Server 2003 Beyond the Basics

1
Server 2003 Beyond the Basics
2
EFS

• Users can encrypt data across the network, but
  the data is only encrypted when written to disk
• Only Server 2003, XP, and W2K users will be able
  to encrypt and decrypt data.

3
EFS

• To encrypt a file or folder, right mouse click on
  object and select properties, and click the
  advanced button.

4
EFS

• If you do not have an advanced button visible,
  make sure the file system is formatted with NTFS
• You can either compress or encrypt file data, not
  both

5
Copying, moving and backing up encrypted files

• If you copy or move an unencrypted file to an
  encrypted NTFS directory, that file will become
  encrypted
• If you copy or move an encrypted file to an
  unencrypted NTFS directory, that file will remain
  encrypted
• If you copy or move an encrypted file to a FAT or
  FAT32 directory, that file will no longer be
  encrypted
• Backups of encrypted documents are stored and
  restored in there encrypted state even if the
  backup media is a FAT-formatted drive.

6
EFS

• You can also encrypt files from the command line
  with the CIPHER command.
• To encrypt a single folder in the current
  directory, type
• Cipher /e foldername

7
EFS

• What about Administrators?
• Cannot affect an encrypted file that was not
  encrypted by the Administrator
• Can only modify an encrypted file if they are the
  designated recovery agent.
• Can verify who is recovery agent by using a
  resource kit tool
• At a command prompt type
• Efsinfo /u /r /sdriveletter\foldername

8
Volume Shadow Copy Service (VSS)

• Allows users to access and/or restore previous
  versions of saved files using a client feature
  called Previous Versions
• Enables applications that take advantage of the
  volume shadow copy API to access locked files.

9
How VSS Works

• When enabled, a snapshot is taken of the entire
  volume and all of its files.
• When a file is modified, VSS stores the original
  snapshot n the System Volume Information
  folder. Now that copy will show up in the
  Previous Versions tab in the properties of that
  file. You can now revert to the previous version.

10
Automating User Creations/Management and
Exporting Data

• Scripts
• http//www.microsoft.com/technet/scriptcenter/defa
  ult.mspx
• setpass.txt
• LDIFDE
• Built-in tool to export/import/modify LDAP
  information.
• ldifde.txt
• CSVDE
• Comma Separated Value Directory Exchange
• Used to import/export LDAP information. But
  cannot modify existing LDAP objects.
• import.txt
• Students.csv

11
Windows Deployment Services

• Rapid deployment of operating systems across the
  wire
• Can perform a complete unattended installation
• Using answer files
• Installation occurs as if performing an
  installation via CD/DVD.
• Plug and play
• Slightly faster than normal installation

12
Windows Deployment Services

• Can push an image of a completely configured
  system.
• Can deploy multiple PCs in minutes
• Image can be created using RIPREP
• WDS also supports Ghost

13
Windows Software Update Services

• WSUS bring Windows updates to the local area
  network.
• Creates a central management point for
  controlling and rolling out Microsoft product
  updates
• Eliminates possibility of unapproved updates
• Reduces bandwidth requirements
• Clients are configured via Group Policy

14
WSUS
15
Software Installation via GPO

• Software deployment controlled by group policies.
• Can make software available based on user or
  computer.
• When the software package falls out of the scope,
  software package is removed.
• Ie. If a user from another OU logs on, the
  software package assigned to a different OU is
  removed.

16
Software Installation via GPO

• Can perform a complete installation or simply
  make software available via Add/Remove Programs.
• Requires a Microsoft Software Installation file.
  Ie. Update.msi
• Most shrink wrapped software comes with MSI
  file for installation.

17
Routing and Remote Access Service

• Allows Server 2003 to be configured as an
  internet gateway (router)
• Uses Network Address Translation (NAT)
• Allows Server 2003 to be configured as a VPN
  concentrator
• Supports Active Directory integration and
  authentication.
• Can be configured as a RADIUS server
• Can support both roles of being a router and VPN
  server.

18
Routing and Remote Access Server (RRAS)

• Can be configured with VPN to support IPSEC
  security protocol
• Requires a multi-homed system.