recommended for use in a high-security environment.

Triple DES (3DES)

Triple DES (3DES) is a much stronger Diffie-Hellman algorithm than DES, and produces a 168– to 2048-bit key. It is recommended for use in medium- to high-security networks.

Testing the Functionality of Existing Applications and Services

Remember, the reason that you originally decided to use security methods was to protect the integrity and the productivity of the network. For this reason, you should always test the applications and services that you are running on your network to make sure that they can still function with the IPSec rules that you have configured. There are many reasons that an application could cease to function or function with errors. Most of these involve the fact that IPSec rules can be used to filter traffic. Sometimes these filters, as indicated in the following list, can cause unexpected results:

  • Filtered ports

  • Filtered IP addresses

  • Filtered protocols

You can use the IP Filter Wizard (see Figure 3.7) to create multiple filters in an IPSec policy rule. If you use more than one filter in a single IPSec policy rule, be aware that the order that the filters are processed in is not necessarily the order in which you are viewing them. Instead, the IPSec Policy Agent reads the policy, and the filters are processed into one ordered list that is sorted from the most to the least specific. You can use the IPSec Monitor console to view the filters sorted by their weight. If you change or delete a filter, the IPSec Policy Agent reorders the filters based on what remains. Because of this, you should always test applications that use IPSec after applying IPSec and after changing any filters. You should use a test lab, if one is available, to test the effect of IPSec rules before assigning them in a production environment.

Figure 3.7. You can use the IP Filter Wizard to create multiple filters in an IPSec policy rule.

IPSec can now function through some Network Address Translation (NAT) infrastructures. As long as the version of NAT is compliant with the latest RFC and is configured to allow User Datagram Protocol (UDP) traffic, the Internet Key Exchange (IKE) protocol will detect the presence of NAT and use UDP-ESP encapsulation to allow the traffic to pass through.


Configuring IPSec Policies

You should understand that IPSec is designed to be an end-to-end security model that secures traffic between clients and servers. The IP address of the computer does not necessarily have to be the entity that is considered; rather, the system that uses the IP address is validated through an authentication process. This allows you to deploy IPSec to a computer, domain, site, or any container within your Active Directory (AD).

In addition, because there are many ways to authenticate, IPSec can be used to secure local area network (LAN) communications, wide area network communications, and remote access communications as well. This is accomplished through the configuration of IPSec policies that contain rules and filters. The rules and filters that you use will depend on what you are securing and how much protection it requires. You should be familiar with the following configuration options using IPSec:

  • Transport mode

  • Tunnel mode

  • IPSec policy rules

Transport Mode

Transport mode is the default mode for IPSec. It is used for end-to-end security between a client and a server within a LAN. IPSec can encrypt the payload of each packet to protect the integrity and confidentiality of the data that it contains. As an alternative, IPSec can simply be used to ensure that the communication came from the indicated source and that the communication hasn't been intercepted or tampered with while in transit. Based on your own security needs, you can configure IPSec for one of the following:

  • Authentication Header (AH) transport mode

  • Encapsulating Security Payload (ESP) transport mode

Authentication Header (AH) Transport Mode

Authentication Header (AH) provides for authentication, integrity, and anti-replay of each packet without encrypting the data. In other words, the data remains readable but is protected from modification. AH uses a system of keyed hash algorithms to sign the packet to ensure its integrity. In this way, you can be assured that a packet did originate from its indicated source and that it has not been modified in transit. This is accomplished by placing an AH header in each packet between the IP header and the IP payload. You can configure custom data integrity and encryption settings, as illustrated on Figure 3.8. Configuring custom settings requires the following steps:

  1. Locate or create an IPSec policy in a computer's Local Settings, a domain's Default Security Policy, or a Group Policy Object.

  2. Right-click the IPSec policy.

  3. Click Properties.

  4. Select the Default Response rule.

  5. Click Edit.

  6. On the Security Methods tab, click Edit.

  7. Select Custom.

  8. Click Settings.

Figure 3.8. IPSec can be used to protect the integrity of a packet using AH.

AH does not encrypt the data within the packets sent.

Encapsulating Security Payload (ESP) Transport Mode

Encapsulating Security Payload (ESP) provides everything that AH does and also provides for the confidentiality of the packet during transit. In transport mode, the entire packet is not encrypted or signed; rather, only the data in the IP payload is encrypted and signed. The authentication process ensures that the packet originated from the indicated sender, and the fact that the data was encrypted ensures that it wasn't viewed or modified during transit. This is accomplished by placing an ESP header before the IP payload and an ESP trailer after the IP payload, further encapsulating only the IP payload.

ESP does not sign the entire packet—only the IP payload itself is encrypted.

Tunnel Mode

IPSec tunnel mode encrypts the IP header and the payload during transit. In this way, tunnel mode provides protection for the entire packet. An entire IP packet is first encapsulated with an AH or ESP header, and then the result is encapsulated with an additional IP header. The additional IP header contains the source and destination of the tunnel endpoints. After the packet reaches the first destination at the tunnel endpoint, it can be decapsulated and sent to the final destination by reading the IP address.

This double encapsulation makes tunnel mode suitable for protecting traffic between network systems. It can be used when traffic must pass through an untrusted medium such as the Internet. It is therefore most often used with gateways or end-systems that do not support L2TP/IPSec or PPTP connections. You can use IPSec tunnel mode for the following configurations:

  • Gateway to gateway

  • Server to gateway

  • Server to server

As with transport mode IPSec, tunnel mode IPSec can be used in AH mode or in ESP mode. The concept is very much the same except that the packets are encapsulated twice. You can configure IPSec tunnel mode for the following:

  • AH tunnel mode

  • ESP tunnel mode

Authentication Header (AH) Tunnel Mode

AH tunnel mode encapsulates an IP packet by placing an AH header between the internal IP header and the external IP header. AH then signs the entire packet for integrity and authentication. This is illustrated in Figure 3.9.

Figure 3.9. In AH tunnel mode, authentication headers are placed between the internal IP header and the external IP header of each packet.

Encapsulating Security Payload (ESP) Tunnel Mode

ESP mode encapsulates an IP packet with an ESP header, IP header, and ESP trailer. This has the effect of protecting the IP header, trailer, and payload. The entire packet is then encapsulated into a new IP tunnel header, which contains the IP addresses of the endpoints of the tunnel. This is illustrated in Figure 3.10.

Figure 3.10. In ESP tunnel mode, the entire packet is encapsulated into a new IP tunnel header, which contains the IP addresses of the endpoints of the tunnel.

Transport mode IPSec is used for secure communications between client and servers in a LAN, whereas tunnel mode is used for secure communication between networks.

IPSec Policy Rules

Whether you use transport mode or tunnel mode for IPSec, the behavior of the system will be determined and controlled by the rules that you configure. Windows Server 2003 comes installed with some basic rules, but these are only to be used for examples because they offer no real security for your network. You should configure rules based on the security requirements of your organization. How you configure the rules of a policy will determine how it will be used and ultimately whether it will be in transport mode or tunnel mode.

Each IPSec policy consists of one of more rules that will determine the behavior of the policy. The rules are configured on the Rules tab of the properties of an IPSec policy, as shown in Figure 3.11. You can access the Rules tab by right-clicking a policy and clicking Properties. Each rule can contain settings for the following:

  • Filter list

  • Filter action

  • Authentication methods

  • Tunnel endpoint

  • Connection type

Figure 3.11. You can configure the properties of each IPSec rule.

Filter List

You configure a filter list by selecting the IP Filter List tab in the properties of an IPSec rule (see Figure 3.12). In the resulting IP Filter List dialog box, a single filter list can contain multiple predefined packet filters that allow traffic to be identified by the list. After the traffic is identified, then the filter action can be applied. Filter lists can identify traffic based on its source, destination, and protocol. You can set both inbound and outbound filters in an IPSec policy.

Figure 3.12. You can configure multiple filter lists in a single IPSec policy.

Filter Action

A filter action is set for each type of traffic as identified by a filter list. The filter actions from which you can choose include Permit, Block, or Negotiate Security for the packets that match the filter list. If Negotiate Security is selected, one or more security methods can be selected. Filter actions are configured on the Filter Action tab in the properties of an IPSec rule. As mentioned previously, the system automatically processes multiple filters in order of specificity, starting with the most specific.

Authentication Methods

You can configure one of more authentication methods to be used in main mode during negotiations. The available authentication methods (as discussed previously) are Kerberos V5, certificates, and preshared keys. You should only use preshared keys as a last resort. You can configure these using the Authentication Methods tab in the properties of an IPSec rule.

Tunnel Endpoint

When you configure a tunnel endpoint as part of a rule, you are setting up one end of tunnel mode IPSec. You must also configure the other end of the tunnel with the same rule and its corresponding tunnel endpoint. This establishes the IP addresses that will be used when the packet is encapsulated before being sent through the tunnel. You should configure the tunnel endpoint on the Tunnel Setting tab in the properties of the IPSec rule to which it applies.

Connection Type

The connection type specifies whether this rule applies to LAN communications, dial-up, or both. The connection type setting can be used to specify rules based on the inherent protocols and technologies that your connection uses. In other words, LAN communications will certainly use different protocols (rules) than dial-up communications and will therefore require different IPSec rules as well.


Deploying and Managing IPSec Policies

Using Group Policy, IPSec policies can be set on a single computer, an entire domain, an entire site, or any AD organizational unit (OU). You can create, modify, and deploy IPSec policies using the IP Security Policy Management Console, as shown in Figure 3.13.

Figure 3.13. You can create, modify, and deploy IPSec policies using the IP Security Policy Management console.

[View full size image]

You should be familiar with the following aspects of deploying and managing IPSec policies:

  • Deploying IPSec using Local Policy objects

  • Deploying IPSec using Group Policy objects (GPOs)

  • Deploying IPSec using commands and scripts

  • Deploying IPSec certificates

Deploying IPSec Using Local Policy Objects

You can configure the properties of IPSec and create rules using the Local Security Policy Microsoft Management Console (MMC), as shown in Figure 3.14, on Windows 2000 Professional and all later clients and on member servers. The Local Security policy is located in Administrative Tools. Any policy defined in a Group Policy will override any policy that is deployed only to the local computer. In other words, if the computer is part of an AD, the IPSec policies defined in Group Policy that apply to its container will override its local policy.

Figure 3.14. You can configure IPSec in the Local Security policy of a client or member server.

Deploying IPSec Using Group Policy Objects

IPSec polices are one of the security settings in each GPO. You can use Group Policy to configure IPSec for an entire domain, an entire site, or selected OUs. Group Policies are processed in the order of local, site, domain, OU, and finally child OU, and any IPSec policies that conflict will be overridden by the next level of processing. In other words, the IPSec policies that will ultimately apply will be only those that are applied to the container in which the object actually resides as well as any policies that did not conflict in the entire processing order. Figure 3.15 shows IPSec settings in a GPO.

Figure 3.15. You can configure IPSec within GPOs.

[View full size image]

Deploying IPSec Using Commands and Scripts

If all of the computers on which you are running IPSec are part of the Windows Server 2003 family, you can deploy IPSec using the netsh ipsec command. This method of deployment can be useful when you want to script the IPSec configuration and run the same script on multiple servers. It also provides some advanced fine-tuning for management and security that is not available in the GUI mode.

You can choose from two major types of commands. You make your choice based on whether you are creating a new policy that be immediately effective or creating a policy that will be applied later. The two major types of netsh ipsec commands are as follows:

  • Netsh ipsec static

  • Netsh ipsec dynamic

Netsh ipsec static

You can use netsh ipsec static commands to create, modify, and assign IPSec policies without immediately affecting the active IPSec policies. This is very much like creating a new policy and new rules within the GUI and not immediately assigning the policy. To view the netsh ipsec static commands, type netsh ipsec static /? at a command prompt.

Netsh ipsec dynamic

You can use netsh ipsec dynamic commands to display the active state of IPSec and to immediately affect the configuration of the active IPSec policy. You use dynamic commands to directly configure the security policy database (SPD). To view the available netsh ipsec dynamic commands, type netsh ipsec dynamic /? at a command prompt.

Most dynamic commands take effect immediately, but some require you to restart the IPSec Policy Agent or restart the computer.

Deploying IPSec Certificates

As mentioned previously, IPSec can use one or more of three authentication methods. These include Kerberos V5, preshared keys, and certificates. You can only use Kerberos if all of the computers to be authenticated are part of your AD. You should only use preshared keys if absolutely necessary. This means that certificates should be used the balance of the time.

To be more specific, you should use certificates whenever communications include Internet access, remote access, external business partners, or computers in your network that cannot use the Kerberos V5 protocol. The use of certificates will require at least one certification authority (CA). This authority can be set up in your own hierarchy or can be a commercial CA. You can use the certification authority and Group Policy provided by Windows Server 2003 to automatically enroll certificates for computers on your network, and computers outside of your network require a third-party CA (such as VeriSign) and manual account mapping for the certificates used. Account mapping maps the computer certificate to a particular computer account, which can be within your organization or another organization.

Microsoft clients and servers prior to Windows 2000 do not use the Kerberos protocol.


Exam Prep Questions

Question 1

Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?

  • A. AH transport mode

  • B. ESP transport mode

  • C. ESP tunnel mode

  • D. AH tunnel mode

A1:

Answer B is correct. ESP transport mode should be used to ensure the integrity and confidentiality of data that is exchanged within the same LAN. AH transport would only ensure the integrity of the LAN data, not the confidentiality; therefore, answer A is incorrect. ESP tunnel mode should be used to secure the integrity and confidentiality of data between networks and not within a network; therefore, answer C is incorrect. AH tunnel mode should be used to secure the integrity of data between networks and not within a network; therefore, answer D is incorrect.

Question 2

Which two types of encryption protocols can be used to secure the authentication of computers using IPSec?

  • A. Kerberos V5

  • B. Cerificates

  • C. SHA

  • D. MD5

A2:

Answers C and D are correct. SHA or MD5 can be used. Kerberos V5 is an authentication protocol, not an encryption protocol; therefore, answer A is incorrect. Certificates are a type of authentication that can be used with IPSec, not an encryption protocol; therefore, answer B is incorrect.

Question 3

Which type of authentication should a company that has all computers in one domain use to ensure authentication of all clients and servers with the least administrative effort? Assume that all client computers run Windows XP Professional and all servers run Windows Server 2003.

  • A. Certificates

  • B. Preshared keys

  • C. Kerberos V5

  • D. MD5

A3:

Answer C is correct. Kerberos V5 is the default authentication protocol for clients running Windows XP Professional and servers running Windows Server 2003 in a domain environment. Certificates would require much more administrative effort in comparison to Kerberos V5; therefore, answer A is incorrect. Preshared keys should only be used when absolutely necessary; therefore, answer B is incorrect. MD5 is an encryption protocol and not an authentication protocol; therefore, answer D is incorrect.

Question 4

Which two types of IPSec can be used to secure communications between two LANs?

  • A. AH tunnel mode

  • B. ESP tunnel mode

  • C. AH transport mode

  • D. ESP transport mode

A4:

Answers A and B are correct. A tunnel mode IPSec should be used. AH transport mode is for protection of the integrity of data transferred between computers on a LAN; therefore, answer C is incorrect. ESP transport mode protects the integrity and confidentiality of data transferred by computers within a LAN; therefore, answer D is incorrect.

Question 5

Which part of an IPSec policy contains filters and filter actions and controls the behavior of the policy?

  • A. Authentication

  • B. Encryption

  • C. Tunneling

  • D. Rules

A5:

Answer D is correct. Rules contain filters and filter actions and control the behavior of an IPSec policy. Authentication is the process of proving an identity; therefore, answer A is incorrect. Encryption is the process of scrambling data to protect its confidentiality; therefore, answer B is incorrect. Tunneling is the process of encapsulating one protocol into another; therefore, answer C is incorrect.

Question 6

Which of the following are settings in an IPSec rule? (Choose two.)

  • A. Types of operating systems allowed

  • B. Filters

  • C. Connection types

  • D. RAM required

A6:

Answers B and C are correct. Parts of an IPSec rule can include filters, filter actions, authentication methods, connection types, and tunnel endpoints. Types of operating systems allowed is not a rule setting; therefore, answer A is incorrect. RAM required is not a rule setting; therefore, answer D is incorrect.

Question 7

Which IPSec rule setting defines traffic that is to be identified?

  • A. Filter action

  • B. Filter

  • C. Tunnel endpoint

  • D. Connection type

A7:

Answer B is correct. A filter defines traffic that is to be identified. Filter action identifies how traffic will be handled after it is identified; therefore, answer A is incorrect. Tunnel endpoint identifies the predefined IP address of the router of a remote network; therefore, answer C is incorrect. Connection type identifies whether the connection can be LAN, dial-up, or both; therefore, answer D is incorrect.

Question 8

Which two components of a rule work together to identify packets and then make decisions that affect traffic flow and security?

  • A. Kerberos V5

  • B. Filters

  • C. Filter actions

  • D. Connection types

A8:

Answers B and C are correct. Filters and filter actions work together to identify packets and then make decisions that affect traffic flow and security. Kerberos V5 is an authentication protocol that runs by default; therefore, answer A is incorrect. Connection types identify whether a rule applies to a LAN, dial-up, or both; therefore, answer D is incorrect.

Question 9

Which AD service should you use to distribute IPSec policies that affect all of the computers in a single domain?

  • A. AD replication

  • B. Kerberos V5

  • C. Group Policy

  • D. Remote Installation Services (RIS)

A9:

Answer C is correct. You should use Group Policy to distribute IPSec policies that affect all of the computers in a single domain. AD replication is not involved in the distribution of IPSec policies to a domain; therefore, answer A is incorrect. Kerberos V5 is the default authentication protocol for AD, but is not involved in distributing IPSec policies; therefore, answer B is incorrect. You can use RIS to install new clients and servers, but RIS is not involved in distributing IPSec policies; therefore, answer D is incorrect.

Question 10

Which two tools should you use to create, manage, and deploy IPSec policies?

  • A. Local Security Policy MMCs for each computer

  • B. IP Security Policy Management Console

  • C. netsh ipsec

  • D. Active Directory Sites and Services

A10:

Answers B and C are correct. The IP Security Policy Management Console and the netsh ipsec command can both be used to create and deploy IPSec policies. Local security policies on each computer cannot be used to control an entire domain; therefore, answer A is incorrect. Active Directory Sites and Services cannot be used to control the IPSec policies for a domain; therefore, answer D is incorrect.


Chapter 4. Planning and Configuring Authentication and Authorization for Remote Access Users

Terms you'll need to understand:

  • Secure Sockets Layer (SSL)

  • Virtual private network (VPN)

  • Internet service provider (ISP)

  • Network Address Translation (NAT)

  • Remote Access Policy

  • Connection Manager Administration Kit (CMAK)

Techniques you'll need to master:

  • Deploying, managing, and configuring SSL certificates

  • Configuring security and authentication for remote access users

  • Configuring and troubleshooting VPN protocols

  • Managing client configuration for remote access security

Because you usually can't see who you are talking to on the other side of a network, your network communication relies on trusting a fast series of fluctuations in current on a wire. Based on these fluctuations in current, you create communications, and based on the communications, you make business decisions that affect the lives of the people in your business. Because of this, you need a way to create fluctuations that not only transmit a message but also prove that the message is genuine and has not been tampered with during its transmission.

Authentication is the process of a user or computer proving its identity on a network. Authorization is a process of the system giving appropriate resource access to a user who has been authenticated. These are important factors in any network, but they become even more important when applied to remote access communications through telephone lines or through the Internet. Your plan for configuring authentication and authorization for your network and its remote access users should include the following components.

  • Deploying, managing, and configuring SSL certificates

  • Configuring security and authentication for remote access users

  • Configuring an troubleshooting VPN protocols

  • Managing client configuration for remote access security


Deploying, Managing, and Configuring SSL Certificates

A digital certificate has many uses in network communication. The public key contained in the certificate can be used for authentication. In addition, anything encrypted with the user's public key can only be decrypted with the user's private key. Since the user is the only one with the private key, he is the only one who can decrypt a message sent encrypted with his public key. You can use this fact to create a temporary session that is private for the two entities involved.

A Secure Sockets Layer (SSL) connection between a client and a Web server consists of the following steps:

  1. The client connects to a Web site using the HTTPS protocol through the default TCP port 443.

  2. The server sends the client a copy of its certificate containing itspublic key.

  3. The client creates a unique session key to be used for this session or sometimes even just a portion of this session of communication.

  4. The client keeps a copy of the key unencrypted and creates another copy of the key encrypted with the public key that it received from the server.

  5. The server decrypts the session key with its private key.

  6. The server and the client communicate using the same encryption key.

  7. At the termination of the session, the keys are discarded and never used again. At least one new session key is created for every session.

SSL uses the HTTPS protocol and port 443.

You can also use SSL to encrypt Active Directory traffic. The Lightweight Directory Access Protocol (LDAP) is used to read from and write to the Active Directory. By default, the traffic is transmitted unsecured, but you can secure it using LDAP over SSL or LDAPS.

As you can see, for SSL to operate, both the client and server must be prepared in advance. This includes the installation of certificates and configuration settings. You should be familiar with the following components of SSL configuration.

  • Configuration of the Web server for SSL certificates

  • Configuration of the client for SSL certificates

Configuration of the Web Server for SSL Certificates

Configuration of the Web server is performed using the IIS Manager tool. You should access the properties of the site and then the Directory Security tab, as shown in Figure 4.1. Click Server Certificate to use the Certificate Wizard to start the certificate request, recovery, and installation process. Depending on the planned usage of the Web server, the certificate can be acquired from an internal, self-managed certification authority (CA) or from an external Internet CA, such as VeriSign or Thawte.

Figure 4.1. You can use the Directory Security tab in the properties of a Web site to access the Certificate Wizard to request and install a certificate for use with SSL.

You should then edit the Secure Communication dialog box within Directory Security for the site by selecting Edit and then selecting the Require Secure Channel (SSL) option, as shown in Figure 4.2. You can also configure each site to use certificates in multiple ways, using the following options:

  • Require 128-bit encryption— Requires that the server and client both utilize 128-bit encryption.

  • Accept client certificates— Users can access the site with a client certificate, but a certificate is not required.

  • Require client certificates— Users without a valid client certificate will be denied access to the site.

  • Ignore client certificates— Users with or without a client certificate will be granted access.

Figure 4.2. You can configure your Web site to require SSL.

Configuration of the Client for SSL Certificates

The exact configuration of the client will vary based on the type of client. Microsoft Internet Explorer browsers are configured to use SSL on the Advanced tab of the Internet Options dialog box within the Tools category, as shown in Figure 4.3. The client will also need a digital certificate, which can be auto-enrolled through Group Policy and your CA or assigned by a third party.

Figure 4.3. You can configure the user's browser to use SSL.

    Previous Section < Day Day Up > Next Section


Configuring Security and Authentication for Remote Access Users

As discussed previously, authentication is a communication process of a user or computer proving that it is who it says it is. The real trick is that this communication should take place without anyone else being able to "listen in" on the conversation and then use that information to impersonate the user at a later time. Some authentication protocols are much better than others at hiding that information during transit. Also, if a user enters their credentials because a server has requested for them to do so, the user should be able to verify that the server is who it says it is. Otherwise, your users could inadvertently provide their credentials to an attacker who is collecting that information for later use.

Generally speaking, authentication protocols have gotten smarter over the years. Microsoft and other vendors have discovered methods of authenticating computers without actually sending credentials in clear text. The catch is that, because the protocols have evolved with time, some protocols only work with certain clients, whereas others work with all clients. You should be familiar with the following authentication protocols:

  • Password Authentication Protocol (PAP)

  • Challenge Handshake Authentication Protocol (CHAP)

  • Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

  • MS-CHAPv2

  • Extensible Authentication Protocol (EAP)

    • Message Digest 5 Challenge (MD5 Challenge)

    • Transport Layer Security (TLS)

  • Multifactor authentication

Password Authentication Protocol (PAP)

Password Authentication Protocol (PAP) is the oldest remote access authentication protocol. PAP uses a two-way handshake to provide for user authentication. Simply put, the server asks for the credentials and the user supplies them. With PAP, a user's credentials are sent over the wire in clear text and can be easily sniffed off of the wire by an attacker. For this reason, PAP is considered non-secure and is rarely used. The only advantage of PAP is that it is extremely versatile and can be used by just about any client, including old Unix based servers.

Challenge Handshake Authentication Protocol (CHAP)

Challenge Handshake Authentication Protocol (CHAP) is a widely supported authentication protocol. All Microsoft clients and many other client computers and network devices support CHAP. The main advantage of CHAP over PAP is that the user's credentials are not sent over the wire in clear text. The remote access server knows the password but does not ask the client for the password. Instead, with CHAP, the remote access server sends a challenge message that is encrypted using Message Digest 5 (MD5) so that the client will only be able to decrypt the challenge if the client actually has the password. The client then decrypts the challenge using its password and a hash algorithm, after which the client sends the result back to the server. The server compares the result with its own decryption of the challenge using the same password. If the two results match, the client must also know the password. The main disadvantage of CHAP is that the password itself must be stored in reversibly encrypted form. This is now considered to be a vulnerability to attackers. Also, you cannot use CHAP authentication when using Microsoft Point-to-Point Encryption (MPPE). Because MPPE is the main encryption protocol used in Point-to-Point Tunneling Protocol (PPTP) tunnels, this is considered to be a disadvantage of CHAP.

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) uses the same type of challenge/response mechanism as CHAP but it uses a nonreversible encrypted password. Because of this distinction, you can use MPPE and therefore PPTP with MS-CHAP. This is considered an advantage of MS-CHAP over CHAP. The only possible disadvantage (depending on your network) is that MS-CHAP can only be used by Microsoft clients and servers. All Microsoft clients and servers support MS-CHAP.

MS-CHAPv2

While PAP, CHAP, and MS-CHAP all require the client to provide credentials to the server, none of these protocols first assure the client that the server already knows what those credentials should be. This means that an attacker could place a rogue server into a network stream and gather the credentials of the clients that attempt to authenticate to it. Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAPv2) uses a challenge response mechanism, but it is much more sophisticated than that of MS-CHAP. With MS-CHAPv2, the server must first prove to the client that it knows the correct password that the client should send. Then, the client answers the challenge of the server to provide the proof that it has the password. All of this in done without the password actually having been sent over the wire. In addition, separate cryptographic keys are generated for transmitted and received data during the authentication process. MS-CHAPv2 is supported by client computers running Windows XP Professional, Windows 2000 Professional, Windows 98, Windows Me, and Windows NT version 4.0. In addition, Windows 95 clients also support MS-CHAPv2 for virtual private networking connections, but not for dial-up connections.

Windows 95 clients support only MS-CHAPv2 on virtual private networking connections, not on dial-up connections.

Extensible Authentication Protocol (EAP)

Extensible Authentication Protocol (EAP) is a set of internal components that provide additional authentication types based on plug-in modules. For successful authentication, the remote access client and the authenticating server must have the same modules installed and configured. EAP modules can provide for smart card authentication, biometric authentication and much more. There are two types of EAP authentication built in to Windows Server 2003. You can add more types based on your needs. You should be familiar with the following two types of EAP authentication that are built-in to Windows Server 2003:

  • Message Digest 5 Challenge (MD5 Challenge)

  • Transport Layer Security (TLS)

Message Digest 5 Challenge (MD5 Challenge)

Message Digest 5 Challenge (MD5 Challenge) uses the same challenge handshake protocol as CHAP, but the challenges are sent as EAP messages. MD5 Challenge can be used to authenticate the credentials of remote access clients by using username- and password-based security systems. It can also authenticate the integrity of the message. An advantage of MD5 Challenge is that it does not require that the user be a member of a domain. A disadvantage is that MD5 Challenge cannot be used with smart cards.

Transport Layer Security (TLS)

Transport Layer Security (TLS) is used in certificate-based security environments. For example, if you are using smart cards, you must also use EAP-TLS authentication. EAP-TLS is only supported on servers that are running Routing and Remote Access, that are configured to use Windows Authentication, and that are members of a domain.

Smart cards use EAP-TLS authentication.

Multifactor Authentication

Multifactor authentication is one of the newest schemes to increase the reliability of authentication. It works on the premise that a user can prove his identity in three ways, as follows:

  • Something he knows— For example, a password or a personal identification number (PIN) for a smart card can be used.

  • Something he has— For example, the possession of the smart card itself can be used.

  • Something he is— For example, his fingerprint or retinal scan can be used.

Multifactor authentication is the combining of two or even three of these factors for proof of indentification. The advantage of this method is that it is more secure than authentication from a single factor. The only disadvantage is that it is less convenient for the user who has to provide the additional methods of authentication.


Configuring and Troubleshooting Virtual Private Network (VPN) Protocols

A virtual private network (VPN) is exactly what the name implies, "virtually private." In other words, it's a method of communicating through a non-secure medium in a secure way. The non-secure medium is most often the Internet. The process of communicating through the Internet with a protocol that keeps the communication secure is called tunneling.

Windows Server 2003 supports both of the major tunneling protocols, PPTP and L2TP, but not all client operating systems support both of these protocols. Also, the tunneling protocols themselves are only one part of the system that makes secure communication through a non-secure medium possible. To effectively configure and troubleshoot a VPN, you should be familiar with the following major components in this system. Table 4.1 illustrates the major differences between PPTP and L2TP.

Table 4.1. Comparison of PPTP to L2TP

PPTP

L2TP

Internetwork must be IP based

Internetwork can be IP, Frame Relay, X.25, or ATM Based

No header compression

Header compression

No tunnel authentication before transmission

Tunnel authentication

Built-in PPP encryption

Uses IPSec encryption

Can be used by all Microsoft clients

Can be used only by Windows 2000 Professional and later clients

  • Internet service providers (ISPs)

  • Client operating systems

  • Network Address Translation (NAT) devices

  • Routing and Remote Access servers

  • Firewall servers

Internet Service Providers (ISPs)

There are basically only two ways to get onto the Internet. Either you register an IP address with the InterNIC (or one its approved registration organizations) and you maintain your own DNS server, or you use a DNS server that has been registered by someone else. This registration is necessary to ensure that all of the domain names and public IP addresses are unique throughout the world.

Because of the "paperwork" and expense of registering their own IP address, most companies choose to use one provided by another company. That company is then their Internet service provider (ISP).

If you choose to register your own IP address and maintain your own registered DNS server, you control all of the components in your system. However, if you use an ISP, it becomes one of your components. In other words, a misconfiguration or filter on the ISP's end can cause you problems. Therefore, if you decide to use your servers and clients to create VPNs, you should also inform your ISP and ensure that its system can handle what you are setting up and that the ISP hasn't filtered any essential protocols.

Client Operating Systems

As we said, a VPN connection relies on tunneling protocols. Your Windows Server 2003 Routing and Remote Access server supports all of these protocols. The catch is that some of your clients may not support all of the protocols. You can configure any supported tunneling protocol in the Network Connections tools of the client.

Your choice of tunneling protocol will depend on the type of clients that you have and the degree of security that you require. You should be familiar with the advantages and disadvantages of the two major tunneling protocols. You should also know which clients will support each protocol. The two major tunneling protocols of which you should be aware are as follows.

  • Point-to-Point Tunneling Protocol (PPTP)

  • Layer 2 Tunneling Protocol (L2TP)

Point-to-Point Tunneling Protocol (PPTP)

Point-to-Point Tunneling Protocol can be used by all Microsoft clients. It allows multiprotocol traffic to be encrypted and then encapsulated into an IP header and sent across on organization's IP internetwork or a public IP internetwork such as the Internet. PPTP encapsulates Point-to-Point Protocol (PPP) frames into IP datagrams and can be used for remote access and for router-to-router communications between networks. PPTP has a built-in encryption protocol called Microsoft Point-to-Point Encryption (MPPE) which encrypts data between two Microsoft systems. It is documented in RFC 2637.

Layer 2 Tunneling Protocol (L2TP)

Layer 2 Tunneling Protocol can only be used by Windows 2000 Professional and newer clients. It allows multiprotocol traffic to be encrypted and then sent across any medium that supports point-to-point datagram delivery, such as IP, X.25, Frame Relay, or ATM. L2TP is a combination of PPTP and Layer 2 Forwarding (L2F), a technology proposed by Cisco Systems, Inc. It represents the best features of PPTP and L2F. L2TP can be used through private networks or over the Internet, when configured with IP as its data transport protocol, as documented in RFC 2661.

With regard to Microsoft products, L2TP can only be used by Windows 2000 Professional and newer clients.

Network Address Translation (NAT) Devices

Network Address Translation (NAT) devices are used primarily to keep private network addresses private and to conserve public address space at the same time. They accomplish this feat by changing the source address of outgoing packets to the address of the outside interface of the router (public address). This keeps the other users on the Internet from knowing the real addresses on your private network. It also allows you to use one public address to provide Internet access to many users simultaneously.

A problem can occur when you combine NAT with a tunneling protocol. Because of their encryption mechanisms, some tunneling protocols are able to handle the address change, while others are not. You should be familiar with the following regarding the two major tunneling protocols and their relation to NAT:

  • PPTP— PPTP and its built-in MPPE encryption are able to interoperate with NAT. PPTP is the recommended protocol when tunneling with NAT using Microsoft servers earlier than Windows Server 2003.

  • L2TP— L2TP does not have an inherent encryption mechanism. However, since the packets need to be encrypted, L2TP uses IPSec for the encryption. Microsoft servers prior to Windows Server 2003 could not use IPSec and NAT together. Windows Server 2003 allows IPSec to be used through a NAT with a new service called IP NAT Traversal. You should be aware that many devices that support NAT may not support it when tunneling with L2TP using IPSec encryption.

Routing and Remote Access Servers

Windows Server 2003 Routing and Remote Access provides full support for PPTP and L2TP tunneling. Windows 2000 Server provides support for both protocols, with the exception that it does not provide support for IP NAT Traversal. Windows NT provides support for PPTP but not for L2TP tunneling.

Firewalls (Servers or Devices)

Firewalls protect your network by filtering incoming and outgoing traffic. They examine each packet to determine what type of packet it is and then make a decision whether to forward the packet or discard it. Many of these decisions are made based on the source and destination ports of the packet. If you are not careful about these ports, a firewall can "protect" your VPN tunnel from communicating at all. You should make sure the appropriate port is open to allow your tunneling protocol to operate. The assigned ports for each tunneling protocol are as follows:

Ports used for PPTP encapsulation:

  • 1723/tcp— This port should be open to allow PPTP traffic to pass through the firewall.

  • IP protocol ID 47 Generic Routing Encapsulation (GRE)— This port is used in conjunction with PPTP to create the VPN.

Ports used for L2TP encapsulation:

  • 1701/udp— This port should be open to allow L2TP traffic to pass through the firewall.

  • 500/udp— This port should be open to allow IKE (IPSec negotiation) traffic to pass through the firewall.

  • IP Protocol ID 50— This port should be open to allow Encapsulating Security Payload (ESP) traffic to be forwarded through the firewall.

  • IP Protocol ID 51— This port should be open to allow Authentication Header (AH) traffic through the firewall.

You should know the ports that may be involved in troubleshooting tunneling protocols.


Managing Client Configuration for Remote Access Security

Windows Server 2003 has built-in tools to assist you in managing a client's access to a remote access server. These tools allow you to select the types of connection, encryption, authentication, and so on that you will allow to make successful connections. You can even customize connections for users to use specifically, or even run specific applications when they connect. You should be familiar with the following remote access tools:

  • Remote Access Policy

  • Connection Manager Administration Kit (CMAK)

Remote Access Policy

In Windows NT, remote access permissions consisted of Allow and Deny for dial-in permissions. Windows 2000 Server and Windows Server 2003 use a much more versatile system called Remote Access Policy. With Remote Access Policy, a user can be allowed or denied based on many factors, including their connection type, security group membership, or the time of day that they are attempting to make the connection, to name a few.

Remote access policies consist of three components that work together to allow or deny the connection. You can configure multiple remote access policies on a single server. If multiple policies are configured, they will be processed in order from the top down. You should place the policy that is most specific at the top of the list. You should be familiar with the following components of remote access policies:

  • Conditions

  • Permissions

  • Profile

Conditions

Remote access policy conditions are attributes that must be met in order to satisfy the policy. They are the first component that is checked on a connection attempt. They are only checked at the initial time of the connection attempt.

Conditions might include day and time restrictions, connection types, security group memberships, and many others. If you set multiple conditions on the same remote access policy, all of the conditions must be met to satisfy the policy.

A policy can be configured to accept or deny the connection based on the conditions. In other words, if the conditions state that a user must be in the Managers group (for example) to satisfy the policy and the user is in the Managers group, then the policy is satisfied. However, if that policy states that all users who satisfy it are denied access, the users in the Managers group would be denied access because they met the conditions of the policy. Figure 4.4 illustrates conditions in a remote access policy.

Figure 4.4. Your remote access policies can be configured to accept or deny the connection based on the conditions.

Permissions

The dial-in permissions of the user are checked after the conditions, assuming that a condition to deny has not already been met. If your domain is in at least Windows 2000 native mode functional level, the dial-in permissions for the user can be set to Allow, Deny, or Control Access through Remote Access Policy. If your domain is in a lower functional level, the Control access through Remote Access Policy option is not available. If you set the permissions to Allow, the user is connected because they already met the conditions earlier. If you set the permissions to Deny, the user is denied access, even though they met the conditions earlier. If you set the permissions to Control Access Through Remote Access Policy, the user's connection will be accepted or denied based on the next step. Figure 4.5 illustrates dial-in permissions for a user with a domain in Windows Server 2003 functional level.

Figure 4.5. Your policies can be configured to accept or deny the connection based on many conditions.

Profile

If you set the user permissions to Control Access Through Remote Access Policy, the profile settings on the policy must be met in order to obtain and to continue a connection. Profiles are checked after conditions. Profile settings that you can select include day and time restrictions, idle-timeouts, session-timeouts, encryption, authentication, connection types, and many more. If you set multiple profile settings in a remote access policy, the user must meet and continue to meet the restrictions that you set.

You should understand the relationship and flow of the three components of Remote Access Policy.

Connection Manager Administration Kit (CMAK)

Connection Manager Administration Kit (CMAK) is a wizard that guides you through the process of building profiles customized for your business. To use CMAK you must first install it from Management and Monitoring Tools of Windows Components in the Add/Remove Programs applet, as shown in Figure 4.6.

Figure 4.6. To use CMAK, you must first install it from Management and Monitoring Tools of Windows Components in the Add/Remove Programs applet.

You can use CMAK to fully customize a connection profile and provide additional functionality for a user. There are many new features in CMAK for Windows Server 2003, including the following:

  • Provide routing table updates that only apply while clients are connected to your server ("split tunneling")

  • Automatically configure Internet Explorer proxy settings for a client computer

  • Enable clients to choose which VPN server to use when they make a connection

  • Automatically run applications on the client computer or on the server at the time of the connection


Exam Prep Questions

Question 1

Which of the following types of Internet communication is secured using digital certificates?

  • A. PPTP

  • B. SSL

  • C. PEAP

  • D. MS-CHAP

A1:

Answer B is correct. SSL is secured using digital certificates. PPTP has a built-in encryption mechanism called MPPE and does not use digital certificates; therefore, answer A is incorrect. Protected Extensible Authentication Protocol (PEAP) is secured with user credentials (username and password); therefore, answer C is incorrect. MS-CHAP is secured with user credentials; therefore, answer D is incorrect.

Question 2

Which are essential elements of SSL communication? (Choose two.)

  • A. Port 80

  • B. Port 443

  • C. Public keys

  • D. EAP

A2:

Answers B and C are correct. Port 443 must be assigned to your Web site. A public key is used to encrypt the session key created by the client. Port 80 is for HTTP, which is not secure; therefore, answer A is incorrect. EAP allows the addition of modules that are used to configure additional security; therefore, answer D is incorrect. Port 443 is the default port used; SSL can be configured to use any port.

Question 3

Which is the strongest authentication protocol that can be used by all clients?

  • A. CHAP

  • B. MS-CHAPv2

  • C. MPPE

  • D. MS-CHAP

A3:

Answer A is correct. CHAP is not specific to Microsoft clients and is the strongest protocol that can be used by all clients. MS-CHAPv2 can only be used by Microsoft clients; therefore, answer B is incorrect. MPPE is an encryption protocol, not an authentication protocol; therefore, answer C is incorrect. MS-CHAP can only be used by Microsoft clients; therefore, answer D is incorrect.

Question 4

Which are forms of EAP authentication? (Choose two.)

  • A. TLS

  • B. L2TP

  • C. MD5

  • D. PAP

A4:

Answers A and C are correct. TLS authentication uses certificates to authenticate the client. It can be used with smart cards. MD5 uses algorithms to authenticate the client and the message. L2TP is a protocol used to encapsulate a message in a VPN; therefore, answer B is incorrect. PAP is a weak authentication protocol that sends the users credentials in clear text; therefore, answer D is incorrect.

Question 5

Which tunneling protocol can be used by all Microsoft clients?

  • A. PPTP

  • B. L2TP

  • C. MS-CHAP

  • D. MS-CHAPv2

A5:

Answer A is correct. PPTP can be used by all Microsoft clients. L2TP can only be used by Windows 2000 Professional and newer clients; therefore, answer B is incorrect. MS-CHAP and MS-CHAPv2 are not tunneling protocols; therefore, answers C and D are incorrect.

Question 6

Which are possible factors in multifactor authentication? (Choose two.)

  • A. User's PIN

  • B. NAT

  • C. ISP

  • D. Fingerprint

A6:

Answers A and D are correct. With multifactor authentication, the user can be authenticated based on something that they have, something that they know, and/or something that they are. The user's PIN is something that they know. The user's fingerprint is something that they are. NAT is not part of multifactor authentication; therefore, answer B is incorrect. An Internet service provider is an organization that gives access to the Internet and is not part of multifactor authentication; therefore, answer C is incorrect.

Question 7

Which tunneling protocol can always be used through a NAT?

  • A. EAP

  • B. L2TP

  • C. MS-CHAP

  • D. PPTP

A7:

Answer D is correct. PPTP can always be used through a NAT device. EAP is an authentication protocol and not a tunneling protocol; therefore, answer A is incorrect. L2TP uses IPSec for encryption and requires NAT Traversal to be used through a NAT; therefore, answer B is incorrect. MS-CHAP is not a tunneling protocol; therefore, answer C is incorrect.

Question 8

Which two ports might be involved in troubleshooting tunneling protocols through a firewall? (Choose two.)

  • A. 1723/udp

  • B. 1701/tcp

  • C. 1701/udp

  • D. 1723/tcp

A8:

Answers C and D are correct. Port 1723/tcp is assigned to Point to PPTP. Port 1701/udp is assigned to L2TP. Port 1723/udp is not assigned to a tunneling protocol; therefore, answer A is incorrect. Port 1701/tcp is not assigned to a tunneling protocol; therefore, answer B is incorrect.

Question 9

Which component of Remote Access Policy must the connection attributes maintain from the beginning to the end of the session?

  • A. Conditions

  • B. Permissions

  • C. Profile

  • D. Encryption

A9:

Answer C is correct. Profile is checked at the beginning of the session and periodically during the session. It must be maintained throughout the session. Conditions and permissions are only checked once at the beginning of the session; therefore, answers A and B are incorrect. Encryption can be used in remote sessions, but is not a component of Remote Access Policy; therefore, answer D is incorrect.

Question 10

The conditions of policy that applies to a user specify access to a resource from 8:00 a.m. to 5:00 p.m. The profile for the same policy specifies access from 10:00 a.m. to 8:00 p.m? Which are true? (Choose two.)

  • A. The user cannot access the resource until 8:00 a.m.

  • B. The user cannot access the resource 10:00 a.m.

  • C. The user will be forced off the connection at 5:00 p.m.

  • D. The user will be forced off the connection at 8:00 p.m.

A10:

Answers B and D are correct. The user must meet both the conditions and the profile to access the resource. He must then meet only the conditions of the profile to continue to use the resource. The user cannot access the resource until 10:00 a.m.; therefore, answer A is incorrect. The user will be forced off the connection at 8:00 p.m.; therefore, answer C is incorrect.


Chapter 5. Planning, Configuring, and Troubleshooting PKI

Terms you'll need to understand:

  • Public key infrastructure (PKI)

  • Certification authority (CA)

  • Root CA

  • Subordinate CA

  • Issuing CA

  • Enterprise CA

  • Standalone CA

  • Certificate template

  • Versions 1 and 2 templates

  • Certificate revocation list (CRL)

  • Delta CRL

  • Certificate enrollment

  • Public and private keys

  • Certificate mapping

  • Certificate stores

Techniques you'll need to master:

  • Planning, building, and managing CA hierarchies

  • Understanding the difference between enterprise and standalone CAs

  • Understanding the types of certificate templates available in Windows Server 2003 and how you can use and configure them

  • Understanding why you would want to revoke a certificate, and how to configure and manage CRLs and delta CRLs

  • Archiving and recovering keys

  • Backing up, restoring, and recovering a CA

We have looked at several uses of certificates in previous chapters of this book. You have learned about the use of X.509 certificates for IPSec authentication. You have also learned about deploying and managing SSL certificates and configuring them for securing communications channels. In this chapter, we show you how to set up and operate a public key infrastructure (PKI), including various aspects of configuring and managing certification authorities (CAs), certificates, and keys. We then look at backup and restore of CAs and the troubleshooting of authentication, authorization, and PKI.


Public Key Infrastructure (PKI) and Certification Authority (CA) Hierarchies

PKI refers to a technology that includes a series of features relating to authentication and encryption. PKI is based on a system of certificates, which are digitally signed statements that contain a public key and the name of the subject. The certificates are issued by a CA, which can be based either on your own network or operated by an external certificate issuing agency such as VeriSign.

Although you can employ a single Windows Server 2003 computer with Certificate Services installed to issue certificates for multiple purposes on your network, best practices dictate that you should use a hierarchy of certificate servers. The following are two possible hierarchies of certificate servers:

  • Two-tier CA hierarchy— This hierarchy consists of a root CA that issues certificates to one or more subordinate CAs, whose job is to issue certificates to users and computers on your network. Each subordinate CA may be dedicated to a single type of certificate, such as smart card, Encrypting File System (EFS), and so on, or to a geographical location of a multisite network.

  • Three-tier CA hierarchy— This hierarchy consists of a root CA that issues certificates to one or more intermediate CAs, which in turn issue certificates to issuing CAs.

Certification Authority Hierarchies and Roles

Within the hierarchies that we introduced here, each CA plays a distinct role that you need to be aware of:

  • Root CA— The topmost CA in any hierarchy is known as a root CA. This CA may exist in the form of a root CA operated by your company, or it may be a CA owned and operated by a third-party issuing authority. In the latter case, you would install the certificate issued by the third-party agency on an intermediate or issuing CA server in your own company.

  • Intermediate CA— In a three-tier hierarchy, the intermediate CA is directly subordinate to the root CA and issues certificates that validate the issuing CAs. This CA takes the form of a subordinate CA. It is common practice to locate intermediate CA servers in different geographical sites, such as cities in which your company does business. Intermediate CAs do not exist in a two-tier hierarchy.

  • Issuing CA— In a two- or three-tier hierarchy, the issuing CA is the server that actually issues certificates to users and client computers as required. Like the intermediate CA, it takes the form of a subordinate CA. It is common practice to dedicate different issuing CA servers to specific certificate types such as EFS, smart cards, and so on.

Whatever type of CA hierarchy you use, be aware of one undeniable fact: Only one root CA exists in any hierarchy. You may have any number of intermediate and issuing CAs, but only one root CA. In addition, you must always install the root CA first. In any hierarchy, the root CA is always the most trusted authority.

Understand the best practices for CA hierarchies. If you have a root CA that is kept offline, it is secure against any type of attack, so that its certificates cannot be compromised. You can always bring it online for only the brief interval needed to issue certificates for intermediate or issuing CAs when needed.

In addition to its level in the hierarchy, you may choose either an enterprise CA (which is integrated with Active Directory) or a standalone CA (which is not integrated). When you employ a CA hierarchy, the best practice is to use a standalone root CA. Doing so enables you to keep the standalone CA offline and physically protected in a locked vault. You should avoid the use of an offline enterprise CA because it cannot maintain its integration with Active Directory when offline. Consequently, it would never be up to date.

Installing and Configuring Root, Intermediate, and Issuing CAs

The procedure for installing a CA depends on its position in the hierarchy. In any case, you begin by installing the root CA on a standalone server, continue by installing as many intermediate CAs as are necessary, and, finally, install the issuing CAs.

Installing the Root CA

To install the root CA on a standalone server, you need to be a member of the local Administrators group. In addition, you need to install Internet Information Services (IIS) 6.0. You can use the following steps to install IIS:

  1. Click Start, Control Panel, Add or Remove Programs.

  2. Click Add/Remove Windows Components to start the Windows Components Wizard.

  3. Select Application Server and then click Details. The Application Server page enables you to select the required Application Server subcomponents.

  4. Ensure that a shaded check mark appears next to Internet Information Services (IIS). This indicates that only certain components of IIS will be installed.

  5. Click OK and then click Next. Insert the Windows Server 2003 CD-ROM when prompted and then click OK.

  6. When the completion page appears, click Finish.

Perform the following steps to install the root CA:

  1. In the Windows Components Wizard, select the Certificate Services check box.

  2. Click Yes to accept the warning that the computer name and domain membership cannot be changed. Click Next.

  3. On the CA Type page, click Standalone Root CA, and then click Next.

  4. On the CA Identifying Information page, enter the CA name and distinguished name suffix, and then click Next.

  5. On the Certificate Database Settings page, accept the default locations for the certificate database, certificate database log, and shared folder. Alternatively, you can type or browse to alternate locations. Click Next.

  6. Click Yes to temporarily stop IIS.

  7. If the Windows Server 2003 CD-ROM is not in the CD-ROM drive from the IIS installation, insert it when requested.

  8. You are informed that Active Server Pages (ASPs) must be enabled in IIS to enable web enrollment services. Click Yes to proceed.

  9. When the completion page appears, click Finish.

If you are installing only a single CA, you can use either an enterprise root CA or standalone root CA. An enterprise root CA stores its information in Active Directory and must be installed on a domain controller.

After you have installed the root CA, you should configure the online location of the certificate revocation list (CRL). You should do this before installing any subordinate CAs because the root CA includes the location information for CRLs on any certificates that it issues. Subordinate CAs then include this information on their certificates. Applications must be aware of the location of the CRL so that they can check certificates presented to them to ensure their validity; otherwise, a security risk could be presented by a revoked certificate. Moreover, many applications will not work if they do not have the proper information available to them regarding the CRL. We discuss configuring the CRL in the "Configuring, Managing, and Troubleshooting CRLs" section later in this chapter.

Installing and Configuring an Intermediate CA

After you have installed a root CA and configured the online location of its CRL, you are ready to proceed with installing as many intermediate CAs as your security infrastructure requires. To install an enterprise subordinate CA, you must be a member of the Domain Admins and the Enterprise Admins groups and have access permissions on the DNS server, the Active Directory database, and the CA server. To install an intermediate CA, you need to first install IIS as already described for the root CA. You then must start the Windows Component Wizard and access the CA Type page as you did for installing a root CA, and proceed as follows:

  1. On the CA Type page, select Enterprise Subordinate CA, and then click Next.

  2. On the CA Identifying Information page, type an identifying name for the CA. This name is combined with the distinguished name suffix to yield the displayed preview of the distinguished name. Click Next.

  3. Accept the locations for the certificate database and log, or type or browse to alternate locations, as required. You may also choose to store configuration information in a shared folder. Click Next.

  4. On the CA Certificate Request page, select Save the Request to a File, and then click Next. You need to select this option because you are keeping the root CA offline.

  5. When requested, insert the Windows Server 2003 CD-ROM.

  6. You are informed that the Certificate Services installation is incomplete. Read the message and click OK.

  7. When the completion page appears, click Finish.

  8. Copy the certificate request file to a floppy disk. Then insert this floppy into the offline root CA. Open the certificate request file in Notepad.

  9. At the offline root CA, click Start, Run, and then type http://localhost/certsrv. This opens the Certificate Services Web pages in Internet Explorer.

  10. Select the Request a Certificate link.

  11. Select the Advanced Certificate Request link to display the Advanced Certificate Request page as shown in Figure 5.1.

    Figure 5.1. The Advanced Certificate Request page of the Certificate Services Web pages.

    [View full size image]

  12. Select the link titled Submit a Certificate Request by Using a Base-64-Encoded CMC or PKCS #10 File, or Submit a Renewal Request by Using a Base-64-Encoded PKCS #7 File.

  13. In Notepad, copy the text of the certificate request file, and paste this text into the Saved Request field of the Certificate Services Web page. Click Submit. Certificate Services informs you that the certificate request has been received and that you must wait for an administrator to issue the certificate.

  14. To issue the certificate, click Start, Administrative Tools, Certification Authority. In the Certification Authority snap-in, expand the CA and select Pending Requests. This displays the certificate request in the details pane.

  15. Right-click the certificate request and choose All Tasks, Issue.

  16. In Internet Explorer, return to the home page of http://localhost/certsrv and select the View the Status of a Pending Certificate Request link.

  17. On the View the Status of a Pending Certificate Request page, select the link to the certificate request. You should obtain the Certificate Issued page. Click Download Certificate.

  18. On the File Download page that appears, click Save and save the .cer file to the floppy disk.

  19. Insert the floppy disk in the subordinate CA. On this computer, click Start, Administrative Tools, Certification Authority to open the Certification Authority snap-in. This displays the CA with the identification name you specified earlier in this procedure. It appears with a red mark that signifies it is not yet valid.

  20. Right-click the CA and choose All Tasks, Install CA Certificate.

  21. Navigate to the .cer file and double-click it. If you receive a message that the root certificate is untrusted, click OK.

  22. The certificate is installed and Certificate Services starts. The red mark changes to a green check mark, signifying that the CA is operational. If this does not occur, right-click the CA and choose All Tasks, Start Service.

Installing an Issuing CA

The task of installing an issuing CA is similar to that of installing an intermediate CA. However, because the intermediate CA is online, you can select the Send the request directly to a CA already on the network option in step 4 of the previous procedure. Then proceed as follows:

  1. Type or browse to the computer on which you installed the intermediate CA. Also type the name of this CA in the Parent CA list box if it is not available. Click Next.

  2. Click Yes to temporarily stop IIS.

  3. Insert the Windows Server 2003 CD-ROM when prompted.

  4. Click Yes to enable Active Server Pages.

  5. Click Finish when the completion page appears.


Managing CAs

After you have installed your CA hierarchy, you need to complete several additional tasks, including the following:

  • Configure certificate templates

  • Configure CRLs

  • Configure key archival and recovery

  • Deploy and revoke certificates

Configuring Certificate Templates

Certificate Services provides certificate templates to simplify the process of requesting and issuing certificates for various purposes. Each template contains the rules and settings that must be in place to create a certificate of a certain type.

Windows Server 2003 supports two versions of certificate templates:

  • Version 1 templates are the same as those provided with Windows 2000. They are read-only and can be used with client computers running Windows 2000 and later.

  • Version 2 templates are new to Windows Server 2003. They are editable and support certificate autoenrollment. They can only be used on client computers running Windows XP or Windows Server 2003.

When you duplicate a version 1 template, the duplicated template is version 2 and can be edited and used for certificate autoenrollment.

Certificate templates are available only on enterprise root and subordinate CAs. They are stored in Active Directory and are available to every enterprise CA in the forest, including those that are subordinate to an offline standalone root CA.

New to Windows Server 2003 is the Certificate Templates snap-in (Certtmpl.msc), which provides administrators with the following capabilities:

  • Create additional templates by duplicating and modifying existing templates

  • Modify template properties such as validity and renewal periods, cryptographic service provider (CSP), key size, and key archival

  • Configure policies applied to certificate enrollment, issuance, and application

  • Allow the autoenrollment of certificates based on Windows Server 2003 version 2 templates

  • Configure access control lists (ACLs) on certificate templates

To access the Certificate Templates snap-in, type certtmpl.msc at the Run dialog box. The details pane lists all available certificate templates. The Autoenrollment column specifies whether autoenrollment of a given template is allowed; version 2 templates allow autoenrollment, while version 1 templates do not. You can configure the properties of any certificate template by right-clicking the template and choosing Properties. The Properties dialog box allows you to configure the following properties:

  • General tab— Enables you to specify validity and renewal periods, and publish certificates in Active Directory.

  • Request Handling tab— As shown in Figure 5.2, enables you to configure the following certificate template properties for version 2 templates:

    • Purpose— Allows you to specify one or more purposes of the template, such as encryption, signature, or signature and encryption. You can also enable the archival of the private encryption key and the inclusion of symmetric algorithms allowed by the subject.

    • Minimum key size— Allows you to specify a minimum key size from 512 to 16384 bits. Longer key sizes provide a higher level of security but consume more processing power. You can also allow private keys to be exported.

    • Do the following when the subject is enrolled and when the private key associated with this certificate is used— Provides options for the amount of user input required. You would use these options, for example, to request that a user enter her PIN when enrolling for a smart card certificate.

    • CSPs— Enables you to select which cryptographic service providers (CSPs) are used in certificate requests.

    Figure 5.2. The Request Handling tab of a version 2 certificate template properties dialog box.

  • Subject Name tab— Enables you to define the subject name of a certificate template. You can choose to supply the name in the certificate request or build it from information stored in Active Directory.

  • Issuance Requirements tab— Enables you to specify default issuance criteria, including the CA certificate manager approval and the number of authorized signatures.

  • Superseded Templates tab— Enables you to specify any templates that are superseded by the current template.

  • Extensions tab— Issued certificates can be accompanied by a predefined list of extensions. You can define the properties of extensions such as application policies, issuance policies, and key usage.

  • Security tab— Enables you to define permissions for users and groups on the certificate template. Available permissions on version 2 templates include Full Control, Read, Write, Enroll, and Autoenroll.

You can also access the Certificate Templates snap-in by right-clicking Certificate Templates in the Certification Authority snap-in and choosing Manage.

Know the options on the Request Handling tab well. You may encounter a question that requires you to configure multiple options on a live version of this dialog box.

When newly installed, the CA can issue certificates based on a limited set of templates as listed in the Certificate Templates node of the Certification Authority snap-in. You can add templates by right-clicking this node and selecting New, Certificate Template to Issue. You can remove templates simply by selecting the template in the details pane and pressing the Delete key. When configuring an issuing CA, you should only include those certificate templates that the CA will be issuing.

You can use three ways to control the issuance of certificate requests: Configuring permissions on the template from the Security tab already mentioned, preventing the CA from issuing that certificate type (by deleting the template from the list in the details pane of the CA snap-in), and configuring the permissions on the CA. To configure CA permissions, right-click the name of the CA and choose Properties. The Security tab of the CA's Properties dialog box allows you to configure the permissions that are listed in Table 5.1.

Table 5.1. CA Permissions

Permission

Description

Groups Granted This Permission by Default

Read

Read configuration information on the certificate

(none)

Issue and Manage Certificates

Approve requests for certificate enrollment and revocation

Members of the Local Administrators, Domain Admins, and Enterprise Admins groups

Manage CA

Configure and manage the CA, including the ability to assign other CA roles and renew the CA certificate

Members of the Local Administrators, Domain Admins, and Enterprise Admins groups

Request Certificates

Request and obtain certificates

Authenticated Users

Restrict permissions on your CAs to prevent unauthorized access. In general, no need exists for users to request certificates from root CAs and intermediary CAs. Only users that require the type of certificate issued by a given issuing CA should have permissions to templates on that CA, and only to the types of templates that they need.

Configuring, Managing, and Troubleshooting CRLs

When you revoke a certificate, the revoked certificate is published in the CRL. As already mentioned, applications check the CRL to ensure that certificates are still valid. Because CRLs can become long, Windows Server 2003 has added the concept of a delta CRL, which is a list of certificates that have been revoked since the last publication of a full CRL. By using delta CRLs, you can publish CRL information more frequently with less replication traffic.

Delta CRLs are published on a differential basis—in other words, each delta CRL includes all revoked certificates since the previous full CRL was published. Figure 5.3 provides an example of CRL publishing. In this example, certificates C1 and C2 were revoked prior to publishing the first base CRL. Certificate C3 was then revoked and appeared in the delta CRL. Certificate C4 was next revoked and the next delta CRL contained both certificates C3 and C4. Finally, a new base CRL was published and contains all revoked certificates. An application that checks CRLs therefore needs to check only the base CRL and the most recent delta CRL to obtain a complete list of revoked certificates.

Figure 5.3. An example of base and delta CRL publication.

You can configure the publication intervals of CRLs and delta CRLs by following these steps:

  1. In the Certification Authority console, right-click Revoked Certificates and choose Properties.

  2. On the CRL Publishing Parameters tab of the Revoked Certificates Properties dialog box, specify the publication intervals for CRLs and delta CRLs.

  3. To view current CRLs and delta CRLs, select the View CRLs tab and click the appropriate command button.

Before you begin to issue certificates from the CA hierarchy, you should place a copy of the root certificate and the CRL (which is empty to begin with) at the locations specified in the policy module. You can obtain copies of the CA certificate and CRLs (base and delta) from the Certificate Services Web pages at http://<server>/certsrv, where <server> is the name of the certificate server. On the home page, select the Download a CA Certificate link, the Certificate Chain link, or the CRL link, and then select the appropriate link on the page that appears. On the File Download page that appears, click Save and specify the appropriate location for the CRL in the Save As dialog box that appears.

Revoking a CA certificate revokes all certificates issued by this CA. Any application that obtains a CRL showing that the parent certificate has been revoked will reject these certificates.

Troubleshooting CRLs

Any application that checks CRLs must be able to locate the CRL before it can accept a certificate. If the application cannot locate the CRL, it fails and the certificate holder is not authenticated. When troubleshooting certificate problems, you need to determine whether the issue lies in the CRL. The following are several CRL-related problems that you might encounter:

  • A CRL is valid for a period that is approximately the same as its publication period, which is one week by default. When changes occur to the CRL or delta CRL, they are not reflected in the context of the user or computer until expiry of a cached CRL or delta CRL. Consequently, information on revoked certificates may not be immediately available. Use a short delta CRL publication interval to alleviate this problem.

  • Applications that check the CRL must be able to locate the current CRL and delta CRL. Ensure that copies of the CRLs are published to URLs and/or file locations that the applications can access.

  • If you are changing the location of a CRL, information on this location is not added to certificates published prior to the change. Only change the location of a CRL when it is absolutely necessary.

  • Applications that check the CRL must be able to access all CRLs in the CA hierarchy. If you are employing an offline root CA, you need to ensure that a copy of its CRL is made available at an online location. Configure this online location before any certificates are issued.

Configuring Archival and Recovery of Keys

You can configure Windows Server 2003, Enterprise Edition to archive the private keys of certificates at the time of issuance. Such an archive enables you to recover the key should it be lost at any time (by accidental deletion, corruption, or any other means).

When you have configured key archival, a user or computer requesting a certificate provides their private key to the CA, which stores this key in its database should later recovery be required.

You can only archive keys at an enterprise CA server running Windows Server 2003, Enterprise Edition. Standalone CAs and CAs on servers running Windows Server 2003, Standard Edition do not support key archival.

A level of danger exists in the archival of keys, especially private keys associated with identification or digital signatures. Unauthorized users could recover archived keys and use them for improper purposes such as the impersonation of legitimate users on the network. In addition, only highly trusted individuals should be granted the privilege of archiving and recovering keys.

By default, Certificate Services does not archive private keys. Perform the following steps to configure Certificate Services for key archival:

  1. Create additional key recovery agents as required by configuring the Security tab of the certificate's Properties dialog box from the Certificate Templates console (Certtmpl.msc). By default, members of the Domain Admins and Enterprise Admins groups can enroll the Key Recovery Agent certificate.

  2. Acquire a certificate for its use in key recovery. You can request this certificate by means of the Certificate Enrollment Web pages. Submit an advanced certificate request and choose Key Recovery Agent as the template on which the certificate is based. You should mark the keys as exportable, and you should also specify strong private key protection, so that a password will be required when accessing the private key. Finally, you can install the certificate from the Certificate Enrollment Web pages.

  3. Configure the CA to load the public key for the key recovery agent. On the Certification Authority console, add the certificate for the key recovery agent to the list of archived keys on the Recovery Agents tab of the CA's Properties dialog box. Then install the key recovery agent certificate in the Certificates console on the computer at which key archival and recovery will take place.

  4. Create a certificate template for key archival purposes. This involves creating a duplicated user certificate template in the Certificate Templates console, with key archival enabled in the Request Handling tab of the duplicated template's Properties dialog box (see Figure 5.2). Finally, you need to enable the duplicated template in the Certification Authority console.

  5. Acquire a user certificate with an archived key. The user who is to act as a key recovery agent needs to request a certificate from the Certificate Enrollment Web pages, using the template you have duplicated and enabled in the previous step.

After you have configured key archival, you can recover a lost key as required by performing key recovery and importing the recovered private key. Key recovery involves use of the Certutil tool, which is a command-line utility included with Windows Server 2003 Certificate Services that performs a large number of certificate management tasks. You can also use the Krecover utility included in the Windows Server 2003 Resource Kit. Key recovery involves the following steps:

  1. Obtain the serial number of the archived certificate from the Certification Authority console. This information is available from the Details tab of the certificate's Properties dialog box, and is needed to perform key recovery.

  2. Recover the private key to a BLOB output file by typing the command Certutil –getkey <serialnumber> blobfile where <serialnumber> is the serial number of the private key to be recovered and blobfile is the name of an output BLOB file that contains the certificate chain and an associated private key. The key is still encrypted at this stage.

  3. Recover (decrypt) the original private/public key pair by typing Certutil –recoverkey blobfile <key_name.pfx> -p password where <key_name> is the username associated with the key pair being recovered and password is the password associated with the .pfx file.

  4. Enter and confirm a secure password for the file to be given to the user in a separate communication.

  5. The user can now use the Certificates console and the supplied password to import the certificate to his personal certificates store.

For complete details on the key archival and recovery process, refer to the "Key Archival and Management in Windows Server 2003" document in Appendix B of this book.

Deploying and Revoking Certificates to Users, Computers, and CAs

When you have configured templates for the types of certificates your company needs to deploy, it is a simple matter to make these certificate templates available to users. We have already discussed the use of Certtmpl.msc for configuring templates. To make these templates available, open the Certification Authority snap-in, expand the entries in the console tree for your server, right-click the Certificate Templates node, and choose New, Certificate Template to Issue. As shown in Figure 5.4, the Enable Certificate Templates dialog box lists the available certificate templates. Simply select the required template and click OK to add the selected template to the list in the details pane.

Figure 5.4. The Enable Certificate Templates dialog box provides a list of templates that you can enable.

Users can use the Web enrollment pages to request certificates by performing the following steps:

  1. Go to http://<server>/certsrv, where <server> is the name of the certificate server.

  2. Select the Request a Certificate link.

  3. On the Request a Certificate page, select the certificate type required or select Advanced Certificate Request.

  4. Follow any additional steps that are presented, and then click Submit.

  5. When the Certificate Issued page appears, click Install This certificate.

If the user is informed that the request is pending, you need to approve the request in the Pending Requests node of the Certification Authority snap-in. This occurs only if you have installed a standalone CA, because enterprise CAs will issue certificates automatically.

Mapping Certificates

You can map certificates issued to a user to the user's account. This creates an association between the certificate and the account. Certificate mapping is especially useful when you need to provide network access to someone outside your organization. When a certificate is mapped and a user presents the certificate, Windows looks at the mapping to determine which account a user should be logged on to. The following two ways of certificate mapping are possible:

  • One-to-one mapping— Maps a single certificate to a single user account. This enables users to connect to a company's secure intranet Web pages from anywhere by providing their client certificates. Users can then log on to their user accounts and receive normal access.

  • Many-to-one mapping— Maps several certificates to a single user account. You can map any certificate with the same subject to the user account regardless of the certificate's issuer, or any certificate that has the same issuer to the user account regardless of the certificate's subject.

To map a certificate to a user account, perform the following steps:

  1. In the View menu of Active Directory Users and Computers, select Advanced Features.

  2. Navigate to the organizational unit (OU) or container in which the required user account is located, right-click the user, and choose Name Mappings.

  3. On the Security Identity Mapping dialog box, click Add.

  4. In the Add Certificate dialog box, navigate to the certificate, select it, and click Open.

  5. In the second Add Certificate dialog box (see Figure 5.5), select from the following options under Identity Mapping, and then click OK:

    • Use Issuer for alternate security identity— Clear this check box for mapping certificates that have the same subject to the user account, regardless of the certificate's issuer. Otherwise, select this check box. Select both check boxes for one-to-one mapping.

    • Use Subject for alternate security identity— Clear this check box for mapping certificates that have the same issuer to the user account, regardless of the certificate's subject. Otherwise, select this check box.

    Figure 5.5. You can use the Add Certificate dialog box to configure certificate mapping.

You can expect to find scenarios in which you need to distinguish between the types of certificate mappings that are available in Windows Server 2003 Certificate Services. Know these mappings thoroughly.

Certificate Autoenrollment

New to Windows XP and Windows Server 2003 is the capability to automatically enroll users and computers for certificates, retrieve existing certificates, and renew expired certificates without user interaction. This action is referred to as autoenrollment of certificates.

You can only autoenroll certificates that are based on version 2 templates. In addition, the client computer must be integrated into Active Directory and the enterprise CA must be hosted on a server running Windows Server 2003 Enterprise Edition. Perform the following steps to enable autoenrollment:

  1. Right-click the template in the Certificate Templates snap-in, and choose Properties.

  2. On the Security tab of the template's Properties dialog box, grant the required user or group the Read, Enroll, and Autoenroll permissions.

  3. On the Request Handling tab, specify the appropriate option for prompting the user during enrollment. See Figure 5.2 shown previously.

  4. In the Certification Authority snap-in, enable the certificate template from the Enable Certificate Templates dialog box shown previously in Figure 5.4.

  5. Configure a Group Policy object (GPO) linked to the appropriate Active Directory container to enroll certificates automatically. As shown in Figure 5.6, this setting is found in the Computer Configuration\Windows Settings\Security Settings\Public Key Policies node.

    Figure 5.6. Configuring autoenrollment settings in Group Policy.

Be sure you know that only version 2 certificates support autoenrollment, and that users require the Read, Enroll, and Autoenroll permissions in order to autoenroll certificates.

Revoking Certificates

You may need to revoke a certificate for various reasons, such as compromise of the certificate or termination of the user to whom the certificate was issued. To revoke a certificate, select the Issued Certificates node of the Certification Authority snap-in. Right-click the certificate to be revoked and select All Tasks, Revoke Certificate. Select a reason code from those displayed in the drop-down list of the Certificate Revocation dialog box, and then click Yes. The certificate is removed from the Issued Certificates list and added to the Revoked Certificates list and the CRL.

If you are unsure about the validity of a certificate, you should specify the "Certificate Hold" reason when revoking it. Specifying this reason provides you with an option to unrevoke the certificate later.


Backing Up and Restoring the CA

Like any other server, you need to back up the CA server regularly so that you can recover it should any type of disaster occur. You can use Ntbackup to back up the system state data, as the Certificate Services database is part of system state. At the same time, you should back up IIS because the proper functioning of the certificate server depends on the Web enrollment pages.

You can also back up Certificate Services by itself. To do so, perform the following steps:

  1. In the Certification Authority snap-in, right-click the certificate server and choose All Tasks, Back up CA.

  2. Click Next, and on the Items to Back Up page of the Certification Authority Backup Wizard, select the items to be backed up (private key and CA certificate, and certificate database and certificate database log). Also type or browse to an empty folder in which you want to store the backup. Then click Next.

  3. Type and confirm a password for the private key, and then click Next.

  4. Click Finish to perform the backup.

You need to specify an empty backup folder in which to store the backup. You can specify a nonexistent folder, and the backup wizard will verify that you want to create the folder.

Certificate Services also provides a restore wizard. To restore Certificate Services, perform the following steps:

  1. In the Certification Authority snap-in, right-click the certificate server and choose All Tasks, Restore CA.

  2. Click OK to stop Certificate Services.

  3. Click Next on the Certification Authority Restore Wizard, select the items to be restored, and type or browse to the location of the backup files. Then click Next.

  4. Type the password for the private key that you specified when you performed the backup, click Next, and then click Finish.

  5. Click Yes to restart Certificate Services. If you have additional files to be restored, click No and repeat this procedure.

Backing up and Restoring Certificate Storage

Certificates are stored in certificate stores, which are located in a protected area of the Registry. A series of certificate stores can exist for each user, computer, and entity. Table 5.2 describes several certificate stores that can be accessed via the Certificates snap-in:

Table 5.2. Certificate Stores

Certificate Store

What It Contains

Personal

User and computer certificates associated with private keys

Trusted Root Certification Authorities

Certificates for implicitly trusted root CAs

Enterprise Trust

Certificate trust lists (CTLs)

Intermediate Certification Authorities

Certificates for subordinate CAs

Active Directory User Object

User certificates published in Active Directory

Trusted Publishers

Certificates from CAs that are trusted by software restriction policies

Untrusted Publishers

Certificates from CAs that are not implicitly trusted

Third-Party Root Certification Authorities

Certificates from commercial CAs such as Thawte and VeriSign

Trusted People

Certificates issued to explicitly trusted people or entities

Certificate Enrollment Requests

Pending or rejected certificate requests

You can use the Certificate Export and Import Wizards to back up and restore certificates with their associated private keys. You should do this to ensure that they are available for recovery or to move them to a different computer. Follow this procedure to back up certificates:

  1. In the Certificates console for a user, service, or computer account, right-click the certificate to be exported and choose All Tasks, Export.

  2. Click Next, and on the Export Private Key page, choose whether to export the private key. You should export this key unless you are merely providing someone with a copy of the certificate.

  3. On the Export File Format page, choose a file format from the following selections:

    • DER encoded binary X.509 (CER)— A platform-independent method for encoding certificates for transfer between computers or other devices.

    • Base-64 encoded X.509 (CER)— Encodes certificates into ASCII text format for transfer to other computers.

    • Cryptographic Message Syntax Standard–PKCS #7 Certificates (.P7B)— For transfer of certificates without private keys between computers or to removable media.

    • Personal Information Exchange–PKCS #12 (.PFX)— For transfer of certificates with private keys from one computer to another or to removable media.

  4. If exporting the private key, type and confirm a password for the key.

  5. Specify the name of the file to be exported.

  6. Click Finish to export the certificate.

Follow this procedure to import certificates with their private keys:

  1. In the Certificates console for a user, service, or computer account, right-click the appropriate certificate store and choose All Tasks, Import.

  2. Click Next, and on the File to Import page, type or browse to the desired file.

  3. If importing a private key, type the password. Also select the following check boxes as appropriate:

    • Enable strong private key protection— Requires prompting before the private key is used. Do not select if a service account or computer uses the key as no means for confirmation exists and the key will fail.

    • Mark this key as exportable— You should generally select this option, so that you can export the key again later.

  4. On the Certificate Store page, ensure that the certificate is imported to the correct store. Click Next and then click Finish to import the certificate.


Troubleshooting Authentication, Authorization, and PKI

Authentication, authorization, and PKI may fail for a number of reasons. When problems occur, you should follow general troubleshooting practices such as examining event logs. You should also ensure that IIS is operating properly and is configured for execution of scripts. Table 5.3 describes several problems you may encounter with PKI and Certificate Services:

Table 5.3. Problems with PKI and Certificate Services

Problem

Cause

Solution

Clients do not automatically enroll for certificates when enabled.

Group Policy autoenrollment information has not replicated to client computers.

Use Gpupdate to force immediate replication of Group Policy.

Clients are unable to obtain certificates by means of autoenrollment.

Improper security permissions have been specified on the certificate template.

Users that require certificate autoenrollment must have the Read, Enroll, and Autoenroll permissions set to Allow.

Unable to find a template when attempting to enroll for a certificate in a child domain.

Security permissions are not properly configured on the templates.

Include the child domain accounts in the permis-sions for the templates to allow enrollment.

After renewing a CA, computers are not auto-matically enrolling for certificates.

After renewing a CA, you need to re-create all automatic certificate enrollment objects.

Configure the automatic certificate request policy in a GPO linked to the appropriate Active Directory container.

User is unable to log on with a smart card because the computer account in the primary domain is missing or the password on the account is incorrect.

The CA that issued the smart card certificate is not trusted by the computer, or the domain computer account may be disabled

In the Certificates snap-in, verify that the root CA's certificate is in the Trusted Root Certification Authorities store. Also verify that the domain controller has been issued a certificate that can be verified to a trusted root. Ensure that the domain computer account is enabled.

Web enrollment pages installed on a server other than the certificate server do not work.

The pages are configured to use NTLM authentication rather than Kerberos authentication.

If the CA is an enterprise CA, you need to configure the pages to use basic authentication. Use SSL to protect the passwords.

Unable to log on to the CA Web pages.

If the Web pages are set to basic authentication, the user account needs the user right to log on to the server.

Modify the default security permissions, which grant only domain administrators this right.

Certificate template names appear as a long string of alphanumeric characters.

This string is an object identifier (OID). The snap-in has not received the full template name.

Close and reopen the Certificates snap-in.

After modifying a certificate template, some CAs on the network still have the original version.

Enterprise CAs replicate certificates with Active Directory replication. They are not available until replication has completed.

Wait until intrasite replication has taken place (5 minutes per hop by default). Use Active Directory Sites and Services to force intersite replication.

Certificate Services is not archiving the private key even though the Archive subject's encryption private key option has been configured from the Request Handling tab.

If you have specified the Signature option on the same tab, private keys are not archived because the digital signature purpose requires that the key not be recoverable.

If you need the keys to be archived, you must specify the Signature and encryption option on this tab.

The CA Web pages do not generate certificates or generate invalid ones.

Enterprise CAs require that users be authenticated. You may encounter this error if pages allow anonymous access.

Configure IIS to use an authentication method other than anonymous.


Exam Prep Questions

Question 1

You are planning a multiple tier CA hierarchy for your company. Which of the following types of CAs should you keep offline as a safeguard against certificate compromise?

  • A. Enterprise root

  • B. Standalone root

  • C. Intermediate

  • D. Issuing

A1:

Answer B is correct. Best practices for creating a CA hierarchy include establishing a standalone root CA that is kept offline. An enterprise root CA should not be allowed to become out-of-date with regard to other Active Directory servers; therefore, answer A is incorrect. Intermediate and issuing CAs are involved in active day-to-day certificate issuing and need to be online at all times; therefore, answers C and D are incorrect.

Question 2

You are planning to install Certificate Services as a standalone root CA on a computer running Windows Server 2003. Which of the following should you install before you install Certificate Services?

  • A. Active Directory

  • B. DNS

  • C. Exchange Server

  • D. IIS

A2:

Answer D is correct. A server running Certificate Services needs to have IIS installed so that it can serve the Certificate Services Web pages. You can install a standalone certificate server without installing Active Directory; therefore, answer A is incorrect. You do not need to install DNS or Exchange Server on a certificate server; therefore, answers B and C are incorrect.

Question 3

You have installed a two-tier hierarchy consisting of an offline root CA plus an online issuing CA. Which of the following tasks should you perform before you begin to issue certificates to users? (Choose three.)

  • A. Configure CRLs

  • B. Configure certificate templates

  • C. Configure key archival and recovery

  • D. Configure the Certificate Services Web pages

A3:

Answers A, B, and C are correct. You need to ensure that certificate templates and CRLs are configured before you are ready to issue certificates. You should also configure key recovery and archival before issuing certificates. The Certificate Services Web pages are created automatically when you install Certificate Services and need no further configuration; therefore, answer D is incorrect.

Question 4

You are configuring Certificate Services for autoenrolling users for smart cards. However, when you access the Security tab of the Smartcard User template, the autoenroll permission is not present. What do you need to do so that you can allow this permission?

  • A. Log off and log on as an enterprise administrator.

  • B. Duplicate the template.

  • C. Specify autoenrollment in a GPO linked to the OU containing the users that need autoenrollment.

  • D. Do nothing. You simply need to configure the Read and Enroll permissions.

A4:

Answer B is correct. A version 1 template such as Smartcard User does not support autoenrollment, but any duplicate of the template is created in version 2 and supports autoenrollment. You do not need to be an enterprise administrator to configure templates—this is needed only to install a CA; therefore, answer A is incorrect. You only specify autoenrollment in a GPO later so that users are required to use smart cards; therefore, answer C is incorrect. The Autoenroll permission is required for certificate autoenrollment to be available; therefore, answer D is incorrect.

Question 5

You are configuring a certificate template for smart card autoenrollment. When a user is creating a new smart card, you want to ensure that he is prompted to enter his PIN as part of the smart card enrollment procedure, so you open the Properties dialog box of the certificate template to the Request Handling tab. Which of the following options should you enable?

  • A. Archive subject's encryption private key

  • B. Allow private key to be exported

  • C. Prompt the user during enrollment

  • D. Prompt the user during enrollment and require user input when the private key is used

A5:

Answer D is correct. Selecting the requirement for user input when the private key is used provides an opportunity for the user to enter his PIN when enrolling for the smart card certificate. Answers A, B, and C are incorrect because none of these options produce a prompt for the PIN when the user is enrolling for the smart card certificate (although you might need to specify archival or export of the private key).

Question 6

You have configured Certificate Services to publish a base CRL every Monday at 6 p.m. and a delta CRL daily at 6 p.m. On Friday morning, a financial application needs to check the CRL to ensure that a new user's certificate is valid. Which of the following CRLs does the application check?

  • A. The base CRL and each delta CRL published from Tuesday to Thursday.

  • B. The base CRL and each delta CRL published from Tuesday to Friday.

  • C. The base CRL and Thursday's delta CRL.

  • D. The base CRL and Friday's delta CRL.

  • E. Thursday's delta CRL only.

  • F. Friday's delta CRL only.

A6:

Answer C is correct. Answers A and B are incorrect because the application needs to check only the base delta CRL and the most recent delta CRL to obtain a complete list of revoked certificates. Answer D is incorrect because the application is checking the CRL before the publication of Friday's delta CRL. Answers E and F are incorrect because the application needs to check the base CRL as well as the delta CRL.

Question 7

You need to enable several users who are members of the Domain Admins group in your company's domain to archive private keys. Which of the following steps should you perform? (Choose all that apply.)

  • A. Add the users to the Enterprise Admins group.

  • B. Request a certificate for key recovery by using the Certificate Enrollment Web pages.

  • C. Add the certificate for the key recovery agent to the list of archived keys.

  • D. Create a certificate template for key archival purposes.

  • E. Acquire a user certificate with an archived key.

A7:

Answers B, C, D, and E are correct. You need to perform all these steps to configure Certificate Services for key archival. After you have performed these steps, you can recover a lost key by performing key recovery and importing the recovered private key. Answer A is incorrect because the users can belong to either the Domain Admins or Enterprise Admins groups, or to another group for which you have allowed the correct permissions.

Question 8

Emily is an enterprise administrator for an Active Directory forest with three domains: examcram.com, east.examcram.com, and south.east.examcram.com. She is deploying a standalone CA server that will issue certificates for users who work for her company's partners. The certificates are to be used for authenticating and providing access to resources in the south.east.examcram.com domain. What does Emily need to do to provide access for outside users of these certificates?

  • A. Map the certificates to user accounts in the examcram.com domain.

  • B. Map the certificates to user accounts in the east.examcram.com domain.

  • C. Map the certificates to user accounts in the south.east.examcram.com domain.

  • D. Map the certificates to user accounts on the standalone CA.

A8:

Answer C is correct. Emily needs to map the certificates to user accounts in the domain in which the resources to be accessed are located. Answers A and B are incorrect because the resources to be accessed are not in either of these domains. Answer D is incorrect because this would not provide any means of access to the resources.

Question 9

Which of the following procedures can you use to back up Certificate Services? Choose all that apply.

  • A. Use Ntbackup to back up the System State data.

  • B. Use Ntbackup to back up the Certificate Services folder.

  • C. In the Certificates snap-in, right-click Certificates–Current User and choose All Tasks, Back up CA.

  • D. In the Certification Authority snap-in, right-click the certificate server and choose All Tasks, Back up CA.

A9:

Answers A and D are correct. Either of these procedures backs up the certificate server. Answer B is incorrect because there is no specific Certificate Services folder. Answer C is incorrect because the Certificates snap-in does not provide an option for backing up the CA.

Question 10

Adam has set up an enterprise CA to serve EFS certificates in his company's Active Directory domain. He has installed the Web enrollment pages in another server in the domain that is already running IIS. However, users are unable to connect to these pages. What should Adam do?

  • A. Configure the pages to use NTLM authentication

  • B. Configure the pages to use basic authentication

  • C. Configure the pages to use anonymous authentication

  • D. Configure the pages to use .NET Passport authentication

A10:

Answer B is correct. In this case, the pages were configured to use NTLM authentication rather than Kerberos authentication. Answer A is incorrect because NTLM authentication is what is causing this problem. Answers C and D are incorrect because these authentication methods do not solve this problem.


Chapter 6. Troubleshooting Security Policies and IPSec

Terms you'll need to understand:

  • Resultant Set of Policy (RSoP)

  • Planning mode

  • Logging mode

  • IP Security Monitor snap-in

  • Internet Key Exchange (IKE)

  • Oakley log

  • Netsh

  • Network Address Translation (NAT)

  • NAT Transversal (NAT-T)

  • Resource Reservation Protocol (RSVP)

  • Internet Security and Acceleration (ISA) Server

Techniques you'll need to master:

  • Use of RSoP to troubleshoot security template and IPSec certificate problems

  • Use of Event Viewer logs to troubleshoot security template and IPSec problems

  • Use of IP Security Monitor to monitor and troubleshoot IPSec

  • Editing IPSec templates from the Edit Rule Properties dialog box

  • Auditing of IPSec-related security events

We have covered the basics of security policies and IPSec in previous chapters of this book. Now that you know how to plan, implement, and configure these items, we look at their troubleshooting. The 70-299 exam presents scenarios that test your ability to diagnose problems in these components and decide on the best means to solve these problems.


Troubleshooting Security Policies

In Chapter 1, "Implementing and Managing Security Policies," you learned about the use of Group Policy and security templates for applying uniform security settings across the computers on your network. You learned about the use of the Security Templates and Security Configuration and Analysis (SCA) consoles for deploying security settings. Now we look at problems that can occur in the use of these tools and the ways you can overcome these problems.

Troubleshooting Security Policy Inheritance

We discussed Group Policy security settings and their inheritance via Group Policy in Chapter 1. You will recall that the Group Policy settings can apply to computers and users, and that policy settings are applied in the order local, site, domain, organizational unit (OU), child OU. You can modify this sequence by using the Block Policy inheritance and No Override options. The availability of these different levels for applying security policies means that conflicts can easily occur with the consequent possibility of policies not being applied as expected. A large part of a security administrator's job is the troubleshooting of unexpected policy behavior, so it is important that you know how to troubleshoot security policy, both for the 70-299 exam and for the real world.

Resultant Set of Policy (RSoP)

Because of the various ways in which you can apply Group Policy, the troubleshooting of security policy settings can be a daunting task. This was especially true in Windows 2000. Windows Server 2003 introduces Resultant Set of Policy (RSoP), which queries computers running Windows XP Professional or Windows Server 2003 and informs you of the order in which policies have been applied. You can run RSoP in either planning mode or logging mode:

  • Planning mode— This mode performs a "what if" scenario to predict the effects of a proposed series of policies on a specified user/computer combination.

  • Logging mode— This mode obtains information on the existing Group Policy application for a specific user/computer combination. This includes the precedence of applying policy settings when the user is subject to different Group Policy objects (GPOs) containing conflicting policy settings.

If you want information about using RSoP in planning mode, or for additional details on applying RSoP in logging mode, consult the Exam Cram or the Que Training Guide for exam 70-294, "Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure."

Troubleshooting of the application of Group Policy security templates and other security settings involves only the logging mode of RSoP. You can use RSoP in logging mode only when the specified user has logged on to the specified computer.

When troubleshooting security policy application and inheritance, you will most likely be using RSoP in logging mode, so we shall concentrate on this mode. You might occasionally need to use planning mode, for example, if you need to test security policy application for a user who has not yet logged on to a particular computer. You can use the following three methods to run RSoP in logging mode:

  • From the Run dialog box— Allows you to rapidly display settings for the current user/computer combination. To use this method, type rsop.msc in the Run dialog box and wait for the RSoP analysis to be completed.

  • From Active Directory Users and Computers— Allows you to specify a user/computer combination found in Active Directory Users and Computers. Right-click the required user and choose All Tasks, Resultant Set of Policy (Logging) to start the Resultant Set of Policy Wizard.

  • From its own console— Allows you to create a custom MMC containing the RSoP snap-in and then start the Resultant Set of Policy Wizard to specify the user and computer to be processed.

We shall briefly discuss the use of the custom RSoP console because this method encompasses the means to analyze RSoP data obtained by any of these three methods. To create the custom console, simply open a blank MMC and add the RSoP snap-in. You can then follow these steps to obtain logging mode data:

  1. In the RSoP console, right-click Resultant Set of Policy and choose Generate RSoP data. The Resultant Set of Policy Wizard opens with a welcome page.

  2. Click Next. On the Mode Selection page, select Logging Mode, and then click Next.

  3. On the Computer Selection page, shown in Figure 6.1, select This Computer or Another Computer as appropriate, type the name or IP address of the computer to be used, and then click Next. You can also click Browse to locate the desired computer from a list.

    Figure 6.1. Selecting the computer to be processed.

  4. On the User Selection page, select the user for which you want to display RSoP data, and then click Next.

  5. Review the information on the Summary of Selections page, and then click Next to process the information entered.

  6. When the completion page appears, click Finish. The RSoP console displays the results of your analysis.

  7. To analyze the results, expand the listings in the console tree to locate the policies you want to examine.

  8. In the details pane, right-click the policy name and choose Properties.

  9. Select the Precedence tab. As shown in Figure 6.2, this tab displays the names of the GPOs that apply and their settings.

    Figure 6.2. Displaying the list of GPOs that are configured for a given policy.

  10. To display the list of all GPOs applied to the current user, right-click either Computer Configuration or User Configuration as needed, and choose Properties. This selection displays a Properties dialog box with the following two tabs:

    • General— Provides the list of GPOs applied. If you want to modify policy settings, you can click Edit to open the Group Policy Object Editor focused on the GPO that is highlighted in the list.

    • Error Information— Provides information on any GPO components that have failed to apply properly. This information helps to facilitate troubleshooting of policies that have not applied properly. See Figure 6.3.

      Figure 6.3. The Error Information tab provides useful information related to GPO processing failure.

  11. To save the results of the query, select the Username on Computername entry near the top of the console tree. Then click View, Archive Data in Console File, and then click File, Save As. Type an appropriate name for the file, and click Save.

  12. To re-run RSoP after making changes to GPOs as described in step 10, right-click the user/computer name, and choose Refresh Query. This reprocesses the query and displays the refreshed results in the same console.

  13. To run RSoP with a different user/computer combination, right-click the user/computer name and choose Change Query. This restarts the Resultant Set of Policy Wizard so that you can re-enter user and computer information.

You can also use the gpresult command to perform nearly all actions that are available in RSoP logging mode. An exception is that gpresult does not provide policy precedence information. Use gpresult if you need to script GPO troubleshooting across a series of computers or store results in text files.

The syntax for the gpresult command is as follows:

gpresult [/s computer [/u domain\user /p password]] [/user target_user]

[/scope {user | computer}] {{/v | /z}]

Table 6.1 describes the options that are available with the gpresult command.

Table 6.1. Options Available with the gpresult Command

Option

Description

/s computer

Specifies the remote computer to be used. You can use either the computer name or IP address. If absent, the local computer is used.

/user target_user

Specifies the user to be used. If absent, the currently logged-on user is used.

/u domain\user /p password

Enables you to enter the appropriate username and password to run the gpresult command in the context of another user. Include the domain if it is not the same as the current domain.

/scope { computer | user}

Limits the display to computer configuration or user configuration data.

/v

Displays verbose policy information.

/z

Displays all available information about Group Policy, more than is available with the /v option.

> filename.txt

Redirects output to the specified file. Because of the large amount of data produced by these options, you should use this option with the /v or /z option.

Troubleshooting Security

Template Problems

Recall that in Chapter 1 we discussed how you can apply security templates. You can use SCA to apply templates to individual computers or groups of computers. In an Active Directory environment, you can import security templates into GPOs to apply them to computers or users in sites, domains, or OUs. You can also use command-line tools and scripts to configure security template settings to multiple computers running different operating systems.

Security Configuration and Analysis

As we noted in Chapter 1, you generally do not use SCA to configure security on computers in OUs and domains. This tool creates a log file that contains useful troubleshooting information should problems arise when analyzing or configuring computer security. Similar logs are generated when using the Secedit command-line tool in a script to analyze or configure a group of computers.

When applying SCA, you might encounter one of the following errors:

  • Access is denied. Import failed— You do not have administrative rights. You need to log on with an administrative account or use the Run As command with an administrative account.

  • Error 1208: An extended error has occurred. Error opening…— The database may be configured with read-only permissions. Either create a new database or change the permissions on the existing database.

Use of Group Policy to Apply Security Templates

Numerous issues might prevent a security policy from taking effect. Resolving such a problem can be difficult. We have endeavored to present several areas that you should look at when security templates do not apply as expected. Additional information is available from the references listed in Appendix B, "Suggested Reading and Resources."

One of the first places you should check is the Event Viewer logs. When security templates do not apply as expected, errors are logged in the system, application, or File Replication Service log.

Errors with event IDs 1000 and 1001 that repeat at 5- to 7-minute intervals indicate problems with applying Group Policy (see Figure 6.4). There might be problems with the %systemroot%\SYSVOL\Domain\Policies folder structure, which holds the Group Policy templates (GPTs), or replication might be failing. Use repadmin or replmon to check Group Policy replication and check the integrity of the subfolders in the GPT folder structure mentioned here. If necessary, restore these folders from backup. See Knowledge Base article 327781 for additional information on troubleshooting the SYSVOL folder.

Figure 6.4. A 1001 error indicates a problem with accessing a Group Policy template.

If you receive a Failed to open the Group Policy Object. You may not have appropriate rights error when attempting to open the Group Policy Object Editor, one or more subfolders in SYSVOL might be missing or corrupted. This error is accompanied by events of ID 1030 and 1058 in the application log, which also repeat at intervals of approximately 6 minutes. You can restore SYSVOL from backup or obtain the folder from another domain controller. You might also need to reset user rights on the GPT as described in Microsoft Knowledge Base article 324800.

The 1030 and 1058 errors will also be recorded if File and Printer Sharing for Microsoft Networks is disabled on the Local Area Connection properties dialog box. You should leave this service enabled on domain controllers.

On a member or standalone server, if you receive the 1000, 1202, 412, and 454 errors in the application log repeatedly, this means the local Group Policy database might be corrupted. This file is located at %systemroot%\security\Database\secedit.sdb. You can use SCA to re-create this database as explained in Knowledge Base article 278316.

Manual Editing of Security Templates

Security template files are ASCII text files, and as such can be edited with a text editor such as Notepad. See Figure 6.5 for an example. Although this provides another way to edit security settings, unpredictable results can occur if you edit a template carelessly. This is especially true of the Registry entries contained in the [Registry Values] section of these files. Be sure to document any changes you have made to template files so that if any undesired effects show up later, you can troubleshoot them.

Figure 6.5. Security templates are editable ASCII files.

Troubleshooting Security Templates in a Mixed Operating System Environment

Different problems might occur when you apply security templates in environments where computers run operating systems other than Windows XP or Windows Server 2003. In this section, we attempt to enumerate several problems you might expect to face when working in mixed operating system environments.

Windows 2000

Security templates in Windows 2000 behave in much the same fashion as in Windows Server 2003; however, differences exist between Windows 2000 and Windows XP/Server 2003 in the syntax of the default security template files. You might receive unpredictable results if you import a Windows 2000-based security template to a Windows Server 2003 domain controller or vice versa. Be sure to use the correct version of the security templates to avoid this problem.

In nearly all cases, communication among computers running Windows 2000/XP/Server 2003 and using security templates presents little or no problem. One exception is that client computers configured with the Hisecws.inf or Securews.inf template cannot communicate with servers running Windows 2000 if their clocks differ by more than 30 minutes. This problem should not occur in a domain environment where the primary domain controller emulator is functioning properly as a time server.

Windows NT 4.0

Issues you should be aware of when Windows NT 4.0 computers are present include limited communication when using highly secure templates and modification of file and folder permissions.

Use of Highly Secure Templates

Use of the highly secure templates (Hisec*.inf) prevents most communication between Windows Server 2003 computers and computers running Windows NT 4.0 or earlier. More specifically, the following are true when computers are configured with these templates:

  • Domain controllers running Windows NT 4.0 cannot authenticate users logging on to a client computer unless they run Service Pack 4 or higher. Domain controllers for the domain to which the computer is joined must run Windows 2000 or later.

  • Client computers cannot communicate with computers running Windows NT 4.0 unless they run Service Pack 4 or higher. They cannot communicate with computers that run only LAN Manager. This restriction is also true for client computers that are configured with the Secure*.inf security templates.

  • Client computers cannot communicate with a server running Windows 2000 or Windows NT Service Pack 4 or higher using a target server-based account if the time on the target server differs by more than 30 minutes from that on the client computer. This restriction is also true for client computers that are configured with the Secure*.inf security templates.

  • When applying Hisecdc.inf to a domain controller, all other domain controllers in trusted or trusting domains must run Windows 2000 or Windows Server 2003.

If any of these conditions prevent proper communication, the best solution is to upgrade servers to Windows 2000 or Windows Server 2003. If this action is not possible, you should use the Securews.inf and Securedc.inf templates, in conjunction with Service Pack 4 or higher for Windows NT 4.0.

Modified File and Folder Permissions

Use of security templates in an environment where Windows NT 4.0 computers are present might create an issue with file and folder permissions, which are specified for the system and boot partitions in several templates such as Compatws.inf, DC security.inf, Rootsec.inf, and Setup security.inf. Unexpected results can occur if you use Group Policy or security templates to set permissions on files or folders whose access control lists (ACLs) were configured on Windows NT 4.0. These files or folders can unexpectedly inherit permissions that are more relaxed than desired. You might encounter this problem if you are using a security template that sets two or more hierarchical ACLs and you are using a volume that meets one of the following conditions:

  • It has been accessed by a remote Windows NT 4.0 computer.

  • It is freshly formatted.

  • It has been migrated from Windows NT 4.0.

  • Cacls.exe was used to set permissions on the volume.

Solutions for this problem include modifying the security template to protect folders that might be affected, using multiple templates to apply file system security, and overwriting the permissions by selecting Replace Existing Permissions on All Subfolders and Files With Inheritable Permissions when configuring permissions on the File System subnode in a security template (see Chapter 1). You might also be able to set up a well-structured OU design that allows you to control the flow of different policies on different clients. For more information on this problem, see Knowledge Base article 321470.

Problems similar to these and additional problems might occur if you have computers running Windows 9x/Me on your network. These computers do not support Kerberos authentication. Windows 9x computers support NTLMv2 authentication only when the Active Directory Client Extensions Pack is installed.

You cannot use Group Policy to apply security templates to computers running Windows NT 4.0 or Windows 9x. See Chapter 1 for information on using scripts or command-line tools for applying templates to these computers.


Troubleshooting IPSec

In Chapter 3, "Implementing and Managing Security for Network Communications," we presented the various means by which you can plan, configure, and deploy IPSec to secure communications between computers and networks. Like any other aspect of network computing, things can and do go wrong with IPSec. Here we show you how to monitor and troubleshoot the application of IPSec.

Remember that general troubleshooting principles apply to IPSec troubleshooting as well. Check the Event Viewer logs for errors related to IPSec and network problems. Ensure that network connectivity is functioning and that remote computers are online. Also look for errors logged in the various files contained in the %systemroot%\Security\Logs folder.

Monitoring IPSec Policies by Using IP Security Monitor

Windows Server 2003 provides the IP Security Monitor (Ipsecmon.msc) MMC snap-in to monitor the application of IPSec policies and verify the creation of secure channels between computers or networks. IP Security Monitor in Windows XP and Windows Server 2003 provides enhanced capabilities compared to the tool in Windows 2000, where it was provided as an executable program.

Actions that IP Security Monitor in Windows Server 2003 enables you to do include the following:

  • Monitor IPSec on local and remote computers.

  • Observe facts about active IPSec policies including their name and description, date last modified, store, path, OU, and GPO name.

  • View generic and specific filters related to main mode and quick mode IPSec operation.

  • View a large range of main mode and quick mode statistics.

  • View security associations in main mode and quick mode.

  • Customize refresh rates, and use DNS name resolution for filter and security association output.

  • Search for filters that match queries such as source and destination IP addresses or range of addresses.

To use IP Security Monitor, simply add it to a blank MMC console. Doing so creates a custom console containing the local server. You can monitor additional servers by right-clicking IP Security Monitor in the console tree and choosing Add Computer.

As shown in Figure 6.6, the IP Security Monitor snap-in displays detailed main mode and quick mode data, as well as the following information related to the active IPSec policy:

  • Policy Name— The name of the active IPSec policy.

  • Policy Description— Optional text that describes the policy. For the default policies, this is the text displayed in the details pane of the Group Policy Object Editor or Local Security Policy snap-in.

  • Policy Last Modified— The date and time the policy was last modified.

  • Policy Store— The storage location, is "Domain Store" for Active Directory policies and "Local Store" for local policies.

  • Policy Path— The LDAP path to the active IPSec policy, for Active Directory-based policies only.

  • Organizational Unit— The LDAP path to the OU, site, or domain to which the GPO containing the policy is linked.

  • Group Policy Object Name— The name of the GPO to which the policy is applied.

Figure 6.6. Active policy statistics as displayed by IP Security Monitor.

IP Security Monitor provides the following main mode and quick mode data:

  • Generic Filters— Details about generic filters specified in the policy. Double-click a filter to see additional information about that filter.

  • Specific Filters— Details about specific filters.

  • IKE Policies— For main mode only, details about Internet Key Exchange (IKE) policies. Double-click a policy to see additional information.

  • Negotiation Policies— For quick mode only, details about policies applied to security negotiation.

  • Statistics— Detailed statistical information about policy application.

  • Security Associations— Information about the combinations of negotiated keys, security protocols, and security parameters indexes that define the security rules defined in the policy. Double-click a security association for additional information.

You can run the IP Security Monitor snap-in on computers running Windows Server 2003 or Windows XP Professional only. If you try to run this snap-in on a Windows 2000 computer, you will receive the error The IPSec server is unavailable or incompatible with the IPSec monitor.

The following are some of the problems that the IP Security Monitor can help you to diagnose:

  • Security policy fails to apply— On selecting the Active Policy node, you might see a different policy than what you expect, or you might see Policy Not Assigned. The Policy Store entry will inform you whether a local or domain policy is in effect. You should check communication with the domain controller. Use of RSoP, discussed earlier in this chapter, will provide you with the sequence of GPO application. The Error Information tab of the Computer Configuration Properties dialog box and the Application log in Event Viewer will provide additional information related to non-application of a policy.

    To run RSoP rapidly in logging mode for the current computer and user, type rsop.msc at the Run dialog box. This starts the logging mode query without the need for additional input.

  • A Bad SPI error message appears in Event Viewer— SPI is the Security Parameters Index. You might encounter this error if a key lifetime value is set too low, or if the IPSec security association (SA) has expired. IP Security Monitor informs you of the number of rekeys. If this number is high compared to the active connection time, configure the key lifetimes in the policy to be larger. See Windows Server Help for more information.

  • Delays in establishing communication between servers— You might see the message Negotiating IP Security when pinging a server that uses the Secure Server policy. Check the statistics available in the IP Security Monitor console for information that will help you in resolving this problem.

Configuring IPSec Logging

Windows XP and Windows Server 2003 record IPSec policy agent events in the security log. IKE events are recorded in the Oakley log, and IPSec driver events are logged to the system log.

Oakley Logs

The Oakley log tracks events related to IKE negotiations, and is recorded in the %systemroot%\Debug\Oakley.log file. This log records Internet Security Association Key Management Protocol (ISAKMP) main mode and quick mode negotiations. Perform the following procedure to enable Oakley logging:

  1. Set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley\EnableLogging DWORD Registry value to 1. You might need to create the Oakley Registry key.

  2. Stop and restart the IPSec service by typing net stop policyagent and net start policyagent at the command prompt.

Each time you restart the IPSec service, the previous Oakley.log file is saved as Oakley.log.sav. When the current log file becomes full (a maximum of 50,000 lines), the file is saved as Oakley.log.bak, and a new Oakley log file is created.

You can also audit IKE and policy change events, and display these events in the security log. Simply configure the auditing of logon and policy change events for success and failure. See Figure 6.7.

Figure 6.7. Configuring the auditing of IKE and policy change events.

Know which types of actions to audit for different scenarios. The exam will present a drag-and-drop interface in which you must select success and failure actions to achieve a given objective.

IPSec Driver Logging

IPSec logs certain events in the Event Viewer system log. This includes IPSec driver inbound and outbound packet dropping. It also includes bad SPI packets, IKE negotiation failures, IPSec processing failures, packets received with invalid packet syntax, and unauthenticated hashes. You can enable packet event logging for IPSec drivers by editing the Registry or using the Netsh command-line utility.

Editing the Registry

Set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\EnableDiagnostics DWORD value to 7. You can also change the interval for writing IPSec driver packet logging events by setting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\LogInterval DWORD value to the number of seconds (minimum of 60 seconds). If this interval is not configured, it is set to one hour by default.

Use of the Netsh Utility

On a Windows Server 2003 computer, type the following command at the command prompt and then restart the computer:

netsh ipsec dynamic set config ipsecdiagnostics 7

To modify the interval for writing IPSec driver packet logging events, type the following command and then restart the computer:

netsh ipsec dynamic set config ipsecloginterval <time>

Where <time> is the required interval in seconds (minimum 60).

The numeric value specified in the netsh command or the Registry Editor defines the type of events that are logged in IPSec driver logging. A value of 2 logs inbound per-packet drop events, a value of 4 logs outbound per-packet drop events, and a value of 1 logs all other events mentioned in this section. Values of 3, 5, 6, or 7 log the combination of event types represented by the sum of the previous values.

Ensure that the system log has adequate space to audit these events, because the log can fill rapidly. Microsoft suggests a size of at least 10MB. You should also save the existing log to a file and clear all past events. You should also not use IPSec driver logging for an extended period of time.

Another useful logging tool for IPSec is Network Monitor. You can use this tool to log the functioning of IPSec SA negotiations relative to other traffic on the network. This can be useful if you suspect that IPSec traffic is overburdening the network.

Troubleshooting IPSec Across Networks

Various problems can cause IPSec-secured communications across networks to fail, or for communications to not be secured. In this section, we look at some of the more common problems.

Network Address Translation

As mentioned in Chapter 3, IPSec can work through Network Address Translation (NAT) provided the NAT is configured to allow UDP traffic.

Problems with the use of NAT and IPSec together arise from the fact that NAT modifies the packet source and destination headers, causing IPSec to think that the packets have been improperly modified. In addition, IKE can generate IP fragments that can be improperly interpreted as a sign of an attack and therefore be discarded. As a result, IPSec cannot be used to secure traffic across a Windows 2000 or older NAT device. Windows Server 2003 NAT devices support a new feature in NAT called IPSec NAT Transversal (NAT-T), which allows traffic to be secured by IPSec while also being translated by a NAT device.

You should upgrade any such devices to Windows Server 2003 or use any other device that supports the NAT-T version of IPSec. In addition, Microsoft provides an L2TP/IPSec virtual private network (VPN) client software that provides support for crossing a NAT device. This client is available from www.microsoft.com/windows2000/downloads/tools.

You should also ensure that the Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS) service is started on the server that is to function as a NAT device. NAT will not function if this service is not running. This service is disabled by default.

Port Filters and Protocol Filters

We discussed the use of the IP Filter Wizard to create multiple filters on ports, IP addresses, and protocols in Chapter 3. As mentioned, these filters can sometimes cause unexpected results, including failure to communicate or unsecured communication taking place. Here we look at some of these results and how you can troubleshoot them.

If communications fail between IPSec-enabled computers, or communications succeed in cases where they should be blocked, use the IP Security Monitor, discussed earlier in this chapter, to view the generic and specific filters that are deployed in both main mode and quick mode. This tool allows you to search for all matches to a filter of a certain traffic type. It provides information that can assist you in editing filter actions to permit expected communications or block communications that should not be allowed to take place.

The following list will assist you in dealing with filter-related communication problems:

  1. Is the filter enabled in the policy? Ensure that the check box next to the filter on the IP filter list on the Rules tab of the policy's Properties dialog box is selected.

  2. Is the correct IP filter in use? The IP Filter List tab of the Edit Rule Properties dialog box lists all filters that have been configured on any policy. Ensure that the correct one is selected.

  3. Are the permitted source and destination addresses and ports properly specified? It is easy to mistakenly specify these values in reversed sequence.

  4. Unsecured traffic can be sent to a secure server if the default response rule (found on the Rules tab of the security policy's Properties dialog box) is in use. To prevent this, deselect this rule and configure additional rules for secure communication.

  5. Which option have you specified on the Filter Action tab of the Edit Rule Properties dialog box for the filter action in use (see Figure 6.8)?

    • If you have specified Permit or Request Security (Optional), unsecured communication can occur in cases where you do not want this to occur. This can also happen if you have selected the Allow Unsecured Communication with Non-IPSec Aware Computers option on the Security Methods tab of a filter's Properties dialog box.

    • If you have only Windows 2000 or later computers and always want communications to be secured, ensure that you have selected Require Security.

    • If you have selected Require Security and untrusted client computers are present, communication does not occur.

    • If you need to create a custom filter action, it is better to create a new filter action by clicking the Add button on the Filter Action tab of the Edit Rule Properties dialog box, rather than editing one of the default filter actions. This way, you can return to a default action if necessary.

    Figure 6.8. Settings accessed from the Filter Action tab of the Edit Rule Properties dialog box govern the action of your IPSec filters.

  6. If you have older computers that cannot authenticate using Kerberos, have you specified another authentication method in the Connection Type tab of the Edit Rule Properties dialog box?

You might see a question or two containing a live version of the Rules tab of an IPSec policy's Properties dialog box. Make sure you know how to configure the options on this tab, including the use of the Edit button to modify filter properties.

The Windows Server 2003 Help and Support Center offers a large number of suggestions that will help you in configuring and troubleshooting IPSec filters.

When problems with IPSec filters are blocking communications, you may want to exempt all broadcast, multicast, IKE, Kerberos, and Resource Reservation Protocol (RSVP) traffic from IPSec filtering. These traffic types are exempted from IPSec filtering in Windows 2000 and Windows XP by default, but only IKE traffic is exempted in Windows Server 2003. To configure the Windows 2000/XP filtering behavior, execute the following command and then restart your computer:

netsh ipsec dynamic set config ipsecexempt 0

To restore the Windows Server 2003 behavior, repeat this command with a value of 1 and restart the computer.

This action increases the risk of attack on your network. You should use this action only on a low-risk network, or for as long as required to troubleshoot filter actions.

Firewalls and Routers

A Windows Server 2003 computer running Internet Security and Acceleration (ISA) Server can function as a network address translator, and can use IPSec to secure traffic to other computers on the internal network. You need to configure the IPSec policy on the ISA server to secure traffic to the IP address of the internal servers and configure IPSec policies on the internal servers to secure traffic to the external IP address of the ISA Server computer.

If IPSec problems occur across firewalls and routers, you can use the Oakley log discussed earlier in this chapter to obtain details about the IPSec security association negotiation process. You can also use Network Monitor to observe traffic being sent during the authentication and data transfer processes. Verify that the firewall allows the forwarding of L2TP/IPSec traffic.

If you are using preshared keys as a means of authenticating IPSec across a VPN, you can use the Connection Manager Administration Kit (CMAK) to configure a connection that includes a preshared key.

Troubleshooting IPSec Certificates

As mentioned in Chapter 3, certificates are one of three ways you can authenticate users and computers in IPSec. This authentication method is most useful in cases where your communications take place outside the boundaries of your Active Directory domain. It is also used for authenticating Windows NT, 98, and Me computers, which cannot use Kerberos.

Automatic Requests for IPSec Certificates

A problem may arise if the certificate template is not available when you have created a GPO specifying an automatic IPSec certificate request policy. Although this policy is in effect, computers cannot receive a certificate until the certificate template has been created.

You can resolve this problem by issuing the IPSec certificate template at the enterprise certification authority (CA). See Chapter 5, "Planning, Configuring, and Troubleshooting PKI" for details on issuing certificate templates.

Enterprise Trust Policies

You can define enterprise trust policies in Group Policy to control the purpose and validity of certificates issued by external certification authorities (CAs). Windows provides the Certificate Trust List Wizard to create or modify certificate trust lists in the Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Enterprise Trust node of the Group Policy Object Editor.

Enterprise Trust Policy is useful for creating certificate trust lists that establish your company's trust of external root CAs. You can use GPOs that are linked to different Active Directory containers for establishing different enterprise trust policies for different segments of your company as required.

When troubleshooting enterprise trust policies, RsoP, as discussed earlier in this chapter, is useful for determining which enterprise trust policy has applied in any given circumstance. You can use RSoP in planning mode to test the effect of configuring new enterprise trust policies, or in logging mode to troubleshoot policy application problems.

Checking Certificate Revocation Lists

As we discussed in Chapter 5, certificate revocation list (CRL) checking is performed to ensure that any type of certificate is still valid. By default, Windows XP and Windows Server 2003 check the CRL during authentication, but only fail the validation if the CRL explicitly indicates a revoked certificate. This validation check ignores other problems including an unavailable CRL. You can use the Netsh utility or edit the Registry to specify strong CRL checking, which requires a completely successful CRL check to accept a certificate. Perform the following procedure:

  1. At a command prompt, type netsh ipsec dynamic set config strongcrlcheck value=2.

  2. Stop and restart the IPSec service by typing net stop policyagent and net start policyagent at the command prompt, or restart the computer.

You can also disable IPSec CRL checking by specifying a value of 0 in this command, or reset the CRL checking level to its default by specifying a value of 1.

You can perform the same procedure by setting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley\StrongCRLCheck DWORD value to 0, 1, or 2 as specified here.

A delay can occur from the time that an updated CRL is published to the time that the computer performing an IPSec CRL check retrieves the CRL. Consequently, CRL checking does not guarantee that certificate validation fails immediately after a certificate has been revoked. Use the value of 2 above to cause authentication to fail if the computer cannot retrieve a CRL immediately.


Exam Prep Questions

Question 1

You are a security engineer for a company that operates a single domain Active Directory network with two sites representing offices in New York and Chicago. You have configured a GPO that specifies security template settings intended to secure member servers and domain controllers in the Chicago site.

After completing configuration of the GPO, you realize that security settings have not been applied, so you decide to use RSoP to check policy application. Which of the following should you do?

  • A. Run a planning mode query from Active Directory Sites and Services.

  • B. Run a logging mode query from Active Directory Sites and Services.

  • C. Run a planning mode query from Active Directory Users and Computers.

  • D. Run a logging mode query from Active Directory Users and Computers.

A1:

Answer D is correct. You can use RSoP logging mode to determine whether another policy (such as one linked to the domain or to an OU) is overwriting the settings you have configured. RSoP in planning mode is used to simulate proposed settings and not troubleshoot applied settings; therefore, answers A and C are incorrect. It is not possible to run a logging mode query on a site from Active Directory Sites and Services; therefore, answer B is incorrect.

Question 2

After applying a security template to your company's servers, you notice that the settings have not taken effect despite forcing a reapplication of Group Policy. Checking the event logs at two of the servers, you notice that a series of events with event IDs 1000 and 1001 are present. Which of the following problems may be occurring? (Choose all that apply.)

  • A. The servers are unable to contact the domain controller for the list of applicable GPOs.

  • B. The GPT files are corrupted.

  • C. Active Directory replication has failed.

  • D. One or more folders in the SYSVOL share is missing or corrupted.

A2:

Answers B and C are correct. These are two possible reasons for the appearance of 1000 and 1001 errors. You should use replmon or repadmin to check Group Policy replication, and check the integrity of GPT files. If the servers were unable to contact the domain controller to receive GPOs, or if folders in SYSVOL were missing or corrupted, you would receive a 1030 or 1058 error; therefore, answers A and D are incorrect.

Question 3

You are a security engineer responsible for ensuring that security policies are applied properly across all 500 desktops in your company's domain. You have applied a security template by means of a GPO, and now want to use a script to automate the testing of policy application across the domain. Which tool should you use?

  • A. Gpresult

  • B. RSoP planning mode

  • C. RSoP logging mode

  • D. Secedit

A3:

Answer A is correct. Gpresult is a command-line version of RSoP that performs nearly all its functions, and is suitable for inclusion in scripts. You cannot use RSoP in either mode in a script; therefore, answers B and C are incorrect. Secedit analyzes and configures system security but does not test security policy application; therefore, answer D is incorrect.

Question 4

Kate is a security engineer for a company that runs an Active Directory domain that has three Windows Server 2003 domain controllers and two Windows NT 4.0 domain controllers. Knowing that highly secure templates prevent nearly all communication with the Windows NT servers, she configures a domain-based policy that specifies the Securedc.inf and Securews.inf templates for servers and client computers. Which two of the following problems can still occur when using this template?

  • A. The Windows NT 4.0 domain controllers cannot authenticate users logging on to client computers.

  • B. Client computers cannot communicate with computers running Windows NT 4.0 unless they run Service Pack 4 or higher.

  • C. Kate needs to upgrade all other domain controllers in trusted or trusting domains to Windows 2000 or higher.

  • D. Client computers cannot communicate with servers running Windows 2000 or Windows NT Service Pack 4 or higher if the time on the computers differs by more than 30 minutes from each other.

A4:

Answers B and D are correct. These two problems can still occur when using the Secure*.inf templates. The other two problems can occur when using the Hisec*.inf templates but not with the Secure*.inf templates; therefore, answers A and C are incorrect.

Question 5

Robert is a security engineer for a company that has recently upgraded its Windows NT 4.0 domain to Windows Server 2003. He has used a security template to configure file and folder permissions on these servers, including an upgraded file server containing highly confidential information that should only be accessible to managers.

Robert notices that several clerical users have accessed this information and even modified it on one occasion. Which of the following solutions should he employ to correct this problem? (Choose three.)

  • A. Modify the security template to protect the confidential folders.

  • B. Configure an additional security template to apply the appropriate security settings.

  • C. Manually set a Deny entry on the ACL of each affected folder.

  • D. Select the Propagate Inheritable Permissions to all Subfolders and Files option when configuring permissions on the File System subnode of the security template.

  • E. Select the Replace Existing Permissions on All Subfolders and Files With Inheritable Permissions option when configuring permissions on the File System subnode of the security template.

A5:

Answers A, B, and E are correct. These are all possible solutions to Robert's problem. The best solution is determined by other factors not mentioned in this question. Robert should not use Deny entries except as a last resort because this method takes more administrative effort and is subject to additional problems; therefore, answer C is incorrect. The option specified in answer D causes child objects to inherit the parent object's security and does not alleviate this problem, so this answer is incorrect.

Question 6

You are troubleshooting a Windows XP Professional computer that is failing to apply domain IP security policy, and notice that a Bad SPI error message is present in the Event Viewer logs. Which of the following tools should you use to determine the number of packets with an incorrect Security Parameters Index (SPI) that have been received since the computer was last restarted?

  • A. Resultant Set of Policy (RSoP)

  • B. IP Security Monitor (Ipsecmon.msc)

  • C. Oakley logging

  • D. Performance Console

A6:

Answer B is correct. This message informs you of the number of packets with an incorrect SPI that have been received since the last system restart. RSoP provides details about GPO application but not SPI statistics, and Oakley logging provides information about IKE events. These tools do not provide information about bad SPI packets; therefore, answers A and C are incorrect. Although Performance Console provides a large number of statistics related to computer and network performance, bad SPI packets are not included; therefore, answer D is incorrect.

Question 7

Which two of the following actions should you audit in order to display events related to IKE and policy agent events in the Event Viewer security log?

  • A. Account logon events

  • B. Account management events

  • C. Logon events

  • D. Object access events

  • E. Policy change events

  • F. System events

A7:

Answers C and E are correct. You should audit logon events and policy change events to display all events related to IKE and policy agent actions. The other event types do not provide information related to these actions; therefore, answers A, B, D, and F are incorrect. Expect to find at least one question in which you must select success and/or failure auditing for the proper types of events.

Question 8

You have configured a tunnel mode IPSec policy to secure traffic between your company's downtown and suburban offices. The suburban office is using a Windows 2000 server as a Network Address Translation (NAT) device so that client computers can access resources in the downtown office.

Users report that they are no longer able to communicate with servers at the downtown office. Which of the following should you do?

  • A. Upgrade the NAT server to Windows Server 2003.

  • B. Upgrade all suburban office computers to Windows XP Professional.

  • C. Change the IPSec policy from tunnel mode to transport mode.

  • D. Use the secedit command to reapply the IPSec policy to suburban office computers.

A8:

Answer A is correct. Because of the way NAT works in Windows 2000, IPSec believes that packets sent across the NAT device have been tampered with and discards them. A new feature of Windows Server 2003, IPSec NAT Transversal, allows IPSec and NAT to work together, so you should upgrade the NAT server to Windows Server 2003. None of the other answers provide a solution to this problem; therefore, answers B, C, and D are incorrect.

Question 9

Karen has configured a Windows Server 2003 computer on her network to require secured traffic between this server and other computers. However, she discovers that unsecured traffic is being sent to this computer from one client computer on the network. What should she do to prevent this unsecured traffic?

  • A. Select the Require Security option on the Filter Action tab of the Edit Rule Properties dialog box for the security policy in use.

  • B. Select the Request Security option on the Filter Action tab of the Edit Rule Properties dialog box for the security policy in use.

  • C. Remove the default response rule from the available filter actions at the server.

  • D. Remove the default response rule from the available filter actions at the client computer.

A9:

Answer D is correct. Unsecured traffic can be sent to a secure server if the default response rule is in use. Karen should deselect this rule and configure additional rules for secure communication. Answer A is incorrect because the Require Security option allows initial incoming unsecured communications (initial passthrough); the recipient attempts to negotiate security with the sender of the unsecured communication, and does not send an outbound communication if it cannot negotiate security. This option does not communicate with untrusted clients. Answer B is incorrect because the Request Security option also accepts unsecured communications and can communicate insecurely to untrusted clients if they do not respond to the security request. Answer C is incorrect because this action should be done at the client computer and not the server.

Question 10

You have configured an IPSec policy to use certificates for authentication at a remote access service (RAS) server. After revoking a certificate from an employee who has resigned, you discover that her certificate is still being accepted for secured communications. Which two of the following actions should you perform?

  • A. Use the netsh command to specify strong certificate revocation list (CRL) checking.

  • B. Remove the default response rule from the available filter actions at the RAS server.

  • C. Configure the certificate server to issue delta CRLs hourly.

  • D. Stop and restart the IPSec service at the RAS server.

  • E. Stop and restart the certificate services at the certificate server.

A10:

Answers A and D are correct. You can ensure that a complete certificate validation check takes place by executing the netsh ipsec dynamic set config strongcrlcheck value=2 command, and then stopping and restarting the IPSec service. Removing the default response rule does not change the manner in which the CRL is checked; therefore, answer B is incorrect. More frequent issuing of delta CRLs does not help because the CRL may not have been available at the RAS server. Under default conditions, the RAS server can still accept a certificate without the CRL being available; therefore, answer C is incorrect. Restarting the certificate service does not help; therefore, answer E is incorrect.


Chapter 7. Planning and Implementing Security for Wireless Networks

Terms you'll need to understand:

  • Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards

  • Service set identifier (SSID)

  • Wired equivalent privacy (WEP)

  • Remote Authentication Dial-in User Service (RADIUS)

  • Internet Authentication Service (IAS)

  • Protected Extensible Authentication Protocol (PEAP)

  • Open-system authentication

  • Shared-key authentication

  • 802.1x authentication

  • Secure Sockets Layer (SSL)

  • Enhanced Key Usage (EKU)

  • Wireless Zero Configuration

Techniques you'll need to master:

  • Configuring Group Policy wireless network settings

  • Configuring an IAS server to control wireless access

  • Configuring an IAS server for certificate use

  • Configuring wireless encryption using 802.1x or WEP

  • Configuring Windows XP and Windows 2000 client computers for wireless access

The recent advances in wireless networking technology have enabled individuals to connect to networks from virtually any place a wireless access point is available. Many offices are taking advantage of the easy setup of wireless LANs (WLANs), which allow for mobility and portability of computers and other devices located within the office. And public access points in locations such as restaurants and airports permit users to send and receive data from many places that would have been unthought of not too many years ago. Along with this convenience comes an increased chance of unauthorized access to the networks and the data they contain. This chapter gives you an understanding of the basic principles surrounding wireless networking security.

Wireless networks commonly operate according to the specifications of the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards, which are defined at the Data Link layer of the Open Systems Interconnection (OSI) model. Table 7.1 summarizes the specifications of the three common 802.11 standards.

Table 7.1. Common 802.11 Specifications

Property

802.11b

802.11a

802.11g

Radio frequency

2.4GHz

5.0GHz

2.4GHz

Maximum bandwidth

11Mbps

54Mbps

54Mbps

Transmission technique

Direct sequence spread spectrum

Orthogonal Frequency Division Multiplexing

Orthogonal Frequency Division Multiplexing

Media Access Control (MAC) protocol

Carrier-sense multiple access with collision avoidance (CSMA/CA)

CSMA/CA

CSMA/CA

Although devices that support the 802.11a standard are generally incompatible with those that support 802.11b, some devices are equipped to support either 802.11a or 802.11b. The newest standard, 802.11g, extends the older 802.11b standard to the 54Mbps rate and allows 802.11b and 802.11g devices to operate together on the same network. This standard was created specifically for backward compatibility with the 802.11b standard.

When planning and configuring security for wireless networks, you need to emphasize two items in particular: authentication and encryption. This chapter deals mainly with these topics and also looks at the use of certificates and the configuration of wireless support on client computers.


Planning the Authentication Methods for a Wireless Network

Any wireless device that is located within range of your access point can theoretically connect to your network. Such a connection can even come from outside the building; hence the popular term "war driving," in which a person in a car scouts around for any available wireless access point that he might use to initiate some type of attack. Consequently, you need to ensure that secure authentication policies that permit only authorized users to connect to your WLAN are in effect.

Authentication on a wireless network is not user authentication but device authentication. This first stage of authentication proves that the device is authorized to connect to the network; then the user can be authenticated in the same way that she would when accessing a wired LAN. The following three means of wireless authentication are currently used:

  • Open authentication— Allows access according to anyone providing the correct service set identifier (SSID) or wired equivalent privacy (WEP) key for the access point. This method provides only minimum protection and should be used with an additional protection mechanism.

  • Shared-key authentication— Similar to a challenge-response authentication process, in this method, the client sends a request for access to the access point, which returns a challenge. The client returns an encrypted response. This method is vulnerable to an intruder intercepting the challenge and response signals. It is also known as shared-secret authentication, because the client computer needs only this shared secret to authenticate.

  • 802.1x authentication standard— Uses Extensible Authentication Protocol (EAP) to integrate with the authenticating server, such as a Remote Authentication Dial-in User Service (RADIUS) server. EAP provides an open-ended conversation between a wireless client computer and the RADIUS server. In its basic form, this method provides a secure authentication of the client; however, it is vulnerable to a man-in-the-middle attack, in which an attacker intercepts the authentication data and gains unauthorized access. You can provide the highest level of security by utilizing a version of EAP that provides mutual authentication, such as EAP-MS-CHAPv2, EAP-TLS, or EAP-MD5. We discussed remote access authentication methods in Chapter 4, "Planning and Configuring Authentication and Authorization for Remote Access Users."

Windows Server 2003 uses the 802.1x standard for authenticating access to wired Ethernet networks and wireless 802.11 networks. It provides support for EAP used in conjunction with several different authentication methods for wireless computers:

  • EAP-TLS— Uses certificate-based mutual authentication, negotiation of the encryption method, and encrypted key determination between the client and the authenticating server.

  • EAP-MS-CHAPv2— Provides mutual password-based user and computer authentication. Both server and client must prove knowledge of the user's password for successful authentication.

  • Protected EAP (PEAP)— Provides several additional benefits within TLS, including an encrypted authentication channel, dynamic keying material from TLS, fast reconnect using cached session keys, and server authentication that protects against the setup of unauthorized access points. You can use PEAP along with EAP-TLS, EAP-MS-CHAPv2, and non-Microsoft EAP authentication methods; however, PEAP is not supported for use with EAP-MD5. As well as providing encrypted authentication, PEAP creates a session key that is used to derive data encryption keys that protect data being sent between the client and the access point during the session.

PEAP and Fast Reconnection

The fast reconnect capability of PEAP allows roaming users to maintain their connections when moving between different access points on the same network, as long as each access point is configured as a client of the same RADIUS server and fast reconnect is configured on both the client and the server. Fast reconnect caches the TLS session key with the credentials (when using PEAP with EAP-MS-CHAPv2) or the PIN (when using PEAP with smart cards) to enable reauthentication upon reconnection. This reduces time delays and resource requirements associated with the reconnection.

If a user moves to an access point that does not use the original RADIUS server, he must reauthenticate with his credentials or PIN. The client can cache TLS session keys for more than one RADIUS server.

When planning wireless authentication methods, you need to balance the required level of security with the ease of deployment. PEAP with EAP-MS-CHAPv2 requires less effort to deploy because you do not need certificates or smart cards. On the other hand, PEAP with EAP-TLS provides the highest level of security because of the use of certificates and smart cards. In both cases, the end-to-end encrypted channel created by PEAP reduces the chance of offline dictionary attacks during authentication.


Planning the Encryption Methods for a Wireless Network

When a user is authenticated to the network, she has access to all data on the network that would normally be available from a regular wired connection. At the same time, an attacker could intercept the transmissions and gain possession of the data. Consequently, encryption of data traveling across the wireless network is of paramount importance.

Wired Equivalent Privacy (WEP)

WEP is the most basic form of encryption that can be used on 802.11-based wireless networks to provide privacy of data sent between a wireless client and its access point. It uses a symmetric cryptography system known as RC4 with a standard 40-bit key, or in some cases, a 104-bit key to protect data against unauthorized access. You can configure the key that WEP uses in Windows XP and Windows Server 2003. Although utilities exist that can crack WEP encryption, you can still provide a moderate level of security by using WEP, particularly if you change the encryption keys frequently.

WEP can work with either open-system or shared-key authentication. We discussed these two authentication methods in the last section. You should only use WEP in cases where only minimal security is required, or if your hardware or software do not support 802.1x.

802.1x

802.1x provides port-based network access control for a stronger level of authentication and encryption of data compared to WEP. We already discussed how 802.1x provides authentication services to clients (supplicants) requesting network access.

802.1x works along with EAP-MS-CHAPv2, EAP-TLS, or EAP-MD5 as already discussed to provide data encryption after a client has been authenticated to the wireless network.

You should use 802.1x encryption wherever possible. We discuss the configuration of servers and client computers for the use of 802.1x later in this chapter.

Use of IPSec with Wireless Networks

We discussed the use of IPSec in detail in Chapter 3, "Implementing and Managing Security for Network Communications." IPSec by itself does not control access to a WLAN, but you can use it on the wired portion of the network to provide a complete security solution for data transmitted across the network. However, you can use IPSec in conjunction with 802.1x to provide security for data being sent to client computers that are roaming between access points on the same network. You should segment the wireless network by placing a firewall between the WLAN and the remainder of the network.

You can use IPSec to provide strong security between a RADIUS server and a domain controller, if these services are not provided on the same machine. You can also use IPSec to secure traffic to a partner organization's RADIUS servers where this capability is needed.


Planning and Configuring Wireless Access Policies

You have seen how authentication and encryption form the cornerstones of securing your wireless network. Group Policy in Windows Server 2003 enables you to create access policies that control the use of your wireless network. You can also create a remote access policy using a RADIUS server, such as the Microsoft Internet Authentication Service (IAS) server. When planning an access policy, consider factors such as the following:

  • Users, groups, and computers allowed to access the WLAN— You can control who has access to the WLAN and from where. You can also specify user account dial-in properties and whether unauthenticated access is permitted.

  • Domains and organizational units (OUs)— You can create policies in different Group Policy objects (GPOs) and link them to sites, domains, and OUs as required.

  • Where and when users can access the WLAN— You can define which resources users can wirelessly access, as well as the time of day when access is permitted.

  • Authentication methods— We already described the authentication methods you can use on your WLAN.

  • Software settings— WLAN security requires the configuration of IAS-based network policy and Group Policy. We discuss these briefly in this section.

  • The type of network security to be used— Do you need to use WEP, IPSec, or 802.1x encryption? Will you use IAS as a central authentication point? Using an IAS server allows you to configure a common wireless access policy for all users, regardless of the access point to which they connect.

You should create a wireless access policy that matches your company's security policies while granting users the level of access needed to perform their duties. Create the minimum number of policies needed to achieve a goal that allows for flexible and simple management of network access. Remote access policies can contain criteria similar to those specified in the preceding list.

Creating a Wireless Access Policy in Group Policy

New to Windows Server 2003 is the ability to create a wireless network policy in Group Policy. Windows provides the Wireless Network Policy Wizard to help you create your policy. Perform the following steps to create a wireless policy:

  1. In Active Directory Users and Computers, right-click the appropriate Active Directory container (domain or OU), and choose Properties.

  2. On the Group Policy tab of the domain's or OU's Properties dialog box, select the appropriate GPO and click Edit to open the Group Policy Object Editor.

  3. Right-click the Computer Configuration\Windows Settings\Security Settings\Wireless Network (IEEE 802.11) Policy node and choose Create Wireless Network policy.

  4. Click Next, and on the Wireless Network Policy Name page of the wizard, type a name and optional description for your policy.

  5. Click Next. Ensure that Edit Properties is selected, and then click Finish.

  6. On the General tab of the Properties dialog box that opens, configure the following properties as required (see Figure 7.1):

    • Check for Policy Changes Every— Controls the interval that clients check for policy changes. The default is 180 minutes.

    • Networks to Access— You can select the type of networks the wireless clients can access. Options are access point (infrastructure), which are wired LANs accessed from a wireless access point; computer-to-computer (ad hoc), which are wireless connections directly between computers that only allow access to the computer to which you are connected; and any available network, which includes both these network types.

    • Use Windows to Configure Wireless Network Settings for Clients— Allows clients to use Windows to configure their own wireless network settings.

    • Automatically Connect to Non-preferred Networks— Enables clients to connect to networks that are not specified as preferred networks on the Preferred Networks tab. You should leave this check box cleared for maximum security.

    Figure 7.1. Configuring a wireless network policy.

  7. Use the Preferred Networks tab of this dialog box to specify the available networks that clients can access. You can configure network properties including encryption type from this location.

Using IAS Server to Control Wireless Access

As we already mentioned, IAS server is Microsoft's implementation of RADIUS and allows you to control authentication of users accessing multiple access points by means of a single server. The deployment of IAS to control wireless access includes the following steps:

  1. Install IAS on a Windows Server 2003 computer. You can install IAS from the Windows Components Wizard by selecting it as a component of Networking Services.

  2. Obtain a computer certificate from a certification authority (CA) for the IAS server. We discussed certificates in Chapter 5, "Planning, Configuring, and Troubleshooting PKI."

  3. Register the IAS server in Active Directory. To do this, right-click Internet Authentication Service in the details pane of the IAS snap-in and choose Register Server in Active Directory. Click OK in the dialog box that opens.

  4. Configure each wireless access point as a RADIUS client in the IAS snap-in. We discuss the procedure for doing this next.

  5. Create a remote access policy as described later in this section.

  6. Configure client computers for PEAP or other authentication. We discuss client computer configuration in a later section of this chapter.

Install IAS on a domain controller rather than a member server. This allows the IAS server to directly authenticate a user in Active Directory without needing to cross the network to a domain controller.

To configure each wireless access point as a RADIUS client, perform the following steps:

  1. Open the IAS snap-in from the Administrative Tools folder.

  2. In the console tree, right-click RADIUS clients and choose New RADIUS Client.

  3. In the New RADIUS Client dialog box, type the name and IP address of the client, and then click Next.

  4. Select the appropriate client vendor, type and confirm a shared secret, and then click Finish.

Perform the following steps to create a wireless remote access policy in IAS:

  1. In the details pane of the IAS snap-in, right-click Remote Access Policies and select Create New Remote Access Policy.

  2. Click Next, and then type a descriptive name for the policy.

  3. On the Access Method page, select Wireless.

  4. On the User or Group Access page, make an appropriate selection. Normally, you should grant access to a group. Click Add to specify the group name.

  5. On the Authentication Methods page, select either Protected EAP or Smart Card or Other Certificate as appropriate. Then click Configure to specify the certificate that the server will use to identify itself to callers (see Figure 7.2).

    Figure 7.2. Configuring IAS for wireless access and certificates.

  6. Click Next, and then click Finish to complete the wizard.

As with other remote access policies, you can specify additional criteria for acceptance or rejection of connection attempts in the profile associated with each access policy. Right-click the policy in the details pane of the IAS snap-in and choose Properties to access the dialog box shown in Figure 7.3. Click Add to add additional policy conditions, or click Edit Profile to specify additional conditions in the profile associated with the policy.

Figure 7.3. Specifying criteria to be met by wireless clients.

If you need additional information about installing and configuring IAS as well as configuring remote access policies, consult the Exam Cram 2 or the Que Training Guide for exam 70-291, "Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure."


Configuring SSL Certificates for Wireless Networks

Earlier in this chapter you saw how to use EAP-TLS for secure authentication and encryption on wireless networks. TLS uses Secure Sockets Layer (SSL) certificates to control machine logon and user logon. In fact, TLS is actually version 3.1 of SSL (the common version of SSL is 3.0). You can achieve the following security benefits by using either version of SSL on regular or wireless networks:

  • Mutual authentication— Validates the identity of both the server and client computers by means of their certificates.

  • Communication privacy— Encrypts all information sent between the server and client computers.

  • Communication integrity— Ensures that information sent between the server and client computers has not been altered in transit.

Certificates and Certificate Templates

In Chapter 5, you found out how to install and configure CAs for issuing certificates. We presented the procedure for configuring SSL to secure communication channels in Chapter 4. Recall from Chapter 5 that you create certificates by requesting them from the certificate server, and that you configure the certificate server to issue certificates based on those certificate templates that you have enabled the server to issue. As shown in Figure 7.4, the intended purposes of each certificate template appear in the details pane of the Certification Authority snap-in. These purposes define the uses for which each certificate may be employed.

Figure 7.4. Displaying the certificate purposes.

[View full size image]

Both EAP-TLS and PEAP use certificates for server authentication. Users and clients may also use certificates, depending on the type of authentication specified. When EAP-TLS is configured as the authentication method for wireless clients, the IAS server certificate contains the Server Authentication purpose in the Enhanced Key Usage (EKU) extension of its certificate to identify itself to the client. The client uses a certificate from a smart card or the local certificate store to validate itself at the IAS server. The client's certificate must contain the Client Authentication purpose in the EKU extension. If PEAP is being used with EAP-MS-CHAPv2, the mutual authentication process is similar except that the user employs a username and password.

To determine whether a certificate contains the appropriate purposes in the EKU extension, double-click the certificate in the details pane of the Certificates snap-in. On the Details tab of the dialog box that opens, scroll to locate the EKU extension and double-click this extension. The lower panel of the dialog box shows the purposes assigned to the certificate, as shown in Figure 7.4.

In version 1 certificate templates, certificate purposes under Enhanced Key Usage are hard-coded and cannot be modified (recall that version 1 templates are read-only). When configuring an SSL certificate for wireless networks, you must create this certificate from a template that includes these extensions, as shown in Figure 7.5.

Figure 7.5. The Computer version 1 certificate template contains the Client Authentication and Server Authentication purposes.

In the case of a version 2 template, the Enhanced Key Usage extension is known as Application Policies. As shown in Figure 7.6, the RAS and IAS Server version 2 certificate template already contains these purposes. If necessary, you can click the Edit button to add additional purposes. You then click Add to display the Add Application Policy dialog box, from which you can select any of almost 30 additional certificate purposes or create a new purpose.

Figure 7.6. You can edit a version 2 certificate template if it does not contain the required purposes.

Remember that you can duplicate a version 1 certificate template to obtain a version 2 copy. You can then add certificate purposes to the copied template as necessary. Also remember that only client computers running Windows XP or Windows Server 2003 can use version 2 templates. Version 1 templates can be used by computers running any of Windows 2000, Windows XP, or Windows Server 2003.

Configuring the IAS Server for Certificates

Configuration of the IAS server to use certificates to authenticate wireless clients is similar to any other certificate request. As described in Chapter 5, you connect to the Certificate Request Web pages at the CA server to request and install a certificate on the IAS server.

After you have obtained and installed the certificate on the IAS server, you can configure a limited number of properties from the Certificates snap-in. As shown previously in Figure 7.4, the Details tab of the Certificate dialog box provides information about the certificate and its properties. To selectively enable certificate purposes, proceed as follows:

  1. In the details pane of the Certificates snap-in, double-click the required certificate to display the Certificate dialog box.

  2. On the Details tab, click Edit Properties to display the Certificate Properties dialog box, as shown in Figure 7.7.

    Figure 7.7. Editing certificate purposes.

  3. Provide an optional friendly name and description for the certificate.

  4. To selectively enable purposes, click Enable Only the Following Purposes, deselect any purposes you do not want enabled, and then click OK. If the certificate was issued from a version 2 template, you can click Add Purpose to add additional purposes to the certificate.

You can automatically enroll users and computers for EAP-TLS or EAP-MS-CHAPv2 certificates by adding them to security groups in Active Directory Users and Computers for which the Read, Enroll, and Autoenroll permissions have been configured on the appropriate version 2 certificate templates. Note that client computers must be running either Windows XP or Windows Server 2003 to support autoenrollment. See "Implementing Wireless LAN Security Using 802.1X" in Appendix B for more information.

If you need to issue a certificate based on a version 2 template such as the RAS and IAS Server template, you must install the CA on a server running Windows Server 2003, Enterprise Edition. CAs on a server running Windows Server 2003, Standard Edition can only issue certificates based on version 1 templates.


Configuring Wireless Encryption

Earlier in this chapter we introduced you to the encryption methods used in wireless networks—WEP and 802.1x. Here we show you how to configure your servers to use these encryption methods.

WEP

WEP encrypts data across the wireless network using a network key that can be automatically provided for clients. After you have created a wireless network policy in Group Policy as described earlier in the chapter, configuration of WEP is a simple procedure:

  1. Select the network from the Preferred Networks tab of the policy's Properties dialog box (see Figure 7.1), and click Edit (or click Add to add a new wireless network).

  2. Type a name and an optional description for the wireless network in the text boxes provided.

  3. On the Network Properties tab of the Edit (network name) Properties dialog box, select the Data Encryption (WEP Enabled) check box, as shown in Figure 7.8. This check box is selected by default.

    Figure 7.8. Configuring WEP encryption.

  4. As required, select the following additional options:

    • Network Authentication (Shared Mode)— When selected, shared-key authentication is used for authentication to the wireless network. Otherwise, open-system authentication is used. We introduced these authentication methods earlier in this chapter.

    • The Key Is Provided Automatically— Automatically provides network keys for clients; for example, if you are using 802.1x for key distribution. This check box is selected by default.

    • This Is a Computer-to-Computer (Ad Hoc) Network; Wireless Access Points Are Not Used— Specifies that the preferred wireless network being configured is a computer-to-computer network without access points.

Remember that WEP alone does not protect data very well for most security needs. If available, use 128-bit WEP and change the keys frequently. Use dynamic WEP keys if possible (this requires access points that can provide them and wireless clients that can support them). Select the option The Key Is Provided Automatically to provide dynamic WEP keys.

802.1x

As already discussed, 802.1x is the recommended method of authentication and encryption for enhanced security on computers running Windows XP and Windows Server 2003. You can configure 802.1x encryption from the IEEE 802.1x tab of the Edit (network name) Properties dialog box, as shown in Figure 7.9. Table 7.2 explains the options available on this tab:

Figure 7.9. Configuring 802.1x encryption.

Table 7.2. Options Available When Configuring 802.1x Authentication and Encryption

Option

Description

Enable network access control using IEEE 802.1x

Select this option to enable 802.1x and make the other options available.

EAPOL-Start message

Determines whether Extensible Authentication Protocol over LAN (EAPOL) messages are transmitted, and how they are transmitted.

Parameters (seconds)

Parameters for transmitting the EAPOL Start message.

EAP type

Allows you to specify Smart Card or other certificate, or PEAP. Click Settings to specify the settings to be used with either EAP type.

Authenticate as guest when user or computer information is unavailable

Client computers attempt authentication to the network when user or computer information is not available.

Authenticate as computer when computer information is available

Client computers attempt authentication to the network if a user is not logged on.

Computer authentication

Specifies how the computer attempts authentication. Available options are user authentication, user re-authentication, and computer only


Installing and Configuring Wireless Support for Client Computers

Configuration of Windows client computers depends on the operating system. In this section, we review methods of configuring Windows XP/Server 2003 and Windows 2000 computers for wireless networking.

Windows XP and Windows Server 2003

Computers running Windows XP and Windows Server 2003 support Wireless Zero Configuration, which enables these computers to automatically connect to available wireless networks. You can configure additional preferences and settings manually. We discuss these methods here.

Wireless Zero Configuration

By default, Windows XP/Server 2003 client computers can choose from available wireless networks and connect automatically without the need for user action. Wireless Zero Configuration automatically configures items such as TCP/IP settings, DNS server addresses, IAS server addresses, and so on. Wireless Zero configuration also includes support for 802.1x authentication and encryption.

Wireless Zero Configuration is enabled by default on Windows XP computers. Follow these steps to modify Wireless Zero configuration settings:

  1. Open the Properties dialog box for the wireless connection in the Network Connections folder.

  2. On the Wireless Networks tab, ensure that the Use Windows to Configure My Wireless Network Settings check box is selected, as shown in Figure 7.10.

    Figure 7.10. You can enable Wireless Zero Configuration from the Wireless Networks tab of the Wireless Network Connection Properties dialog box.

  3. To modify settings for available networks, select the network and click Configure.

  4. To add new wireless networks to the list of preferred networks, click Add. Type the network name (SSID), WEP settings, and select the mode (ad hoc or infrastructure).

  5. Use the Move Up and Move Down buttons to modify the sequence of connecting to preferred networks as needed.

Never turn on Guest access on a laptop using Wireless Zero Configuration. An unauthorized user could establish an ad hoc connection to the laptop and gain access to confidential information on the laptop.

Manual Configuration in Windows XP and Windows Server 2003

You can access additional options by manually configuring Windows XP/Server 2003 computers for wireless networks. Follow these steps to manually configure EAP-TLS authentication for certificate or smart card use:

  1. Open the Properties dialog box for the wireless connection in the Network Connections folder.

  2. On the Authentication tab, select Network Access Control Using IEEE 802.1x.

  3. To use a smart card or certificate, select Smart Card or Other Certificate, and then click Properties.

  4. To use a Registry-based certificate, select Use a Certificate on This Computer; to use a smart card, select Use My Smart Card.

  5. To use a smart card that has a different name from the username of the logged-on user, click Use a Different User Name for the Connection.

  6. To ensure the validity of the certificate being used, select Validate Server Certificate. Also specify whether the computer should connect only if the server is within a specific domain, and then indicate the trusted root authority.

  7. Select Authenticate as Computer When Computer Information Is Available and/or Authenticate as Guest When Computer Information Is Unavailable, as required. We described these options in Table 7.2. (Selecting the latter option is not recommended.)

Perform the following steps to manually configure PEAP-MS-CHAPv2 on a Windows XP/Server 2003 client computer:

  1. On the Wireless Networks tab of the wireless connection's Properties dialog box, select the required network under Preferred Networks, and then click Properties.

  2. On the Authentication tab, select Enable Network Access Control Using IEEE 802.1x and Protected EAP, and then click Properties.

  3. In the Protected EAP Properties dialog box, ensure that Validate server certificate is selected. To specify the names of the authentication servers, select Connect to These Servers and type the names of the servers.

  4. In Select Authentication Method, select Secured Password (EAP-MS-CHAP v.2).

Windows 2000 and Windows CE

Computers running Windows 2000 do not support Wireless Zero Configuration. You can easily configure a wireless network card for connection using EAP-TLS or PEAP authentication using procedures similar to those described for manual configuration of Windows XP computers. For additional information, refer to "Enterprise Deployment of Secure 802.11 Networks Using Microsoft Windows" in Appendix B.

Palmtop computers running Windows CE .NET include Wireless Zero Configuration and similar manual configuration options to those found on Windows XP. They support 802.11a and Native Wireless Fidelity (Wi-Fi). Older Windows CE palmtop computers can also be configured for wireless networking. Settings and configuration are similar to those for Windows 2000.

When configuring client policies, place Windows XP computers into a separate OU. Define policies that apply only to these computers in a GPO linked to this OU, and policies that apply to Windows 2000 computers in a GPO linked to the OU in which these computers are located.

Only Windows XP computers natively support IEEE 802.1x authentication. Microsoft provides an 802.1x Authentication Client download that allows Windows 2000 computers to use the 802.1x standard. Microsoft also provides 802.1x Authentication Clients for Windows 98 and Windows NT 4.0 Workstation to customers with Premier and Alliance support contracts.


Exam Prep Questions

Question 1

You are planning authentication methods for your company's new wireless network implementation. Which of the following would you use to provide an encrypted authentication channel and fast reconnect using cached session keys?

  • A. Shared-key authentication

  • B. EAP-TLS

  • C. EAP-MS-CHAPv2

  • D. PEAP

A1:

Answer D is correct. Protected Extensible Authentication Protocol (PEAP) provides these benefits as well as several others. None of the other authentication methods provide these abilities; therefore, answers A, B, and C are incorrect.

Question 2

While planning an authentication protocol for your company's wireless network, you discover that you can use PEAP along with several other EAP-based authentication methods. Which of the following authentication methods support the use of PEAP? (Choose all that apply.)

  • A. EAP-TLS

  • B. EAP-MS-CHAP

  • C. EAP-MS-CHAPv2

  • D. EAP-MD5

  • E. Non-Microsoft EAP methods

A2:

Answers A, C, and E are correct. These EAP authentication methods all support the use of PEAP. EAP does not work with the original version of MS-CHAP; therefore, answer B is incorrect. EAP-MD5 does not support the use of PEAP; therefore, answer D is incorrect.

Question 3

You are a security engineer for a banking company. Your manager has asked you to implement a wireless encryption solution that will provide a strong level of security for financial data being transmitted across your WLAN between several banking departments. The specifications require a port-based access control method that works along with EAP-TLS and EAP-MD5 authentication methods. Which of the following should you choose?

  • A. WEP

  • B. 802.1x

  • C. EFS

  • D. IAS

A3:

Answer B is correct. 802.1x includes port-based network access control for a stronger level of authentication and data encryption. It also works along with the various EAP authentication methods. WEP does not provide these benefits; therefore, answer A is incorrect. EFS is the Encrypting File System, which is used only for securing data while stored on computers and not during data transmission; therefore, answer C is incorrect. IAS is Internet Authentication Service and is not a data encryption method; therefore, answer D is incorrect.

Question 4

Linda is a security administrator for a company that operates a Windows Server 2003 domain. She is configuring a wireless security policy in Active Directory that is designed to govern users' access to her company's WLAN. The WLAN is set up with specified access points located in different areas of her company's office building.

After implementing the policy, users report that they are unable to access the WLAN. Which two of the following (taken together) are a possible reason for this problem?

  • A. Linda has specified access to infrastructure networks only.

  • B. Linda has cleared the Use Windows to Configure Wireless Network Settings for Clients option.

  • C. Linda has cleared the Automatically Connect to Non-preferred Networks option.

  • D. Linda has not specified any wireless networks on the Preferred Networks tab of the policy's Properties dialog box.

A4:

Answers C and D are correct. The Preferred Networks tab enables Linda to specify which wireless networks client computers should preferentially access. Computers can only access networks listed on this tab unless Linda has selected the Automatically Connect to Non-preferred Networks option on the General tab of the policy's Properties dialog box. If she has not specified any preferred networks and has not selected this option, client computers will be unable to access any network. If Linda specifies access to infrastructure networks only, users are able to access the WLAN and will not encounter this problem; therefore, answer A is incorrect. Selecting the Use Windows to Configure Wireless Network Settings for Clients option enables users to configure their own wireless network settings; clearing this option does not prevent them from accessing the WLAN; therefore, answer B is incorrect.

Question 5

Which of the following is a benefit of using IAS server to control authentication of users to a WLAN?

  • A. IAS allows you to control authentication of users accessing multiple access points by means of a single server.

  • B. IAS provides a stronger level of authentication and encryption of data being transmitted across the WLAN.

  • C. IAS allows for mutual authentication of both the server and client computers creating a wireless connection.

  • D. IAS allows roaming users to maintain their connection when moving between different access points on the same network.

A5:

Answer A is correct. This control by means of a single server is a benefit of IAS, although you should employ a second IAS server for fault tolerance purposes. 802.1x is used to provide the strong level of authentication and encryption of data; therefore, answer B is incorrect. The use of SSL certificates in conjunction with EAP-TLS provides for mutual authentication; therefore, answer C is incorrect. PEAP (used in conjunction with IAS) allows roaming users to maintain their connection across different access points on the same network. IAS by itself does not provide this benefit; therefore, answer D is incorrect.

Question 6

You are a security engineer for your company. You have installed an IAS server for authenticating client computers connecting to your company's WLAN, and have obtained a certificate for this server from the company's enterprise root CA server. The server uses the RAS and IAS Server certificate template to create the certificate. You need to ensure that this certificate is used to authenticate the server to clients connecting to the WLAN, but you do not want this certificate to be used for client authentication. What should you do?

  • A. On the General tab of the Certificate Properties dialog box, select the Disable All Purposes for This Certificate option.

  • B. On the General tab of the Certificate Properties dialog box, select Enable Only the Following Purposes. Ensure that Server Authentication is selected and Client Authentication is cleared.

  • C. On the Cross-Certificates tab of the Certificate Properties dialog box, clear the Specify Additional Cross-Certificate Download Locations option.

  • D. Do nothing. This certificate is used for server authentication purposes only by default.

A6:

Answer B is correct. This certificate has the Server Authentication and Client Authentication purposes enabled by default; performing this procedure allows the certificate to be used for server authentication only. Selecting the Disable All Purposes for This Certificate option would not allow the certificate to be used for any purpose; therefore, answer A is incorrect. Cross-certification is used to establish trust between CAs in different trust hierarchies. This option is immaterial to the scenario in this question; therefore, answer C is incorrect. You have to follow the procedure of answer B to achieve the required result; therefore, answer D is incorrect.

Question 7

You want to automatically enroll users and computers for EAP-TLS certificates, and have added these users and computers to security groups in Active Directory. You open the properties dialog box for the certificate template and add the groups on the Security tab. You want to grant the groups the Read, Enroll, and Autoenroll permissions, but the Autoenroll permission is not present. What should you do?

  • A. Click Advanced and grant the Autoenroll permission from the Advanced Security Settings dialog box.

  • B. Grant the Full Control permission instead.

  • C. Duplicate the certificate template.

  • D. Do nothing. You only need to grant the Read and Enroll permissions.

A7:

Answer C is correct. A version 1 certificate template does not support certificate autoenrollment, which is what you are using in this scenario. Duplicating the template creates a version 2 template, which supports autoenrollment. Answer A is incorrect because this permission is not available on the Advanced Security Settings dialog box. Answer B is incorrect because the Full Control permission does not provide autoenrollment of a version 1 certificate. Answer D is incorrect because the Autoenroll permission is required.

Question 8

You want to make sure that only IEEE 802.1x authentication and encryption are enabled on your WLAN, so you open the Properties dialog box for your wireless network policy in the Group Policy Object Editor and edit the properties of your network on the Preferred Networks tab. What should you do?

  • A. Select the Data Encryption (WEP Enabled) check box.

  • B. Clear the Data Encryption (WEP Enabled) check box.

  • C. Select the Network Authentication (Shared Mode) check box.

  • D. Select the Enable Network Access Control Using IEEE 802.1x check box.

A8:

Answer B is correct. Clearing this check box disables WEP. Selecting this check box enables WEP; therefore, answer A is incorrect. The Network Authentication check box enables shared mode authentication but does not disable WEP; therefore, answer C is incorrect. You need to select the Enable Network Access Control Using IEEE 802.1x check box to enable IEEE 802.1, but this does not disable WEP; therefore, answer D is incorrect.

Question 9

You need to configure a Windows XP Professional client computer manually to authenticate to a WLAN using a username and password, so you access the Properties dialog box for the appropriate connection. Which of the following options should you specify?

  • A. On the Wireless Networks tab, select the network to which you want to authenticate, click Configure, and then select Secured Password (EAP-ms-CHAP v.2).

  • B. On the Wireless Networks tab, select the network to which you want to authenticate, click Configure, and then select Smart Card or Other Certificate.

  • C. On the Authentication tab, select Enable Network Access Control Using IEEE 802.1x and Protected EAP, click Properties, and then select Secured Password (EAP-ms-CHAP v.2).

  • D. On the Authentication tab, select Enable Network Access Control Using IEEE 802.1x and Protected EAP, click Properties, and then select Smart Card or other Certificate.

A9:

Answer C is correct. This procedure enables authentication using EAP-MS-CHAPv2, which is used to authenticate with a username and password. Answer D is incorrect because this procedure enables authentication with a smart card and EAP-TLS, which is not the desired result. Answers A and B are incorrect because you cannot configure these settings from the Wireless Networks tab.

Question 10

Which of the following operating systems support Wireless Zero Configuration? (Choose all that apply.)

  • A. Windows Server 2003

  • B. Windows 2000

  • C. Windows 98

  • D. Windows XP

  • E. Windows NT 4.0

A10:

Answers A and D are correct. Older operating systems such as Windows 2000, Windows 98, and Windows NT 4.0 do not support Wireless Zero Configuration; therefore, answers B, C, and E are incorrect.


Chapter 8. Practice Exam #1

Question 1

You are responsible for assessing security patches on the computers in your domain. To do so, you have chosen to use the mbsacli /hf command. When you run mbsacli /hf on the first computer, the following error message appears: Error: 200 - System not found. Scan not performed.

What could cause this error message?

  • A. You might receive this error if the remote Registry service is not enabled on the computer you want to scan.

  • B. You might receive this error message when you attempt to scan beta or unreleased versions of Microsoft Windows operating systems.

  • C. This error indicates that mbsascli /hf could not locate the computer and did not scan it.

  • D. You may receive this error message if no computer has the specified IP address.

Question 2

It is your responsibility to analyze all security reports generated by MBSA. You run MBSA using the GUI on a domain controller. Which of the following pieces of information is not contained in the MBSA security report?

  • A. Computer name

  • B. Administrator logon ID

  • C. IP address

  • D. Security report name

Question 3

You are responsible for the deployment of 15 new desktop computers. These desktop computers will run Windows XP. The desktops all have identical hardware. Microsoft has just released a new service pack. Your company policy states that all new computers must conform to the standards already in place on the network, which means that the service pack must be installed on the new computers. Your planned method of distribution is from a distribution share folder. How do you automate the installation of the service pack when installing the Windows XP operating system with the least amount of administrative effort?

  • A. Update the distribution share by using the service pack's update/s command.

  • B. Install Windows XP on the computers and then configure the Automatic Updates feature to run.

  • C. Install Windows XP on the computers and then send an email message to the users instructing them to run Windows Update.

  • D. Create a new WUAU22.msi file and then run it after you install Windows XP.

Question 4

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with computers running Windows XP and Windows 2000 Professional with SP3. You must install several updates on various Windows 2000 Professional computers. You want to install the updates using QChain.exe to avoid having to restart the computers after each update. You also want to install the updates using unattended setup mode. Which of the following switches can you use to accomplish this?

  • A. /z /l

  • B. /z /m

  • C. /z /u

  • D. /z /f

Question 5

You are responsible for making sure that all hotfixes and service packs are properly tested before they are applied to the computers in the production environment. You have chosen to use two SUS servers, one for testing and one for production. Which of the following would be included in this procedure? (Choose two; each answer represents part of the solution.)

  • A. Set up one server in your test lab and configure an Automatic Updates policy for the client computers in the lab.

  • B. Configure an Automatic Updates policy that points the test clients to the test server running SUS. Configure another Automatic Updates policy that points the production computers to the production server running SUS.

  • C. Publish the updates to client computers in the lab. If these clients install correctly, configure your production SUS servers to publish the updates.

  • D. After testing successfully, approve the updates for use on the production server.

Question 6

You are the network security administrator for the Test domain. Your company currently has no solution in place for ensuring that the computers are kept up to date. You want to make sure that you are notified when new security updates become available so you can review them to determine whether they need to be applied. What do you need to do to receive such updates?

  • A. Sign up for the Microsoft Security Notification Service using the Microsoft Profile Center.

  • B. Select the Automatic Security Updates option in Control Panel.

  • C. Nothing. If the company owns licensed copies of Microsoft products, free security notifications are automatically received.

  • D. Periodically visit the Microsoft Web site and search for security updates.

Question 7

You are the network administrator for the Test domain, which consists of a mixed Windows 2000 and Windows 2003 domain with client computers running Windows XP Professional, Windows 2000 Professional, and Windows NT Workstation. You receive a new version of a custom application with some additional security features that will benefit the company. You want to update the application with the least amount of administrative effort. Which of the following would you use?

  • A. Group Policy

  • B. SMS 2.0 with the SUS Feature Pack

  • C. SUS

  • D. WU

Question 8

You are responsible for making sure that all hotfixes and service packs are properly tested before they are applied to the computers in the production environment. Which option should you select on the Approve Updates page for content that is updated in a testing environment?

  • A. Automatically Approve New Versions of Previously Approved Updates

  • B. Notify for Download and Notify for Installation

  • C. Do Not Automatically Approve New Versions of Previously Approved Updates. I Will Manually Approve These Later

  • D. Automatically Download and Notify for Installation

Question 9

You are the network administrator for the Test domain, which consists of a mixed Windows 2000 and Windows 2003 domain with client computers running Windows XP Professional and Windows 2000 Professional. Company policy dictates that auditing for the following be tracked:

  • When an attempt is made to log on to any local computer

  • When a user account or group is created or a user account password has been changed

Which of the following would you enable? (Choose two; each answer represents part of the solution.)

  • A. Audit account logon events, success, failure

  • B. Audit account management, success

  • C. Audit logon events, success, failure

  • D. Audit object access, success

Question 10

You are the network administrator for the Test domain, which consists of a mixed Windows 2000 and Windows 2003 domain with client computers running Windows XP Professional, Windows 2000 Professional, and Windows 98. Recently, Microsoft announced that it would no longer support Windows 98, so you upgraded the computers running Windows 98 to Windows XP. The help desk is getting a large volume of calls from the users who have been upgraded, reporting that a proprietary accounting package they are using no longer works. How do you resolve this issue?

  • A. Apply the Securews.inf security template.

  • B. Apply the Notssid.inf security template.

  • C. Apply the Setup security.inf security template.

  • D. Apply the Compatws.inf security template.

Question 11

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Several of your users need certain user rights on a file server. Many of these users are members of the Development group, but you don't want the entire group to have access. You create a new group called DevelopsubA and then create a new template allowing the needed user rights. How do you configure this in the Restricted Groups area?

  • A. The Members list should show DevelopsubA and the Members Of list should show Development.

  • B. The Members list should show Development and the Members Of list should show Development and DevelopsubA.

  • C. The Members list should show Development and the Members Of list should show DevelopsubA.

  • D. The Members list should show Development and DevelopsubA and the Members Of list should show DevelopsubA.

Question 12

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Your company has merged with ABC Company. ABC consists of a native mode Windows 2000 domain with client computers running Windows 2000. You need to grant access to resources to a group that is a distribution group of ABC without affecting email distribution. How do you accomplish this with the least amount of administrative effort?

  • A. Create a new security group and add all users.

  • B. Convert the distribution to a security group.

  • C. Create new distribution and security groups, and then add all users.

  • D. Make the distribution group a universal group.

Question 13

You are responsible for making sure that all computers in the domain are secure. You would like to make several adjustments but do not want the changes to affect system security. You merely want to see how changes to the settings will affect the security of the computer. Which of the following would you use?

  • A. HFNetChk

  • B. MBSA

  • C. SCA

  • D. QChain.exe

Question 14

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows 2000 and Windows XP Professional. The computers are in an OU called Production. You use GPOs to configure the computers. Company policy states that all desktops must have the same uniform look. The computers in the Production OU are shared by users because it is a call center environment, which operates 24/7. To conform to company policy, you want to be sure that regardless of who logs on to a computer, the desktop settings will be the same. How do you accomplish this?

  • A. Create a GPO and link it to the Test domain. Configure the GPO to use loopback processing.

  • B. Create a GPO and link it to the Production OU. Configure the GPO to use loopback processing.

  • C. Create a GPO and link it to the Production OU. Configure the GPO for a software restriction policy.

  • D. Configure the client computers with a batch file that will run secedit/refreshpolicy, and then have Task Scheduler run the file on a daily basis.

Question 15

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows 2000 and Windows XP Professional. The computers are in an OU called Production. You are responsible for making sure that the domain account policies are no less secure than the account policies in the Securedc.inf template. By using the Security and Configuration Analysis tool, you analyze the computer and find that that there are several areas in the password policy portion that need improvement but there are also other areas in which the company policy is more restrictive than the template. Company policy states that the existing security level is not to be reduced. How do you increase the password policy in the areas in which it is less restrictive than the Securedc.inf template?

  • A. Create a new GPO and link it to the Production OU. Import the Securewk.inf template into the new GPO.

  • B. Import the Securedc.inf template into the Domain Security Policy.

  • C. Create a new GPO and link it to the Production OU. Make the appropriate changes, and then import this template into the new GPO.

  • D. Create a new security template. Make the appropriate changes, and then import this template into the Domain Security Policy.

Question 16

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional, Windows 2000 Professional, Windows NT Workstation, and Windows 98. The company policy states that all domain controllers authenticate users only by using the most secure method available. What Windows Server 2003 Registry keys replace the Windows 2000 Restrict Anonymous value? (Choose two; each answer represents part of the solution.)

  • A. Network Access: Restrict Anonymous Accounts

  • B. Network Access: Restrict Anonymous Shares

  • C. Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts and Shares

  • D. Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts

Question 17

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional and Windows 2000 Professional. You have just configured a new software restriction policy for the Production OU and you do not want it to apply to the local administrators because they will be using this software for troubleshooting purposes. How do you do this?

  • A. Create a new GPO and link it to the OU. Open Software Restriction Policies and select All Users Except Local Administrators under the Enforcement object of Group Policy.

  • B. Create a new GPO and link it to the OU. Open Software Restriction Policies and select Domain Administrators under the Trusted Publishers object of Group Policy.

  • C. Create a new GPO and link it to the Domain. Open Software Restriction Policies and select All Users Except Local Administrators under the Enforcement object of Group Policy.

  • D. Create a new GPO and link it to the OU. Open Software Restriction Policies and select All Users under the Enforcement object of Group Policy.

Question 18

Which mode of IPSec should you use to assure security and confidentiality of data within a single network?

  • A. AH transport mode

  • B. ESP tunnel Mode

  • C. ESP transport mode

  • D. AH tunnel mode

Question 19

Which encryption protocols can be used to secure the authentication of computers using IPSec? (Choose two.)

  • A. SHA

  • B. MD5

  • C. Kerberos

  • D. Certificates

Question 20

Immediately after installing a network containing only servers running Windows Server 2003 and clients running Windows XP Professional, which authentication protocol can be used with the least administrative effort?

  • A. Certificates

  • B. Preshared keys

  • C. Kerberos V5

  • D. MD5

Question 21

Which two types of IPSec can be used to secure communications between networks?

  • A. AH tunnel mode

  • B. AH transport mode

  • C. ESP tunnel Mode

  • D. ESP transport mode

Question 22

Which part of an IPSec policy contains filters and filter actions and controls the behavior of the policy?

  • A. Rules

  • B. Encryption

  • C. Tunneling

  • D. Authentication

Question 23

Which of the following are settings in an IPSec rule?

  • A. Types of operating systems allowed

  • B. Processor speed

  • C. Connection types

  • D. Authentication types

Question 24

Which IPSec rule setting defines traffic that is to be identified?

  • A. Filter action

  • B. Tunnel endpoint

  • C. Filter

  • D. Connection type

Question 25

Which two components of a rule work together to identify packets and then make decisions that affect traffic flow and security?

  • A. Filters

  • B. Kerberos V5

  • C. Filter actions

  • D. Connection types

Question 26

Which Active Directory tool should you use to manage IPSec policies that affect all of the computers in a domain?

  • A. Active Directory replication

  • B. Kerberos V5

  • C. Group Policy Object Editor

  • D. GPMC

Question 27

Which two tools should you use to create, manage, and deploy IPSec policies for an entire domain?

  • A. Active Directory Sites and Services

  • B. IP Security Policy Management Console

  • C. netsh ipsec

  • D. Local security policy MMCs for each computer

Question 28

Which type of device is usually at the endpoints of tunnel mode IPSec?

  • A. Hub

  • B. Switch

  • C. Router

  • D. Bridge

Question 29

Which IPSec authentication method should only be used as a last resort?

  • A. Certificates

  • B. Preshared key

  • C. Anonymous access

  • D. Kerberos

Question 30

Which 160-bit encryption method is used to secure government contracts as part of the Federal Information Processing Standard (FIPS)?

  • A. DES

  • B. 3DES

  • C. SHA

  • D. MD5

Question 31

Which Diffie-Hellman algorithm can produce up to a 2048-bit key?

  • A. DES

  • B. 3DES

  • C. MD5

  • D. SHA

Question 32

If an IPSec policy contains multiple filters, in which order are they processed?

  • A. Top to bottom

  • B. Bottom to top

  • C. Least specific to most specific

  • D. Most specific to least specific

Question 33

Which are valid filter action settings for a filter in an IPSec policy?

  • A. Allow

  • B. Negotiate Security

  • C. Block

  • D. Deny

Question 34

Which command can be used to create, modify, and assign IPSec policies without immediately affecting the active IPSec policies?

  • A. netsh ipsec static

  • B. netdiag

  • C. gpupdate

  • D. netsh ipsec dynamic

Question 35

You have issued a new certificate to a user in your company named Fred. The next day, your boss informs you that there is concern that Fred might be unsuitable for the job, so you revoke the certificate. Later, your boss informs you that the concern has been cleared up, and asks you to make the certificate available. Selecting the certificate in the Revoked Certificates folder of the Certification Authority snap-in, you attempt to unrevoke the certificate but are informed that the unrevoke command failed. Which of the following is the most likely explanation for the failure of this command?

  • A. You have not deleted the certificate from the current CRL.

  • B. You revoked the certificate with the Unspecified reason code. You should have used the Certificate Hold reason code.

  • C. You have not restored the CRL to the day before you first revoked the certificate.

  • D. You need to delete the delta CRL containing the revoked certificate before you can unrevoke it.

Question 36

You have used the Certificate Services snap-in to configure a version 2 certificate template for archiving the subject's encryption private key. The template is to be used for issuing certificates that are to be used for signature purposes. However, the private keys associated with these certificates are not being archived. What should you do?

  • A. Specify the Allow Private Key to be Exported option.

  • B. Use a version 1 certificate template rather than the version 2 template.

  • C. Specify the Allow-Autoenroll permission for the certificate template.

  • D. Configure the certificate template to allow both signature and encryption.

Question 37

You are the domain administrator of the quepublishing.com domain and have configured Certificate Services on a server in this domain. Several users in the research.quepublishing.com domain attempt to enroll for a user certificate but receive a message that the template was not found. What should you do?

  • A. Include a group containing the required users in the ACL for the User certificate template.

  • B. Create a duplicate of the User certificate template and specify the Autoenroll permission for the Authenticated Users group.

  • C. Configure the Web enrollment pages to use basic authentication.

  • D. Configure the automatic certificate request policy in a GPO linked to the research.quepublishing.com domain.

Question 38

You are an enterprise administrator for a Windows Server 2003 forest that contains three domains: examcram.com, na.examcram.com, and europe.examcram.com. All client computers run Windows XP Professional.

You have deployed a three-tier CA hierarchy. Which of the following types of CAs would you expect to issue smart card certificates to users in the forest? (Choose all that apply.)

  • A. Enterprise root CA

  • B. Enterprise subordinate CA

  • C. Standalone root CA

  • D. Issuing standalone CA

  • E. Issuing enterprise CA

Question 39

You are an enterprise administrator for a Windows Server 2003 forest that contains three domains: examcram.com, na.examcram.com, and europe.examcram.com. All client computers run Windows XP Professional.

You have been asked to install and configure an enterprise root CA that will issue certificates to users and computers in all domains of the forest. Users with the proper permissions should be able to use the enrollment Web pages.

Which of the following must be available for you to accomplish this task? (Choose all that apply.)

  • A. DHCP

  • B. DNS

  • C. Active Directory

  • D. RIS

  • E. IIS

Question 40

Lorne's company hires a large number of contract workers for outsourcing to client companies to fulfill temporary needs when regular workers are overburdened or go on vacation. He needs to allow the workers to view Web pages describing current job openings that only these workers can see. His company uses a CA to issue certificates to these workers. After installing the CA's root certificate in his company's enterprise, Lorne needs to set a rule for mapping these certificates. How should Lorne proceed?

  • A. Lorne needs to configure one-to-one mapping of the certificates.

  • B. Lorne needs to configure many-to-one mapping of the certificates.

  • C. Lorne needs to configure one-to-many mapping of the certificates.

  • D. Lorne needs to configure user principal name mapping.

Question 41

Karen is the security administrator for an Active Directory forest that includes a root domain named quepublishing.com and three child domains named accounting.quepublishing.com, inventory.quepublishing.com, and marketing.quepublishing.com. She has deployed a PKI that includes a standalone root CA and subordinate issuing CAs for each of the domains.

Users attempting to obtain certificates from the subordinate CAs in the child domains are unsuccessful. Karen checks the event logs at the subordinate CA servers and determines that the root CA is not a trusted CA in these domains. What should she do?

  • A. Configure a GPO linked to the root domain that adds the root CA's certificate to a CTL.

  • B. Convert the standalone root CA to an enterprise root CA.

  • C. Use a three-tier CA hierarchy in which the subordinate CAs are configured as intermediate CAs and new CAs serve as issuing CAs.

  • D. Use certutil at a child domain CA to publish the certificate for the root CA in Active Directory.

Question 42

You are deploying a remote access connection strategy involving L2TP over IPSec, and will be issuing IPSec certificates to secure the connection between remote client computers and network servers. Which of the following must be true so that connections will successfully take place?

  • A. Each client computer must have a computer certificate, and each server must have a user certificate.

  • B. Both client and server computers require a certificate from the same CA.

  • C. Client computers need certificates from enterprise CAs located in the internal network, whereas servers need certificates from a public CA.

  • D. Client computers need certificates from standalone CAs located in the internal network, whereas servers need certificates from a public CA.

Question 43

Which of the following features of IIS needs to be enabled so that Web enrollment services work properly?

  • A. ASPs

  • B. FTP

  • C. Host headers

  • D. Server certificates

Question 44

Which of the following actions are possible with version 2 certificate templates but not with version 1 templates? (Choose all that apply.)

  • A. Specification of the level of user interaction possible during certificate enrollment

  • B. Specification of the Enroll permission for users and groups requiring certificates

  • C. Specification of the Autoenroll permission for users and groups requiring certificates

  • D. Specification of the purpose of the certificate

Question 45

Immediately after your manager fired an employee named Kevin, you revoked his user certificate from your company's enterprise CA. Thirty minutes later, you noticed several important files missing from a file server. Audit information indicated that Kevin had logged on using his certificate and deleted these files. Fortunately, you were able to restore the files from backup.

Which of the following is the most likely reason for Kevin's ability to log on despite the revoked certificate?

  • A. Kevin imported a copy of his private certificate to the computer that he used to log on.

  • B. The CRL had not yet been replicated to the server at which Kevin logged on successfully.

  • C. Delta CRLs are published at specified intervals and the most recent delta CRL was not yet published.

  • D. The server at which Kevin logged on was unable to locate a copy of the most recent CRL and delta CRL.

Question 46

You are setting up a system of smart cards on your company's Active Directory network. Two users named Bill and Heather will be assisting you in enrolling the users for smart cards. They are members of the Server Operators and Account Operators groups. When they access the enrollment pages, they are denied access. What should you do to correct this problem, without granting them excessive privileges?

  • A. Use the server on which Certificate Services is installed to enroll the smart cards.

  • B. Connect to the enterprise root CA to access the enrollment pages.

  • C. Add their user accounts to the Domain Admins group.

  • D. Grant their user accounts the Read and Enroll permissions on the certificate templates.

Question 47

You are a security engineer at a company that runs an Active Directory domain with servers that run either Windows 2000 Server or Windows Server 2003, and client computers that run either Windows 2000 Professional or Windows XP Professional. The company has experienced several security breaches related to cracking of user names and passwords. Management has authorized the purchase of a smart card system to reduce the probability of further breaches.

You have purchased and installed the required hardware and set up a system of CAs to support the required PKI. You have configured smart card certificate templates and enrollment stations. What else should you do to take complete advantage of the smart card system?

  • A. Upgrade all servers to Windows Server 2003.

  • B. Upgrade all client computers to Windows XP Professional.

  • C. Require the use of smart cards for interactive logon.

  • D. Obtain a certificate from an external certification agency such as VeriSign.

Question 48

Which of the following are required to enable the autoenrollment of users and computers for certificates? (Choose all that apply.)

  • A. The user or group must have the Read and Autoenroll permissions.

  • B. The user or group must have Read, Enroll, and Autoenroll permissions.

  • C. The certificate server must be hosted on a server running Windows Server 2003, Standard Edition or Windows Server 2003, Enterprise Edition.

  • D. The certificate server must be hosted on a server running Windows Server 2003, Enterprise Edition.

  • E. A GPO needs to be configured for automatic enrollment of user and computer certificates.

  • F. Client computers may run any version of Windows XP.

  • G. Client computers must be integrated into the Active Directory domain.

Question 49

You are exporting a certificate for EFS file recovery, and start the Certificate Export Wizard. Which of the following file formats should you select from the Export File Format page?

  • A. DER encoded binary X.509 (CER)

  • B. Base-64 encoded X.509 (CER)

  • C. Cryptographic Message Syntax Standard–PKCS #7 Certificates (.P7B)

  • D. Personal Information Exchange–PKCS #12 (.PFX)

Question 50

You are the security administrator for a company that operates an Active Directory network with a PKI that includes a standalone offline root CA with an intermediate CA named Corp-CA, and three issuing CAs named Acctg-CA, Legal-CA, and Res-CA. The issuing CAs are directly subordinate to Corp-CA.

After a downsizing of company research activities, executives decided there was no need for Res-CA, so you removed this CA and recommissioned the computer as a file server. Later, you discovered that several clients were still using certificates issued by Res-CA.

What should you do to ensure that all certificates issued by Res-CA are rendered invalid?

  • A. Revoke all certificates from Corp-CA.

  • B. Revoke all certificates from Res-CA.

  • C. Revoke the CA certificate for Res-CA from Corp-CA.

  • D. Revoke the CA certificate for Res-CA from the offline root CA.

  • E. Rebuild Corp-CA and reissue CA certificates to Acctg-CA and Legal-CA.

Question 51

You are the security engineer for your company, which operates a Windows Server 2003 domain. All client computers run Windows XP Professional. The CEO has asked you to configure an autoenrollment policy for users in the Legal OU that will enable autoenrollment of user certificates. You have just completed the configuration of a user certificate template for autoenrollment, including specifying the proper permissions and configuring a GPO linked to the Legal OU with the proper autoenrollment settings. However, users in the Legal OU are not able to automatically enroll for certificates.

What should you do?

  • A. Use Active Directory Sites and Services to force replication of Active Directory.

  • B. Use the secedit command to force replication of Group Policy.

  • C. Use the gpupdate command to force replication of Group Policy.

  • D. Link the GPO to the domain instead of the Legal OU.

Question 52

You are responsible for the deployment of 15 new desktop computers. These computers will be running Windows XP. The computers all have identical hardware. Microsoft has just released several hotfixes. Your company policy states that all new computers must conform to the standards already in place on the network, which means that the hotfixes must be installed on the new computers. Your planned method of distribution is by using RIS. How do you automate the installation when installing the Windows XP operating system with the least amount of administrative effort?

  • A. Install Windows XP on the computers and then configure the Automatic Updates feature to run.

  • B. Install Windows XP on the computers and then send an email to the users instructing them to run Windows Update.

  • C. Add the hotfix script lines to the [GuiRunOnce] section of the Unattend.txt file and then call them from Hotfix.exe.

  • D. Create a new WUAU22.msi file and run it after you install Windows XP.

Question 53

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP. Service Pack 2 for Windows XP was just released. You want to deploy the service pack to all of your client computers with a GPO. Which file would you use?

  • A. Update.xls

  • B. Update.exe

  • C. Update.inf

  • D. Update.msi

Question 54

You are the network administrator for a company with its corporate headquarters located in Phoenix. The company has several other offices located throughout the United States and a total user population of approximately 1,500. Company policy dictates that all computer systems are up to date with security patches and that any new security patches and software updates are deployed in a consistent and timely manner with the least administrative effort as possible. The servers all run Windows Server 2003 and the client computer systems run a combination of Microsoft Windows 2000 Professional and Windows XP. The company does not currently have any solution in place. You want to be able to test and deploy all changes. Which of the following would be the best and most economical option for the company?

  • A. Install SUS on a member server in the corporate headquarters and configure all client computers to perform automatic updates from this server.

  • B. Install MBSA on a member server in the corporate headquarters and use Group Policy to control the distribution of updates.

  • C. Configure all the client computers to download updates directly from Microsoft's Windows Update site.

  • D. Install SMS using one primary server in the corporate headquarters and secondary servers in all of the other locations.

Question 55

You are using the Microsoft Network Security Hotfix Checker (Hfnetchk.exe) command to check the current service pack and hotfix status on the 10.10 subnet, and you want to write the results to the file Subnet1.txt. Which of the following string of commands would you enter?

  • A. mbsacli.exe /hf -r 10.10.1.1 -10.10.255.254 -S 2 subnet1.txt

  • B. mbsacli.exe /hf -i 10.10.1.1-10.10.255.254 -f subnet1.txt

  • C. mbsacli.exe /hf -r 10.10.1.1-10.10.255.254 -f subnet1.txt

  • D. mbsacli.exe /hf -i 10.10.1.1-10.10.255.254 -S -f subnet1.txt

Question 56

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. You want to be sure the client computers are updated with the latest services packs and hotfixes. To do so, you need to determine which computers are exposed to vulnerabilities. You also want to determine which users are updating their computers. You will collect this information for a two-week period to see what has changed on each computer. How do you automate this process?

  • A. Install SUS on one of the servers. Configure the clients to update from the server every night.

  • B. Create a batch file using Hfnetchk.exe. Schedule the command to run every night.

  • C. Create a batch file using Mbsacli.exe. Schedule the command to run every night.

  • D. Create a batch file using Secedit.exe. Schedule the command to run every night.

Question 57

You are the network administrator for the Test forest, which consists of several native mode Windows 2000 domains and Windows 2003 domains with client computers running Windows 2000 and Windows XP Professional. The company recently decided to switch to Exchange for email capabilities. You are in the process of creating a plan to accommodate this new change. For security reasons, you want to create groups that can be used only for email purpose, yet minimize replication traffic. How do you accomplish this?

  • A. Create global security groups for each domain, then add the user accounts. Create universal security groups and add the global security groups as members.

  • B. Create global distribution groups for each domain, and then add the user accounts. Create universal distribution groups and add the global distribution groups as members.

  • C. Create domain local distribution groups for each domain, and then add the user accounts. Create universal distribution groups and add the domain local distribution groups as members.

  • D. Create universal distribution groups and add the users as members.

Question 58

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Company policy states that users should not be able to run unauthorized applications. To conform to this policy, you have configured the software restrictions portion of the GPO to not apply to the local administrators. The administrators have installed a new application but the users cannot run this new application. How do you ensure that the users can run this new application without allowing unauthorized applications to run?

  • A. Create a group that contains the users that need to access the application, and then configure the GPO to not include this group.

  • B. Create a hash rule for the application. Change the Software Restriction GPO to allow files that match the hash value to run.

  • C. Create a .msi file and assign the package to the users that need to access the application.

  • D. Create a path rule for the application. Change the Software Restriction GPO to allow users to access the path where the application is located.

Question 59

You are the network administrator for the Test forest, which consists of a mixed mode Windows 2000 domain and a Windows 2003 domain with client computers running Windows 98, Windows NT Workstation, Windows 2000, and Windows XP Professional. The information exchanged within the company is extremely sensitive. The company's written policy states that all domain controllers must accept a LAN Manager authentication level of NTLMv2 only so that the session key is encrypted and the authentication process is more secure than NTLM. How do you configure the domain controllers in the mixed mode domain to meet these requirements?

  • A. Import the Securews.inf security template into the default Domain Controllers GPO for the Windows 2000 domain.

  • B. Import the Securedc.inf security template into the default Domain Controllers GPO for the Windows 2003 domain.

  • C. Import the Rootsec.inf security template into the default Domain Controllers GPO for the Windows 2000 domain.

  • D. Import the Securedc.inf security template into the default Domain Controllers GPO for the Windows 2000 domain.

Question 60

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Currently, you are in the process of formulating a baseline security configuration and upgrade plan for the Web servers from Windows 2000 to Windows 2003. Company policy states that all unnecessary services and protocols be uninstalled, disabled, or removed. The Web servers are in an OU called Web. How do you do this with the least administrative effort?

  • A. After determining the unnecessary services, create a GPO to set the unnecessary services startup type to Disabled. Link the GPO to the Web OU.

  • B. After determining the unnecessary services, create a GPO and import the Notssid.inf security template.

  • C. After determining the unnecessary services, create a GPO to set the unnecessary services startup type to Disabled. Link the GPO to the Domain Controllers OU.

  • D. After determining the unnecessary services, create a GPO to set the unnecessary services startup type to Manual. Link the GPO to the Web OU.


Chapter 9. Answer Key to Practice Exam #1

1. C

2. B

3. A

4. B

5. B, D

6. A

7. B

8. C

9. B, C

10. D

11. A

12. B

13. C

14. B

15. D

16. C, D

17. A

18. C

19. A, B

20. C

21. A, C

22. A

23. C, D

24. C

25. A, C

26. D

27. B, C

28. C

29. B

30. C

31. B

32. D

33. B, C

34. A

35. B

36. D

37. A

38. B, E

39. B, C, E

40. B

41. D

42. B

43. A

44. A, C, D

45. C

46. D

47. C

48. B, D, E, G

49. D

50. C

51. C

52. C

53. D

54. A

55. C

56. C

57. B

58. B

59. D

60. A

Question 1 | Answer C is correct. To resolve this error, verify that the computer is on the network and that the host name and IP address are correct. If the remote Registry service is not enabled on the computer you want to scan, you will receive Error: 501 - Remote registry access denied. Scan not performed; therefore, answer A is incorrect. When you attempt to scan beta or unreleased versions of Microsoft Windows operating systems, the error message generated is Error: 622 - Machine OS is not Recognized. Please run with tracing on and send to technical support. Scan not performed. Unable to determine the Operating System of the specified machine; therefore, answer B is incorrect. If no computer has the specified IP address, the error message generated is Error: 235 - System not found, or NetBIOS ports may be firewalled. Scan not performed; therefore, answer D is incorrect.
Question 2 | Answer B is correct. The Administrator logon ID is not listed in the report. When a MSBA scan is run, the security report lists the computer name, IP address, security report name, and scan date; therefore, answers A, C, and D are incorrect.
Question 3 | Answer A is correct. Slipstreaming simultaneously installs service packs with an operating system. This will ensure that all computers will conform to company policy. Configuring the computers for Automatic Updates requires more administrative effort and does not conform to company policy; therefore, answer B is incorrect. Requesting that the users run Windows Update does not conform to company policy because you are relying on the users to update the systems; therefore, answer C is incorrect. WUAU22.msi is a Windows Installer-based setup program for the Automatic Updates client; therefore, answer D is incorrect.
Question 4 | Answer B is correct. The /z switch denotes no restart after installation and the /m switch uses Windows 2000 unattended Setup mode. The /l switch displays a list of all installed hotfixes; therefore, answer A is incorrect. The /u switch uses Windows XP unattended Setup mode; therefore, answer C is incorrect. The /f switch forces programs to close at shutdown; therefore, answer D is incorrect.
Question 5 | Answers B and D are correct. The procedure to use two SUS servers includes using one for testing and one for production computers. You then test the content on the test server and approve the items on the production server. The procedure to use a manually configured distribution point includes using a test server running SUS with test client computers. After the content is tested, the tested content and the list of approved items are copied to a manually configured distribution point; therefore, answers A and C are incorrect.
Question 6 | Answer A is correct. You can receive technical alerts by subscribing to Product Security Notification. To register for the Microsoft Security Notification Service, go to the Microsoft Profile Center. There is no Automatic Security Updates icon in Control Panel; therefore, answer B is incorrect. Security notifications are not automatically received; therefore, answer C is incorrect. Periodically visiting Microsoft's Web site is an option, but you want to make sure that you are notified when new security updates become available; therefore, answer D is incorrect.
Question 7 | Answer B is correct. SMS can be used to update any software product on an SMS client. While it may be possible to update the systems using Group Policy by creating an installation package, this is more administrative work; therefore, answer A is incorrect. In WU and SUS environments, custom products must be updated by using other services or by manually applying software updates; therefore, answers C and D are incorrect.
Question 8 | Answer C is correct. The option Do Not Automatically Approve New Versions of Previously Approved Updates. I Will Manually Approve These Later allows an approved item to be automatically unapproved if it is updated during a synchronization. This option should be chosen if you are using a test environment. It allows the update to be tested before being installed on the client computers. Automatically Approve New Versions of Previously Approved Updates allows an approved item to continue to be approved if it is later updated during synchronization; therefore, answer A is incorrect. Notify for Download and Notify for Installation alerts a user with local Administrator rights about updates. This is an announcement to the users that is done through Group Policy; therefore, answer B is incorrect. Automatically Download and Notify for Installation is also an announcement to the users that is done through Group Policy; therefore, answer D is incorrect.
Question 9 | Answers B and C are correct. The audit account management event includes user account or group creation, modification, or deletion; user accounts being renamed or disabled or a password being set or changed; and the audit logon events are events that are generated on domain controllers for domain account activity and on local computers for local account activity. Audit account logon events are events that occur when a domain user account is authenticated on a domain controller; therefore, answer A is incorrect. Audit object access tracks when a user accesses an object such as a file, folder, Registry key, or printer that has its own SACL specified; therefore, answer D is incorrect.
Question 10 | Answer D is correct. The Compatible template changes the default file and Registry permissions to be compatible with the requirements of most legacy applications. The Secure template defines enhanced security settings for servers and workstations, limiting the use of LAN Manager and NTLM authentication protocols; therefore, answer A is incorrect. The Notssid template is used to remove the unnecessary Terminal Server SIDs from the file system and Registry locations if Terminal Server will not be used; therefore, answer B is incorrect. The Setup security template contains settings that are applied during installation of the operating system for servers or client computers; therefore, answer C is incorrect.
Question 11 | Answer A is correct. The Members list defines who belongs to a restricted group, whereas the Member Of list states which other groups a restricted group belongs to; therefore, answers B, C, and D are incorrect.
Question 12 | Answer B is correct. A security group can also be used as an email entity. Creating a new security group and adding all users is too much administrative effort; therefore, answer A is incorrect. Creating new distribution and security groups and then adding all users is not necessary; therefore, answer C is incorrect. Making the distribution group a universal group will not allow access to resources; therefore, answer D is incorrect.
Question 13 | Answer C is correct. SCA is used to analyze security configurations and resolve security discrepancies. The changes you make will not affect system security. They will only affect the analysis database because the purpose of the tool is to help you see how changes in the settings will affect the security of the computer. The HFNetChk scan will check for missing security updates and then display the results in the command-line window; therefore, answer A is incorrect. MBSA is a tool that is used to scan one or more Windows-based computers for common security holes; therefore, answer B is incorrect. With QChain.exe, updates can be chained together so they install without restarting the computer between each installation; therefore, answer D is incorrect.
Question 14 | Answer B is correct. Loopback policy is used to override user-based Group Policy with computer-based Group Policy. This makes the desktop configuration the same regardless of who logs on. Creating a GPO and linking it to the Test domain will affect all computers in the domain, not just the Production OU; therefore, answer A is incorrect. Configuring the GPO for a software restriction policy will not affect the desktops because software restriction policies are used for more granular control over who receives what software and specify the software that is allowed to run on the computer; therefore, answer C is incorrect. Configuring the client computers with a batch file that will run secedit/refreshpolicy, and then having Task Scheduler run the file on a daily basis is an indirect way of applying security policies, and the secedit/refreshpolicy has been replaced by Gpupdate in Windows Server 2003; therefore, answer D is incorrect.
Question 15 | Answer D is correct. A new security template should be created that is at least as restrictive as the current settings and the Securedc.inf template. Importing the Securewk.inf template into the new GPO will not work because the template is for enhanced security settings for servers and workstations, not domain controllers; therefore, answer A is incorrect. Importing the Securedc.inf template into the Domain Security Policy will reduce the security of some of the settings; therefore, answer B is incorrect. Creating a new GPO and linking it to the Production OU will not work because there can be only one domain account policy which is applied at the root domain; therefore, answer C is incorrect.
Question 16 | Answers C and D are correct. The keys Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts and Shares and Network Access: Do Not Allow Anonymous Enumeration of SAM Accounts replace the Windows 2000 additional restrictions for anonymous connections that managed the Registry value called Restrict Anonymous. Network Access: Restrict Anonymous Accounts and Network Access: Restrict Anonymous Shares do not exist; therefore, answers A and B are incorrect.
Question 17 | Answer A is correct. If you do not want the software restriction policies to apply to local administrators, you can configure this by clicking All Users Except Local Administrators under the Enforcement object of Group Policy. The Trusted Publishers Group Policy object deals with the issuance of certificates; therefore, answer B is incorrect. Creating a new GPO and linking it to the domain will not serve the purpose because the software restriction is for the Production OU; therefore, answer C is incorrect. Selecting All Users under the Enforcement object of Group Policy will not exclude the local administrators; therefore, answer D is incorrect.
Question 18 | Answer C is correct. ESP transport mode would ensure both the integrity and confidentiality of data within a network. AH transport would only ensure the integrity of the LAN data, not the confidentiality; therefore, answer A is incorrect. ESP tunnel mode should be used to secure the integrity and confidentiality of data between networks and not within a network; therefore, answer B is incorrect. AH tunnel mode should be used to secure the integrity of data between networks and not within a network; therefore, answer D is incorrect.
Question 19 | Answers A and B are correct. SHA or MD5 could be used. Kerberos V5 is an authentication protocol, not an encryption protocol; therefore, answer C is incorrect. Certificates are a type of authentication that can be used with IPSec, not an encryption protocol; therefore, answer D is incorrect.
Question 20 | Answer C is correct. Kerberos V5 is the default authentication protocol for Windows Server 2003 and for Windows XP clients. Certificates would require much more administrative effort in comparison to Kerberos v5; therefore, answer A is incorrect. Preshared keys should only be used as a last resort; therefore, answer C is incorrect. MD5 is an encryption protocol and not an authentication protocol; therefore, answer D is incorrect.
Question 21 | Answers A and C are correct. A tunnel mode IPSec should be used. AH transport mode is for protection of the integrity of data transferred between computers in a LAN; therefore, answer B is incorrect. ESP is for protection of integrity and confidentiality of data transferred by computers within a LAN; therefore, answer D is incorrect.
Question 22 | Answer A is correct. IPSec policy rules contain filters and filter actions that control the behavior of the policy. Encryption is a process of scrambling data to protect its confidentiality; therefore, answer B is incorrect. Tunneling is encapsulating one protocol over another; therefore, answer C is incorrect. Authentication is a process of proving an identity; therefore, answer D is incorrect.
Question 23 | Answers C and D are correct. Parts of an IPSec rule can include filters, filter actions, authentication methods, connection types, tunnel endpoints, and much more. Types of operating systems allowed is not a rule setting; therefore, answer A is incorrect. Processor speed is not a rule setting; therefore, answer B is incorrect.
Question 24 | Answer C is correct. Filters define traffic that is to be identified. Filter action identifies how traffic will be handled once it is identified; therefore, answer A is incorrect. Tunnel endpoint identifies the predefined IP address of the router of a remote network; therefore, answer B is incorrect. Connection type identifies whether the connection can be LAN, dial-up, or both; therefore, answer D is incorrect.
Question 25 | Answers A and C are correct. Filters and filter actions work together to define traffic and then control it. Kerberos V5 is an authentication protocol that runs by default; therefore, answer B is incorrect. Connection type identifies whether a rule applies to a LAN, dial-up, or both; therefore, answer D is incorrect.
Question 26 | Answer D is correct. GPMC can be used to create and manage Group Policies. AD replication is not involved in the management of IPSec policies in a domain; therefore, answer A is incorrect. Kerberos V5 is the default authentication protocol for AD, but is not involved in managing IPSec policies; therefore, answer B is incorrect. Group Policy Object Editor can be used to edit Group Policy settings but not to manage Group Policies; therefore, answer C is incorrect.
Question 27 | Answers B and C are correct. You should use the IP Security Policy Management Console to control policies with a GUI tool. You should use netsh ipsec to control policies from the command line. Active Directory Sites and Services cannot be used to control the IPSec policies for a domain; therefore, answer A is incorrect. Local security policies on each computer cannot be used to control an entire domain; therefore, answer D is incorrect.
Question 28 | Answer C is correct. The endpoints of an IPSec connection in tunnel mode are generally router interfaces. Hubs, switches, and bridges are used to distribute traffic within a network; therefore, answers A, B, and D are incorrect.
Question 29 | Answer B is correct. Preshared key uses a string that is configured on each client and server. This method is considered non-secure and should be used only as a last resort. Certificates provide a secure method of authenticating a user in an IPSec negotiation process; therefore, answer A is incorrect. Anonymous access is not a form of authentication used with IPSec; therefore, answer C is incorrect. Kerberos is the default form of authentication with IPSec and is considered secure; therefore, answer D is incorrect.
Question 30 | Answer C is correct. SHA is a 160-bit encryption protocol that is used on most government contracts as directed by the Federal Information Processing Standard. DES is a 56-bit encryption method that is not recommended for high security networks; therefore, answer A is incorrect. 3DES is a much stronger standard that can use a 168- to 2048-bit key; therefore, answer B is incorrect. MD5 is a 128-bit encryption protocol that can be used to secure authentication as well as data; therefore, answer D is incorrect.
Question 31 | Answer B is correct. 3DES is a Diffie-Hellman algorithm that can produce up to a 2048-bit key. DES is an older algorithm that only uses a 56-bit key; therefore, answer A is incorrect. MD5 is not a Diffie-Hellman algorithm and only uses a 128-bit key; therefore, answer C is incorrect. SHA is not a Diffie-Hellman algorithm and only uses a 168-bit key; therefore, answer D is incorrect.
Question 32 | Answer D is correct. The filters are read and then processed into one ordered list that is sorted from the most specific to the least specific. The filters are not processed in order from top to bottom; therefore, answer A is incorrect. The filters are not processed in order from bottom to top; therefore, answer B is incorrect. The filters are not processed in order from least specific to most specific; therefore, answer C is incorrect.
Question 33 | Answers B and C are correct. Valid filter actions on IPSec policy filters include Permit, Block, and Negotiate Security. Allow is a setting that gives permissions; therefore, answer A is incorrect. Deny is a setting that restricts permissions; therefore, answer D is incorrect.
Question 34 | Answer A is correct. Netsh ipsec static can be used to create, modify, and assign IPSec policies without immediately affecting the active IPSec policies. Netdiag is a command used to troubleshoot network connectivity; therefore, answer B is incorrect. Gpupdate is a command used to force the effectiveness of a local Group Policy; therefore, answer C is incorrect. Netsh ipsec dynamic commands take effect immediately; therefore, answer D is incorrect.
Question 35 | Answer B is correct. You can only unrevoke a certificate if you have revoked it with the Certificate Hold reason code; it is not possible to unrevoke a certificate that has been revoked with any other reason code. It is not possible to delete a certificate from a CRL; therefore, answer A is incorrect. It is not possible to restore a CRL in this manner; therefore, answer C is incorrect. You cannot simply delete a delta CRL; therefore, answer D is incorrect.
Question 36 | Answer D is correct. If you have specified the Signature option, private keys are not archived because the digital signature purpose requires that the key not be recoverable. Answer A is incorrect because this option only allows users to export keys for backup; it does not provide for archival of keys. Answer B is incorrect because you need to use a version 2 template. Answer C is incorrect because this scenario does not require certificate autoenrollment.
Question 37 | Answer A is correct. By default, only members of the Authenticated Users group in the parent domain have permissions on the templates. You need to add an entry to the ACL for this template. Answer B is incorrect because certificate autoenrollment is not part of this scenario. Answer C is incorrect because the users were able to reach the Web enrollment pages but not the required template, so authentication on these pages was not a problem. Answer D is incorrect because the automatic certificate request policy is used to automatically enroll computers for certificates.
Question 38 | Answers B and E are correct. You might expect enterprise subordinate CAs and issuing enterprise CAs to be issuing smart card certificates. Answer A is incorrect because an enterprise root CA is not normally found in a three-tier hierarchy; rather an offline standalone root CA instead. Answers C and D are incorrect because standalone CAs cannot issue smart card certificates.
Question 39 | Answers B, C, and E are correct. You need Active Directory to deploy an enterprise CA, and Active Directory needs DNS to function properly. You also need IIS to serve the enrollment Web pages. Answers A and D are incorrect because you do not need DHCP or RIS to deploy an enterprise CA.
Question 40 | Answer B is correct. Many-to-one mapping of certificates maps a large number of certificates to a single user account. Lorne can map all certificates issued by his company's CA to a single Windows Server 2003 account, and set the access rights of the account to enable viewing of the Web pages. Answer A is incorrect because one-to-one mapping only maps a single certificate to a single account. Answer C is incorrect because there is no such thing as one-to-many mapping. Answer D is incorrect because user principal name mapping only associates a UPN to the user's account, enabling the user to use the UPN to log on (it is actually a form of one-to-one mapping).
Question 41 | Answer D is correct. The root CA's certificate is not in Active Directory, and Karen needs to publish it in Active Directory so that the subordinate CA servers can locate it. A CTL is a signed list of root CA certificates that are considered as reputable for their required purposes. Karen would need to link the GPO to every domain in the forest to accomplish her objective; therefore, answer A is incorrect. Converting the CA to an enterprise root CA would not resolve this problem; therefore, answer B is incorrect. Expanding the CA hierarchy to a third layer would not solve this problem; therefore, answer C is incorrect.
Question 42 | Answer B is correct. All computers participating in the remote access connection should have certificates from the same CA. Answer A is incorrect because all computers must have computer certificates. You could deploy certificates issued by different CAs; however, the root CA certificates for all CAs would need to be in the certificate store of both computers. Because this fact was not specified, answers C and D are incorrect.
Question 43 | Answer A is correct. ASPs need to be enabled so that Web enrollment services can be enabled. The Windows Components Wizard informs you of this while installing Certificate Services, and enables ASPs for you. Answers B, C, and D are incorrect because none of these features need to be enabled. You would obtain server certificates after you have enabled and configured Certificate Services.
Question 44 | Answers A, C, and D are correct. A version 1 template is read-only and does not support autoenrollment; hence, none of these actions are possible with version 1 templates. Answer B is incorrect because you can specify the Enroll permission for users and groups requiring certificates on a version 1 template.
Question 45 | Answer C is correct. CRLs and delta CRLs are published at intervals that you specify in the Revoked Certificates Properties dialog box. If a CRL or delta CRL has not been published since the certificate was revoked, it is possible for a user to employ the revoked certificate to access resources. Answer A is incorrect because it is not the most likely reason for this problem, although this is a possible reason. Answer B is incorrect because CRLs in an enterprise CA are replicated with Active Directory at intervals that are more frequent than the usual CRL publication interval. Answer D is incorrect because the logon would fail if the server were unable to locate a copy of the CRL.
Question 46 | Answer D is correct. Users who are enrolling others for smart cards must have the Read and Enroll permissions on the certificate templates, or the requests will be denied. Only members of the Domain Admins and Enterprise Admins groups have these permissions by default. Answer A is incorrect because Bill and Heather can connect to this server across the network. Answer B is incorrect because they can connect to an enterprise subordinate CA to perform their tasks. Answer C is incorrect because this action would grant them excessive privileges.
Question 47 | Answer C is correct. Active Directory provides the Smart Card Is Required for Interactive Logon setting. You can configure this setting for multiple user accounts from Active Directory Users and Computers. This option prevents users from logging on with user names and passwords, and thereby eliminates the weakest form of user authentication. Answers A and B are incorrect because computers running Windows 2000 are fully capable of smart card authentication. Answer D is incorrect because such a certificate is not required to implement a smart card authentication system.
Question 48 | Answers B, D, E, and G are correct. These are all requirements for autoenrollment of user and computer certificates. Answer A is incorrect because the Enroll permission is required as well as the Read and Autoenroll permissions. Answer C is incorrect because a certificate server running Windows Server 2003, Standard Edition cannot autoenroll certificates. Answer F is incorrect because client computers must run Windows XP Professional to support certificate autoenrollment. Client computers running Windows XP Home Edition cannot join a domain and hence do not support autoenrollment.
Question 49 | Answer D is correct. When exporting a certificate for EFS file recovery, you need to export the private key along with the certificate. The only available file system when exporting the private key is Personal Information Exchange - PKCS #12 (.PFX). Answers A, B, and C are incorrect because these file formats are only available when you choose the No, Do Not Export the Private Key option on the Export Private Key page of the Certificate Export Wizard.
Question 50 | Answer C is correct. By revoking the CA certificate for Res-CA, you render all certificates issued by this CA invalid. These certificates are all published on the CRL, so that no users can employ them. Answer A is incorrect because this would revoke more certificates than required. Answer B is incorrect because Res-CA is no longer available. Answer D is incorrect because the offline root CA does not hold the CA certificate for Res-CA. Answer E is incorrect because this action would invalidate a large number of certificates and require far more effort to ensure continuity of company operations.
Question 51 | Answer C is correct. This problem occurred because autoenrollment information has not yet replicated to client computers, so you need to force replication of Group Policy. Answer A is incorrect because the issue is not Active Directory replication but Group Policy replication. Answer B is incorrect because secedit is no longer used for forcing Group Policy replication; this command was used in Windows 2000 to force Group Policy replication. Answer D is incorrect because the GPO was linked to the proper container; you would only need to follow this step for applying account policies such as password and account lockout policy.
Question 52 | Answer C is correct. Service packs and hotfixes can be added to the image by editing the unattended installation file. These are added in the [GuiRunOnce] section of the file and then called from Update.exe for service packs or Hotfix.exe for hotfixes. Configuring the computers for Automatic Updates requires more administrative effort and does not conform to company policy; therefore, answer A is incorrect. This does not conform to company policy because you are relying on the users to update the systems; therefore, answer B is incorrect. WUAU22.msi is a Windows Installer-based setup program for the Automatic Updates client; therefore, answer D is incorrect.
Question 53 | Answer D is correct. Packages can be used to distribute service packs by making a new software installation package (.msi file) and linking it to a GPO through the computer configuration settings. Update.xls is a Microsoft Excel file; therefore, answer B is incorrect. Update.exe can be used to call changes in the [GuiRunOnce] section of the unattended file for a RIS install or run by itself on a standalone machine; therefore, answer B is incorrect. Update.inf would be used in a slipstream install; therefore, answer C is incorrect.
Question 54 | Answer A is correct. SUS allows each software update to be approved before it is installed in the environment. Each SUS server can support up to 15,000 clients. MBSA is a tool that scans computers to check for security holes or to assess the status of service packs and updates; therefore, answer B is incorrect. Configuring the clients to download the updates directly does not allow for testing; therefore, answer C is incorrect. Installing SMS on servers is all locations is too costly; therefore, answer D is incorrect.
Question 55 | Answer C is correct. The command mbsacli.exe /hf -r xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx scans a specified range of IP addresses, and -f filename specifies the output format that you want. The -s2 switch suppresses notes and warnings; therefore, answer A is incorrect. The command mbsacli.exe /hf -i xxx.xxx.xxx.xxx scans the named IP address, not a range; therefore, answer B is incorrect. The -s switch suppresses note messages; therefore, answer D is incorrect.
Question 56 | Answer C is correct. The process can be automated to collect the information by writing a batch file to call mbsacli.exe with the switches needed to scan only the options you deem necessary. The batch file can then be scheduled to run on a daily basis. SUS is used to manage and distribute critical Windows patches; therefore, answer A is incorrect. The Microsoft Network Security Hotfix Checker (Hfnetchk.exe) tool only checks for missing security updates and service packs; therefore, answer B is incorrect. The command-line tool Secedit.exe can be used to configure and analyze system security by comparing your current configuration to a template; therefore, answer D is incorrect.
Question 57 | Answer B is correct. If you are using the groups strictly for email purposes, distribution groups should be created. To minimize traffic, domain global groups are created and then placed in universal groups. Creating global and universal security groups does not satisfy the requirement because security groups are not needed for only email distribution; therefore, answer A is incorrect. Domain local groups cannot span other domains; therefore, answer C is incorrect. Answer D is incorrect because universal groups should used to nest global groups. It is not recommended that individual users be added to universal groups, because even if it were an acceptable practice, this would cause replication to increase and therefore, not meet the requirements.
Question 58 | Answer B is correct. You can create a hash rule for a virus or a Trojan horse to prevent the malicious software from running as well as to authorize software applications to run. Answer A is incorrect because you cannot use groups to allow users to access applications. Answer C is incorrect because you assign packages to computers not users, and this would have no effect on the application because the software restriction policy is controlled by Group Policy. A path rule specifies a file or folder for restriction or access and this is not the issue; therefore, answer D is incorrect.
Question 59 | Answer D is correct. The Securedc.inf template enhances security settings for domain controllers and limits the use of LAN Manager and NTLM authentication protocols by configuring servers to refuse LAN Manager responses. The Securews.inf security template defines enhanced security settings for servers and workstations, not domain controllers; therefore, answer A is incorrect. Windows 20003 uses NTLMv2 by default so importing the Securedc.inf security template into for the Windows 2003 domain isn't necessary; therefore, answer B is incorrect. Rootsec.inf is used to reapply or modify the root directory permissions; therefore, answer C is incorrect.
Question 60 | Answer A is correct. The least administrative effort is to use a GPO and link it to the OU. The Notssid.inf security template is used to remove the unnecessary Terminal Server SIDs from the file system and Registry locations if Terminal Server will not be used; therefore, answer B is incorrect. Linking the GPO to the Domain Controllers OU will affect all the domain controllers, not just the Web servers; therefore, answer C is incorrect. Setting the unnecessary services startup type to Manual will allow the services to be started at will and will not satisfy the company policy requirements; therefore, answer C is incorrect.


Chapter 10. Practice Exam #2

Question 1

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. You are unsure if all security patches and standards are in place for the Windows XP Professional computers. You want to use the MBSA GUI to analyze these computers. However, MBSA will not run because you recently applied a custom security template that disabled many of the services. To ensure that the MBSA can be used to evaluate the security of the computers, which services must be enabled? (Choose two; each answer represents part of the solution.)

  • A. Remote Registry

  • B. RSoP

  • C. Task Scheduler

  • D. Server

Question 2

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Your company business is Web based, and you have about 20,000 clients that access 15 different servers depending on the application the clients are using. Company policy dictates that all application servers must be securely locked down. Because these servers are hosting Web-based applications, there is a good chance that they may be compromised. To ensure that this does not happen, you want to capture changes to the security settings by generating a daily report comparing the company-required secure settings with the settings of each server. How do you do this?

  • A. Create an appropriate security template. Schedule Task Scheduler to run the gpresult command daily.

  • B. Create an appropriate security template. Write a custom script file, and then schedule Task Scheduler to run the secedit /analyze command against the template daily.

  • C. Create an appropriate security template. Import it into Group Policy and then set the policy to refresh daily.

  • D. Create an appropriate security template. Create a batch file that will run secedit /analyze against the security template on startup.

Question 3

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows 2000 and Windows XP Professional. For security purposes, several computers are not connected to the Internet. You want to run MBSA on these computers but, due to company policy, you cannot connect them to the Internet. You have decided to download the necessary file(s) to another computer, transfer the data to a CD, and then use the CD to load the data onto the computers that cannot connect to the Internet. Which of the following files must you download to analyze the security of the computers?

  • A. Hfnetchk.exe

  • B. Mssecure.xml

  • C. Mssecure.cab

  • D. Mbsacli.exe

Question 4

You have just become the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP, Windows 2000 Professional SP1, and Windows NT Workstation 4.0. You have found that many of the computers are out of date and several updates need to be installed on all computers. You want the updates to install one after the other without having the computers restart after each update. You use QChain.exe to accomplish this. After you run QChain.exe, you find that the file versions are different on some of the computers. Why is this?

  • A. QChain.exe will not work on Windows NT Workstation 4.0 or Windows 2000 earlier than SP2.

  • B. All Windows NT Workstation 4.0 and Windows 2000 updates earlier than SP2 call a mapped file rather than the KnownDLLs that are loaded in memory, and the file was overwritten.

  • C. All Windows NT Workstation 4.0 and Windows 2000 updates earlier than SP2 use the GetFileVersionInfo function to call the version of a file. The version of the file may have been overwritten by an older one.

  • D. Qfecheck.exe, not QChain.exe, is the proper utility to use for installing updates on Windows NT 4.0 and Windows 2000 computers earlier than SP2.

Question 5

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows 2000 and Windows XP Professional. Company policy states that all computers must be kept current with the latest software updates. You have already planned the configuration for the client computers and are in the process of creating an update plan for the servers. Company policy dictates that server updates must be installed within 24 hours after release by the vendor. You want to be sure that this is done with the least amount of administrative effort and intervention. How do you accomplish this?

  • A. Enable Configure Automatic Updates with the Notify for Download and Notify for Install in the Default Domain Controllers Policy GPO option.

  • B. Enable Configure Automatic Updates with the Auto Download and Notify for Install in the Default Domain Controllers Policy GPO option.

  • C. In the System Properties dialog box for each server, on the Automatic Updates tab, under Notification Settings, select the Download Updates Automatically and Notify Me When They Are Ready to Be Installed option.

  • D. Enable Configure Automatic Updates with the Auto Download and Schedule the Install in the Default Domain Controllers Policy GPO option.

Question 6

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows NT Workstation 4.0, Windows 2000, and Windows XP Professional. Due to the nature of the business, your company wants to prosecute anyone who compromises a system. Therefore, company policy dictates that a logon banner display a warning about unauthorized use of the computer. To ensure that the banner appears whenever a user logs on to a computer, which of the following should you do? (Choose two; each answer represents part of the solution.)

  • A. Create a system policy file called NTconfig.pol, which includes the desired settings. Place the file in a folder on the domain controller.

  • B. Create a GPO with the security settings configured for the interactive logon message. Link the GPO to the domain.

  • C. Create a system policy file called Registry.pol, which includes the desired settings. Place the file in a folder on the domain controller.

  • D. Create a system policy file called Config.pol, which includes the desired settings. Place the file in a folder on the domain controller

Question 7

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Several servers are not domain controllers and some of the client computers are located in each OU throughout the domain. Company policy states that office applications are not to be installed on any of the servers. All users are to have access to a new custom application. How do you configure the installation of the new application without violating company policy and with the least amount of administrative effort?

  • A. Create a GPO with the new application listed in the user software installation settings. Link the GPO to each OU. Configure the GPO permissions to deny Read and apply the GPO to servers and domain controllers.

  • B. Create a GPO with the new application listed in the user software installation settings. Link the GPO to the domain. Configure the GPO permissions to deny Read and apply the GPO to servers and domain controllers.

  • C. Create a GPO with the new application listed in the user software installation settings. Link the GPO to the domain. Configure servers and domain controllers to block policy inheritance.

  • D. Create a GPO with the new application listed in the computer software installation settings. Link the GPO to the domain. Configure the GPO permissions to deny Read and apply the GPO to servers and domain controllers.

Question 8

You are the network administrator for the Test domain, which consists of a Windows 2003 domain with client computers running Windows XP Professional. Company policy states that all service packs and hotfixes must be tested before being deployed in the production environment. You have set up a SUS server on your network to test all service packs and hotfixes before they are put into your production environment. How do you configure the Approve Updates page? (Choose two; each answer is part of the solution.)

  • A. Clear the check box beside the package(s) you do not wish to approve.

  • B. Click the Approve button located at the bottom of the page.

  • C. Click the Unapprove button located at the bottom of the page.

  • D. Check the check box beside the package(s) you do not wish to approve.

Question 9

Which type of secure Internet communication uses port 443?

  • A. SSL

  • B. PPTP

  • C. PEAP

  • D. MS-CHAP

Question 10

Which are not elements of SSL communication? (Choose two.)

  • A. Port 80

  • B. Port 443

  • C. Public keys

  • D. MS-CHAP

Question 11

Which authentication protocols can only be used by Microsoft clients and servers? (Choose two.)

  • A. CHAP

  • B. MS-CHAPv2

  • C. MPPE

  • D. MS-CHAP

Question 12

Which are forms of EAP authentication? (Choose two.)

  • A. PPTP

  • B. TLS

  • C. SHA

  • D. MD5

Question 13

Which tunneling protocol can only be used by Windows 2000 Professional and newer clients?

  • A. PPTP

  • B. L2TP

  • C. MS-CHAP

  • D. MS-CHAPv2

Question 14

Which are possible factors in multifactor authentication? (Choose two.)

  • A. NAT

  • B. Smart card

  • C. ISP

  • D. Retina scan

Question 15

Which tunneling protocol cannot always be used through a NAT?

  • A. EAP

  • B. L2TP

  • C. MS-CHAP

  • D. PPTP

Question 16

Which port of a firewall should be open to allow for PPTP tunneling?

  • A. 1723/udp

  • B. 1723/tcp

  • C. 1701/udp

  • D. 1701/tcp

Question 17

Which components of Remote Access Policy are only checked at the beginning of a session?

  • A. Conditions

  • B. Permissions

  • C. Profile

  • D. Encryption

Question 18

The conditions of policies that apply to a user specify access to a resource from 8:00 a.m. to 5:00 p.m. The profile for the same policy specifies access from 6:00 a.m. to 6:00 p.m.? Which of the following are true? (Choose two.)

  • A. The user cannot access the resource until 8:00 a.m.

  • B. The user cannot access the resource until 10:00 a.m.

  • C. The user will be forced off of the connection at 5:00 p.m.

  • D. The user will be forced off of the connection at 6:00 p.m.

Question 19

Which type of key used in SSL communication is unique with each communication?

  • A. Private

  • B. Session

  • C. Public

  • D. Preshared

Question 20

Which authentication protocol sends the user's credentials over the wire in clear text?

  • A. PAP

  • B. CHAP

  • C. MS-CHAP

  • D. Anonymous access

Question 21

Which authentication protocols provide for mutual authentication? (Choose two.)

  • A. CHAP

  • B. MS-CHAPv2

  • C. MS-CHAP

  • D. EAP

Question 22

Which Microsoft clients support MS-CHAPv2 on dial-up connections?

  • A. All clients

  • B. Only Windows 2000 and newer clients

  • C. Only Windows XP clients

  • D. Only Windows 98 and newer clients

Question 23

Which type of EAP authentication should be used for smart cards?

  • A. MD5

  • B. CHAP

  • C. TLS

  • D. DES

Question 24

Which type of tunneling protocol can only be used on an IP network?

  • A. L2TP

  • B. VPN

  • C. CHAP

  • D. PPTP

Question 25

Which tool provides a wizard that can assist you in building Internet Explorer profiles and proxy settings that are customized for your business?

  • A. Network Connections

  • B. RRAS

  • C. Active Directory Sites and Services

  • D. CMAK

Question 26

Brenda is responsible for monitoring and troubleshooting the application of security templates and security policies on her company's Active Directory network. Administrators have just completed upgrading the domain controllers from Windows 2000 to Windows Server 2003. Because she has had to spend many hours in the past troubleshooting policy application problems in Windows 2000, Brenda is excited about the new capabilities that RSoP provides. In which of the following situations should Brenda employ RSoP in logging mode?

  • A. To determine which policies apply when she moves a user from one OU to another

  • B. To determine the precedence of GPOs being applied to a user on a computer running Windows XP Professional

  • C. To test the effect of applying loopback processing policy on a computer located in the public information booth

  • D. To determine the application of policies to users after they are moved to a new security group that she has just created

Question 27

You are deploying GPOs that define security policies for the various departments in your company, each of which is represented by a different OU. You are evaluating the use of RSoP and Gpresult for measuring the effect of these GPOs on users and computers. In which of the following cases is it appropriate to use Gpresult?

  • A. To examine the policy settings for a user currently logged on to a computer

  • B. To determine the policy settings affecting a computer that is not currently available

  • C. To determine the precedence of GPOs affecting the policy settings of a given user and computer

  • D. To simulate security policy settings

Question 28

Jane is a security administrator for her company's Active Directory network. All servers run Windows Server 2003. Client computers run a mix of Windows XP Professional, Windows 2000 Professional, and Windows 98.

The company creates a new design department, so Jane creates a Design OU and moves the users and computers for the new department into this OU. She imports the Hisecws.inf security template into a GPO linked to this OU, and upgrades the Windows 98 computers to Windows XP Professional. However, the upgraded computers do not receive the same security settings as the other computers.

What action should Jane take on the upgraded computers so that all computers in the Design OU receive the same security settings?

  • A. Create a script that runs secedit to apply the Hisecws.inf template to the upgraded computers.

  • B. Join the upgraded computers to the domain and move their accounts to the Design OU.

  • C. Use the gpupdate command to force the reapplication of the GPO to the upgraded computers.

  • D. Use SCA to apply the Hisecws.inf template to each of the upgraded computers.

Question 29

You are a security engineer for a company that operates a Windows Server 2003 domain. One morning, you attempt to add new security policy settings to a GPO named Legal Policy, which is linked to your domain's Legal OU. However, Group Policy Object Editor fails to open, displaying a Failed to open the Group Policy Object. You may not have appropriate rights error message. Checking the Event Viewer application log, you notice a series of 1030 and 1058 errors.

Which two of the following are the most likely reasons for receiving this error?

  • A. A folder in the SYSVOL share is missing or corrupted.

  • B. Active Directory replication has failed.

  • C. The Active Directory database is configured with the Read-Only permission.

  • D. The File and Printer Sharing for Microsoft Networks service is disabled.

Question 30

As part of your security engineer position, you are responsible for the proper deployment of GPOs in your company's Windows Server 2003 domain. You have created several GPOs that are intended to enforce security settings on the company's computers. After users have been working on these computers for several days, you discover that the security settings failed to apply on some of the company's computers.

Which of the following tools should you use to troubleshoot this problem?

  • A. RSoP in planning mode

  • B. RSoP in logging mode

  • C. SCA

  • D. Oakley logs

Question 31

Norman is a security administrator for a company that runs an Active Directory domain. The servers run Windows 2000 Server or Windows Server 2003. Client computers run Windows 98, Windows NT Workstation 4.0, Windows 2000 Professional, or Windows XP Professional. He has used Group Policy to apply security templates, but discovers that the security settings do not apply to the computers running Windows NT or Windows 98. What should he do to apply the security settings to these computers?

  • A. Use System Policy on a Windows 2000 Server server to apply the settings.

  • B. Install a server running Windows NT Server 4.0 and apply the security templates from this server.

  • C. Use a script with the secedit command to apply the settings.

  • D. Use a script with the gpresult command to apply the settings.

Question 32

You are the security specialist on a team that has been upgrading your company's Windows NT 4.0 domain to Windows Server 2003. Your colleagues have upgraded all the servers and enabled Active Directory to run at the Windows 2003 domain and forest functional levels. They are in the midst of upgrading a series of client computers from Windows NT Workstation 4.0 to Windows XP Professional.

You have created a GPO designed to ensure that the upgraded client computers conform to the default security level of new Windows XP Professional computers and existing Windows 2000 Professional computers, which have not previously had a security policy applied. Therefore, you import the Setup security.inf template to a GPO linked to the OU in which the upgraded client computers are located.

Users at these computers report that a critical line-of-business application no longer works. This application was written for the Windows NT computers, and it will take developers four to six months to upgrade it to Windows XP standards. What should you do to ensure this application works until it can be upgraded?

  • A. Use the Compatws.inf template rather than the Setup security.inf template.

  • B. Use the Securews.inf template rather than the Setup security.inf template.

  • C. Reinstall Windows XP Professional on every upgraded client computer as a new installation.

  • D. Remove Windows XP and install Windows 2000 Professional on every upgraded client computer as a new installation.

Question 33

You are a consultant who has been hired by a small medical office to implement security policies in accordance with new laws. The office operates a workgroup with one Windows Server 2003 computer, one Windows 2000 Server computer, and seven client computers running either Windows 2000 Professional or Windows XP Professional. You decide to implement the Hisecws.inf security template. Which of the following problems might occur on this network?

  • A. Windows 2000 client computers will be unable to communicate with the Windows Server 2003 computer.

  • B. Windows XP client computers will be unable to communicate with the Windows 2000 server.

  • C. Computers on the network will be unable to communicate with the Windows 2000 server if their clocks differ by more than 30 minutes.

  • D. No computers will be able to communicate with each other unless you install an Active Directory domain.

Question 34

You have completed upgrading the servers on your company's network from Windows 2000 Server to Windows Server 2003, and need to monitor the application of a new IPSec policy that another administrator has configured. Noticing that IP Security Monitor is now implemented as an MMC snap-in, you are excited about using the new tool. Which of the following activities can you perform from the IP Security Monitor snap-in? (Choose all that apply.)

  • A. Observe facts about active IPSec policies.

  • B. View generic and specific filters related to main mode and quick mode IPSec operation.

  • C. Customize refresh rates, and use DNS name resolution for filter and security association output.

  • D. View details about IKE negotiation events.

  • E. View information related to IPSec driver inbound and outbound packet dropping.

  • F. Search for filters that match queries, such as source and destination IP addresses or range of addresses.

Question 35

Janet is a security administrator for a company that runs an Active Directory domain with a mixture of computers running Windows 2000, Windows XP Professional, and Windows Server 2003. She has been using IP Security Monitor to monitor IPSec policies on a Windows Server 2003 computer, and notices that an OU-based security policy has not been applied. To check the application of this policy further, she moves to the one domain controller that is located on the same floor as her office, which runs Windows 2000. She attempts to open the IP Security Monitor snap-in, and receives the following message: The IPSec server is unavailable or incompatible with the IPSec monitor. What should she do to solve this problem?

  • A. Move to the server on which she originally configured the IPSec policy.

  • B. Ping the IPSec server to ensure that it is available and connected to the network.

  • C. Use Netdiag.exe to verify the condition and functionality of computers on the network and check DNS name registrations.

  • D. Move to any server running Windows Server 2003.

Question 36

After John configured logging for IPSec driver events by setting the EnableDiagnostics DWORD value to 7 in the Registry, he noticed a large number of events related to various IPSec events in the system log. He is primarily interested in viewing information about IKE negotiation failures and IPSec processing failures only, and wants to ignore other IPSec driver events for the time being, so he goes back to the EnableDiagnostics DWORD Registry entry. To which of the following values should John set this Registry entry?

  • A. 1

  • B. 2

  • C. 4

  • D. 6

Question 37

Which of the following activities can you perform by using the netsh command? (Choose all that apply.)

  • A. Enable the logging of IKE events in the Event Viewer security log.

  • B. Enable the logging of IPSec driver events in the Event Viewer system log.

  • C. Modify the types of traffic that are exempted from IPSec filtering on a Windows Server 2003 computer.

  • D. Specify the extent of CRL checking during certificate-based authentication.

  • E. Enable the viewing of IPSec policy change events in the Event Viewer security log.

Question 38

You have created a new IPSec policy called Accounting IP Security Policy and enabled this policy in a GPO linked to the Accounting OU of your company's Active Directory domain. Checking the application of this policy at a computer in the Accounting OU, you discover that no security policy is being applied. You check three other computers in the same OU and discover the same result. Which of the following is a possible cause of this problem?

  • A. No filter is specified on the Rules tab of the Accounting IP Security Policy's Properties dialog box.

  • B. No filter is selected on the IP Filter List tab of the Edit Rules Properties dialog box for the Accounting IP Security Policy.

  • C. An incorrect IP address is specified for the tunnel endpoint on the Tunnel Setting tab of the Edit Rules Properties dialog box for the Accounting IP Security Policy.

  • D. No interval is specified for checking for policy changes on the General tab of the Accounting IP Security Policy's Properties dialog box.

Question 39

You are the security administrator for a company that operates an Active Directory network with all computers running Windows Server 2003 or Windows XP Professional. To ensure that IPSec is used for all network communications, you have enabled the Secure Server (Require Security) IP security policy in a GPO linked to the domain. You have also specified the No Override option for this GPO. However, you discover that unsecured communication is still taking place on the network. Which of the following is a possible reason for the occurrence of unsecured communication?

  • A. No Override is also specified on an OU-based GPO that assigns the Client (Respond Only) security policy.

  • B. The Allow Unsecured Communication with Non-IPSec-aware Computers option is specified on the Security Methods tab of the Require Security Properties dialog box.

  • C. No filter is selected on the IP Filter List tab of the Edit Rules Properties dialog box for the GPO in use.

  • D. More than one authentication method is specified on the Authentication Methods tab of the Edit Rule Properties dialog box.

Question 40

John has taken the certificate server down to perform hardware maintenance, and consequently the CRL is temporarily unavailable. At the same time, Jennifer attempts to log on to a remote access server that uses IPSec with certificate-based authentication. The remote access server is configured to use the default level of CRL checking. What happens?

  • A. Jennifer is unable to log on because the remote access server is unable to locate the CRL.

  • B. Jennifer is unable to log on because the certificate server must be available to authenticate her logon.

  • C. Jennifer is able to log on because the remote access server caches a copy of the CRL locally.

  • D. Jennifer is able to log on because the default level of CRL checking allows validation of her certificate without checking the CRL.

Question 41

Which of the following properties of an IPSec policy rule can you configure from the Edit Rule Properties dialog box and other dialog boxes accessed from there? (Choose all that apply.)

  • A. Ability to communicate in an unsecured manner with computers that are not enabled for IPSec

  • B. Source and destination ports and IP addresses covered by the rule

  • C. Permitted authentication methods

  • D. Whether communication takes place in transport or tunnel mode

  • E. Whether local IPSec policies are used

  • F. The connection type covered by the rule (LAN, remote access, or both)

  • G. Additional settings for key exchange

  • H. Which IP filter is used by the rule

Question 42

You are a security engineer for your company. You have just purchased a certificate from an external CA that will be used to verify the IPSec communications within your company and across a dedicated T1 connection to an external partner company. You have also installed an enterprise subordinate CA that will issue certificates to users requiring secured communications. However, after installing the certificate to a certificate store, communications fail with a message informing you that no trusted certificate is present. Which of the following should you do?

  • A. Export the private key associated with the certificate to every computer that requires secure communication.

  • B. Specify the Server (Request Security) policy in a domain-based GPO.

  • C. Specify the Secure Server (Require Security) policy in a domain- based GPO.

  • D. Use the Certificate Import Wizard to import the certificate to an enterprise trust list configured on a domain-based GPO.

Question 43

You are planning authentication methods for your company's new wireless network implementation. Which of the following would you use to provide certificate-based mutual authentication and use of smart cards for user logon?

  • A. Shared key authentication

  • B. EAP-TLS

  • C. EAP-MS-CHAP2

  • D. PEAP

Question 44

Which of the following authentication methods allows access according to anyone that provides the correct SSID or WEP key for the access point, thereby providing only minimum protection?

  • A. Open authentication

  • B. Shared-key authentication

  • C. 802.1x authentication with EAP-TLS

  • D. 802.1x authentication with EAP-MS-CHAPv2

Question 45

Which of the following are true statements about EAP-MS-CHAPv2? (Choose all that apply.)

  • A. EAP-MS-CHAPv2 provides mutual authentication based on password-based user and computer authentication.

  • B. EAP-MS-CHAPv2 provides mutual authentication based on smart card-based user and computer authentication.

  • C. EAP-MS-CHAPv2 is used along with PEAP to provide benefits such as an encrypted authentication channel and fast reconnect using cached session keys.

  • D. EAP-MS-CHAPv2 can be used with IAS to provide a centralized authentication mechanism for clients accessing the WLAN.

  • E. EAP-MS-CHAPv2 provides strong data encryption as well as secured authentication.

Question 46

You are using a system of shared-key authentication for authenticating users to your wireless access point, and require a data encryption standard that will work properly with this authentication method. Which of the following should you choose?

  • A. 802.1x

  • B. IPSec

  • C. WEP

  • D. EAP

Question 47

Which of the following are true about 802.1x authentication? (Choose all that apply.)

  • A. 802.1x encryption is inferior to WEP encryption and should only be used when it is not possible to use WEP.

  • B. 802.1x provides port-based network access control for authenticating clients to the WLAN.

  • C. 802.1x provides both authentication and data encryption services.

  • D. 802.1x is especially useful to provide strong security between an IAS server and a domain controller when these services are provided by different servers.

  • E. 802.1x works together with EAP-MS-CHAPv2, EAP-TLS, or EAP-MD5 to provide data encryption after the client has connected to the WLAN.

Question 48

You are setting up an IAS server that will authenticate users connecting to your network from wireless access points. Which of the following should you configure as clients of the IAS server?

  • A. Users requiring wireless access to the network

  • B. Computers used for wireless access to the network

  • C. Active Directory domain controllers

  • D. Access points from which wireless users access the network

Question 49

You have installed an IAS server to authenticate users to your company's WLAN, and need to obtain a certificate for this server. You want to obtain a certificate based on the RAS and IAS Server template, but this template is not available on the certificate server and cannot be added in the Certification Authority snap-in. Which of the following is the most likely explanation for this problem?

  • A. IIS is not installed on the CA server.

  • B. You are not logged on to the server as a member of the Enterprise Admins group.

  • C. The IAS server is not registered in Active Directory.

  • D. The CA is installed on a server running Windows Server 2003, Standard Edition. It needs to be installed on a server running Windows Server 2003, Enterprise Edition to issue a certificate based on a version 2 template such as the RAS and IAS Server template.

Question 50

Which of the following are benefits of using a RADIUS server such as Microsoft IAS to authenticate wireless connections to your network? (Choose all that apply.)

  • A. RADIUS provides centralized authentication, authorization, and accounting services.

  • B. RADIUS provides data encryption as well as authentication to wireless clients.

  • C. RADIUS provides a secure authentication service without the need for a certificate.

  • D. RADIUS can authenticate users accessing the network from multiple access points.

Question 51

Jean is a security administrator for a company that operates an Active Directory-based network. She is setting up a system of wireless access points that will allow users in the office to connect to the network from their laptop computers when in conference rooms or managers' offices. She installs an IAS server and configures three access points as clients of the IAS server. She also obtains a certificate for this server from the company's issuing CA server.

Users report that they are unable to log on to the IAS server with their user accounts. Jean tests the connection and is able to log on from her laptop using a local administrator account. Which of the following is the most likely reason that users are unable to log on to the IAS server?

  • A. The IAS server is not registered in Active Directory.

  • B. The certificate for the IAS server is not valid.

  • C. No wireless access policy is specified in the IAS snap-in.

  • D. The wireless access policy governing access to the IAS servers specifies Deny remote access permission.

Question 52

Jim is configuring a policy at his company's IAS server that will permit wireless users to access the WLAN from a wireless access point. He has accessed the New Remote Access Policy Wizard from the IAS snap-in, and specified wireless as the access method. What else must Jim do to enable users to use this policy for accessing the WLAN? (Choose two; each answer represents part of the solution.)

  • A. Specify and configure a certificate for each wireless access point.

  • B. Specify and configure a data encryption type for the policy.

  • C. Define the users or groups permitted to access the WLAN.

  • D. Specify and configure the EAP type for the policy.

Question 53

You are using SSL certificates to secure communication between client computers and various servers including Web servers, SQL servers, and domain controllers. You need to configure the IIS server to ensure that no client computers can communicate with servers unless they have certificates available. Which of the following options should you specify at the server?

  • A. Accept Client Certificates

  • B. Require Client Certificates

  • C. Enable Client Certificate Mapping

  • D. Client Authentication Purpose

  • E. Server Authentication Purpose

Question 54

Which of the following represent security benefits of using SSL on wireless networks? (Choose all that apply.)

  • A. SSL validates the identities of both the server and client computers.

  • B. SSL provides a unified policy that governs the authentication of users accessing the network from multiple access points.

  • C. SSL encrypts all information sent between the server and client computers.

  • D. SSL ensures that information sent between the server and client computers has not been altered in transit.

Question 55

You have configured a wireless access policy that specifies WEP encryption for users in your domain's Sales OU. The policy is part of a GPO that is linked to this OU. However, you discover that wireless communications involving laptop computers that belong to Sales users are not encrypted. Which of the following is a possible cause of this problem?

  • A. Another policy in a GPO linked to the domain does not specify encryption settings. This GPO is configured with the Block Policy Inheritance option.

  • B. Another policy in a GPO linked to the domain does not specify encryption settings. This GPO is configured with the No Override option.

  • C. No networks are specified in the Preferred Networks tab of the policy's Properties dialog box.

  • D. The Networks to access option on the General tab of the policy's Properties dialog box is set to Computer-to-Computer (ad hoc) networks only.

Question 56

You are configuring settings for WEP encryption and are unsure as to which encryption strengths that WEP can accommodate. Which of the following encryption strengths can be used in a WEP-based WLAN? (Choose two.)

  • A. 40 bits

  • B. 64 bits

  • C. 104 bits

  • D. 128 bits

  • E. 256 bits

Question 57

You are responsible for new Windows XP Professional laptop computers being issued to sales associates in your company. The computers contain wireless network cards and will be used to connect to customer networks by means of wireless access points. They should not be able to connect directly to other laptop computers with wireless cards. What should you do?

  • A. On the Wireless Networks tab of the wireless network connection's Properties dialog box, click Advanced. Then select Access Point (Infrastructure) Networks Only.

  • B. On the Wireless Networks tab of the wireless network connection's Properties dialog box, select the network under Available networks, and then click Configure. Then select Access Point (Infrastructure) Networks Only.

  • C. On the Wireless Networks tab of the wireless network connection's Properties dialog box, select the network under Preferred Networks, and then click Properties. Then select Access Point (Infrastructure) Networks Only.

  • D. Do nothing. The Wireless Zero Configuration service in Windows XP automatically configures the laptop computers for connecting to wireless access points.

Question 58

Which of the following operating systems require a Microsoft 802.1x Authentication Client package to use IEEE 802.1x authentication and encryption? (Choose all that apply.)

  • A. Windows 98

  • B. Windows NT 4.0

  • C. Windows 2000

  • D. Windows XP

  • E. Windows Server 2003

Question 59

You are the security engineer for your organization, which operates an Active Directory domain. A research scientist travels to a conference with his laptop computer running Windows XP Professional and presents a paper detailing a new product your company has just made public.

Several months later, your manager informs you that a competitor has just released a product that has the same secret components as your product. She suspects that the competitor has hacked the scientist's laptop computer and obtained confidential information. What should you do to prevent this from happening in the future?

  • A. On the Wireless Networks tab of the wireless network connection's Properties dialog box, click Advanced. Then clear the Automatically Connect to Non-preferred Networks check box.

  • B. On the Authentication tab of the wireless connection's Properties dialog box, clear the Authenticate As Computer When Computer Information Is Available check box.

  • C. On the Authentication tab of the wireless connection's Properties dialog box, clear the Authenticate As Guest When User or Computer Information Is Unavailable check box.

  • D. Ask the scientist to disable his wireless network adapter in Device Manager when he is in a location where eavesdroppers might be present.

Question 60

You are the network administrator for a small company. Your only server runs Windows 2000 Server. You are configuring NAT and require encryption of packets. Which of the following is the recommended tunneling protocol to use?

  • A. PPTP

  • B. L2TP

  • C. MD5

  • D. SSL


Chapter 11. Answer Key to Practice Exam #2

1. A, D

2. B

3. C

4. C

5. D

6. A, B

7. D

8. A, B

9. A

10. A, D

11. B, D

12. B, D

13. B

14. B, D

15. B

16. B

17. A, B

18. A, D

19. B

20. A

21. B, D

22. D

23. C

24. D

25. D

26. B

27. A

28. B

29. A, D

30. B

31. C

32. A

33. C

34. A, B, C, F

35. D

36. A

37. B, C, D

38. A

39. B

40. D

41. A, B, C, D, F, H

42. D

43. B

44. A

45. A, C, D

46. C

47. B, C, E

48. D

49. D

50. A, D

51. A

52. C, D

53. B

54. A, C, D

55. B

56. A, C

57. A

58. A, B, C

59. C

60. A

Question 1

Answers A and D are correct. For MBSA to run the Server service, the Remote Registry service and File and Print Sharing must be installed or enabled. The Resultant Set of Policy Provider service enables a user to connect to a remote computer to access the WMI database and check or verify the current GPO settings before they are applied; therefore, answer B is incorrect. The Task Scheduler service enables the configuration and scheduling of automated tasks; therefore, answer D is incorrect.

Question 2

Answer B is correct. By using the command-line tool Secedit.exe in a batch file or script, you can analyze the security on multiple computers at scheduled times. Running the secedit /analyze command against the template allows you to check the current settings against the template. Answer A is incorrect because it will list the effective policies but not compare them against the template. Importing the template into Group Policy and then setting the policy to refresh daily will reapply the template and will not compare the current settings against it; therefore, answer C is incorrect. You can use a batch file to analyze the security, but the key here is that "on startup" is required. Because the application servers are hosting Web-based applications, it is doubtful that the servers would be restarted everyday; therefore, answer D is incorrect.

Question 3

Answer C is correct. The Mssecure.cab file is the official file offered by Microsoft. This is a more secure design by ensuring that only the signed cab file is used, and it prevents customers from downloading a potentially out-of-date XML file; therefore, answer B is incorrect. HFNetChk and Mbsacli.exe will check for missing security updates but both rely on the XML database file; therefore, answers A and D are incorrect.

Question 4

Answer C is correct. All Windows NT 4.0 and Windows 2000 updates earlier than SP2 use the GetFileVersionInfo function to call the version of a file. If you install two or more Windows NT 4.0 updates or pre-SP2 Windows 2000 updates, and the updates contain different KnownDLLs for the Registry key, Qchain does not make sure that the latest version file is installed. Qchain will work on Windows NT 4.0 and Windows 2000 machines earlier than SP2; therefore, answer A is incorrect. Answer B describes a post-SP2 Windows 2000 fix where GetFileVersionInfo calls a mapped file rather than the KnownDLLs that are loaded in memory; therefore, it is incorrect. Qfecheck.exe tracks and verifies installed Windows 2000 and Windows XP hotfixes; therefore, answer D is incorrect.

Question 5

Answer D is correct. The Auto Download and Schedule the Install in the Default Domain Controllers Policy GPO option will allow the updates to download and install without any administrative interference. The Notify for Download and Notify for Install in the Default Domain Controllers Policy GPO option and the Auto Download and Notify for Install in the Default Domain Controllers Policy GPO option both require administrative effort and might not satisfy the requirement of being installed within 24 hours of release; therefore, answers A and B are incorrect. Configuring each server individually requires too much administrative effort; therefore, answer C is incorrect.

Question 6

Answers A and B are correct. Although Group Policy has pretty much replaced the System Policy editor since Windows 2000 operating systems came into being, there are situations in which you will still have to configure a policy file. This includes computers that run Windows NT Workstation 4.0 and Server. To manage these computers, you need to use NTconfig.pol. Windows 2000 standalone computers use a Registry.pol file for providing settings for multiple users; therefore, answer C is incorrect. Config.pol files are used on Windows 95 and 98 computers; therefore, answer D is incorrect.

Question 7

Answer D is correct. Linking the GPO to each OU might work but the requirements are to do this with the least amount of administrative effort; therefore, answer A is incorrect. Configuring the user settings will not guarantee that the applications will not get installed on the servers; therefore, answer B is incorrect. Some policies might need to be applied to the servers and domain controllers, so blocking policy inheritance could have adverse affects; therefore, answer C is incorrect.

Question 8

Answers A and B are correct. In order not to approve updates, such as for testing purposes, clear the check box beside the package(s) you do not wish to approve and then click the Approve button located at the bottom of the page. An Unapprove button doesn't exist; therefore, answers C and D are incorrect.

Question 9

Answer A is correct. SSL is the method of securing Internet communications using port 443. PPTP is a tunneling protocol that uses port 1723/tcp; therefore, answer B is incorrect. PEAP is an authentication protocol that requires a user's credentials (username and password); therefore, answer C is incorrect. MS-CHAP is an authentication protocol used with remote access servers; therefore, answer D is incorrect.

Question 10

Answers A and D are correct. Port 80 and MS-CHAP are not elements of SSL communication. Port 443 must be assigned to the Web site that will use SSL; therefore, answer B is incorrect. Public keys are used to encrypt the session key used in SSL communication; therefore, answer C is incorrect.

Question 11

Answer B and D are correct. MS-CHAP and MS-CHAPv2 can only be used by Microsoft clients and servers. CHAP can be used by most clients and other network devices; therefore, answer A is incorrect. MPPE is an encryption protocol, not an authentication protocol; therefore, answer C is incorrect.

Question 12

Answers B and D are correct. EAP-TLS authentication uses certificates to authenticate the client. It can be used with smart cards. MD5 uses algorithms to authenticate the client and the message. PPTP is used with VPN communications and is not an EAP protocol; therefore, answer A is incorrect. SHA is an encryption protocol; therefore, answer C is incorrect.

Question 13

Answer B is correct. L2TP can only be used by Windows 2000 Professional and newer clients. PPTP can be used by all Microsoft clients; therefore, answer A is incorrect. MS-CHAP and MS-CHAPv2 are not tunneling protocols; therefore, answers C and D are incorrect.

Question 14

Answers B and D are correct. With multifactor authentication, users can be authenticated based on something that they have, something that they know, and/or something that they are. A smart card is something that they have. A user's retina is something that they are. NAT is not part of multifactor authentication; therefore, answer A is incorrect. An ISP is an organization that gives access to the Internet and is not part of multifactor authentication; therefore, answer C is incorrect.

Question 15

Answer B is correct. L2TP uses IPSec for encryption and requires NAT Traversal to be used through a NAT. EAP is a type of authentication protocol, but not a tunneling protocol; therefore, answer A is incorrect. MS-CHAP is not a tunneling protocol; therefore, answer C is incorrect. PPTP can always be used through a NAT device; therefore, answer D is incorrect.

Question 16

Answers B is correct. Port 1723/tcp is assigned to PPTP. Port 1723/udp is not assigned to a tunneling protocol; therefore, answer A is incorrect. Port 1701/udp is assigned to L2TP; therefore, answer C is incorrect. Port 1701/tcp is not assigned to a tunneling protocol; therefore, answer D is incorrect.

Question 17

Answer A and B are correct. Conditions and permissions are only checked once at the beginning of the session. The profile is checked at the beginning of the session and periodically during the session; therefore, answer C is incorrect. Encryption can be used in remote sessions but is not a component of Remote Access Policy; therefore, answer D is incorrect.

Question 18

Answers A and D are correct. The user must meet both the conditions and the profile to access the resource. He must then meet only the profile to continue to use the resource. The user can access the resource at 8:00 a.m.; therefore, answer B is incorrect. The user will be forced off the connection at 6:00 p.m.; therefore, answer C is incorrect.

Question 19

Answer B is correct. Each new communication using SSL uses a new and unique session key. Private and public keys make up a key pair that is used repeatedly by a user; therefore, answers A and C are incorrect. Preshared keys are strings that are sometimes used in IPSec and other communication protocols but are not used with SSL; therefore, answer D is incorrect.

Question 20

Answer A is correct. Password Authentication is an older protocol that sends users' credentials (username and password) in clear text. It should only be used as a last resort for compatibility with old clients. CHAP and MS-CHAP do not send users' credentials over the wire in clear text; therefore, answers B and C are incorrect. Anonymous access is a type of authentication (or non-authentication) used with Web servers. It does not require user credentials; therefore, answer D is incorrect.

Question 21

Answers B and D are correct. MS-CHAPv2 and EAP each provide for mutual authentication of the client and the server? CHAP does not provide for mutual authentication; therefore, answer A is incorrect. MS-CHAP does not provide for mutual authentication; therefore, answer C is incorrect.

Question 22

Answer D is correct. Only Microsoft Windows 98 and newer clients support MS-CHAPv2 on dial-up connections. Windows 95 clients support MS-CHAPv2 on VPN connections but not dial-up; therefore, answer A is incorrect. Windows 98 and newer clients support MS-CHAP on dial-up connections; therefore, answers B and C are incorrect.

Question 23

Answer C is correct. EAP-TLS should be used with smart cards. MD5 is a type of EAP authentication protocol but it is not used with smart cards; therefore, answer A is incorrect. CHAP is not a type of EAP authentication protocol; therefore, answer C is incorrect. DES is an encryption protocol and not an authentication protocol; therefore, answer D is incorrect.

Question 24

Answer D is correct. PPTP is a tunneling protocol that can only be used on an IP network. L2TP can be used on IP, IPX, Frame Relay, and X25 networks; therefore, answer A is incorrect. VPN stands for virtual private network and is not a tunneling protocol; therefore, answer B is incorrect. CHAP is an authentication protocol used with remote access connections, but is not a tunneling protocol; therefore answer C is incorrect.

Question 25

Answer D is correct. CMAK provides a wizard that can assist you in building Internet Explorer profiles and proxy settings that are customized for your business. Network Connection is a tool that is manually configured on each client; therefore, answer A is incorrect. RRAS is a tool that is used to create and manage remote access connections; therefore, answer B is incorrect. Active Directory Sites and Services is a tool that is used to manage the physical aspects of Active Directory, such as sites and subnets; therefore, answer C is incorrect.

Question 26

Answer B is correct. Brenda should use RSoP in logging mode to determine policy precedence, which helps her to troubleshoot the reason why conflicting policies are not applying as expected. Answers B, C, and D are incorrect as Brenda needs to use RSoP in planning mode to achieve any of these objectives.

Question 27

Answer A is correct. Gpresult is useful for examining current policy settings. This application produces output that is similar to that generated by running RSoP in logging mode. Answer B is incorrect because Gpresult cannot determine policy settings for a computer that is not available. Answer C is incorrect because Gpresult does not provide precedence settings (you need to use RSoP in logging mode). Answer D is incorrect because only RSoP in planning mode simulates security policy settings.

Question 28

Answer B is correct. When Jane upgrades the Windows 98 computers to Windows XP Professional, they are not automatically joined to the domain. When she joins them to the domain and moves their accounts to the Design OU, the GPO will automatically be applied. There is no need to use a script; therefore, answer A is incorrect. Reapplication of the GPO will not work because the computers are not yet joined to the domain and OU; therefore, answer C is incorrect. There is also no need to use SCA; therefore, answer D is incorrect.

Question 29

Answers A and D are correct. Errors with event ID 1030 and 1058 can appear in the application log and repeat at approximately six-minute intervals if a folder in the SYSVOL share is missing or corrupted, or if File and Printer Sharing for Microsoft Networks is disabled. If Active Directory replication has failed, you may receive errors with event IDs 1000 and 1002; therefore, answer B is incorrect. If the local database on a member server is configured with read-only permissions, you may receive a 1208 error; therefore, answer C is incorrect.

Question 30

Answer B is correct. RSoP in logging mode will provide you with information that will help you to determine what policies have applied and in which order. Planning mode is used to simulate policy settings and not to troubleshoot settings that have been applied; therefore, answer A is incorrect. SCA is used to analyze and configure security templates on individual computers and not to troubleshoot application of security settings; therefore, answer C is incorrect. Oakley logs are used in troubleshooting IPSec and not security policies; therefore, answer D is incorrect.

Question 31

Answer C is correct. This method can be used to apply security settings to pre-Windows 2000 computers. System Policy cannot apply security templates; therefore, answer A is incorrect. A Windows NT 4.0 server also cannot apply security templates; therefore, answer B is incorrect. Gpresult is used to analyze GPO application and not to apply security settings; therefore, answer D is incorrect.

Question 32

Answer A is correct. The Compatws.inf template is designed to provide a security level that is comparable to that of the Windows NT 4.0 computers, so that applications designed for that operating system can run properly on the Windows XP computers. You should note that this template actually provides a lower level of security than the default level, and should only be used in situations such as the one described here. You should apply a more secure template such as Securews.inf after the application has been upgraded. However, this template will not permit the application to run in its current security context; therefore, answer B is incorrect. Reinstallation of Windows XP or use of Windows 2000 instead will not solve this problem; therefore, answers C and D are incorrect.

Question 33

Answer C is correct. Computers configured with the Hisecws.inf or Securews.inf templates cannot communicate with a Windows 2000 server if their clocks differ by more than 30 minutes. Apart from this problem, communication among these computers presents little or no problems; therefore, answers A and B are incorrect. There is no need for an Active Directory domain to enable security templates; therefore, answer D is incorrect.

Question 34

Answers A, B, C, and F are correct. The IP Security Monitor snap-in allows you to perform all these tasks and several others. Details about the IKE negotiation events are recorded in the Oakley log; therefore, answer D is incorrect. Information related to IPSec packet dropping is recorded in the Event Viewer system log; therefore, answer E is incorrect.

Question 35

Answer D is correct. The IP Security Monitor snap-in can run on computers running Windows XP or Windows Server 2003 only. Janet received this message because she attempted to run this snap-in on a Windows 2000 server. She could also use the Ipsecmon.exe tool included with Windows 2000; however, this tool does not have the same level of functionality of the Windows Server 2003 IP Security Monitor tool. Answer A is incorrect because she can use the IP Security Monitor tool from any computer running Windows XP or Windows Server 2003. Answers B and C are incorrect because the problem is related to the operating system on the server in question, and not to network connectivity problems.

Question 36

Answer A is correct. Setting the EnableDiagnostics Registry value to 1 enables the logging of bad SPI packets, IKE negotiation failures, IPSec processing failures, packets received with invalid packet syntax, and unauthenticated hashes. It disables the logging of dropped inbound and outbound packets. A value of 2 logs inbound per-packet drop events only; therefore, answer B is incorrect. A value of 4 logs outbound per-packet drop events only; therefore, answer C is incorrect. A value of 6 logs inbound and outbound per-packet drop events only; therefore, answer D is incorrect. Note that you can also specify these values by using the netsh command.

Question 37

Answers B, C, and D are correct. These are all activities that you can enable using the netsh command. You need to edit the Registry to enable the logging of IKE events; therefore, answer A is incorrect. You need to configure an auditing policy to enable the viewing of IPSec policy change events; therefore, answer E is incorrect.

Question 38

Answer A is correct. While at least one filter is always present on the IP Filter list on the Rules tab, you need to ensure that the check box opposite the required filter(s) is selected to apply the filter action. It is not possible to have no filter selected on the IP Filter List tab of the Edit Rule Properties tab; therefore, answer B is incorrect. Specifying an incorrect IP address on the Tunnel Setting tab would result in communication failing rather than in the filter not applying; therefore, answer C is incorrect. It is not possible to have no interval specified on the General tab; therefore, answer D is incorrect.

Question 39

Answer B is correct. Unsecured communication can occur if the Allow Unsecured Communication with Non-IPSec-aware Computers check box is selected. This check box is not selected by default in the Secure Server (Require Security) policy. You should not make changes to the properties of the default IPSec policies; rather, you should create your own custom policies if such a need arises. If No Override were specified on an OU-based GPO, this would not have an effect on the domain-based GPO, since you specified No Override on that GPO also. Therefore, answer B is incorrect. It is not possible to have no filter selected on the IP Filter List tab of the Edit Rule Properties tab; therefore, answer C is incorrect. The number of authentication methods specified on the Authentication Methods tab is immaterial to this problem; therefore, answer D is incorrect.

Question 40

Answer D is correct. The default level of CRL checking specifies that the server will check the CRL during authentication but only fail the validation if the CRL explicitly indicates a revoked certificate. Answer A is incorrect because you need to use the netsh command or edit the Registry to specify a stronger level of CRL checking that fails a logon when the CRL is unavailable. Answer B is incorrect for the same reason. Answer C is incorrect because the remote access server looks for the certificate server to locate the CRL.

Question 41

Answers A, B, C, D, F, and H are correct. The ability to communicate in an unsecured manner is configured from the Properties dialog box of the applied filter action on the Filter Actions tab. The source and destination ports and IP addresses are configured from the Properties dialog box of the IP filter specified on the IP Filter List tab. Permitted authentication methods are configured from the Authentication Methods tab. The use of transport or tunnel mode is configured from the Tunnel Setting tab. The connection type covered by the rule is configured from the Connection Type tab. Which IP filter is used by the rule is specified from the IP Filter List tab. Answer E is incorrect because local IPSec policies are only used in non-domain computers or if no IPSec policy has been assigned in the Group Policy Object Editor console. Answer G is incorrect because you configure additional settings for key exchange by clicking the Settings button found on the General tab of the policy's Properties dialog box.

Question 42

Answer D is correct. Windows Server 2003 provides the Certificate Import Wizard to create a certificate trust list (CTL) that enables you to control the purpose and validity of certificates issued by an external CA. You do not need to export private keys to every computer; therefore, answer A is incorrect. This problem is related to the availability of the external certificate and not to the security policy in use; therefore, answers B and C are incorrect.

Question 43

Answer B is correct. Among the benefits provided by EAP-TLS are certificate-based authentication and use of smart cards. This authentication method also provides several other benefits such as negotiation of the encryption method and encrypted key determination. None of the other authentication methods provide these abilities; therefore, answers A, C, and D are incorrect.

Question 44

Answer A is correct. Open authentication works in this manner and provides only minimum protection. It should not be used except with additional protection or as a temporary measure when troubleshooting authentication by a stronger mechanism. The other authentication methods rely on additional means of protection; therefore, answers B, C, and D are incorrect.

Question 45

Answers A, C, and D are correct. EAP-MS-CHAPv2 provides all these benefits when used for authenticating users to a WLAN. You need to use EAP-TLS for smart card-based authentication; therefore, answer B is incorrect. You need to use another service such as WEP or 802.1x for data encryption; therefore, answer E is incorrect.

Question 46

Answer C is correct. WEP can work along with either open-system or shared-key authentication. 802.1x encryption only works along with an EAP-based authentication method; therefore, answer A is incorrect. IPSec is used to provide encryption on the wired network only beyond the wireless access point; therefore, answer C is incorrect. EAP is an authentication protocol, not a data encryption protocol; therefore, answer D is incorrect.

Question 47

Answers B, C, and E are correct. Answer A is incorrect because 802.1x encryption is stronger than that provided by WEP. Answer D is incorrect because you should use IPSec to provide strong security between servers on the wired network.

Question 48

Answer D is correct. You configure the access points as IAS clients. Users who access the network or computers used by them are clients of the access point, not the IAS server; therefore, answers A and B are correct. The IAS server uses the domain controller (which may be the same machine) to authenticate domain users; therefore, it is a client of the domain controller; therefore answer C is incorrect.

Question 49

Answer D is correct. If IIS were not installed on the CA server, it would be unable to serve the Certificate Web pages to issue certificates; therefore, answer A is incorrect. You do not need to be a member of the Enterprise Admins group to obtain the required certificate; therefore, answer B is incorrect. You need to register the IAS server in Active Directory so that it can authenticate domain user accounts, but not for obtaining a certificate; therefore, answer C is incorrect.

Question 50

Answers A and D are correct. These are benefits of using RADIUS for authenticating wireless users. You need to use another technology such as 802.1x for data encryption; therefore, answer B is incorrect. One of the steps involved in setting up a secure RADIUS system is obtaining a certificate from a CA (either local or external); therefore, answer D is incorrect.

Question 51

Answer A is correct. The IAS server needs to be registered in Active Directory so that it can authenticate users with domain user accounts. Jean used a local administrator account on the IAS server; therefore, the server was able to authenticate her with this account. Answers B, C, and D are all incorrect because Jean would also have been unable to access the IAS server if any of these conditions were true.

Question 52

Answers C and D are correct. Jim needs to define which users or groups are permitted to access the WLAN, and the EAP type (PEAP, or smart card or other certificate). Answer A is incorrect because only the IAS server needs a certificate; the access points do not need certificates. Answer B is incorrect because remote access policies do not contain data encryption settings.

Question 53

Answer B is correct. When you require SSL from the Secure Communications dialog box in IIS, you are given the choice of Ignore Client Certificates, Accept Client Certificates, or Require Client Certificates. You must choose the last option to ensure that no communication takes place without certificates. The Accept Client Certificates option looks for client certificates but will still communicate with a client that does not have a certificate; therefore, answer A is incorrect. Client certificate mapping allows access control to resources using client certificates but does not prevent communication without a certificate; therefore, answer C is incorrect. Server and client authentication purposes are stated on the certificate to indicate how a certificate may be utilized. They do not define whether a certificate is required for a given type of communication; therefore, answers D and E are incorrect.

Question 54

Answers A, C, and D are correct. Answer B is incorrect because providing of a unified policy that governs the authentication of users accessing the network from multiple access points is a function of IAS Server, not SSL.

Question 55

Answer B is correct. If a GPO linked to the domain contains conflicting settings and is configured with the No Override option, this option prevents contained in its GPO from being overwritten by other GPOs that are processed later in the policy processing sequence, such as a GPO linked to the Sales OU. Consequently, the policies in this GPO are not applied, including its encryption settings. The Block Policy Inheritance option prevents policy settings in the domain-based GPO from applying to the Sales OU in this case. That would not produce the observed result; therefore, answer A is incorrect. If no networks were specified in the Preferred Networks tab, wireless communication would not take place unless the Automatically Connect to Non-preferred Networks Option is selected; consequently, answer C is incorrect. If the Networks to Access Option were set to Computer-to-Computer (Ad Hoc) Networks Only, no wireless communication would occur except between individual wireless-enabled computers. This option does not affect encryption settings; therefore, answer D is incorrect.

Question 56

Answers A and C are correct. WEP uses a symmetric cryptography system known as RC4 with a standard 40-bit key, or in some cases, a 104-bit key to protect data against unauthorized access. Answers B, D, and E are incorrect as these bit lengths are not used by WEP.

Question 57

Answer A is correct. The Advanced dialog box, accessed by clicking Advanced from the Wireless Networks tab, contains options that control the type of networks that can be accessed (infrastructure, ad hoc, or both). This option is not found in the Available Networks or Preferred Networks section of the Wireless Networks tab; therefore, answers B and C are incorrect. By default, Windows allows connection to either type of wireless network; therefore, answer D is incorrect.

Question 58

Answers A, B, and C are correct. These operating systems require a Microsoft 802.1x Authentication Client package to use IEEE 802.1x authentication and encryption. This package is available by free download for Windows 2000 and by means of a Premier or Alliance support contract for Windows 98 and NT 4.0. Windows XP and Windows Server 2003 support 802.1x without the need for any add-on package.

Question 59

Answer C is correct. If the laptop computer is configured for guest authentication, the Wireless Zero Configuration service can create an ad hoc network with an unauthorized user and make this scenario possible. Clearing the Authenticate As Guest When User or Computer Information Is Unavailable check box prevents this from happening. Disabling the Automatic Connect to Non-preferred Networks option does not prevent this scenario from occurring; therefore, answer A is incorrect. The Authenticate As Computer When Computer Information Is Available check box governs authentication to the network and not guest access; therefore, answer C is incorrect. Disabling the wireless network adapter would prevent this type of connection, but this is a tedious and error-prone means of solving this problem. Therefore answer D is incorrect.

Question 60

Answer A is correct. PPTP is the recommended protocol to use when tunneling with NAT using Microsoft servers earlier than Windows Server 2003. L2TP uses IPSec for encryption, and Microsoft servers prior to Windows Server 2003 cannot use IPSec and NAT together; therefore, answer B is incorrect. Neither MD5 nor SSL are tunneling protocols; therefore, answers C and D are incorrect.


Appendix A. CD Contents and Installation Instructions

The CD features an innovative practice test engine powered by MeasureUp™,giving you yet another effective tool to assess your readiness for the exam.


Multiple Test Modes

MeasureUp practice tests are available in Study, Certification, Custom, Adaptive, Missed Question, and Non-Duplicate question modes.

Study Mode

Tests administered in Study Mode enable you to request the correct answer(s) and explanation to each question during the test. These tests are not timed. You can modify the testing environment during the test by selecting the Options button.

Certification Mode

Tests administered in Certification Mode closely simulate the actual testing environment you will encounter when taking a certification exam. These tests do not enable you to request the answer(s) and/or explanation to each question until after the exam.

Custom Mode

Custom Mode enables you to specify your preferred testing environment. Use this mode to specify the objectives you want to include in your test, the timer length, and other test properties. You can also modify the testing environment during the test by selecting the Options button.

Adaptive Mode

Tests administered in Adaptive Mode closely simulate the actual testing environment you will encounter taking an Adaptive exam. After answering a question, you are not allowed to go back—you are only allowed to move forward during the exam.

Missed Question Mode

Missed Question Mode enables you to take a test containing only the questions you have missed previously.

Non-Duplicate Mode

Non-Duplicate Mode enables you to take a test containing only questions not displayed previously.


Random Questions and Order of Answers

This feature helps you learn the material without memorizing questions and answers. Each time you take a practice test, the questions and answers appear in a different randomized order.


Detailed Explanations of Correct and Incorrect Answers

You'll receive automatic feedback on all correct and incorrect answers. The detailed answer explanations are a superb learning tool in their own right.


Attention to Exam Objectives

MeasureUp practice tests are designed to appropriately balance the questions over each technical area covered by a specific exam.


Installing the CD

The minimum system requirements for the CD-ROM are

  • Windows 95, 98, Me, NT 4.0, 2000, or XP

  • 7MB disk space for the testing engine

  • An average of 1MB disk space for each test

To install the CD-ROM, follow these instructions:

If you need technical support, please contact MeasureUp at 678-356-5050 or email support@measureup.com. Additionally, you'll find Frequently Asked Questions (FAQs) at www.measureup.com.

  1. Close all applications before beginning this installation.

  2. Insert the CD into your CD-ROM drive. If the setup starts automatically, go to step 5. If the setup does not start automatically, continue with step 3.

  3. From the Start menu, select Run.

  4. In the Browse dialog box, double-click Setup.exe. In the Run dialog box, click OK to begin the installation.

  5. On the Welcome screen, click Next.

  6. To agree to the Software License Agreement, click Yes.

  7. On the Choose Destination Location screen, click Next to install the software to C:\Program Files\Certification Preparation.

  8. On the Setup Type screen, select Typical Setup. Click Next to continue.

  9. After the installation is complete, verify that Yes, I Want to Restart My Computer Now is selected. If you select No, I Will Restart My Computer Later, you will not be able to use the program until you restart your computer.

  10. Click Finish.

  11. After restarting your computer, choose Start, Programs, MeasureUp Practice Tests.

  12. Select the practice test you want to access and click Start Test.

Creating a Shortcut to the MeasureUp Practice Tests

To create a shortcut to the MeasureUp practice tests, follow these steps:

  1. Right-click on your Desktop.

  2. From the shortcut menu, select New, Shortcut.

  3. Browse to C:\Program Files\MeasureUp Practice Tests and select the MeasureUpCertification.exe or Localware.exe file.

  4. Click OK.

  5. Click Next.

  6. Rename the shortcut MeasureUp.

  7. Click Finish.

After you have completed step 7, use the MeasureUp shortcut on your Desktop to access the MeasureUp practice test.


Technical Support

If you encounter problems with the MeasureUp test engine on the CD-ROM, please contact MeasureUp at 678-356-5050 or email support@measureup.com. Technical support hours are from 8:00 a.m. to 5:00 p.m. EST Monday through Friday. Additionally, you'll find Frequently Asked Questions (FAQs) at www.measureup.com.

If you'd like to purchase additional MeasureUp products, call 678-356-5050 or 800-649-1MUP (1687), or visit www.measureup.com.


Appendix B. Suggested Reading and Resources

    General Resources

    Chapter 1

    Chapter 2

    Chapter 3

    Chapter 4

    Chapter 5

    Chapter 6

    Chapter 7


General Resources

Microsoft Certified Professional and Office Specialist Exams: www.microsoft.com/traincert/mcpexams/default.asp

Microsoft Learning: View New and Upcoming Exams: www.microsoft.com/traincert/mcpexams/status/new.asp

TechNet Windows Server 2003: www.microsoft.com/technet/prodtechnol/windowsserver2003/default.mspx


Chapter 1

Best Practices for Delegating Active Directory Administration, Appendices, Appendix F, "Logon Rights and Privileges." www.microsoft.com/downloads/details.aspx?FamilyID=29dbae88-a216-45f9-9739-cb1fb22a0642&displaylang=en

Windows Server 2003 Security Guide: www.microsoft.com/downloads/details.aspx?FamilyID=8a2643c1-0685-4d89-b655-521ea6c7b4db&displaylang=en

Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP: www.microsoft.com/downloads/details.aspx?FamilyID=1b6acf93-147a-4481-9346-f93a4081eea8&displaylang=en

Technical Overview of Windows Server 2003 Security Services: www.microsoft.com/windowsserver2003/techinfo/overview/security.mspx

Group Policy Infrastructure White Paper: www.microsoft.com/downloads/details.aspx?FamilyID=d26e88bc-d445-4e8f-aa4e-b9c27061f7ca&displaylang=en

Exchange Server 2003 Security Enhancements: www.microsoft.com/exchange/evaluation/Security_e2k3.asp

Microsoft SQL Server Features: www.microsoft.com/sql/evaluation/features/


Chapter 2

Software Update Services: www.microsoft.com/windowsserversystem/sus/default.mspx

Microsoft Solutions for Management: Patch Management Using Microsoft Software Update Services: www.microsoft.com/downloads/details.aspx?FamilyId=38D7E99B-E780-43E5-AA84-CDF6450D8F99&displaylang=enURL

Software Update Services Feature Pack, Systems Management Server 2.0: www.microsoft.com/smserver/evaluation/overview/featurepacks/suspack.asp

Software Update Services Overview White Paper: www.microsoft.com/windowsserversystem/sus/susoverview.mspx

Patch Management, Security Updates, and Downloads: www.microsoft.com/technet/security/topics/patch/default.mspx

Software Update Services Deployment White Paper: www.microsoft.com/windowsserversystem/sus/susdeployment.mspx

Standardizing the Patch Experience: www.microsoft.com/technet/security/topics/patch/stdpatex.mspx

Microsoft Security Baseline Analyzer: www.microsoft.com/technet/security/tools/mbsahome.mspx

Microsoft Knowledge Base Article—303215, "Microsoft Network Security Hotfix Checker (Hfnetchk.exe) Tool Is Available": http://support.microsoft.com/default.aspx?scid=kb;en-us;303215&sd=tech


Chapter 3

HOW TO: Configure IPSec Tunneling in Windows Server 2003: http://support.microsoft.com/?kbid=816514

Windows XP product documentation, "Transport Mode": www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/sag_IPSec_Und10.asp

Deploying IPSec: www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/enus/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dnsbj_ips_overview.asp

Assigning IPSec policy: www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/sag_IPSECpolassign.asp

Using Microsoft Windows IPSec to Help Secure an Internal Corporate Network Server: www.microsoft.com/downloads/details.aspx?FamilyID=a774012a-ac25-4a1d-8851-b7a09e3f1dc9&displaylang=en

Windows 2000 Advanced Server documentation, "IPSec Security Protocols": www.microsoft.com/windows2000/en/advanced/help/default.asp?url=/windows2000/en/advanced/help/sag_IPSECsecprotocols.htm


Chapter 4

Administrator's Guide to Microsoft L2TP/IPSec VPN Client: www.microsoft.com/technet/itsolutions/network/security/vpnclnta.mspx

Virtual Private Networks for Windows Server 2003: www.microsoft.com/windowsserver2003/technologies/networking/vpn/default.mspx

HOW TO: Install and Configure a Virtual Private Network Server in Windows Server 2003: http://support.microsoft.com/default.aspx?scid=kb;en-us;323441

VPN Servers and Firewall Configuration: www.microsoft.com/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/sag_VPN_und13.asp

Using the CMAK Wizard to Build a Service Profile: www.microsoft.com/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/cmak_ops_86.asp

HOW TO: Configure a NAT Server in Windows Server 2003: http://support.microsoft.com/default.aspx?scid=kb;en-us;324264

Overview of Network Address Translation (NAT) in Windows XP: www.microsoft.com/technet/prodtechnol/winxppro/deploy/nattrnsv.mspx

Microsoft Privacy Protected Network Access: Virtual Private Networking and Intranet Security: www.microsoft.com/windows2000/techinfo/howitworks/communications/remoteaccess/nwpriv.asp


Chapter 5

Smith, Ben and Brian Komar. Microsoft Windows Security Resource Kit. Microsoft Press. Redmond, Washington. 2003. ISBN 0-7356-1868-2.

Internet Security Systems, Inc. Microsoft Windows 2000 Security Technical Reference. Microsoft Press. Redmond, Washington. 2000. ISBN 0-7356-0858-X.

Bragg, R., Microsoft Windows Server 2003 Security Administrator's Companion. Microsoft Press. Redmond, Washington. 2004. ISBN 0-7356-1574-8.

Key Archival and Management in Windows Server 2003: www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/kyacws03.mspx

Best Practices for Implementing a Microsoft Windows Server 2003 Public Key Infrastructure: www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws3pkibp.mspx

Troubleshooting Certificate Status and Revocation: www.microsoft.com/technet/prodtechnol/winxppro/support/tshtcrl.mspx


Chapter 6

HOW TO: Troubleshoot Missing SYSVOL and NETLOGON Shares on Windows Server 2003 Domain Controllers: http://support.microsoft.com/default.aspx?scid=kb;en-us;327781

HOW TO: Reset User Rights in the Default Domain Group Policy in Windows Server 2003: http://support.microsoft.com/default.aspx?scid=kb;en-us;324800

SENT Event IDs 1000, 1202, 412, and 454 Are Logged Repeatedly in the Application Event Log: http://support.microsoft.com/default.aspx?scid=kb;en-us;278316

Unexpected Results Occur If You Set File Security by Using Either Group Policy or Security Templates: http://support.microsoft.com/default.aspx?scid=kb;en-us;321470

Public Key Certificate: www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dnsbj_ips_gmla.asp

Virtual Private Networking with Windows Server 2003: Deploying Site-to-Site VPNs: www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/networking/vpndpls2.mspx


Chapter 7

Weber, Chris and Gary Bahadur. Windows XP Professional Security. McGraw-Hill-Osborne. Berkeley, California. 2002. ISBN 0-07-222602-1.

Securing Wireless LANs – A Windows Server 2003 Certificate Services Solution: Planning Guide, Chapter 6, "Planning Guide 6—Designing Wireless LAN Security Using 802.1X": www.microsoft.com/technet/security/prodtech/win2003/pkiwire/plan/swlanpg6.mspx

Securing Wireless LANs – A Windows Server 2003 Certificate Services Solution: Build Guide, Chapter 4, "Implementing Wireless LAN Security Using 802.1X": www.microsoft.com/technet/security/prodtech/win2003/pkiwire/build/swlanbg4.mspx

Ask Us About…Security—February, 2003: www.microsoft.com/technet/archive/community/columns/security/askus/auas0303.mspx

Certificates: www.microsoft.com/technet/security/topics/crypto/certs.mspx

Enterprise Deployment of Secure 802.11 Networks Using Microsoft Windows: www.microsoft.com/WindowsXP/pro/techinfo/deployment/wireless/default.asp


Glossary

802.1x authentication

Used in wireless authentication. In the first stage of authentication, the device proves it is authorized to connect to the network. This method uses Extensible Authentication Protocol (EAP) to integrate with the authenticating server such as a Remote Authentication Dial-in User Service (RADIUS) server. This is accomplished by using EAP to provide an open-ended conversation between a wireless client computer and the RADIUS server.

authentication

A process whereby an entity on a network proves it is who it says it is. The authentication process validates the source and integrity of information, and includes such tasks as confirming the identity of a user, computer, or digital signature.

Authentication Header (AH)

An IPSec protocol component that provides for authentication, integrity, and anti-replay of each packet. This is done without encrypting the data; the data remains readable but is protected from modification.

automatic security updates

A method by which computers are configured to perform software updates without intervention. This can be done through either connecting directly to the Microsoft Windows Update Web page or having the clients connect to a Software Update Server (SUS) on the network.

certificate

A method of granting access to a user based on unique identification. Certificates represent a distinctive way to establish a user's identity and credentials. They originate from a certification authority (CA).

certification authority (CA)

A computer that issues, maintains, and distributes information about digital certificates. A CA can be either public, such as a company like VeriSign, or private, whereby by a company issues certificates for internal use.

certificate autoenrollment

New to Windows XP and Windows Server 2003, the ability to automatically enroll users and computers for certificates, retrieve existing certificates, and renew expired certificates without user interaction.

certificate enrollment

The process by which users and computers can be given permission to make requests for certificates, retrieve existing certificates, and renew expired certificates. Each CA that is installed on a server has Web pages that users can access to submit basic and advanced certificate requests.

certificate mapping

Certificates that map a user to the user's account, creating an association between the certificate and the account. When a certificate is mapped and a user presents the certificate, Windows looks at the mapping to determine which account a user should be logged on to.

certificate revocation list (CRL)

A document published by a CA that lists certificates that have been issued but are no longer valid. By default, the CA publishes the CRL on a weekly basis.

certificate stores

Places where certificates are stored, which are located in a protected area of the Registry. A series of certificate stores can exist for each user, computer, and entity.

certificate template

Provided by Certificate Services to simplify the process of requesting and issuing certificates for various purposes. Each template contains the rules and settings that must be in place to create a certificate of a certain type. Certificate templates are available only on enterprise root and subordinate CAs.

Challenge Handshake Authentication Protocol (CHAP)

An authentication protocol that uses a hashed version of a user's password so that the user's credentials are not sent over the wire in clear text. The remote access server knows the password but does not ask the client for the password. Instead, the remote access server sends a challenge message that is encrypted using Message Digest 5 (MD5) so that the client will only be able to decrypt the challenge if the client actually has the password. The client then decrypts the challenge using its password and the hash algorithm, after which the client sends the result back to the server.

computer role

A chosen function for a computer. Depending on the role of the computer, it might need more or less security configured depending on the types of information that users may access. Some of the different computer roles on a network include file, application, mail, database, and Web. Examples of these include products such as Exchange, SQL, IIS, and IAS.

Connection Manager Administration Kit (CMAK)

A tool used in the process of building service profiles that fully customizes a connection and provides additional functionality for a user to connect to either other company networks or ISPs. Basically, it provides a customized remote access client so that the client connects based on the information you provide.

delta CRL

New in Windows Server 2003, a list of certificates that have been revoked since the last publication of a full CRL. By using delta CRLs, you can publish CRL information more frequently with less replication traffic. Delta CRLs are published on a differential basis; each delta CRL includes all revoked certificates since the previous full CRL was published.

Data Encryption Standard (DES)

The lowest encryption strength of the Diffie-Hellman algorithms. DES is a block cipher in which the block size for plaintext is 64 bits. The length of the key is also 64 bits, but 8 bits are used for parity. Hence, the effective key length is only 56 bits. Therefore, it not recommended for use in a high- security environment.

digital certificate

A document that contains the digital signature of the authenticating CA and the user's public key. It can also contain information about the user and/or the CA.

encapsulating security payload (ESP)

An IPSec protocol component that provides everything that AH does, along with providing for the confidentiality of the packet during transit. This authentication process ensures that the packet originated from the apparent sender and ensures that it wasn't viewed or modified during transit.

Enhanced Key Usage (EKU)

Specifies the uses for which a certificate is valid. It has both a digital certificate extension and a certificate extended property value. Often used with wireless technology where the wireless client certificate must also have a Client Authentication certificate purpose (EKU).

enterprise CA

A CA that is integrated with Active Directory. Enterprise CAs replicate certificates with Active Directory replication and require that users be authenticated.

enterprise trust policy

Used to control the purpose and validity of certificates. Enterprise Trust Policy is useful for creating certificate trust lists that establish a company's trust of external root CAs. You can use Group Policy objects (GPOs) that are linked to different Active Directory containers for establishing different enterprise trust policies for different segments of a company as required.

Extensible Authentication Protocol (EAP)

An extension to the Point-to-Point Protocol (PPP) that allows arbitrary authentication methods using credential and information exchanges of arbitrary lengths. EAP was developed in response to an increasing demand for authentication methods that use other security devices, and provides an industry-standard architecture for support of additional authentication methods within PPP. EAP modules can provide for smart card authentication, biometric authentication, and more.

Group Policy object (GPO)

A collection of Group Policy settings. You create GPOs using the Group Policy snap-in. They are stored at the domain level, and affect users and computers contained in sites, domains, and organizational units. Each Windows computer also has one group of settings stored locally. Group Policy objects are applied in the following order: local, site, domain, and then organizational unit.

HFNetChk

The Microsoft Network Security Hotfix Checker (Hfnetchk.exe) is a tool used to check for missing security updates and service packs. It can be invoked within Microsoft Baseline Security Analyzer (MBSA) using the syntax mbsacli.exe /hf with optional parameters.

IEEE 802.11

The standard that wireless networks use, defined at the Data Link layer of the Open Systems Interconnection (OSI) model. The three most common implementations are 802.11a, 802.11b, and 802.11g.

Internet Authentication Service (IAS)

The Microsoft implementation of RADIUS. It is used for authentication, authorization, and accounting by allowing you to control authentication of users accessing multiple access points by means of a single server. It has capabilities to authenticate users from Windows NT 4.0, Windows 2000, or Windows Server 2003 domains.

Internet Information Service (IIS)

The Microsoft version of a Web server service. IIS is not installed by default on Windows Server 2003. When it is installed, it installs in a highly secure mode. Features such as Active Server Pages (ASP), ASP.NET, Server Side Includes (SSI), Web Distributed Authoring and Versioning (WebDAV) publishing, and FrontPage Server Extensions are not installed.

Internet Key Exchange (IKE)

IKE is also known as the Internet Key Management Protocol (IKMP) and is used for key generation and security association (SA) establishment between the two endpoints of the IPSec encryption channel (IKE SA). Where no pre-shared keys exist, IPSec participants have to agree on a session encryption key used for symmetric encryption of the information traveling the wire.

Internet Security and Acceleration (ISA) Server

This is the Microsoft Application-layer firewall, virtual private network, and Web cache solution, allowing various levels of security, simplified management, and performance. A Windows Server 2003 computer running ISA Server can function as a security network address translator, and can use IPSec to secure traffic to other computers on the internal network.

Internet service provider (ISP)

A company that provides access to the Internet by charging a connection fee. An ISP typically provides connection information so users or companies can connect their computers to the ISP's computers. They may also provide additional services such as email and Web services.

IP Security (IPSec)

A method that secures communications while it allows you to control security with flexible policies that adapt to any network. It secures data in the private and public environments of your network by providing a strong cryptography-based defense.

IP Security (IPSec) certificates

One of the three ways IPSec can authenticate computers. Certificates should be used whenever communications include Internet access, remote access, external business partners, or computers on your network that cannot use the Kerberos v5 protocol. The use of certificates will require at least one certification authority.

IP Security Monitor snap-in

A tool to log the functioning of IPSec SA negotiations relative to other traffic on the network. It displays detailed main mode and quick mode data, as well as information related to the active IPSec policy. This includes the name and description of the active IPSec policy, the date and time the policy was last modified, the storage location, the Lightweight Directory Access Protocol (LDAP) path, and the name of the GPO to which the policy is applied.

issuing CA

Found in a three-tier CA hierarchy, receives certificates from intermediate CAs. Typically, the intermediate CAs are located in different geographical sites, such as cities in which your company does business, and the issuing CAs are dedicated to issuing certificates to users and computers on your network.

Kerberos

The default authentication method for Windows 2000 Server and Windows Server 2003. With Kerberos, the client must prove its identity to the server and the server must also prove its identity to the client.

keys, public and private

Used in public key encryption, a public key and private key are generated by a CA, and these keys are returned to the client in the form of digital certificates. The public key is given to those who need to encrypt data and send it to the client. The client then decrypts the data using its private key, which only the client has. The public key is used to encrypt a message, and the private key is used to decrypt the results.

logging mode

One of the two modes that Resultant Set of Policy (RSoP) can be run in. This mode obtains information on the existing Group Policy application for a specific user/computer combination. This includes the precedence of applying policy settings when the user is subject to different GPOs containing conflicting policy settings.

logon right

Controls which users can log on to the computer, and how, such as the right to log on to a system locally. Although user rights can apply to individual user accounts, they are best administered by using a group account.

loopback processing

Loopback processing policy is used to override a user-based Group Policy with a computer-based Group Policy. This makes the desktop configuration the same regardless of who logs on.

Message Digest 5 (MD5)

Encryption method defined in RFC 1321 and used for most commercial applications. It can be used to secure authentication as well as data. This high-security method takes a message of arbitrary length and produces a 128-bit hash value as output.

Message Digest 5 (MD5) Challenge

Uses the same challenge handshake protocol as CHAP, but the challenges are sent as EAP messages. MD-5 Challenge can be used to authenticate the credentials of remote access clients by using username- and password-based security systems. It can also authenticate the integrity of the message.

Microsoft Baseline Security Analyzer (MBSA)

A tool developed for Microsoft by Shavlik Technologies LLC. MBSA assesses the status of service packs and updates for Windows, IIS, SQL, and Exchange. MBSA can also determine which critical security updates are applied to a system. This is done by referencing an Extensible Markup Language (XML) file called Mssecure.xml.

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

A Microsoft version of CHAP that uses the same type of challenge/response mechanism as CHAP but uses a nonreversible encrypted password. This is done by using MD4 algorithms to encrypt the challenge and the user's password.

Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAPv2)

Uses a challenge response mechanism, but it is much more sophisticated than that of MS-CHAP. With MS-CHAPv2, the server must first prove to the client that it knows the correct password that the client should send. The client then answers the challenge of the server to provide the proof that it has the password. It uses stronger initial data encryption keys than standard CHAP or MS-CHAPv1, and different cryptographic keys are generated for transmitted and received data during the authentication process.

multifactor authentication

A method used to increase the reliability of authentication. It works on the premise that a user can prove his identity in three ways: something he knows, something he has, and something he is. Multifactor authentication is the combining of two or even three of these factors for proof of identification.

mutual authentication

Used in Kerberos. The client must prove its identity to the server and the server must also prove its identity to the client.

Netsh

A method used to deploy a script of the IPSec configuration for a computer. If all of the computers on which you are running IPSec are part of the Windows Server 2003 family, this method can be used. It is useful when you want to script the IPSec configuration and run the same script on multiple servers. It also provides some advanced fine-tuning for management and security that is not available in the GUI mode.

Network Address Translation (NAT)

Network Address Translation is a method used to keep private network addresses private and to conserve public address space at the same time. This is done by changing the source address of outgoing packets to the address of the outside interface of the router (public address), thereby keeping other users on the Internet from knowing the real addresses on a private network. It also allows the use of one public address to provide Internet access to many users simultaneously.

Network Address Translation Transversal (NAT-T)

A new feature in Windows Server 2003 NAT devices that allows traffic to be secured by IPSec while also being translated by a NAT device. It solves the problems of using IPSec across NAT by sending the original address in the NAT-OA IKE payload, sending periodic NAT keepalive packets, encapsulating the ESP PDU with a UDP header, and allowing peers to accept IKE messages from a source port NAT.

Oakley log

Tracks events related to IKE negotiations, and is recorded in the %systemroot%\Debug\Oakley.log file. This log records Internet Security Association Key Management Protocol (ISAKMP) main mode and quick mode negotiations.

open-system authentication

Used in wireless authentication. In the first stage of authentication, the device proves it is authorized to connect to the network. This method allows access to anyone providing the correct service set identifier (SSID) or wired equivalent privacy (WEP) key for the access point. This method provides only minimum protection and should be used with an additional protection mechanism.

Password Authentication Protocol (PAP)

The oldest remote access authentication protocol. PAP uses a two-way handshake to provide for user authentication. Simply put, the server asks for the credentials and the user supplies them. With PAP, a user's credentials are sent over the wire in clear text and can be easily sniffed off of the wire by an attacker.

planning mode

One of the two modes that RSoP can be run in. This mode performs a what-if scenario to predict the effects of a proposed series of policies on a specified user/computer combination.

policy files

The mechanism by which desktop settings are configured automatically, as defined by the administrator. Policy files must be run locally on computers for backward compatibility. Windows 98 or Windows 95 use Config.pol files and Windows NT4.0 Workstation and Windows NT4.0 Server use their own style of .pol file, known as NTconfig.pol.

policy store

The storage location of the IPSec policy. This is defined as Domain Store for Active Directory policies and Local Store for local policies.

Pre-Boot Execution Environment (PXE)

Environment created by Intel and Microsoft that allows a workstation with an Ethernet interface to boot from a server on a network prior to booting the operating system on the local hard drive.

pre-shared key

A shared, secret key that becomes part of the IPSec policy. During negotiation, information is encrypted by using the shared key before transmission, and then the information is decrypted using the same key on the other end. If the receiver can decrypt the information, identities are considered to be authenticated.

privilege

Allows users to perform system tasks, such as the right to back up files and directories. Privileges and permissions are different, and sometimes privileges can override permissions set on an object.

Protected Extensible Authentication Protocol (PEAP)

Provides several additional benefits within Transport Layer Security (TLS), including an encrypted authentication channel, dynamic keying material from TLS, fast reconnect using cached session keys, and server authentication that protects against the setup of unauthorized access points. PEAP can be used with EAP-TLS, EAP-MS-CHAPv2, and non-Microsoft EAP authentication methods; however, PEAP is not supported for use with EAP-MD5. As well as providing encrypted authentication, PEAP creates a session key that is used to derive data encryption keys that protect data being sent between the client and the access point during the session.

public key infrastructure (PKI)

A technology that includes a series of features relating to authentication and encryption that is based on a system of certificates, which are digitally signed statements that contain a public key and the name of the subject.

QChain

With QChain, updates can be chained together so they install without restarting the computer between each installation. QChain can be used with product updates that use Hotfix.exe or Update.exe, and is included in all Windows XP and Windows 2000 updates that were released since May 18, 2001.

Qfecheck

A command-line tool that has the capability to track and verify installed Windows 2000 and Windows XP hotfixes. Qfecheck.exe checks which hotfixes are installed by reading the information that is stored the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates Registry key.

Remote Access Policy

The part of Routing and Remote Access service that determines the conditions, profile, and permissions under which users can dial in to remotely access their networks for services.

Remote Access Service (RAS)

An integrated service that provides remote networking access for telecommuters, mobile workers, system administrators, and so on, and provides remote access to the network for services such as file and printer sharing, electronic mail, and database access.

Remote Authentication Dial-in User Service (RADIUS)

An industry standard protocol described in RFC 2865 and RFC 2866. RADIUS is used to provide authentication, authorization, and accounting services. A RADIUS client sends user credentials and connection information in the form of a RADIUS message to a RADIUS server via UDP port 1812. The RADIUS server authenticates and authorizes the RADIUS client request, and sends back a RADIUS message response. UDP port 1813 is used for RADIUS accounting messages, which the clients send to the server.

Remote Installation Services (RIS)

Software services that allow an administrator to set up new client computers remotely, without having to visit each client. The target clients must have PXE DHCP–based boot ROM version .99c or greater remote booting or use a floppy disk to boot to the shared installation directory.

Resource Reservation Protocol (RSVP)

A multifaceted protocol dedicated to being the facilitator and carrier of standardized Quality of Service (QoS) information and parameters. It is the carrier on which Windows 2000 systems send QoS parameters and information to the network. It allows the sender and receiver in a communication to set up a reserved highway for data transmission with a specified quality of service.

restricted group

A security setting that allows an administrator to define the properties for Members and Member Of groups. The Members list defines who belongs to the restricted group while the Member Of list states which other groups the restricted group belongs to. When a Restricted Groups Policy is defined, any user on the Members list who is not currently a member of the group is added and any current member of the group that is not on the Members list is removed. Any members that are not specified in the policy are removed during configuration or refresh.

Resultant Set of Policy (RSoP)

Used in the troubleshooting of Group Policy security policy settings. It queries computers running Windows XP Professional or Windows Server 2003 and informs you of the order in which policies have been applied. You can run RSoP in either planning mode or logging mode.

rollback strategy

A plan used to undo changes when there are adverse effects. When serious problems are encountered during deployment, if the root cause of the problem cannot be identified or diagnosed the system may need to be put back to its original state. A rollback strategy is the formulated plan to do this.

root CA

In any hierarchy, this is always the most trusted authority. Only one root CA exists in any hierarchy. You may have any number of intermediate and issuing CAs, but only one root CA. In addition, you must always install the root CA first.

secedit

A command-line tool used to configure the security on multiple computers. The commands that can be run are secedit /analyze, secedit /configure, secedit /export, secedit /import, secedit /validat, and secedit /GenerateRollback. Gpupdate replaces the Windows 2000 command secedit /refreshpolicy.

Secure Hash Algorithm (SHA)

Developed by NIST and specified in the Secure Hash Standard, it is the accepted standard for securing authentication on most government contracts. SHA is a very high security method that produces a one-way 160-bit hash that can used for a variety of applications, including authentication and cryptography.

Secure Sockets Layer (SSL)

A protocol developed by Netscape for transmitting private documents via the Internet for creating a secure communications channel, in order to keep critical information from being captured, such as bank or credit account numbers. SSL works by using a private key to encrypt data that's transferred over the SSL connection. SSL creates a shared digital key, which only lets the sender and the receiver of the transmission scramble or unscramble information.

security baseline

A minimum set of controls to protect information and assets, and to provide a basis for a security policy. Microsoft has defined baseline security settings for templates based on three distinct environments in the Windows Server 2003 Security Guide. The objective is to create the security requirements that will be implemented in the initial server installation. By identifying the role that each server plays, it can more easily be determined which settings and software are required.

Security Configuration and Analysis (SCA)

Configures security settings on a single system with a system that has Windows 2000 or Windows Server 2003 installed on it. SCA allows you to see the effects of the template settings before they are applied. It is used to configure security areas that are not affected by Group Policy settings. This tool does not work directly from a security policy template file, but instead uses a database to analyze or configure the security settings on a system.

service set identifier (SSID)

A unique configurable identification that allows clients to communicate to the appropriate base station in an 802.11 network. The SSID is a secret key that is set by the network and is attached to the header of packets sent over a WLAN to act as a password when a mobile device tries to connect. A device must know the SSID to join an 802.11 network, and all access points or all devices attempting to connect to a specific WLAN must use the same SSID.

shared-key authentication

In the first stage of authentication, the device proves it is authorized to connect to the network. This method is similar to a challenge-response authentication process. The client sends a request for access to the access point, which returns a challenge. The client returns an encrypted response. It is also known as shared secret authentication, because the client computer only needs this shared secret to authenticate.

Software Update Services (SUS)

A method that uses the Windows Automatic Updates service and allows you to configure a server that contains content from a live Windows Update site in your own environment to update internal servers and clients.

subordinate CA

A CA whose certificates come from a root CA, whose job is to issue certificates to users and computers on the network. Each subordinate CA may be dedicated to a single type of certificate, such as smart card, Encrypting File System (EFS), or to a geographical location of a multisite network.

Systems Management Server (SMS)

Microsoft's solution for change and configuration management. It enables organizations to provide relevant software and updates to users quickly and cost-effectively. SMS 2003 features application deployment, asset and security patch management, and Windows management services integration.

Transport Layer Security (TLS)

A protocol designed to allow applications to communicate over the Internet privately. It is intended to secure and authenticate communications through data encryption. TLS is composed of two layers: the TLS Record Protocol, which provides connection security with an encryption method, and the TLS Handshake Protocol, which negotiates an encryption algorithm and cryptographic keys for data transmissions. It is used in certificate based security environments. For example, if you are using smart cards, then you must also use EAP-TLS authentication.

Triple Data Encryption Standard (3DES)

A much stronger Data Encryption Standard (DES) based on the Diffie-Hellman algorithm. In DES, the effective key length is only 56 bits. In 3DES, three stages of DES are applied, with a separate key for each stage. The key length in 3DES is 168 bits. It is recommended for use in medium and high security networks.

transport mode

The default mode for IPSec. It is used for end-to-end security between a client and a server within a local area network. In transport mode, the entire packet is not encrypted or signed; rather, only the data in the IP payload is encrypted and signed.

tunnel mode

IPSec tunnel mode encrypts the IP header and the payload during transit. In this way, tunnel mode provides protection for the entire packet.

version 1 template

These are the same certificate templates as those provided with Windows 2000. They are read-only and can be used with client computers running Windows 2000 and later.

version 2 template

These certificate templates are new to Windows Server 2003. They are editable and support certificate autoenrollment. They can only be used on client computers running Windows XP or Windows Server 2003.

virtual private network (VPN)

A method of communicating through a non-secure medium in a secure way. It does this by means of tunneling one protocol within another. Basically, it extends a private network by using encapsulation, encryption, and authentication across public networks such as the Internet.

Windows Update

A list of items such as drivers, security fixes, and critical updates that can be downloaded to update computers. Windows Update scans a computer for outdated system files and replaces them with the most recent versions.

wired equivalent privacy (WEP)

The most basic form of encryption that can be used on 802.11-based wireless networks to provide privacy of data sent between a wireless client and its access point. It is based on the RC4 encryption scheme and provides a method of data encryption and authentication that may be used to establish a more secured wireless connection by using symmetric encryption to protect data.

Wireless Zero Configuration

Allows for client computers to connect automatically to wireless networks without the need for user action. Wireless Zero Configuration automatically configures items such as TCP/IP settings, DNS server addresses, IAS server addresses, and so on. It also includes support for 802.1x authentication and encryption and is enabled by default on Windows XP computers.


index

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]


index_SYMBOL

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

1000 (event ID) error messages 2nd
1001 (event ID) error messages
1030 (event ID) error messages
1058 (event ID) error messages
1202 (event ID) error messages
1701/udp ports (L2TP)
1723/tcp ports (PPTP)
3DES (3Data Encryption Standard). [See also DES]
412 (event ID) error messages
454 (event ID) error messages
500/udp ports (L2TP)
802.11 standards (IEEE) 2nd 3rd
802.1x authentication standard (wireless networks) 2nd
802.1x encryption (wireless networks)
configuring 2nd


index_A

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Access is denied. Import failed error messages
access policies (wireless networks)
building
in Group Policy
configuring
guidelines 2nd
in Group Policy
managing
via IAS 2nd 3rd 4th
SSL certificates
account lockout policies
account policies
account lockout policies
domain account policies 2nd
Kerberos policies
OU account policies
password policies
default settings 2nd 3rd
policy files
configuring
Active Directory
distribution groups 2nd
domain local group scope
global group scope
local group scope
nesting
universal group scope
LDAP 2nd
security groups 2nd 3rd
domain local group scope
global group scope
local group scope
membership limitations
nesting 2nd 3rd 4th
universal group scope
SSL 2nd
Active Directory User Object certificate stores
Adaptive mode (MeasureUp practice test CD)
Add Certificate dialog box
certificate mapping
administrative templates (Group Policy)
Conf.adm
Inetres.adm
System.adm
Wmplayer.adm
Wuau.adm
Administrative Templates extension (Group Policy)
Registry permissions
saving settings 2nd
Administrative Tools
Services icon
Advanced Certificate Request page (Certificate Services Web pages)
intermediate CA
installing
Advanced tab (Internet Options dialog box)
SSL certificate configuration
AH (Authentication Header) transport mode (IPSec) 2nd
AH (Authentication Header) tunnel mode (IPSec)
analyzing
security
troubleshooting 2nd
security configurations
MBSA 2nd
SCA console
answer keys (practice exams)
multiple choice practice exams 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th
answers
MeasureUp practice test CD
randomizing in
archiving
private keys (certificates)
configuring 2nd
assigning
user rights
AT command
running tasks, scheduling
audit policies (security templates)
local audit policies 2nd
auditing
IKE change events
member server objects
audits
Event Viewer
authentication
IPSec
certificates 2nd
encryption
encryption via 3DES
encryption via DES
encryption via MD5
encryption via SHA
Kerberos 2nd 3rd
preshared keys
multifactor authentication 2nd
mutual authentication
protocols
CHAP
EAP
EAP, MD5 Challenge
EAP, TLS
MS-CHAP
MS-CHAPv2
PAP
wireless networks
802.1x authentication standard 2nd
EAP-MS-CHAPv2 authentication 2nd 3rd
EAP-TLS authentication 2nd 3rd 4th 5th
open authentication
PEAP authentication 2nd 3rd 4th
shared-key authentication
authentication methods (IPSec policies)
configuring
authorization
autoenrolling
certificates 2nd 3rd
Autoenrollment column (Certificate Templates snap-in)
automatic certificate requests (IPSec)
troubleshooting 2nd
automatic setting (System Services policies)
Automatically Connect to Non-preferred Networks option (Wireless Network Policy Wizard)


index_B

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

backups
Certificate Services
certificates
with private keys 2nd
Bad SPI error messages
Base-64 encoded X.509 (CER) file format
certificate backups
Block Policy inheritance attribute (GPO)
building
RSoP custom console
wireless network access policies
in Group Policy


index_C

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

CA (certification authorities)
enterprise CA 2nd
intermediate CA
installing 2nd 3rd
issuing CA 2nd
installing 2nd
managing
configuring certificate templates
permissions
configuring 2nd
Issue and Manage Certificates
Manage CA
Read
Request Certificates
root CA
installing 2nd 3rd
standalone CA
subordinate CA
CRL
CA (Certification Authority)
backups
restoring
CA Type page (Windows Component Wizard)
intermediate CA
installing 2nd 3rd
root CA
installing 2nd 3rd
Certificate Enrollment Requests certificate stores
Certificate Export Wizard
backups
certificates with private keys
Certificate Import Wizard
certificates with private keys 2nd
certificate rules (software restriction policies)
Certificate Services
backups
restoring
troubleshooting 2nd 3rd
Certificate Services Web pages
Advanced Certificate Request page
installing intermediate CA
CRL
certificate stores
Active Directory User Object
Certificate Enrollment Requests
Enterprise Trust
Intermediate Certification Authorities
personal
third-Party Root Certification Authorities
Trusted People
Trusted Publishers
Trusted Root Certification Authorities
Untrusted Publishers
certificate templates
certificate enrollment
configuring
deploying
Extensions tab 2nd
General tab
Issurance Requirements tab
properties
configuring 2nd 3rd
Request Handling tab 2nd
Security tab
storing 2nd
Subject Name tab
Superseded Templates tab
version 1
EKU extensions
version 2
autoenrollment 2nd 3rd
editing
Certificate Templates snap-in
Autoenrollment column
certificate enrollment
Certificate Wizard (IIS Manager tool)
SSL certificate configuration
certificates
CA
enterprise CA 2nd
intermediate CA 2nd 3rd 4th
issuing CA 2nd 3rd 4th
managing
managing, configuring certificate templates
root CA 2nd 3rd 4th
standalone CA
subordinate CA 2nd
three-tier CA hierarchies
two-tier CA hierarchies
enrolling 2nd 3rd
IPSec certificates
troubleshooting automatic requests 2nd
mapping 2nd
many-to-one mapping
one-to-one mapping
PKI
private keys
configuring archival 2nd
key recovery 2nd 3rd
public keys
purposes
displaying
requests 2nd
managing 2nd 3rd
revoking 2nd
CRL 2nd 3rd
delta CRL 2nd
SSL certificates
client configuration
communication integrity option
communication privacy option
configurign IAS servers for 2nd 3rd
EKU extensions
mutual authentication option
Web Server configuration 2nd
wireless network access policies
wireless networks 2nd 3rd 4th
storing. [See certificate stores]
with private keys
backups 2nd
importing 2nd
restoring 2nd
certificates (IPSec network authentication)
deploying
Certification Authority Restore Wizard
certification exams
MeasureUp practice exam CD
installing
randomizing questions/answers
shortcuts
test modes 2nd
multiple choice practice exam 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th 40th 41st 42nd 43rd 44th 45th 46th 47th 48th 49th 50th 51st 52nd 53rd 54th 55th 56th 57th 58th 59th 60th 61st 62nd 63rd 64th 65th 66th 67th 68th
answer key 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th
suggested reading 2nd 3rd 4th 5th 6th 7th 8th 9th
Certification mode (MeasureUp practice test CD)
Certtmpl.msc (Certificate Templates snap-in)
Autoenrollment column
certificate enrollment
CHAP (Challenge Handshake Authentication Protocols)
Check for Policy Changes Every option (Wireless Network Policy Wizard)
Clear This Database Before Importing option (Group Policy tab)
clients
auditing
Event Viewer
desktop computers
configuring security
developer computers
configuring security
email computers
configuring security
Internet zones
configuring security
kiosk computers
configuring security
local intranet zones
configuring security
logging
Event Viewer
firewalls 2nd
IIS servers
netlogon.log files
RAS log files 2nd
mobile computers
configuring security 2nd
remote access policies configuration
conditions
dial-in permissions
profiles
profiles, CMAK
restricted sites zones
configuring security
software restriction policies
certificate rules
hash rules
Internet zone rules
loopback policies
path rules
SSL
standard connection outline
SSL certificate configuration
trusted sites zones
configuring security
VPN configuration 2nd
CMAK (Connection Manager Administration Kit)
installing
command-line tools
Secedit.exe
deploying security templates 2nd
command-line utilities
Gpupdate
refreshing Group Policy
commands
AT
scheduling running tasks
net start
starting System Services policies
netsh ipsec dynamic
deploying IPSec policies 2nd
netsh ipsec static
deploying IPSec policies
communication integrity option (SSL certificates)
communication privacy option (SSL certificates)
Compatws.inf security template 2nd
computer security
analyzing
troubleshooting 2nd
configuring
troubleshooting 2nd
Computer Selection page (RSoP custom console)
Error Information tab
General tab
conditions (remote access policies)
Conf.adm administrative templates
config.pol files
configuring
802.1x encryption (wireless networks) 2nd
CA permissions 2nd
certificate template properties 2nd 3rd
certificate templates
clients
for remote access policies 2nd 3rd 4th 5th
IAS servers
for SSL certificates 2nd 3rd
IPSec policy rules
authentication methods
connection types 2nd
filter actions
filter lists
tunnel endpoints
policy files
private key archival (certificates) 2nd
security
in desktop computers
in developer computers
in DHCP servers 2nd
in DNS servers
in Domain Controller templates 2nd
in email computers
in Exchange servers
in IAS servers
in IIS servers 2nd
in Internet zones
in kiosk computers
in local intranet zones 2nd
in mobile computers 2nd
in restricted sites zones
in SQL servers
in trusted sites zones
MBSA 2nd
SCA console
troubleshooting 2nd
VPN
client support 2nd
firewall support
ISP support
NAT device support 2nd 3rd
Remote Access server support
Routing server support
WEP encryption (wireless networks) 2nd
wireless network access policies
guidelines 2nd
in Group Policy
connection types (IPSec policies)
configuring 2nd
CRL (certificate revocation lists) 2nd
Certificate Services Web pages
IPSec CRL
troubleshooting 2nd
publishing 2nd
troubleshooting
CRL (certificate revocation lists). [See also delta CRL]
Cryptographic Message Syntax Standard PKCS #7 Certificates file format
certificate backups 2nd
Cscript.exe scripting tool
security templates, deploying
CSPs option (Request Handling tab)
Custom mode (MeasureUp practice test CD)
customizing
security templates
file system permissions 2nd
Registry permissions 2nd 3rd 4th


index_D

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

DC security.inf security template
delta CRL (certificate revocation lists)
publishing 2nd
deploying
certificate templates
certificates (IPSec network authentication)
IPSec policies
via GPO
via LPO
via netsh ipsec dynamic commands 2nd
via netsh ipsec static commands
security templates 2nd
Cscript scripting tool
GPO 2nd
SCA console 2nd
Secedit.exe command-line tool 2nd
WMIC
DER encoded binary X.509 (CER) file format
certificate backups
DES (Data Encryption Standard). [See also 3DES]
desktop computers
security, configuring
developer computers
security, configuring
DHCP (Dynamic Host Control Protocol) servers
security, configuring 2nd
dial-in permissions (remote access policies)
Directory Security tab (IIS Manager tool)
Certificate Wizard
SSL certificate configuration
disabled setting (System Services policies)
displaying
certificate purposes
distribution groups (Active Directory) 2nd
domain local group scope
global group scope
local group scope
nesting
universal group scope
DNS (Domain Name System) servers
security, configuring
domain account policies 2nd
Domain Controller templates
security, configuring 2nd
domain controllers
auditing
domain functional levels (nesting) 2nd
domain local group scope (Active Directory groups)


index_E

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

EAP (Extensible Authentication Protocols)
MD5 Challenge
TLS
EAP-MS-CHAPv2 authentication (wireless networks) 2nd 3rd
EAP-TLS authentication (wireless networks) 2nd 3rd 4th 5th
Edit Security option (System Services policies)
editing
manual editing
security templates, troubleshooting
Registry
EKU (Enhanced Key Usage) extensions (SSL certificates)
email computers
security, configuring
Enable Certificate Templates dialog box
encrypting
authentication
3DES
DES
MD5
SHA
encryption
wireless networks
802.1x 2nd 3rd
IPSec
WEP 2nd 3rd
enrolling
certificates 2nd 3rd
enterprise CA 2nd
Enterprise Client security templates
Enterprise Trust certificate stores
enterprise trust policies (Group Policy)
IPSec
troubleshooting 2nd
Error 1208[COLON] An extended error has occurred. Error opening error messages
Error Information tab (RSoP custom console)
error messages
1000 (event ID) 2nd
1001 (event ID)
1030 (event ID)
1058 (event ID)
1202 (event ID)
412 (event ID)
454 (event ID)
Access is denied. Import failed
Bad SPI
Error 1208[COLON] An extended error has occurred. Error opening
ESP (Encapsulating Security Payload) transport mode (IPSec) 2nd
ESP (Encapsulating Security Payload) tunnel mode (IPSec)
Event Log security policies (security templates)
Event Viewer
exams
MeasureUp practice test CD
installing
randomizing questions/answers
shortcuts
test modes 2nd
multiple choice practice exam 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th 40th 41st 42nd 43rd 44th 45th 46th 47th 48th 49th 50th 51st 52nd 53rd 54th 55th 56th 57th 58th 59th 60th 61st 62nd 63rd 64th 65th 66th 67th 68th
answer key 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th
suggested reading 2nd 3rd 4th 5th 6th 7th 8th 9th
Exchange back-end servers
Exchange servers
Exchange back-end servers
OWA front-end servers
security, configuring
Extensions tab (certificate templates) 2nd


index_F

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

file system permissions
security template customization 2nd
file/folder permissions
Windows NT 4.0 2nd
files
config.pol
netlogon.log
Ntconfig.pol
policy files
configuring
RAS log files 2nd
Registry.pol
filter actions (IPSec policies)
configuring
filter lists (IPSec policies)
configuring
filters
IPSec Policy Agent
IPSec policy rules
port filters
troubleshooting IPSec 2nd 3rd
protocol filters
troubleshooting IPSec 2nd 3rd
viewing
IPSec Monitor console
firewall client logs 2nd
firewalls
IPSec
troubleshooting 2nd
VPN configuration
folder permissions
Windows NT 4.0 2nd


index_G

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

General tab (certificate templates)
General tab (RSoP custom console)
global group scope (Active Directory groups)
GPMC (Group Policy Management Console) 2nd
GPO
listing
in RSoP custom console
GPO (Group Policy Object) Editor
software restriction policies
creating
GPO (Group Policy Objects
IPSec policies
deploying
GPO (Group Policy Objects)
Block Policy inheritance attribute
Domain Controller templates
No Override attribute
security templates, deploying 2nd
gpressult command
options
Gpupdate command-line utilities
Group Policy, refreshing
Group Policy
Administative Templates extension
saving Registry permission settings 2nd
administrative templates
Conf.adm
Inetres.adm
System.adm
Wmplayer.adm
Wuau.adm
computer configurations
saving
enterprise trust policies
troubleshooting 2nd
GPMC 2nd
RSoP
security settings
refreshing
security templates
importing into
group policy
security templates
troubleshooting in 2nd 3rd
Group Policy
user configuration
saving
Windows NT 4.0
wireless network access policies
building
configuring
Group Policy tab
Clear This Database Before Importing option


index_H

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

hash rules (software restriction policies)
help
technical support
High Security security templates
highly secure templates
Windows NT 4.0 2nd
Hisecdc.inf security template
Hisecws.inf security template
HTTP SSL service (IIS servers)


index_I

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

IAS (Internet Authentication Service)
servers
configuring for SSL certificates 2nd 3rd
SSL certificates
EKU extensions
version 2 certificate templates
editing
wireless network access policies
managing 2nd 3rd 4th
IAS (Internet Authentication Service) servers
security, configuring
icons
Services icon (Administrative Tools)
starting System Services policies
IEEE (Institute of Electrial and Electronics Engineers) 802.11 standards 2nd 3rd
IIS (Internet Information Service) servers
client logs
HTTP SSL services
IIS Admin Service
IIS Lockdown Wizard
security, configuring 2nd
World Wide Web Publishing Service
IIS Admin Service (IIS servers)
IIS Lockdown Wizard
IIS Manager tool
Directory Security tab
Certificate Wizard
IKE (Internet Key Exchange)
change events
auditing
Oakley logs (IPSec)
troubleshooting 2nd 3rd
importing
certificates
with private keys 2nd
security templates
into Group Policy
Inetres.adm administrative templates
inheritance
security policies
troubleshooting in 2nd 3rd 4th 5th 6th 7th 8th
installing
CMAK
intermediate CA 2nd 3rd
issuing CA 2nd
MeasureUp practice test CD
root CA 2nd 3rd
intermediate CA
installing 2nd 3rd
Intermediate Certification Authorities certificate stores
Internet Options dialog box (Internet Explorer)
Advanced tab
SSL certificate configuration
Internet zone rules (software restriction policies)
Internet zones
security, configuring
intranet zones
security, configuring 2nd
IP Filter Wizard (IPSec)
IP protocol ID 47 GRE (Generic routing Encapsulation) ports (PPTP)
IP Protocol ID 50 ports (L2TP)
IP Protocol ID 51 ports (L2TP)
IP Security Monitor snap-in 2nd 3rd 4th 5th
IPSec
IP Security Monitor snap-in 2nd 3rd 4th 5th
NAT-T
policies
Rules tab
RADIUS
troubleshooting
automatic certificate requests 2nd
CRL 2nd
driver logging 2nd 3rd
enterprise trust policies (Group Policy) 2nd
firewalls 2nd
monitoring policies 2nd 3rd 4th 5th
NAT 2nd
Oakley logs 2nd 3rd
port filters 2nd 3rd
protocol filters 2nd 3rd
routers 2nd
RSVP
wireless networks
IPSec (Internet Protocol Security)
authentication
certificates 2nd
encryption
encryption via 3DES
encryption via DES
encryption via MD5
encryption via SHA
Kerberos 2nd 3rd
preshared keys
filters
IP Filter Wizard
NAT
policies
configuring rules
configuring rules, authentication methods
configuring rules, connection types 2nd
configuring rules, filter actions
configuring rules, filter lists
configuring rules, tunnel endpoints
deploying via GPO
deploying via LPO
deploying via netsh ipsec dynamic commands 2nd
deploying via netsh ipsec static commands
transport mode 2nd
AH transport mode 2nd
ESP transport mode 2nd
tunnel mode 2nd
AH tunnel mode
configuring tunnel endpoints
ESP tunnel mode
IPSec Monitor console
IPSec Policy Agent
filters
ISA (Internet Security and Acceleration) Servers
IPSec
troubleshooting 2nd
ISP (Internet Service Providers)
VPN configuration
Issue and Manage Certificates permission (CA)
issuing CA 2nd
installing 2nd
Issurance Requirements tab (certificate templates)


index_K

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Kerberos (IPSec network authentication) 2nd 3rd
Kerberos policies
Key is Provided Automatically option (WEP encryption), The
kiosk computers
security, configuring


index_L

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

L2TP (Layer 2 Tunneling Protocols) 2nd
1701/udp ports
500/udp ports
clients
firewalls
IP Protocol ID 50 ports
IP Protocol ID 51 ports
NAT devices
Remote Access servers
Routing servers
LDAP (Lightweight Directory Access Protocol) 2nd
Legacy Client security templates
local audit policies (security templates) 2nd
local group scope (Active Directory groups)
local intranet zones
security, configuring 2nd
Local Security Policy MMC (Microsoft Management Console)
IPSec policies, deploying
logging mode (RSoP) 2nd 3rd 4th 5th 6th
logon rights (user rights)
logs
Event Viewer
firewalls 2nd
IIS servers
netlogon.log files
RAS log files 2nd
loopback policies
as software restriction policies
LPO (Local Policy Objects
IPSec policies
deploying


index_M

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Manage CA permission (CA)
managing
CA
configuring certificate templates
certificate requests 2nd 3rd
wireless network access policies
IAS 2nd 3rd 4th
manual configuration (wireless networks) 2nd 3rd
manual editing
security templates
troubleshooting in
manual setting (System Services policies)
many-to-one mapping (certificates)
mapping
certificates 2nd
many-to-one mapping
one-to-one mapping
MBSA (Microsoft Baseline Security Analyzer) 2nd
MD5 (Message Digest 5)
MD5 (Message Digest 5) Challenge (EAP)
MeasureUp practice test CD
installing
questions/answers, randomizing
shrotcuts
test modes 2nd
MeasureUp technical support
Member Of lists (restricted group policies) 2nd
member servers
auditing
Members lists (restricted group policies) 2nd
merging
security templates
SCA console
Minimum keysize option (Request Handling tab)
Missed Question mode (MeasureUp practice test CD)
mobile computers
security, configuring 2nd
modifying
Wireless Zero Configuration settings
monitoring
IPSec policies 2nd 3rd 4th 5th
MS-CHAP (Microsoft-Challenge Handshake Authentication Protocols)
MS-CHAPv2 (Microsoft-Challenge Handshake Authentication Protocols version 2)
multifactor authentication 2nd
multiple choice practice exam 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th 40th 41st 42nd 43rd 44th 45th 46th 47th 48th 49th 50th 51st 52nd 53rd 54th 55th 56th 57th 58th 59th 60th 61st 62nd 63rd 64th 65th 66th 67th 68th
answer key 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th
mutual authentication
mutual authentication option (SSL certificates)


index_N

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

NAT (Network Address Translation)
IPSec
troubleshooting 2nd
NAT (Network Address Translation) devices
VPN configuration 2nd 3rd
NAT-T (NAT-Transversal)
nesting
domain functional levels 2nd
security groups (Active Directory)
net start command
System Services policies, starting
netlogon.log files
netsh command 2nd
netsh ipsec dynamic commands
IPSec policies
deploying 2nd
netsh ipsec static commands
IPSec policies
deploying
Network Authentication (Shared Mode) option (WEP encryption) 2nd
Network Monitor
IPSec
network security
IPSec
authentication
authentication, certificates 2nd
authentication, encryption
authentication, encryption via 3DES
authentication, encryption via DES
authentication, encryption via MD5
authentication, encryption via SHA
authentication, Kerberos 2nd 3rd
authentication, preshared keys
configuring policy rules
configuring policy rules, authentication methods
configuring policy rules, connection types 2nd
configuring policy rules, filter actions
configuring policy rules, filter lists
configuring policy rules, tunnel endpoints
deploying policies via GPO
deploying policies via LPO
deploying policies via netsh ipsec dynamic commands 2nd
deploying policies via netsh ipsec static commands
filters
IP Filter Wizard
transport mode 2nd
transport mode, AH transport mode 2nd
transport mode, ESP transport mode 2nd
tunnel mode 2nd
tunnel mode, AH tunnel mode
tunnel mode, ESP tunnel mode
tunnel mode;configuring tunnel endpoints
network zones
Internet zones, configuring security
local intranet zones, configuring security 2nd
restricted sites zones, configuring security
trusted sites zones, configuring security
Networks to Access option (Wireless Network Policy Wizard)
No Override attribute (GPO)
Non-Duplicate mode (MeasureUp practice test CD)
Notssid.inf security template
Ntconfig.pol files


index_O

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Oakley logs (IPSec)
troubleshooting 2nd 3rd
one-to-one mapping (certificates)
open authentication (wireless networks)
open-system authentication
wireless networks
OU account policies
OWA (Outlook Web Access) front-end servers


index_P

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

packet logging
IPSec drivers
troubleshooting 2nd 3rd
PAP (Password Authentication Protocols)
password policies
default settings 2nd 3rd
path rules (software restriction policies)
PEAP (Protected EAP) authentication (wireless networks) 2nd 3rd 4th
permissions
file system permissions
security template customization 2nd
Registry permissions
saving settings 2nd
security template customization 2nd
versus privileges
personal certificate stores
Personal Information Exchange PKCS #12 (.PFX) file format
certificate backups
PKI (public key infrastructures)
troubleshooting 2nd 3rd
planning mode (RSoP)
policy files
configuring
port filters
IPSec
troubleshooting 2nd 3rd
ports
L2TP ports
1701/udp
500/udp
IP Protocol ID 50
IP Protocol ID 51
PPTP ports
1723/tcp
IP protocol ID 47 GRE
PPTP (Point-to-Point Tunneling Protocols) 2nd
1723/tcp ports
clients
firewalls 2nd
IP protocol ID 47 GRE ports
NAT devices
Remote Access servers
Routing servers
practice exams
multiple choice practice exam 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th 40th 41st 42nd 43rd 44th 45th 46th 47th 48th 49th 50th 51st 52nd 53rd 54th 55th 56th 57th 58th 59th 60th 61st 62nd 63rd 64th 65th 66th 67th 68th
answer key 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th
suggested reading 2nd 3rd 4th 5th 6th 7th 8th 9th
practice tests
MeasureUp practice test CD
installing
randomizing questions/answers
shortcuts
test modes 2nd
predefined security templates
Compatws.inf 2nd
DC security.inf
Hisecdc.inf
Hisecws.inf
Notssid.inf
Rootsec.inf
Securedc.inf
Securews.inf
Setup security.inf 2nd
preshared keys (IPSec network authentication)
privacy keys
WEP keys
open authentications
private keys
private keys (certificates)
archival
configuring 2nd
backups 2nd
importing 2nd
key recovery 2nd 3rd
restoring 2nd
privileges
versus permissions
profiles (remote access policies)
CMAK
protocol filters
IPSec
troubleshooting 2nd 3rd
protocols
authentication protocols
CHAP
EAP
EAP, MD5 Challenge
EAP, TLS
MS-CHAP
MS-CHAPv2
PAP
tunneling protocols
L2TP 2nd 3rd 4th 5th 6th
PPTP 2nd 3rd 4th 5th 6th 7th
public keys
publishing
CRL 2nd
delta CRL 2nd
Purpose option (Request Handling tab)


index_Q

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

questions
MeasureUp practice test CD
randomizing in
questions (practice exams)
multiple choice practice exam 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th 40th 41st 42nd 43rd 44th 45th 46th 47th 48th 49th 50th 51st 52nd 53rd 54th 55th 56th 57th 58th 59th 60th 61st 62nd 63rd 64th 65th 66th 67th 68th
answer key 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th


index_R

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

RADIUS (Remote Authentication Dial-in User Service)
802.1x authentication standard 2nd
IAS
managing wireless network access policies 2nd 3rd 4th
IAS servers
configuring security
IPSec
PEAP
randomizing
questions/answers (MeasureUp practice test CD)
RAS (Remote Access Service) log files 2nd
Read permission (CA)
recovering
private keys (certificates) 2nd 3rd
refreshing
Group Policy security settings
Registry
editing
Registry permissions
security template customization 2nd
settings, saving 2nd
Registry.pol files
remote access policies
client configuration
conditions
dial-in permissions
profiles
profiles, CMAK
Remote Access servers
VPN configuration
removing
Registry permission settings
from security templates
Request Certificates permission (CA)
Request Handling tab (certificate templates) 2nd
requesting
certificates 2nd
restoring
Certificate Services
certificates
with private keys 2nd
restricted group policies (Security Templates) 2nd
Member Of lists 2nd
Members lists 2nd
restricted sites zones
security, configuring
Resultant Set of Policy Wizard (RSoP custom onsole)
revoking
certificates 2nd
CRL 2nd 3rd
delta CRL 2nd
root CA
installing 2nd 3rd
Rootsec.inf security template
routers
IPSec
troubleshooting 2nd
Routing servers
VPN configuration
RSoP (Resultant Set of Policy) 2nd 3rd 4th 5th 6th 7th
logging mode 2nd 3rd 4th 5th 6th
planning mode
running
RSoP custom console
building
Computer Selection page
Error Information tab
General tab
GPO
listing
Resultant Set of Policy wizard
Summary of Selections page
User Selection page
Error Information tab
General tab
RSVP (Resource Reservation Protocols)
IPSec
troubleshooting
Rules tab (IPSec policies)
running
tasks
scheduling via AT command


index_S

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

saving
Group Policy computer configurations
Group Policy user configurations
Registry permission settings 2nd
SCA (Security and Configuration Analysis) console
security configuration analysis
security templates, deploying 2nd
security templates, importing
security templates, merging
scheduling
running tasks
AT command
scope (Active Directory groups)
domain local group scope
global group scope
local group scope
universal group scope
scripting tools
Cscript.exe
deploying security templates
WMIC
deploying security templates
Secedit.exe command-line tool
security templates, deploying 2nd
Securedc.inf security template
Securews.inf security template
security
computer security
troubleshooting 2nd
configuration analysis
MBSA 2nd
SCA console
security groups (Active Directory) 2nd 3rd
domain local group scope
global group scope
local group scope
membership limitations
nesting 2nd
domain functional levels 2nd
universal group scope
security option policies 2nd
security policies
RSoP 2nd 3rd 4th 5th 6th
running
troubleshooting
inheritance 2nd 3rd 4th 5th 6th 7th 8th
Security tab (certificate templates)
security templates
account policies 2nd 3rd
Compatws.inf 2nd
customizing
file system permissions 2nd
Registry permissions 2nd 3rd 4th
DC security.inf
deploying 2nd
Cscript scripting tool
GPO 2nd
SCA console 2nd
Secedit.exe command-line tool 2nd
WMIC
Enterprise Client templates
Event Log security policies
Group Policy, importing into
High Security templates
Hisecdc.inf
Hisecws.inf
Legacy Client templates
local audit policies 2nd
merging
SCA console
Notssid.inf
policy file configuration
restricted group policies 2nd
Rootsec.inf
Securedc.inf
Securews.inf
security option policies 2nd
settings
viewing
Setup security.inf 2nd
System Services policies
automatic setting
disabled setting
Edit Security option
manual setting
troubleshooting
group policy applications 2nd 3rd
in Windows 2000 2nd
in Windows NT 4.0 2nd 3rd 4th
manual editing
security configuration/analysis 2nd
user rights
assigning
servers
DHCP
configuring security 2nd
DNS
configuring security
Exchange
configuring security
Exchange back-end servers
OWA front-end servers
Exchange back-end
IAS
configuring security
IAS servers
configuring for SSL certificates 2nd 3rd
IIS
client logs
configuring security 2nd
HTTP SSL services
IIS Admin Service
IIS Lockdown Wizard
World Wide Web Publishing Service
member servers
auditing
OWA front-end
Remote Access
VPN configuration
Routing
VPN configuration
SQL
configuring security
WRMS
Web
SSL standard connection outline
Web serves
SSL certificate configuration 2nd
Services icon (Administrative Tools)
System Services policies, starting
Setup security.inf security template 2nd
SHA (Secure Hash Algorithm)
shared-key authentication (wireless networks)
shared-secret authentication. [See shared-key authentication]
shortcuts
MeasureUp practice test CD
snap-ins
Certificate Templates snap-in
Autoenrollment column
certificate enrollment
IP Security Monitor snap-in 2nd 3rd 4th 5th
software restriction policies
certificate rules
creating
hash rules
Internet zone rules
loopback policies
path rules
SQL servers
security, cofiguring
WRMS
SSID (service set identifiers)
open authentication
SSL
LDAP 2nd
SSL (Secure Sockets Layer)
Active Directory 2nd
certificates
client configuration
Web Server configuration 2nd
standard connection outline
SSL (Secure Sockets Layer) certificates
communication integrity option
communication privacy option
IAS servers, configuring for 2nd 3rd
mutual authentication option
wireless network access policies
wireless networks 2nd 3rd 4th
EKU extensions
standalone CA
storing
certificate templates 2nd
certificates. [See certificate stores]
strings
preshared keys
Study mode (MeasureUp practice test CD)
Subject Name tab (certificate templates)
subordinate CA
CRL
suggested reading (certification exams) 2nd 3rd 4th 5th 6th 7th 8th 9th
Summary of Selections page (RSoP custom console)
Superseded Templates tab (certificate templates)
System Services policies
automatic setting
disabled setting
Edit Security option
manual setting
System.adm administrative templates


index_T

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

tabs
Advanced tab (Internet Options dialog box)
SSL certificate configuration
Directory Security tab (IIS Manager tool)
Certificate Wizard
Group Policy tab
Clear This Database Before Importing option
Rules tab (IPSec policies)
tasks
running
scheduling via AT command
technical support
templates
administrative (Group Policy)
Conf.adm
Inetres.adm
System.adm
Wmplayer.adm
Wuau.adm
certificate templates
certificate enrollment
configuring
configuring properties 2nd 3rd
deploying
Extensions tab 2nd
General tab
Issurance Requirements tab
Request Handling tab 2nd
Security tab
storing 2nd
Subject Name tab
Superseded Templates tab
version 1 2nd
version 2 2nd 3rd 4th 5th
Domain Controller
configuring security 2nd
highly secure templates
Windows NT 4.0 2nd
security
account policies 2nd 3rd
assigning user rights
Compatws.inf 2nd
customizing, file system permissions 2nd
customizing, Registry permissions 2nd 3rd 4th
DC security.inf
deploying 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
Enterprise Client templates
Event Log security policies
High Security templates
Hisecdc.inf
Hisecws.inf
importing into Group Policy
Legacy Client templates
local audit policies 2nd
merging in SCA console
Notssid.inf
policy file configuration
restricted group policies 2nd
Rootsec.inf
Securedc.inf
Securews.inf
security option policies 2nd
Setup security.inf 2nd
System Services policies 2nd 3rd 4th
System Services policies;Edit Security option
viewing settings
security templates
troubleshooting group policy applications 2nd 3rd
troubleshooting in Windows 2000 2nd
troubleshooting in Windows NT 4.0 2nd 3rd 4th
troubleshooting manual editing
troubleshooting security configuration/analysis 2nd
tests
MeasureUp practice test CD
installing
randomizing questions/answers
shortcuts
test modes 2nd
multiple choice practice test 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th 40th 41st 42nd 43rd 44th 45th 46th 47th 48th 49th 50th 51st 52nd 53rd 54th 55th 56th 57th 58th 59th 60th 61st 62nd 63rd 64th 65th 66th 67th 68th
answer key 2nd 3rd 4th 5th 6th 7th 8th 9th 10th 11th 12th 13th 14th 15th 16th 17th 18th 19th 20th 21st 22nd 23rd 24th 25th 26th 27th 28th 29th 30th 31st 32nd 33rd 34th 35th 36th 37th 38th 39th
suggested reading 2nd 3rd 4th 5th 6th 7th 8th 9th
The Key is Provided Automatically option (WEP encryption)
Third-Party Root Certification Authorities certificate stores
This is a Computer-to-Computer (Ad Hoc) Network
Wireless Access Points Are Not Used option (WEP encryption)
three-tier CA hierarchies
enterprise CA
intermediate CA
issuing CA 2nd
root CA
standalone CA
subordinate CA
TLS (Transport Layer Security)
EAP
transport mode (IPSec) 2nd
AH transport mode 2nd
ESP transport mode 2nd
troubleshootin
PKI 2nd 3rd
troubleshooting
Certificate Services 2nd 3rd
CRL
IPSec
automatic certificate requests 2nd
CRL 2nd
driver logging 2nd 3rd
enterprise trust policies (Group Policy) 2nd
firewalls 2nd
monitoring policies 2nd 3rd 4th 5th
NAT 2nd
Oakley logs 2nd 3rd
port filters 2nd 3rd
protocol filters 2nd 3rd
routers 2nd
RSVP
security policies
inheritance 2nd 3rd 4th 5th 6th 7th 8th
security templates
group policy applications 2nd 3rd
in Windows 2000 2nd
in Windows NT 4.0 2nd 3rd 4th
manual editing
security configuration/analysis 2nd
Trusted People certificate stores
Trusted Publishers certificate stores
Trusted Root Certification Authorities certificate stores
trusted sites zones
security, configuring
tunnel endpoints (IPSec policies)
configuring
tunnel mode (IPSec) 2nd
AH tunnel mode
ESP tunnel mode
tunnel endpoints, configuring
tunneling
protocols
L2TP 2nd 3rd 4th 5th 6th
PPTP 2nd 3rd 4th 5th 6th 7th
two-tier CA hierarchies
enterprise CA
issuing CA
root CA
standalone CA
subordinate CA


index_U

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

universal group scope (Active Directory groups)
Untrusted Publishers certificate stores
Use Windows to Configure Wireless Network Settings for Clients option (Wireless Network Policy Wizar
user rights
assigning
logon rights
User Selection page (RSoP custom console)
Error Information tab
General tab


index_V

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

version 1 certificate templates
EKU extensions
version 2 certificate templates
autoenrollment 2nd 3rd
editing
viewing
certificate purposes
client logs
Event Viewer
filters
IPSec Monitor console
security template settings
VPN (virtual private networks)
configuring
client support 2nd
firewall support
ISP support
NAT device support 2nd 3rd
Remote Access server support
Routing server support
tunneling protocols
L2TP 2nd 3rd 4th 5th 6th
PPTP 2nd 3rd 4th 5th 6th 7th


index_W

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W]

Web servers
SSL
standard connection outline
SSL certificate configuration 2nd
WEP (Wired Equivalent Privacy) encryption (wireless networks)
configuring 2nd
Network Authentication (Shared Mode) option 2nd
The Key is Provided Automatically option
This is a Computer-to-Computer (Ad Hoc) Network
Wireless Access Points Are Not Used option
WEP (wired equivalent privacy) keys
open authentication
Windows 2000
security templates
troubleshooting in 2nd
Wireless Zero Configuration
Windows CE .NET
Wireless Zero Configuration
Windows Component Wizard
intermediate CA
installing 2nd 3rd
root CA
installing 2nd 3rd
Windows NT 4.0
file/folder permissions 2nd
Group Policy
highly secure templates 2nd
security templates
troubleshooting in 2nd 3rd 4th
Windows Server 2003
manual configuration (wireless networks) 2nd 3rd
Wireless Zero Configuration 2nd
modifying settings
Windows XP
IEEE 802.1x authentication
manual configuration (wireless networks) 2nd 3rd
Wireless Zero Configuration 2nd 3rd
modifying settings
wireless networks
access policies
building in Group Policy
configuring in Group Policy
guidelines 2nd
managing via IAS 2nd 3rd 4th
SSL certificates
authentication
802.1x authentication standard 2nd
EAP-MS-CHAPv2 authentication 2nd 3rd
EAP-TLS authentication 2nd 3rd 4th 5th
open authentication
PEAP authentication 2nd 3rd 4th
shared-key authentication
encryption
802.1x 2nd 3rd
IPSec
WEP 2nd 3rd
IEEE 802.11 standards 2nd 3rd
manual configuration 2nd 3rd
open-system authentication
SSL certificates 2nd 3rd 4th
configuring IAS servers for 2nd 3rd
EXU extensions
Wireless Zero Configuration 2nd
modifying settings
Wireless Zero Configuration 2nd 3rd
modiyfing settings
Wirelss Network Policy Wizard
Automatically Connect to Non-preferred Networks option
Check for Policy Changes Every option
Networks to Access option
Use Windows to Configure Wireless Network Settings for Clients option
wizards
Certificate Export Wizard
certificate backups
Certificate Wizard (IIS Manager tool)
SSL certificate configuration
CertificateImport Wizard
certificates with private keys 2nd
Certification Authority Restore Wizard
CMAK
installing
IIS Lockdown Wizard
IP Filter Wizard (IPSec)
Resultant Set of Policy Wizard (RSoP custom console)
Windows Component Wizard
installing intermediate CA 2nd 3rd
installing root CA 2nd 3rd
Wireless Network Policy Wizard
Automatically Connect to Non-preferred Networks option
Check for Policy Changes Every option
Networks to Access option
Use Windows to Configure Wireless Network Settings for Clients option
WMIC (WMI Command-Line interface)
security templates, deploying
Wmplayer.adm administrative templates
workstations
auditing
World Wide Web Publishing Service (IIS servers)
WRMS (Windows Rights Management Services)
Wuau.adm administrative templates