Computer Tips and Tricks

How to protect Exchange with Data Protection Manager (DPM) 2010

noreply@blogger.com (Unknown) — Sat, 7 Aug 2010 02:31:00 -0700

The DPM team has released a new whitepaper on “How to protect Exchange with Data Protection Manager (DPM) 2010”
You can download this whitepaper from the following location:
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=be885d26-25e5-41ff-afc8-506414aed960

DPM 2010 Guides

noreply@blogger.com (Unknown) — Sat, 24 Jul 2010 23:32:00 -0700

Here are the latest DPM 2010 guides from the DPM team:

Planning a System Center Data Protection Manager 2010 Deployment
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=277db8f2-dbd9-456a-a99d-8fb6f47f3203

Deploying System Center Data Protection Manager 2010 http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=4ea389ef-7626-48ac-bac2-66ef4173f167

Data Protection Manager 2010 Operations Guide http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=58ed28c3-252a-452b-b6e1-992bd56cede0

Data Protection Manager 2010 Troubleshooting Guide http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=ed702ecc-0469-455c-9337-a0a7f14a3cf3

Microsoft System Center Configuration Manager 2007 R2 VHD

noreply@blogger.com (Unknown) — Sat, 24 Jul 2010 23:30:00 -0700

You can download a fully configured System Center Configuration Manager 2007 R2 VHD from the Microsoft site. This download enables you evaluate Microsoft System Center Configuration Manager 2007 R2.

Download:

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=e0fadab7-0620-481d-a8b6-070001727c56

Exchange Server Active Directory Schema Changes Reference

noreply@blogger.com (Unknown) — Wed, 9 Jun 2010 21:49:00 -0700

This download includes the Active Directory Schema Reference, which provides information about the changes that Microsoft Exchange Server makes to the Active Directory schema when it is installed.

This provides a summary of the Active Directory schema changes that are made when you install Microsoft Exchange Server 2010 Service Pack 1 (SP1), Exchange Server 2010, Exchange Server 2007 Service Pack 3 (SP3), Exchange Server 2007 Service Pack 2 (SP2), Exchange Server 2007 Service Pack 1 (SP1), Exchange Server 2007, and Exchange Server 2003.

Download : Click Here

System Requirements

Supported Operating Systems: Windows 2000; Windows 2000 Advanced Server; Windows 2000 Professional Edition ; Windows 2000 Server; Windows 2000 Service Pack 2; Windows 2000 Service Pack 3; Windows 2000 Service Pack 4; Windows Server 2003; Windows Server 2003 Service Pack 1; Windows Server 2003 Service Pack 1 for Itanium-based Systems; Windows Server 2003 Service Pack 2; Windows Server 2003 Service Pack 2 for Itanium-based Systems; Windows Server 2003, Datacenter Edition for 64-Bit Itanium-Based Systems; Windows Server 2003, Datacenter x64 Edition; Windows Server 2003, Enterprise Edition for Itanium-based Systems; Windows Server 2003, Enterprise x64 Edition; Windows Server 2003, Standard x64 Edition

Access to a computer that is running Microsoft Word or a Microsoft Word viewer.

Microsoft Exchange Server 2010 Administrator's Pocket Consultant

MCTS Self-Paced Training Kit (Exam 70-662): Configuring Microsoft Exchange Server 2010 (Pro - Certification)
Mastering Microsoft Exchange Server 2010
Microsoft Exchange Server 2010 Best Practices
TS - Microsoft Exchange Server 2010, Configuring Practice Exam

Windows SFC and Registry Keys

noreply@blogger.com (Unknown) — Sun, 30 May 2010 21:22:00 -0700

SFC is System File Checker. SFC is running in system to protect system files. All the system files are located in C:\Windows and C:\Windows\System32 folders. These files are important for Windows Operating to work effeciently. If any of the files is deleted accidently the file gets restored from the DLLCache folder automatically with the help of SFC. Sometimes, you might need to disable the SFC for development and testing purpose. This article explains the registry keys you can play with to disable the SFC and various options.

KEY Name:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry Name: SFCDisable
Date Type: REG_DWORD
Value: 0,1,2,3,4

0 = enabled. This is the default option. The SFC is enabled by default on Windows Systems.
1 = disable the SFC. The value 1 disable the SFC but prompt the user at the boot to re-enable the SFC.
2 = This is to disable the SFC completely and users are not prompted to re-enable it.
4 = SFC is enabled but the popups are disabled.

At the same location at registry, you can configure one more registry entry: SFCScan. Data type for this is REG_DWORD and values could be 0,1,2. This entry can be useful to perform the scan of protected files of the systems.

0 = do not scan protected files at boot (default)
1 = scan protected files at every boot
2 = scan protected files once

How to Set a Registry Entry on Multple Computers?

noreply@blogger.com (Unknown) — Sun, 30 May 2010 21:19:00 -0700

This article explains how you can use FOR loop to set a registry entry on computers specified in a text file.

This article explains how you can use the FOR loop to set registry entry on multiple computers. As an example, you want to enable SFCScan on all computers on your network. This is how you accomplish this:

Create a text file called Comps.TXT
Put all the computer names in it.
Next run the following command from a command window:

FOR /F "Tokens=*" %A IN (Comps.TXT) DO REG.EXE Add "\\%A\HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v SFCScan /d REG_DWORD /v 1 /F

The above command runs on all the computers mentioned in the Comps.TXT file and execute the REG.EXE command against each computer mentioned in the Comps.TXT file.

Windows 2008 R2 - SID Instead of User Friendly Names

noreply@blogger.com (Unknown) — Fri, 28 May 2010 21:59:00 -0700

Issue:
The SID information is displayed on Windows 2008 R2 servers instead of actual user or group names.

Resolution:
This issues can be resolved by installing the following patch on the Widows 2008 R2 servers:

http://support.microsoft.com/?id=976494

Hotfix Download Available

View and request hotfix downloads

Microsoft Exchange Server Information Store Viewer (MDBVU32)

noreply@blogger.com (Unknown) — Sat, 22 May 2010 02:01:00 -0700

Use Information Store Viewer (also called MDBVu32) to view or set details about a user’s message storage files, which consist of the private information store, the personal folder file (.Pst), the public store and the offline folder file (.Ost). The Information Store Viewer shows the properties available for each message, how you can use them, and in what format they appear.

Download: http://www.microsoft.com/downloads/details.aspx?familyid=3d1c7482-4c6e-4ec5-983e-127100d71376&displaylang=en

Identify Users Connecting to Exchange Server Using POP3

noreply@blogger.com (Unknown) — Mon, 17 May 2010 21:54:00 -0700

You can use the following 2 options to identify the POP3 users in an Exchange environment.

1. Enable diagnostic logging for the POP3svc service for authentications and connections. You will see the connection details in the event log.
2. Another option is to view pop connections under your pop SMTP virtual server which is located in Protocols -> POP3 -> Default POP3 Virtual Server -> Current Sessions.

Also, a log file will be generated in the Exchange logging folder under POP3.

Workstation Profile Migration

noreply@blogger.com (Unknown) — Sun, 9 May 2010 20:51:00 -0700

If you are using a migration tool (ADMT, Quest, NetIQ etc ) to migrate workstation and user profile, it will automatically translate the SID and assign the same profile to the target user account. The following procedure is used in the background to achieve this:

· The C:\Documents and Settings\UserName originally has Source SID listed in the ACL. Target SID is added or Source SID is replaced with Target SID depends on your migration tool configuration.

· The Target SID is added under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList and ProfileImagePath key is assigned the same value that ProfileImagePath has under Source SID. This ensures both source and target users will receive the same profile which is stored under C:\Documents and Settings\UserName.

For some reason, if a migrated user gets a new profile (or lost the old profile) you can use the following procedure to re-assign the old profile back to the target account:
1. Ask the user to log off from the user workstation.
2. Run Regedit from your computer. Connect Network Registry to the user workstation.
3. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
4. Go through the Profile list and identify the Source account. Copy the value from the ProfileImagePath key.

5. Again go through the Profile list and identify the Target account. Paste the ProfileImagePath key value there.
6. Restart the user workstation.

The ProfileImagePath key will be same value for both Source and Target user accounts. This ensures both source and target users will receive the same profile which is stored under C:\Documents and Settings\UserName.

Windows Server 2008 Virtual Labs

noreply@blogger.com (Unknown) — Sun, 9 May 2010 02:36:00 -0700

Virtual Labs

In these TechNet Virtual Labs, you'll have the opportunity to test-drive new and improved features and functionality in the Windows Server 2008 and Windows Server 2008 R2 releases. Each lab takes approximately 45-60 minutes to complete.

TechNet Virtual Labs are simple: No complex setup or installation is required to try out Windows Server 2008 or Windows Server 2008 R2 running in the full-featured TechNet Virtual Lab. You get a downloadable manual and a 90-minute block of time for each module. You can sign up for additional 90-minute blocks any time.

View the system requirements for TechNet Virtual Labs.

Virtual Labs

Virtual Hard Drive (VHD) Windows Server 2008 R2 Enterprise and Server Core Evaluation

noreply@blogger.com (Unknown) — Sun, 9 May 2010 02:31:00 -0700

Virtual Hard Drive

The Microsoft VHD file format specifies a virtual machine hard disk that can reside on a native host file system encapsulated within a single file. The format is used by Virtual PC 2007, Virtual Server 2005 R2 and Hyper-V and all future versions of Microsoft Windows Server that includes hypervisor-based virtualization technology.

The two virtual machines available for download include the Windows Server 2008 R2 Enterprise Full Evaluation, and the Windows Server 2008 R2 Enterprise Server Core Evaluation. For more information on the difference between full and core installation please see the Windows Server 2008 R2 Editions Overview pages.

The VHD releases are available in English only and are for evaluation and testing purposes. Further information such as registration details, and evaluation periods are available via the download instructions.

Download (Available for host servers running Windows Server 2008 or Windows Server 2008 R2 and Hyper-V only)

Logon types in Windows Server

noreply@blogger.com (Unknown) — Wed, 5 May 2010 23:41:00 -0700

Here’s a list of the logon types you may find in Windows’ security event log when auditing:

2 – Interactive

Console Logons basically.

3 – Network

This logon happens when you’re accessing file shares using SMB for example.

4 – Batch

This is used for scheduled tasks.

5 – Service

This is used for services and service accounts that log on to start a service.

7 – Unlock

This is used whenever a user unlocks their machine.

8 – Network Cleartext

This is used when logging on over the network - when the password is sent in clear text (should happen to you!)

9 – New Credentials

This is used when you run an application using the RunAs command.

10 – Remote Interactive

This is used for the RDP applications like Terminal Services or Remote Assistance.

11 – Cached Interactive

This is logged when users log on using cached credentials.

5 Group Policy Myths

noreply@blogger.com (Unknown) — Wed, 5 May 2010 23:38:00 -0700

1 - Group Policy is Hype

Hype comes from people. Technology doesn't hype itself. Group Policy is serious stuff. It's not rocket science when you get down to what it's doing and how it works. Sure, there's some intricate processing being done in the background, but in the end, it's simply a way to deploy and manage configuration settings to groups of users or computers. Just as with a box of matches, Group Policy is a tool that can provide enormous benefit and time savings if used properly. Or you can fire it up next to a can of gasoline and burn the house down if you're not careful. It's a powerful tool. Very powerful. So you need to get familiar with it before you unleash it in a production environment. Plan and test in a separate environment - always.

2 - Group Policy will Break Your Network and Clog the Pipes

So will putting a dozen raw potatos down your sink drain at once. If you don't do stupid things you won't get stupid results. Make sure you retain documentation about what your policy settings are doing so that you don't accidentally duplicate the same setting, or worse, push contradictory settings from different policies. Remember to always consider Inheritence, Tatooing and the combined effects of User+Computer settings as they relate to what user and computer accounts are impacted, and where each of them reside within Active Directory. It's all about planning and being careful. Group Policy on it's own will not damage your network. Using it improperly may. It's like driving a car. If you use it improperly you can do bad things. It's not the car's fault. Ok, maybe that was a bad example. It's like using a match (I need to find a better analogy or metaphor).

3 - Group Policy Takes an Expert to Make it Work Properly

Wrong! It takes getting familiar with it. Download and install VMware Player or VIrtual PC or Virtual Box or Parallels or whatever you prefer. Install a virtual guest running Windows Server 2003 or 2008, and another running XP or Vista, and test it out. Get a book and read up. Learn. You have to prepare in order to get a driver's license or pilot's license. You have to prepare in order to build a house. The same applies to using Group Policy. Don't just "figure it out" in production. That's not the way to go.

4 - Group Policy is Great for Deploying Software Installations

For small package on small LAN environments, the answer is "maybe". It depends on how the software is packaged. It also depends on how it installs and how your LAN is built and what sort of throughput limitations or demands are present during the window of time you intend to deploy the package. Much of this holds true for SMS, SCCM, Altiris or anything else as well. To give a few quick examples, you can deploy Adobe Acrobat Reader or WInZip or small applications like these if your network doesn't choke on a lot of traffic happening all at once. I would NOT recommend pushing Office 2007 or Autodesk Inventor 2009 using Group Policy, unless you're planning to quit and make everyone miserable on your last day of work.

5 - Group Policy Still Needs Scripts to Complete the Job

That used to be true. However, with the added capabilities of Group Policy Preferences, you can replace a ton of login scripting with GPP settings now. The ease of use is fantastic. The reliability is superb. The gains are enormous. You can leverage the benefits of GPP features on XP and WS03 as well as WS08 and Vista, as long as you have WS08 servers in your environment to use GPP features.
While third-party products like LikeWise add GPO-like features to Linux clients, I've yet to see anything like Group Policy for OSX or Linux "in general". OpenLDAP is a good solution for network-centric account management, it's doesn't include Group Policy features for managing settings via rules like Active Directory does. The point I'm working towards here is that Group Policy prior to GPP is a huge added benefit over other platform capabilities, which are only possible through extensive scripting (Bash, etc.). Some advanced processing on Windows still requires scripting or application additions, but GPP adds user and computer settings for such things as drive mappings, printer connections, shortcuts, and much more. These things used to require login scripts or startup scripts to accomplish. Not that scripting is entirely unnecessary now, but you have more options at hand to do more with less effort.
Group Policy is without a doubt one of the most powerful and compelling reasons for choosing Microsoft Windows as a business networking platform. It provides built-in, straightforward, centralized management and control over the computers and user settings in your environment. Best of all: It's FREE. And you don't have to download anything to make it work. Enhancements are available, like GPMC, GPP extensions and ADMX templates, etc., but they're not required in order to start using Group Policy right now. As with any tool however, it works best when applied to what it was intended for. Hammers are great for driving nails, but not so great at turning screws.

Display The Shutdown Menu When Your Computer’s Power Button Is Pressed

noreply@blogger.com (Unknown) — Wed, 5 May 2010 01:10:00 -0700

By default, your Windows XP will shut down when the Power button is pressed. It’s a good idea to change it so that the shutdown menu is opened instead, especially if you have little kids running around the house.

It’s quite easy to change it:

1. Go to your Windows XP’s desktop and right-click it. Select “Properties” and the Display Properties window will appear.

2. Open the “Screen Saver” tab and look for the “Power” button near the bottom of the window. Click it.

3. In the “Power Options Properties” window that opens, go to the “Advanced” tab.

There is a dialog box in the “Power Buttons” section. Choose what you want Windows to do when the power button is pressed.

“Ask me what to do” will make it open up the shutdown menu.

4. Click “OK” and restart your computer. From now on, pressing the power button will open the shutdown menu, letting you decide what you want to do.

How To Speed Up Your Windows XP By Disabling File Indexing

noreply@blogger.com (Unknown) — Wed, 5 May 2010 01:00:00 -0700

File indexing is a Windows service that like many others, is totally useless – unless you do a lot of searching on your computer. As most users don’t, it’s a good idea to disable it to speed up actions like opening and closing files and folders on your Windows XP.

To disable the Indexing Service:

Go to “My Computer” and right click on your hard drive. At the bottom of the window that opens, you should see a check box titled “Allow Indexing Service to index the disk for fast file searching.” …

How to Rename the Recycle Bin

noreply@blogger.com (Unknown) — Wed, 5 May 2010 00:58:00 -0700

To change the name of the Recycle Bin desktop icon, open Regedit and go to:

HKEY_CLASSES_ROOT/CLSID/{645FF040-5081-101B-9F08-00AA002F954E}

and change the name "Recycle Bin" to whatever you want (don't type any quotes).

Best Practices Analyzer (BPA) for HYPER-V

noreply@blogger.com (Unknown) — Sun, 2 May 2010 02:15:00 -0700

You can use Hyper-V Best Practices Analyzer to scan a server that is running the Hyper-V role, and help identify configurations that do not comply with the best practices of Microsoft for this role. BPA scans the configuration of the physical computer, the virtual machines, and other resources such as virtual networking and virtual storage. Scan results are displayed as a list of issues that you can sort by severity, and include recommendations for fixing issues and links to instructions. No configuration changes are made by running the scan.

Download: click here

ForeFront Client Security (FCS) -Definition Updates

noreply@blogger.com (Unknown) — Wed, 28 Apr 2010 04:10:00 -0700

If you are using an unmanaged version of ForeFront Client Security (FCS), you can update the FCS definitions from Windows Update. But sometimes Windows Update won’t find any updates for FCS definition. Also, if you look at the FCS version details, you will see the following information:

Antivirus definition: 1.0.0.0
Antispyware definition: 1.0.0.0

Here are a few options you can try to update the FCS definition to the current version.
Option #1
Go to Windows Update and try Check For Update option.
Option #2
If You receive updates option is set For Windows only, change it to all Microsoft product and then run windows update again.

Option #3 Manually download and install the latest definition from the following location:
https://www.microsoft.com/security/portal/Definitions/HowToForeFront.aspx

Free eBooks From Microsoft

noreply@blogger.com (Unknown) — Wed, 28 Apr 2010 04:01:00 -0700

Download

Download

Download

Download

How to Install ISA Server Service Pack 1 on ISA server 2000

noreply@blogger.com (Unknown) — Mon, 26 Apr 2010 23:07:00 -0700

You can get Service Pack 1 at http://www.microsoft.com/isaserver/downloads/sp1.asp Download SP1 to a machine on the internal network, scan it for viruses, then copy it to the ISA Server. Perform the following steps after copying the service pack to the ISA Server:

Double click on the isasp1.exe file. Type in a path to put the temporary files in the Choose Directory for Extracted Files dialog box. Click OK.

Click I Agree in the End User License Agreement (EULA) dialog box.
Click OK in the Microsoft ISA Server 2000 Update Setup dialog box. The computer will restart.

That’s all there is to installing ISA Server service pack 1.

Install HotFix isahf255.exe
Log onto the machine after the ISA Server service pack 1 installation routine restarts the machine. There are a few hotfixes and updates you need to install on the Windows Server 2003/ISA Server machine to insure that everything works correctly. You can download the HotFix pack, isahf255.exe at http://www.microsoft.com/downloads/details.aspx?familyid=77d89f87-5205-4779-b1ab-fc338283b2d9&displaylang=en
Download the file to a machine on the internal network, scan it for viruses, and then copy it to the ISA Server. Perform the following steps after copying the file to the ISA Server:

Double click on the isahf255.exe file. Type in a path for the temporary files in the Choose Directory for Extracted Files dialog box, then click OK.

Click I Agree in the Feature Pack 1 EULA dialog box.
Click OK in the Microsoft ISA Server 2000 Feature Pack 1 dialog box. Leave the checkmark in the Read about ISA Server Feature Pack 1 checkbox to learn more about what you get with Feature Pack 1.

Note that you do not need to restart the server. The next step is to install Feature Pack 1.

Install Feature Pack 1
Feature Pack 1 (FP1) is not required. You don’t have to install ISA Server Feature Pack 1 on the Windows Server 2003/ISA Server machine to get it working correctly. However, I do highly recommend that you install ISA Server Feature Pack 1 because it adds a lot of cool new capabilities and Wizards. You can download ISA Server Feature Pack 1 at http://www.microsoft.com/downloads/details.aspx?FamilyID=2f92b02c-ac49-44df-af6c-5be084b345f9&DisplayLang=en
Download the feature pack to a machine on the internal network and scan it for viruses. Then copy the file to the ISA Server and perform the following steps:

Double click on the isaftp1.exe file. Type in a path for the extracted files in the Choose Directory For Extracted Files dialog box.

Click I Agree in the Feature Pack 1 EULA dialog box.
Click OK in the Microsoft ISA Server 2000 Feature Pack 1 dialog box. Leave the checkmark in the Read about ISA Server Feature Pack 1 checkbox to learn more about what you get with Feature Pack 1.

Conclusion

I think you’ll find that running ISA Server on Windows Server 2003 will be a good experience. Windows Server 2003 provides the highest level of stability and security ever seen in a Windows-based platform and ISA Server raises the level of security by several orders of magnitude. Give ISA Server on Windows Server 2003 a try and let us know what you think.

I hope you enjoyed this article and found something in it that you can apply to your own network.

Installing ISA Server 2000 on Windows Server 2003

noreply@blogger.com (Unknown) — Mon, 26 Apr 2010 22:54:00 -0700

There have been a lot of questions on the ISAServer.org message boards on how Windows Server 2003 and ISA Server get along with each other. I didn’t spend too much time trying to figure out issues with pre-release versions of Windows Server 2003 and ISA Server because many of the problems could have been related to beta issues that would be fixed in the final version. You could never know if it was an ISA Server issue, and adverse interaction between ISA Server and Windows Server 2003, or maybe a beta bug.

Now that Windows Server 2003 is officially released, and ISA Server is officially supported on Windows Server 2003, we can get to the business of testing out ISA Server on Windows Server 2003 machines. There are many compelling reasons to run ISA Server on a Windows Server 2003 machine:

Windows Server 2003 is the most secure version of Windows ever

Windows Server 2003 is the most stable version of Windows ever

Non-essential services are disabled right out of the box

Its very difficult to run IIS services on the Windows Server 2003/ISA Server because there is no documentation on how to disable socket pooling for all IIS services except the W3SVC

When you combine high security, rock solid stability and the increased difficulty in harpooning yourself in the foot by running IIS services on your firewall, you get what you’re really looking for in a firewall: protection for your internal network.
I’ve had the chance to run ISA Server in integrated mode on a Windows Server 2003 machine for over a month and I find it much more stable than my experiences with ISA Server on Windows 2000 machines. This could be due to the better hardware on which the ISA/Windows Server 2003 software is installed on, or it could be an operating system issue.

Installing ISA Server on a Windows Server 2003 machine is painless, but it is a little different than how you do it on a Windows 2000 machine. We need to go through the follow steps to install ISA Server on a Windows Server 2003 box:

Install Windows Server 2003

Install ISA Server 2000

Install ISA Server Service Pack 1

Install isahf255.exe

Install Feature Pack 1

Install Windows Server 2003 The Windows Server 2003 machine should have the following characteristics:

At least two network interfaces – one internal and one external

No extraneous services installed on the machine

As much RAM as possible

Disable non-essential services

You need at least one internal and one external interface. The internal interface will be on the Local Address Table (LAT) and does not have a default gateway set on it. The external interface is never on the LAT and it’s the only interface with a default gateway set on it. Windows Server 2003 is like Windows 2000 in that only one interface can have a default gateway. This means ISA Server on Windows Server 2003 supports a single external interface. You can have multiple public address DMZ interfaces, but only a single interface that connects the internal network to the Internet.
Do not install extra services on the firewall. Do not install a Quake server, do not install a enterprise mail and groupware server, do not install an FTP server, do not install a Web server an do not install a Kaaza server! Your ISA Server is a firewall – you wouldn’t install these services on a PIX or Checkpoint Nokia – so you shouldn’t do it on the ISA Server firewall.
Most people will use the Web Proxy service to provide Web performance enhancements and increased security for Web Publishing. The cool thing about ISA Server is that it keeps the Web cache in RAM. The more RAM you have, the more cached content can be kept in fast memory and the better end-user perceived performance. Aim for at least 768 MB of RAM in the ISA Server firewall, and more is better.
You can harden your server by disabling non-essential services. Non-essential services depend on what services you need, so its hard to give you a hard and fast list of what services you should disabled.

Install ISA Server 2000
Now for the fun part. Get out your ISA Server 2000 CD-ROM disk and put it into the drive, or connect to a network share that contains the ISA Sever installation files. Then perform the following steps to begin installing ISA Server on a Windows Server 2003 machine:

Double click on the ISAAutorun.exe file on the ISA Server CD
Click on the Install ISA Server link on the Internet Security & Acceleration Server 2000 splash page.
You will see an ISA 2000 dialog box that informs you that you need to install ISA 2000 Service Pack 1 in order for things to work right. We know that, so we’ll click Continue.

Click Continue on the Welcome to the Microsoft ISA Server installation program page.
Enter your CD Key in the CD Key dialog box. Click OK.
Write down your Product ID as list in the Product ID dialog box. Click OK in the Product ID dialog box after writing this number down.
Click I Agree in the Microsoft ISA Server Setup dialog box.
Click the Full Installation button in the installation type dialog box. I am assuming you want to use all the features that ISA Server has to offer. You can use the Add/Remove Programs applet later if you want to remove some ISA Server features.
In this example we are installing ISA Server in standalone mode, not in enterprise array mode. Click Yes in the dialog box that asks if you want to continue.

Select the Integrated mode option on the Select the mode for this server page. You want to take advantage of the full power of your ISA Server firewall. Integrated mode gives you everything the Web Proxy and Firewall services have to offer. Go for it! Click Continue.

On the Web cache page, select a drive to put the Web cache file on. The drive must be NTFS. Type in a size of the cache in the Cache size (MB) text box and then click the Set button. Then click OK.

On the LAT page, click the Construct Table button. On the Local Address Table page, remove the checkmark in the Add the following private ranges checkbox. Put a checkmark in the Add address ranges based on the Windows 2000 Routing Table checkbox. Remove the checkmark from the checkbox representing the external interface, and leave the checkmark in the checkbox for the internal interface. Click OK in the Local Address Table dialog box, then click OK in the Setup Message dialog box that informs you that the LAT was contstructed based on the Windows 2000 routing table (in spite of the fact that you’re installing ISA Server on a Windows Server 2003 machine).

13. Click OK on the LAT dialog box after reviewing the list listing in the Internal IP ranges list.

Unlike Windows 2000, Windows Server 2003 does not install IIS by default (yeah! You should NEVER run IIS services on a firewall – except for maybe the SMTP service). You will see a dialog box telling you that you’ll have to install the SMTP service if you want to run the SMTP Message Screener. Click OK to continue.

The ISA Server services are installed. You will see a warning balloon informing you that ISA 2000 will cause Windows to become unstable. Close the balloon, remove the checkmark from the Start ISA Server Getting Started Wizard checkbox, and then click OK in the Launch ISA Management Tools dialog box.

Click OK in the dialog box that informs you that setup was completed.
Click OK in the dialog box that informs you that setup has failed to start one or more services.

Now you’re ready to install ISA Server Service Pack 1.

Publish Domain Name System servers with Internet Security and Acceleration Server

noreply@blogger.com (Unknown) — Mon, 26 Apr 2010 00:22:00 -0700

This article describes how to publish a Domain Name System (DNS) server by using Microsoft Internet Security and Acceleration (ISA) Server.

There are two possible scenarios for DNS hosting:

Scenario 1: DNS hosting with a DNS Server on ISA Server

By default, ISA Server includes a predefined DNS query packet filter:

Name: DNS Filter
Filter Type: Predefined
Protocol: UDP
Direction: Send Receive
Local Port: All ports
Remote Port: Fixed port, 53
Local Computer: Default IP address on the External interface(s)
Remote Computer: All Remote Computers

Because the direction of the preceding packet filter is "Send Receive" with Remote port 53, the filter enables ISA Server to send DNS queries to an external DNS server that listens on User Datagram Protocol (UDP) port 53 and receives responses to these queries.

The filter does not enable incoming DNS queries to ISA Server. When you host a DNS server for external client computers, you must add a custom DNS packet filter that can enable incoming DNS queries to be received by the DNS server. An example of such a packet filter is:

Name: DNS Query
Protocol: UDP
Direction: Receive Send
Local Port: Fixed port, 53
Remote Port: All ports
Local Computer: Default IP address on the External interface(s)
Remote Computer: All Remote Computers

Unlike DNS queries which use UDP protocol, DNS zone transfers between primary and secondary DNS servers use Transmission Control Protocol (TCP) protocol. If you require a DNS zone transfer to a secondary DNS server on the external network adapter of ISA Server, you must create another custom packet filter, such as:

Name: DNS Zone transfer (In)
Protocol: TCP
Direction: Inbound
Local Port: Fixed port, 53
Remote Port: All ports
Local Computer: Default IP address on the External interface(s)
Remote Computer: All Remote Computers

Name: DNS Zone transfer (Out)
Protocol: TCP
Direction: Outbound
Local Port: Allports
Remote Port: Fixed port, 53
Local Computer: Default IP address on the External interface(s)
Remote Computer: All Remote Computers

To prevent DNS zone transfers to unauthorized DNS servers, you must set the DNS server to enable zone transfers only to the specified DNS servers, or you can modify the preceding packet filter so that the specified remote computer is the Internet Protocol (IP) address of the secondary DNS server, instead of "All Remote Computers".

Scenario 2: DNS Server on the private network of ISA Server

To enable a DNS server on the private network of ISA Server to resolve DNS queries for clients on the network adapter of ISA Server, you must create a DNS Publishing rule:

Right-click Server Publishing Rule, click New, and then click Rule.
Type in a name for the Server Publishing rule, and then click Next.
Enter the IP addresses of the internal DNS server and the external interface of ISA Server, and then click Next.
Click DNS Query Server as the protocol, and then click Next.
Apply the rule to Any Request, click Next, and then click Finish.

If you require DNS zone transfer to a secondary DNS server on the network adapter of ISA Server, you must create another Server Publishing rule. Use the same general guidelines as the preceding DNS Query rule and select "DNS zone transfer" as the protocol.

APPLIES TO

Microsoft Internet Security and Acceleration Server 2000 Standard Edition

How To Configure DNS Records for Your Web Site in Windows Server 2003

noreply@blogger.com (Unknown) — Mon, 26 Apr 2010 00:08:00 -0700

This article describes how to configure your Domain Name System (DNS) server to host an externally accessible Web site (that is, accessible from the Internet).

How to Obtain an IP Address

To host an externally accessible Web site, you must obtain a public IP address from your Internet service provider (ISP). Assign this IP address to the external interface of the firewall or router to which your DNS server is connected. For additional information about how to assign an IP address to a network adapter, click the following article number to view the article in the Microsoft Knowledge Base:

323444 How To Change the IP Address of a Network Adapter in Windows Server 2003

For additional information about how to configure a DNS server for Internet access, click the following article number to view the article in the Microsoft Knowledge Base:

323380 How To Configure DNS for Internet Access in Windows Server 2003

How to Register a Domain Name

Register a parent or second-level DNS domain name for your organization with an Internet domain name registration authority (such authorities are known as registrars). For a list of world-wide accredited registrars, visit the following Internet Corporation for Assigned Names and Numbers (ICANN) Web site:

The Internet Corporation for Assigned Names and Numbers

http://www.icann.org

Although the registration process may vary among registrars, follow these steps to register your domain name:

Perform a search to verify that the name that you want to register is available.
Provide contact and billing information (including an e-mail address) for the account.
Type the fully qualified domain names (FQDNs) of your primary and secondary DNS servers.
NOTE: These are the public IP addresses that you obtained from your ISP.
Pay, or arrange for the payment of, an annual fee.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

How to Configure the Web Server

Install and configure Microsoft Internet Information Services (IIS) if it is not already installed.

How to Create a DNS Entry for the Web Server

Create an alias or CNAME record for the DNS server on which you configured IIS. This step makes sure that external host computers can connect to your Web server by using the "www" host name. To do this, follow these steps:

Open the DNS snap-in. To do this, click Start, point to Administrative Tools, and then click DNS.
Under DNS, expand Host name (where Host name is the host name of the DNS server).
Expand Forward Lookup Zones.
Under Forward Lookup Zones, right-click the zone that you want (for example, domain_name.com), and then click New Alias (CNAME).
In the Alias name box, type www.
In the Fully qualified name for target host box, type the fully qualified host name of the DNS server on which IIS is installed. For example, type dns.domain_name.com, and then click OK.

For additional information about how to create a DNS record, click the following article number to view the article in the Microsoft Knowledge Base:

323445 How To Create a New Zone on a DNS Server in Windows Server 2003

Adding Users and Computers to the Active Directory Domain

noreply@blogger.com (Unknown) — Sun, 25 Apr 2010 23:58:00 -0700

After the new Active Directory domain is established, create a user account in that domain to use as an administrative account. When that user is added to the appropriate security groups, use that account to add computers to the domain.

To create a new user, follow these steps:
1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers to start the Active Directory Users and Computers console.
2. Click the domain name that you created, and then expand the contents.
3. Right-click Users, point to New, and then click User.
4. Type the first name, last name, and user logon name of the new user, and then click Next.
5. Type a new password, confirm the password, and then click to select one of the following check boxes:
  - Users must change password at next logon (recommended for most users)
  - User cannot change password
  - Password never expires
  - Account is disabled
  Click Next.
6. Review the information that you provided, and if everything is correct, click Finish.
After you create the new user, give this user account membership in a group that permits that user to perform administrative tasks. Because this is a laboratory environment that you are in control of, you can give this user account full administrative access by making it a member of the Schema, Enterprise, and Domain administrators groups. To add the account to the Schema, Enterprise, and Domain administrators groups, follow these steps:
1. On the Active Directory Users and Computers console, right-click the new account that you created, and then click Properties.
2. Click the Member Of tab, and then click Add.
3. In the Select Groups dialog box, specify a group, and then click OK to add the groups that you want to the list.
4. Repeat the selection process for each group in which the user needs account membership.
5. Click OK to finish.
The final step in this process is to add a member server to the domain. This process also applies to workstations. To add a computer to the domain, follow these steps:
1. Log on to the computer that you want to add to the domain.
2. Right-click My Computer, and then click Properties.
3. Click the Computer Name tab, and then click Change.
4. In the Computer Name Changes dialog box, click Domain under Member Of, and then type the domain name. Click OK.
5. When you are prompted, type the user name and password of the account that you previously created, and then click OK.
  
  A message that welcomes you to the domain is generated.
6. Click OK to return to the Computer Name tab, and then click OK to finish.
7. Restart the computer if you are prompted to do so.