Windows 2000 Server 安全配置详解：新特性和管理策略

需积分: 3 26 浏览量更新于2024-08-01 收藏 4.06MB PDF 举报

《配置Windows 2000 Server安全》是一本由Thomas W. Shinder, M.D., MCSE, MCP+I, MCT, Debra Littlejohn Shinder, MCSE, MCP+I, MCT, D. Lynn White, MCSE, MCPS, MCP+I, MCT等作者合作编写的Syngress出版公司的专业书籍。该书旨在与Windows 2000 Server的发布同步，针对网络管理员提供关于微软操作系统Windows 2000的安全服务深入指南。随着Windows NT在网络安全领域的主导地位，微软推出Windows 2000 Server时，引入了一系列重要的新安全功能，这些新特性对于保护组织的数据和通信至关重要。书中首先讨论了Windows 2000 Server的安全迁移路径，概述了从Windows NT到2000 Server的安全转变，分析了变化的原因、差异以及可能遇到的问题和限制，同时也强调了两者之间的共性。升级或迁移过程中需要考虑的关键因素和如何启动这个过程都有详尽的指导。第二章主要关注默认访问控制设置，介绍了管理员组、用户组和Power Users组的基本概念。在安装Windows 2000 Server时，书中详细讲解了默认文件系统和注册表权限，以及预设的用户权利。读者可以找到如何分析和配置服务器安全的实用信息，包括一个详细目录链接。第三章深入探讨了Kerberos服务器认证，这是Windows 2000 Server中的一个重要安全机制，用于加强身份验证和授权，确保数据传输的安全性。Kerberos服务器是网络域环境中的一种关键服务，通过非对称加密和密钥管理来增强安全性。此外，书中还涵盖了IP Security（IPSec）的支持，这是一种用于保护网络通信的协议，确保数据在传输过程中的完整性、机密性和可用性。另外，作者提到了Encrypting File System（EFS），一种用于加密文件系统的工具，以及Public Key Infrastructure（PKI），它在数字证书和公钥管理中发挥着核心作用。书中还讨论了智能卡的应用，它们在身份验证和访问控制中扮演着重要角色。《Configuring Windows 2000 Server Security》这本书提供了全面的教育资源，帮助管理员理解和掌握Windows 2000 Server的安全特性，从而有效地管理和保护组织的信息资产，确保其在日益复杂的网络安全环境中保持安全稳定。对于任何关注网络安全性并使用Windows 2000 Server的IT专业人士来说，这是一本不可或缺的参考书籍。

Timing

Timing is very important for any new application, but especially for a network operating system. You must

determine what effects it will have on the users of the network and how much time it will take to implement

the new security features that are required for your organization. This is one reason it is good to begin with a

controlled lab environment. This will give you a good idea of how long it will take to implement your plan in

the production environment. Another issue to consider is other activity in your organization. If it is a

particularly busy time of year, you may want to hold off the implementation until things calm down

somewhat.

Cost

Cost analysis for upgrading to Windows 2000 Server goes well beyond the cost for the licenses. It must also

include any hardware upgrades that are required, as well as the cost of training users and administrators in

the use of the new features available in Windows 2000 domains, especially Active Directory and the new

security features available with Distributed Security Services. You must determine whether the greater

security available in Windows 2000 Server lessens the chance of downtime due to security incidents. With

less downtime, the organization may experience greater productivity, which may lead to an increased return

on investment.

Resources

Resources consist of both humans and hardware. Both must be analyzed to ensure that sufficient resources

are available to implement and sustain the upgrade to Windows 2000 Server. Windows 2000 Server has

higher minimum requirements than did previous versions of the operating system, so you may have to add

new hardware or enhance the existing hardware in your organization. You also need to analyze the human

resources that are available for implementing and administering the upgrade.

Summary

Windows 2000 Server adds a great number of security enhancements to those that were available in previous

versions of the operating system. These enhancements include Public Key Infrastructure capabilities, the

Kerberos v5 authentication protocol, smart card support, the Encrypting File System, and IPSec. These new

additions to security are necessary to protect data as organizations start depending on their information

technology infrastructure even more than in the past. Any vulnerability could wreak havoc on those

mission-critical systems.

The Network Security Plan is vital to the upgrading of your network from Windows NT 4.0 to Windows

2000 Server. It must be carefully thought out so that your organization can take advantage of the new

security features in Windows 2000 Server. If the plan is not thought out carefully, then the necessary security

you desire may not be put into place. At a minimum your Network Security Plan must include security group

strategies, security group policies, network logon and authentication strategies, and strategies for information

security.

Before you upgrade to Windows 2000 Server in a production environment, you need to test it. The test

environment should mimic the production environment so that you can obtain an accurate picture of how the

implementation will affect the production environment. When you are satisfied with the results of your

testing, you should carefully consider the timing of rolling out the upgrade to the production environment to

ensure that there will not be an interruption during a particularly busy time for your organization.

FAQs

Q: Why do I have to upgrade my primary domain controller first?

A: The primary domain controller must be upgraded first to ensure a successful upgrade of a Windows

NT domain to a Windows 2000 domain. Information from the Security Accounts Manager on the PDC

is copied over to the data store of the Active Directory.

Q: How can I enable my Windows 98 clients to use Kerberos v5 authentication?

A: Install the Distributed Security Client on all of your Windows 98 clients.

Q: Can I still use Windows NT 4.0 backup domain controllers in a Windows 2000 domain?

A: Yes, Windows NT 4.0 BDCs can still be used in a Windows 2000 domain. One of the Windows

2000 Server domain controllers acts as a PDC emulator, so communication can occur to/from the

Configuring Windows 2000 Server Security:The Windows 2000 Server Security Migration Path

http://corpitk.earthweb.com/reference/pro/1928994024/ch01/01-04.html (2 of 3) [8/3/2000 6:50:59 AM]

Introduction

One of the weaknesses in Windows NT 4.0 is inherent in the default access permissions assigned to the built-in groups for the file

system and the Registry. Windows 2000 has alleviated that weakness by refining the permissions granted to these groups.

Windows 2000 Server is a member server or stand-alone server when it is first installed onto a clean system. If the server participates in

a domain, it is a member server, but if it is in a workgroup, it is a stand-alone server. Active Directory is not automatically installed

during a fresh installation of a system, because the setup program does not know whether you want it to be a member server or a

domain controller. However, Windows 2000 Server does automatically create these groups when it is first installed:

• Administrators

• Backup Operators

• Guests

• Power Users

• Replicator

• Users

These groups are found in the “Groups” folder under Local Computer Users and Groups in the Computer Management console, as

shown in Figure 2.1.These same groups, with the exception of Power Users, are also present if the system is promoted to domain

controller; however, additional groups are added as domain local groups. The additional groups are:

• Account Operators

• Print Operators

• Server Operators

These groups, as well as the others, are found in the “Builtin” folder of your directory tree in the Active Directory Users and Computers

console, as shown in Figure 2.2.

Figure 2.1 These are the built-in groups for Windows 2000 Server when it is first installed on a clean system.

Figure 2.2 These are built-in groups for a Windows 2000 Server domain controller.

A major segment of operating system security is defined by the default access permissions granted to three groups: Administrators,

Power Users, and Users.

Administrators Group

The Administrators group is the most powerful group available on the system. Members of the Administrators group can perform any

function available in the operating system, and they are not restricted from access to any file system or Registry object. Members of the

Configuring Windows 2000 Server Security:Default Access Control Settings

http://corpitk.earthweb.com/reference/pro/1928994024/ch02/02-01.html (2 of 4) [8/3/2000 6:51:02 AM]

Administrators group should be kept to a bare minimum precisely because they do have so much power. Ideally, people who are in the

Administrators group should also have another account that they use normally. They should use the account in the Administrators group

only when they need to perform these functions.

• Configure system parameters such as password policy and audit functions.

• Install Service Packs and Hotfixes.

• Upgrade the operating system.

• Install hardware drivers.

• Install system services.

Users Group

The Users group is the most restrictive group available in Windows 2000. The default security settings prevent members of the Users

group from modifying machine-wide registry settings, program files, and operating system files. Members of the Users group are also

prevented from installing applications that can be run by other members of the Users group.

Power Users Group

The Power Users group in Windows 2000 has more system access than the Users group but less system access than the Administrators

group. Power Users can install applications to a Windows 2000 system as long as the application does not need to install any system

services. Only the Administrators group can add system services. Power Users can also modify system-wide settings such as Power

Configuration, Shares, Printers, and System Time. However, Power Users cannot access other users’ data that is stored on NTFS

partitions. Power Users can add user accounts, but they cannot modify or delete any account they did not create, nor can they add

themselves to the Administrators group. Power Users can create local groups and remove users from local groups they have created.

The Power Users group has much power on a system, and in Windows 2000 it is also backward compatible to the default security

settings for the Users group in Windows NT 4.0.

Configuring Security During Windows 2000 Setup

The default security settings for Windows 2000 are put in place during the beginning of the GUI-mode portion of setup if the

installation is a clean install or if it is an upgrade from a Windows 95 or Windows 98 system. However, if the upgrade is being

performed on an existing Windows NT system, the existing security settings are not modified. Of course, for file system settings to be

applied you must be using NTFS and not the FAT file system. To see the security settings that are applied during Windows 2000 setup,

go to %windir%\Inf and locate these files:

• defltdc.inf—Domain Controller security settings

• defltsv.inf—Server security settings

• defltwk.inf—Professional security settings

Each of these files contains all the default security settings that are applied to the system, depending on the type of system that is being

installed. Be warned that it does look cryptic, so you may not be able to make sense out of the settings. Here is a small portion of the

security settings from the defltsv.inf file:

[Registry Keys]

Configuring Windows 2000 Server Security:Default Access Control Settings

http://corpitk.earthweb.com/reference/pro/1928994024/ch02/02-01.html (3 of 4) [8/3/2000 6:51:02 AM]

剩余236页未读，继续阅读

sunxianbin

粉丝: 9
资源: 84

Windows 2000 Server 安全配置详解：新特性和管理策略

Installing And Configuring Windows Server 2012 Exam Ref 70-410

Configuring SonicWALL Firewalls(syngress安全图书)

Configuring NetScreen Firewalls(syngress安全图书)

Configuring Citrix Metaframe XP for Windows(syngress安全图书)

Syngress - How To Cheat At Installing, Configuring Windows 2000 File Systems

Configuring Cisco Voice Over IP(Second Edition)(syngress安全图书)

Configuring Windows Server 2008 Active Directory

Installing and Configuring Windows Server 2012 R2

Training Guide Installing and Configuring Windows Server 2012

MSICT 70-642 Configuring Windows Server 2008 Network Infrastructure

最新资源