Microsoft Windows 2000 Server Administrator's Companion

Jason Gerend has co-authored numerous books, including The Effective Executive's Guide To Outlook 2002, The New Webmaster's Guide to Dreamweaver 4, and the New Webmaster's Guide to FrontPage 2002. He also helped Sharon and Charlie write the first edition of the Microsoft Windows 2000 Server Administrator's Companion, and Windows 2000 Pro: The Missing Manual. A Microsoft Certified Systems Engineer (MCSE), Jason enjoys hiking and installing operating systems for fun. He's been fooling around with computers since the days of MS-DOS 2, was a big fan of OS/2 2.1, and has been a freelance Webmaster and computer consultant since 1995.

Introduction xliii PART I PREPARING FOR INSTALLATION 1 Overview of Windows 2000 2 Deploying Server and Workstation Functions Together 4 Network Management 5 The Microsoft Management Console 6 Group Policy 6 Zero Administration 6 Terminal Services 7 Interoperability 8 System and Network Security 8 Hardware Support 9 Availability and Reliability 10 Active Directory 11 Storage and File System Support 11 Removable Storage 12 Remote Storage 12 Disk Administrator 12 Microsoft Distributed File System 12 NTFS 5 12 Communications 13 Internet Services 13 Defying Categories 14 The Need for Planning 14 Summary 15 2 Introducing Directory Services 16 Understanding Directory Services 17 Active Directory in Windows 2000 19 Terminology and Concepts in Active Directory 20 The Active Directory Architecture 23 The Directory System Agent 23 Naming Formats 24 The Data Model 25 Schema Implementation 25 The Security Model 25 Naming Contexts and Partitions 27 The Global Catalog 27 Summary 29 3 Planning Namespace and Domains 30 Analyzing Naming Convention Needs 31 Trees and Forests 31 Defining a Naming Convention 33 Determining Name Resolution 36 Planning a Domain Structure 38 Domains vs. Organizational Units 38 Designing a Domain Structure 40 Domain Security Guidelines 41 Creating Organizational Units 41 Planning Multiple Domains 42 Planning a Contiguous Namespace 42 Determining the Need for a Forest 43 Creating the Forest 43 Summary 43 4 Planning Deployment 44 How Information Technology Functions 46 Identifying Business Needs 46 Getting Specific 47 Seeing into the Future 47 Assessing Your Current Setup 48 Documenting the Network 48 Making a Roadmap 50 Defining Goals 51 Assessing Risk 52 Summary 53 PART II INSTALLATION AND INITIAL CONFIGURATION 5 Getting Started 56 Windows Installation Considerations 57 Reviewing System Requirements 58 Planning Partitions 59 Gathering Network Information 61 Physical Preparation 62 Dual-Boot Considerations 63 Installing Windows 2000 65 Manually Installing Windows 66 Automating Windows Installations 78 Using Setup Command-Line Parameters 79 Creating a Distribution Folder 82 Creating Answer Files Using the Setup Manager Wizard 89 Using SysPrep to Clone Your Computer 97 Troubleshooting Installations 99 Setup Freezes or Locks Up 99 Setup Stops During File Copying 101 Previous OS Will Not Boot 102 Summary 104 6 Configuring New Windows 2000 Server Installations 106 Checking for Setup Problems 107 Configuring Devices 108 Using the Add/Remove Hardware Wizard 108 Using Device Manager 110 Configuring Networking Settings 114 Changing Your Network Identity 114 Configuring Network Components 116 Configuring TCP/IP 117 Configuring NWLink IPX/SPX 124 Configuring Storage 125 Using the Windows 2000 Configure Your Server Tool 125 Choosing Whether to Set Up a Domain Controller 126 Configuring the First Server on Your Network 127 Performance and Memory Tuning 129 Updating Windows 132 Securing Windows 133 Summary 135 7 Upgrading to Windows 2000 136 Architectural Improvements in Windows 2000 137 Domain Controllers and Server Roles in Windows 2000 137 Active Directory 139 Hardware Support 142 Software Support 143 Planning a Domain Upgrade 144 Documenting the Existing Network 145 Making a Recovery Plan 148 Planning the Site Topology 156 Developing an Upgrade Strategy 158 Preparing Domains and Computers for Upgrading 161 Preparing the Domains 161 Preparing the Computers 161 Upgrading to Windows 2000 Professional from Windows 95/98 163 Difficulties Involved with Windows 95/98 Upgrades 164 Using a Dual Boot 165 Performing the Upgrade 166 Upgrading to Windows 2000 Server from Windows NT 168 Switching Domain Operational Modes 169 Summary 173 8 Installing and Managing Printers 174 Understanding the Basics 175 Printer Terminology 175 Understanding Network Printers 176 Understanding Print Servers 177 Understanding the Printing Process 180 What Happens When You Print a Document 180 Planning Printer Deployment 183 Establishing Printer Naming Conventions 184 Creating Location-Naming Conventions 185 Choosing Printers and Print Servers 187 Installing Printers 189 Adding Local Printers 190 Sharing Printers on a Network 192 Adding Printers Shared by Another Computer 193 Adding TCP/IP Printers on a TCP/IP Printer Port 194 Adding Printers on an LPR Printer Port 198 Adding AppleTalk Printing Devices 199 Modifying Printer Properties 200 Setting Security Options 200 Changing Printer Options 205 Changing Default Print Settings 213 Setting Print Server Options 215 Printers and Active Directory 218 How Printers Are Published 218 Using Active Directory to Find Printers 218 Using Printer Location Tracking 219 Managing Printers and Print Servers 222 Managing Printers from Windows 2000 222 Managing Printers from a Web Browser 225 Troubleshooting Printing Problems 227 Printing from the Client Machine Experiencing the Problem 228 Checking the Print Server Status 230 Printing from Another Client Machine 231 Checking the Printer 231 Deleting Stuck Documents 232 Troubleshooting Printer Location Tracking 233 Summary 234 9 Managing Users and Groups 236 Understanding Groups 237 Assigning Group Scopes 238 Planning Organizational Units 240 Creating Organizational Units 241 Moving Organizational Units 241 Deleting Organizational Units 241 Planning a Group Strategy 242 Determining Group Names 242 Using Global and Domain Local Groups 242 Using Universal Groups 243 Implementing the Group Strategy 243 Creating Groups 243 Deleting Groups 244 Adding Users to a Group 245 Changing the Group Scope 246 Creating Local Groups 247 Managing Built-in Groups and User Rights 248 Built-in Local Groups 248 Built-in Domain Local Groups 249 Built-in Global Groups 250 Defining User Rights 250 Creating User Accounts 257 Naming User Accounts 257 Account Options 257 Passwords 258 Creating a Domain User Account 260 Creating a Local User Account 261 Setting User Account Properties 262 Testing User Accounts 263 Managing User Accounts 263 Disabling and Enabling a User Account 264 Deleting a User Account 264 Finding a User Account 265 Moving a User Account 266 Renaming a User Account 266 Securing the Administrator Account 267 Resetting a User s Password 268 Unlocking a User Account 268 Using Home Folders 269 Maintaining User Profiles 271 Local Profiles 273 Roaming Profiles 273 Assigning a Logon Script to a User Profile 278 Configuring Shares and Permissions 279 Using Special Shares 280 Shares and Permissions on NTFS vs. FAT 282 Sharing a Folder 282 Share Permissions 285 Mapping Shared Folders and Drives 286 Working with Shared Folders 288 Maintaining Folder and File Permissions 290 Considering Inheritance 290 What the Permissions Mean 291 How Permissions Work 293 Configuring Folder Permissions 294 Assigning Permissions to Files 295 Configuring Special Permissions 295 Ownership and How It Works 297 Understanding Group Policies 299 Components of Group Policy 301 Managing Group Policies 303 Order of Implementation 304 Creating a Group Policy Object 307 Using the Group Policy Editor 307 Using Group Policy for Folder Redirection 310 Summary 314 PART III NETWORK ADMINISTRATION 10 Managing Day-to-Day Operations 316 Using the Secondary Logon 317 Opening Programs Using Another Account 318 Starting a Command-Line Window for Administration 318 Administration Tools 320 Installing Administration Tools Locally 322 Making Administration Tools Available Remotely 322 Support Tools 322 Network Connectivity Tester 323 Windows 2000 Domain Manager 323 Active Directory Replication Monitor 323 Disk Probe 324 Microsoft Management Console Basics 325 Creating an MMC-Based Console with Snap-ins 325 Automating Chores with Scripts 332 Auditing Events 333 Audit Settings for Objects 334 Viewing Event Logs 336 Searching Event Logs 337 Filtering Event Logs 338 Setting the Size of Event Logs 338 Archiving Event Logs 339 Delegating Control 340 Using Task Scheduler 341 Changing a Schedule 343 Tracking Task Scheduler 343 Viewing Tasks on a Remote Computer 344 Using the AT Command 345 Summary 347 11 Installing and Configuring Active Directory 348 Using the Active Directory Installation Wizard 350 Preparing for Installation 351 Promoting Your First Server to a Domain Controller 353 Choosing Installation Options 361 Upgrading Windows NT 4 Domain Controllers 365 Demoting a Domain Controller 365 Changing a Domain Controller Identification 368 Setting a Global Catalog Server 370 Using Active Directory Domains and Trusts 371 Launching Active Directory Domains and Trusts 372 Changing the Domain Mode 372 Managing Domain Trust Relationships 374 Specifying the Domain Manager 375 Configuring User Principal Name Suffixes for a Forest 376 Managing Domains 377 Using Active Directory Users and Computers 377 Launching Active Directory Users and Computers 377 Viewing Active Directory Objects 378 Creating an Organizational Unit 386 Configuring OU Objects 386 Delegating Object Control 389 Creating a User Object 390 Configuring User Objects 391 Creating a Group 396 Configuring Group Objects 398 Creating a Computer Object 398 Configuring Computer Objects 399 Using Remote Computer Management 399 Publishing a Shared Folder 400 Publishing a Printer 400 Moving, Renaming, and Deleting Objects 400 Summary 401 12 Managing Active Directory 402 Using Active Directory Sites and Services 403 Defining Site Objects 405 Understanding Domain Replication 407 Launching Sites and Services 408 Using Active Directory Schema 416 Examining Schema Security 416 Launching Active Directory Schema 417 Modifying the Schema 419 Modifying Display Specifiers 424 Performing Batch Importing and Exporting 428 Understanding Operations Master Roles 431 Summary 439 13 Understanding TCP/IP 440 The TCP/IP Protocol Suite 441 Internet Protocol 442 Transmission Control Protocol 442 User Datagram Protocol 443 Windows Sockets 443 Network Basic Input/Output System 444 Requests for Comments 444 IP Addresses and What They Mean 446 Class A Networks 446 Class B Networks 447 Class C Networks 447 Class D and Class E Addresses 447 Routing and Subnets 448 What Is a Subnet? 449 Gateways and Routers 450 Routers 450 Routing Protocols 451 Name Resolution 452 The Domain Name System 452 Windows Internet Name Service 461 IP Version 6 463 Summary 465 14 Administering TCP/IP 466 Using DHCP 468 Designing DHCP Networks 468 Installing the DHCP Service 470 Creating a New Scope 471 Authorizing the DHCP Server and Activating Scopes 475 Adding Address Reservations 476 Enabling Dynamic Updates to a DNS Server for Earlier Clients 477 Using Multiple DHCP Servers for Redundancy 479 Other DHCP Functions 482 Setting Up a DHCP Relay Agent 484 Moving DHCP to Another Server 486 Using Ipconfig to Release, Renew, or Verify a Lease 487 Using DNS Server 488 Installing DNS 488 Using the Configure A DNS Server Wizard 490 Creating Zones 494 Creating Subdomains and Delegating Authority 496 Adding Resource Records 499 Configuring Zone Transfers 502 Interoperating with Other DNS Servers 504 Enabling Dynamic DNS Updates 505 Enabling WINS Resolution 506 Setting Up a Forwarder 507 Updating Root Hints 508 Setting Up a Caching-Only DNS Server 509 Setting Up a WINS Server 510 Determining Whether You Need WINS 510 Configuring the Server to Prepare for WINS 512 Installing WINS 513 Adding Replication Partners 513 Miscellaneous WINS Functions 515 Compacting the WINS Database 516 Summary 517 15 Implementing Disk Management 518 Understanding Disk Terminology 519 Overview of Disk Management 521 Disk Administration Enhancements 522 Remote Management 524 Dynamic Disks 524 Disk Management Tasks 525 Adding a Partition or Volume 525 Converting a Disk to a Dynamic Disk 538 Extending a Volume 539 Adding a Mirror 541 Converting a Volume or Partition from FAT to NTFS 546 Formatting a Partition or Volume 547 Changing a Drive Letter 549 Mounting a Volume 550 NTFS Version 5 551 Disk Quotas 551 Encrypting on the File System Level 555 Summary 557 16 Using Clusters 558 What Is a Cluster? 559 Network Load Balancing Clusters 559 Server Clusters 560 Cluster Scenarios 560 Intranet or Internet Functionality 560 Mission-Critical Availability 561 Integrated Windows Clustering 561 Requirements and Planning 562 Identifying and Addressing Goals 562 Identifying a Solution 562 Identifying and Addressing Risks 563 Making Checklists 563 Network Load Balancing Clusters 564 NLB Concepts 564 Choosing an NLB Cluster Model 565 Planning the Capacity of an NLB Cluster 566 Providing Fault Tolerance 567 Optimizing an NLB Cluster 567 Server Clusters 568 Server Cluster Concepts 569 Types of Resources 570 Defining Failover and Failback 573 Configuring a Server Cluster 573 Planning the Capacity of a Server Cluster 575 Summary 577 17 Configuring Storage 578 The Distributed File System 579 Advantages 580 Concepts and Terminology 582 Structure and Topology 585 Setup 587 Backing Up and Restoring the Dfs Database 593 Dfs Command-Line Administration 593 Removable Storage 594 Benefits and Requirements 594 Concepts and Terminology 596 Use and Management 600 Remote Storage 610 Concepts and System Requirements 611 Setup and Configuration 616 Data Recovery and Protection 628 Shared Folders 633 Using the Shared Folders Snap-In 633 Setting Up Shared Folders 634 Ending Folder Sharing 636 Disconnecting Users 636 Limiting Simultaneous Connections 636 Setting Permissions 637 Configuring Web Shares 638 Summary 639 18 Planning for Security 640 Smart Cards 641 Security Basics 642 Authentication 643 Data Protection 645 Access Control 647 Auditing 648 Nonrepudiation 648 Public-Key Infrastructures 649 Public-Key Encryption vs. Symmetric-Key Encryption 650 Public-Key Certificates and Private Keys 651 Certificate Authorities 653 Certificate Registration 655 Certificate Directories 656 Certificate Revocation 656 Certificate Renewal 658 Security-Enabled Protocols 658 Secure Multipurpose Internet Mail Extensions 658 Kerberos Version 5 660 Windows NT LAN Manager 661 Secure Socket Layer 661 Internet Protocol Security 662 Virtual Private Networks 665 Remote Access VPNs 666 Router-to-Router VPNs 667 Security Modules 667 Cryptographic Application Programming Interface 667 Cryptographic Service Providers 668 Summary 669 19 Implementing Security 670 Physical Security 672 Using Templates to Implement Security Policies 673 Running the Security Templates Snap-In 673 Examining Template Policies 674 Using Predefined Templates 675 Defining New Templates 679 Applying Templates 680 Using Security Configuration and Analysis 680 Opening a Security Database 681 Importing and Exporting Templates 681 Analyzing Security and Viewing the Results 682 Configuring Security 684 Enabling Authentication 685 Obtaining Smart Cards and Certificates 686 Logging On with Smart Cards 688 Enabling Remote Certificate or Smart Card Authentication 688 Configuring Authentication for a Remote Access Server 691 Implementing Access Control 691 Establishing Ownership 692 Assigning Permissions 692 Managing Certificates 694 Exporting Certificates and Private Keys 695 Importing Certificates 696 Requesting Certificates 696 Enabling Certificates for Specific Purposes 697 Using Internet Protocol Security Policies 698 Defining IPSec Policies 698 Assigning IPSec Policies 706 Securing Local Data 707 Creating Your Recovery Policy 707 Encrypting Files and Folders 709 Decrypting Files and Folders 710 Recovering Files 710 Auditing 712 Establishing an Audit Policy 712 Auditing Access to Objects 713 Viewing the Security Log 714 What to Do If You Get Hacked 715 Summary 716 PART IV SUPPORTING SERVICES AND FEATURES 20 Using Microsoft Certificate Services 718 More Vocabulary 720 Policy Modules 720 Exit Modules 720 Certificate Publishers 721 Certificate Templates 721 Certificate Authority Types 724 Preinstallation 725 Understanding Certificate Authority Roles 725 Preparing for Installation 727 Installation and Configuration 728 Installing Certificate Services 728 Installing the Certification Authority Snap-in 732 The Certification Authority Snap-In 733 Managing the Certification Authority Service 734 Configuring the CA s Properties 737 Working with Certificate Templates 741 Managing Revocation and Trust 743 Managing Stand-Alone CAs 748 The Certificates Snap-In 749 CAs Linked into a Hierarchy 750 Requesting a Certificate if Your Root CA Is Online 751 Requesting a Certificate if Your Root CA Is Offline 751 Command-Line Utilities 752 The Certsrv Tool 752 The Certreq Tool 753 The Certutil Tool 754 Summary 755 21 Interoperating with Novell NetWare 756 Installing NetWare Services for Windows 2000 757 Novell Clients 758 Microsoft Clients 758 Using Gateway Service for NetWare 759 Installing and Configuring the NWLink Protocol 759 Installing Gateway Service for NetWare 762 Configuring Gateway Service for NetWare 764 Running NetWare Utilities 766 Using NetWare-Aware Applications 767 Sharing Windows 2000 Resources with NetWare Clients 768 Selecting the Right Client Services 769 Understanding Permissions and Security Concepts 770 Summary 771 22 Interoperating with UNIX 772 Permissions and Security Concepts 773 A UNIX File Listing 774 Symbolic Links 776 Privilege Levels 776 Basic Connectivity 777 File Transfer Protocol 777 Telnet 778 File Systems 778 The Network File System 779 Server Message Block 779 Services for UNIX Overview 780 Installing Services for UNIX 780 Services for UNIX Configuration 783 Connectivity Services 784 File Services 788 Interoperability and Migration Services 793 Summary 793 23 Using Macintosh Services 794 Mac OS X and Windows Networks 796 Connecting to Networked Printers 797 Connecting to Windows File Servers 799 Talking the Talk 800 Macintosh-Accessible Volumes 801 Forks, Streams, and Codes 801 A Brief Digression Concerning AppleTalk 802 Understanding Macintosh Services 804 Installing and Configuring AppleTalk 805 Installing AppleTalk 805 Configuring AppleTalk Routing 806 Configuring the AppleTalk Protocol 809 Setting Up File and Print Services 810 Prerequisites for Installing Macintosh Services 810 Creating Accounts for Macintosh Users 812 Installing the Components 812 Installing the Microsoft Authentication Module on the Macintosh 813 Configuring FSM Options 816 Sharing Files with FSM 817 Creating MAVs 818 Assigning Security and Permissions 819 Managing Type and Creator Codes 824 Sending Messages to Users 826 Using the Macfile Utility 827 Using Macfile Server 828 Using Macfile Volume 828 Using Macfile Directory 830 Using Macfile Forkize 832 Sharing Printers with PSM 833 Before You Install PSM 833 Sharing a Printer for Macintosh Users 834 Connecting to an AppleTalk Printer 835 Capturing and Releasing Existing AppleTalk Printers 836 Summary 837 24 Configuring Mail Services 838 Using Outlook 2002 839 Configuring Outlook 2002 840 Customizing Outlook 853 Using Outlook with Exchange Server 859 Scheduling with Outlook 871 Customizing the Way Outlook Handles E-Mail 879 Setting Up Security 881 Configuring Outlook Express 883 Setting Up Accounts 884 Changing Where Mail Is Stored 885 Sharing Address Books with Outlook 885 Customizing the Appearance of Outlook Express 886 Setting Up Outlook Express Identities 887 Changing the Default Mail Program 889 Creating Message Rules to Automatically Process Mail and News 890 Configuring Secure E-Mail 891 Using Fax Services 893 Using the Fax Service Management Tool 893 Using the Fax Service to Send a Fax 896 Summary 897 25 Managing Software 898 Deploying and Managing Software Using Group Policy 900 Understanding Software Installation and Maintenance 900 Setting Up Software Installation and Maintenance 906 Configuring Software Installation and Maintenance 909 Working with Packages 916 Repackaging Applications 925 Creating the "Before" Snapshot and Installing the Application 926 Creating the "After" Snapshot 929 Deploying Service Packs 930 Manually Installing Service Packs 931 Deploying Service Packs Using Group Policy 932 Checking Service Pack and Hot Fix Installations 933 Remote Installation Services 935 How RIS Works 935 RIS Requirements and System Recommendations 936 Installing RIS 937 Administering RIS 939 Performing User Installations 954 Getting Incompatible Applications to Run 959 Application Compatibility Background 960 Running Legacy Applications 961 Summary 963 26 Deploying Terminal Services 964 Concepts 965 Remote Access 966 Central Management 966 Requirements 967 RAM 967 CPU 967 Network Utilization 967 Capacity Planning 968 Installation 968 Installation of Terminal Services at Windows 2000 Install 968 Installation of Terminal Services After Initial Installation 969 Installing Programs 971 Administration 977 Terminal Services Manager 977 Terminal Services Configuration 988 Terminal Services Client Creator 992 Terminal Services Client 993 Summary 1003 27 Understanding Other Services 1004 Understanding the Indexing Service 1005 Defining Terms 1006 How Indexing Works 1007 Planning Your Indexing Service 1008 Merging Indexes 1009 Setting Up an Indexing Console 1010 Creating and Configuring Catalogs 1012 Creating a Catalog 1012 Configuring a Catalog 1013 Including or Excluding a Directory 1014 Configuring the Property Cache 1016 Running a Scan of the Index 1018 Registry Entries for the Indexing Service 1019 Querying the Index 1021 Creating Query Forms 1023 Indexing a New Site 1026 Examining Performance 1027 Modifying the Indexing Service s Performance 1027 Using Performance Monitor 1028 Troubleshooting the Indexing Service 1029 No Documents Matched the Query 1029 .PDF Files Aren t Indexed 1031 Query Produces Inconsistent Results 1032 Catalog Is Reportedly Corrupted 1032 Indexing Is Slow and Some Documents Aren t Indexed 1032 Understanding Microsoft Message Queuing 1033 What the Message Queue Does 1034 Planning a Message Queuing Network 1034 Hardware Issues Involved in Message Queuing 1035 Summary 1036 PART V SERVERS AND SERVICES 28 Basics of Internet Information Services 1038 Protocols Supported 1039 HTTP 1040 FTP 1043 SMTP 1044 NNTP 1046 Other Protocols 1046 Installing and Securing IIS 1047 Installing and Uninstalling IIS 1047 Securing IIS 1048 Administration Tools 1057 Internet Information Services 1057 Internet Services Manager (HTML) 1058 Administration Scripts 1059 The WWW Publishing Service 1059 The Default Web Site 1059 Other Web Sites 1061 Virtual Directories 1065 The FTP Publishing Service 1071 The Default FTP Site 1071 Other FTP Sites 1072 Virtual Directories 1074 Basic Administrative Tasks 1076 Configuring Permissions 1076 Stopping, Starting, and Pausing IIS Services 1080 Using FrontPage Server Extensions 1081 Summary 1083 29 Advanced Internet Information Services 1084 Server-Level Administration 1087 Connecting to an IIS Server 1088 Creating Configuration Backups 1088 Configuring Server Properties 1090 Site-Level Administration 1095 Directory-Level Administration 1096 File-Level Administration 1097 Managing WWW Sites 1098 Managing FTP Sites 1119 FTP Service Master Properties 1119 Configuring FTP Site Properties 1120 Configuring FTP Directory Properties 1125 Managing NNTP Virtual Servers 1126 What NNTP Service Does 1126 NNTP Service Wizards 1127 Configuring the Default NNTP Virtual Server 1129 Connecting to the Default NNTP Virtual Server 1133 Displaying NNTP Sessions 1134 Rebuilding an NNTP Virtual Server 1134 Managing SMTP Virtual Servers 1135 What SMTP Service Does 1135 Configuring the Default SMTP Virtual Server 1137 SMTP Domains 1142 Remote Administration 1143 The Administration Web Site 1143 Summary 1145 30 Internet Explorer Administration 1146 Internet Explorer Administration Kit 1148 Obtaining the IEAK 1149 Installing the IEAK 1149 Planning Your Internet Explorer 5 Deployment 1149 Creating an Installation Package 1151 Deploying IEAK Packages 1161 IEAK Profile Manager 1162 Connection Manager Administration Kit 1164 Installing CMAK 1165 Using the CMAK Wizard 1165 Deploying CMAK Packages 1168 Summary 1169 31 Internet Security and Acceleration Server 1170 Concepts 1171 Network Address Translation 1172 Packet Filtering 1174 Caching 1174 Client Types 1174 ISA Server Policies and Policy Elements 1175 ISA Server Deployment 1175 Installation 1179 Preinstallation 1179 Enterprise Initialization 1180 ISA Server Installation 1182 Initial Configuration 1187 Configuring Enterprise Policy 1189 Selecting Policy Elements 1189 Configuring Schedules 1190 Configuring Client Sets 1190 Configuring Protocol Rules 1191 Configuring Destination Sets 1193 Configuring Site and Content Rules 1194 Securing Your Server 1196 Configuring Firewall Protection 1197 Configuring Dial-Up Entries 1200 Configuring Routing for Firewall and SecureNAT Clients 1201 Configuring Routing for Web Browser Applications 1202 Configuring Cache Policy 1203 Administering ISA Server 1205 Administering Arrays 1208 Publishing Internal Servers to the Internet 1211 Creating Protocol Definitions 1218 Changing Cache Properties 1219 Configuring the Local Address Table 1223 Configuring the Local Domain Table 1224 Working with VPNs 1226 Backing Up and Restoring ISA Server 1227 Working with Clients 1229 Changing Default Settings for Web Browser Clients 1230 Changing Default Settings for Firewall Clients 1231 Setting Up ISA Server Auto Discovery 1232 Setting Up Client Systems 1235 Monitoring ISA Server 1238 Working with Alerts 1238 Viewing Service and Session Status 1240 Working with Reports 1240 Working with Logs 1242 Summary 1245 32 Connection Services 1246 How Dial-Up Remote Access Works 1247 Understanding Virtual Private Networks 1248 How VPNs Work 1249 Components of a VPN 1251 Installing a Remote Access Server 1251 Configuring the Connection to Dial-Up Networking Clients 1251 Setting Remote Access Policies 1252 Understanding the Default Policy 1253 Choosing an Administrative Model for Remote Access Policies 1254 Administering Access by User 1254 Administering Access by Policy for a Mixed-Mode Domain 1256 Administering Access by Policy for a Native-Mode Domain 1260 Configuring a Remote Access Policy 1264 Specifying Conditions of Remote Access Policies 1264 Configuring Profiles in Remote Access Policies 1266 Configuring a Remote Access Server 1268 Configuring a Virtual Private Network 1269 Configuring the Internet Connection 1269 Configuring the Remote Access Server as a Router 1269 Configuring PPTP Ports 1270 Configuring PPTP Filters 1270 Elements of a Router-to-Router VPN Connection 1271 Adding a Demand-Dial Interface 1273 Setting Up Static Routes and Routing Protocols 1274 Using the Internet Authentication Service 1275 IAS Authentication 1275 Installing and Configuring IAS 1275 Installing IAS 1275 Configuring IAS 1276 Configuring Clients for IAS 1276 Using RADIUS for Multiple Remote Access Servers 1278 Configuring a Remote Server for RADIUS Authentication 1278 Configuring the Remote Server for RADIUS Accounting 1279 Configuring the IAS Server for RADIUS 1279 Summary 1280 PART VI TUNING, MAINTENANCE, AND REPAIR 33 Performance Monitoring and Tuning 1282 What Is a Bottleneck? 1283 Using Event Viewer 1284 Event Log Files 1285 The Components of an Event 1286 Archiving an Event Log 1288 Viewing an Event Log on Another Computer 1289 Using System Monitor 1289 Running System Monitor 1290 Adding Counters 1291 Selecting Counters 1292 Matching Counters to Graph Lines 1292 Deleting Counters 1293 Modifying the Display 1293 Choosing a View 1294 Monitoring a Different Computer 1297 Performance Logs and Alerts 1298 Counter Logs 1298 Trace Logs 1299 Creating Counter and Trace Logs 1299 Adding Counters to Counter Logs 1299 Saving Log and Alert File Settings 1300 Selecting System and Nonsystem Providers for Trace Logs 1300 Setting File Parameters for Counter and Trace Logs 1301 Using Alerts 1303 Permissions for Counter Logs, Trace Logs, and Alerts 1305 Selecting a Monitoring Method 1307 Determining How Often to Monitor 1307 Monitoring Memory Usage 1308 Monitoring Processor Activity 1312 Monitoring Disk Activity 1313 Monitoring Network Activity 1315 Using Network Monitor 1316 Viewing the Frame Viewer Window 1318 Viewing the Capture Window 1319 Configuring and Customizing Network Monitor 1321 Capturing Network Data 1326 Designing a Capture Filter 1326 Setting a Capture Trigger 1329 Designing a Display Filter 1330 Summary 1333 34 Disaster Planning 1334 Planning for Disaster 1335 Identify the Risks 1336 Identify the Resources 1337 Develop the Responses 1337 Test the Responses 1341 Iterate 1342 Preparing for a Disaster 1342 Setting Up a Fault-Tolerant System 1343 Backing Up the System 1343 Creating Emergency Repair Disks 1343 Creating Windows 2000 Setup Disks 1346 Creating a Boot Disk 1346 Installing the Recovery Console 1348 Specifying Recovery Options 1349 Creating and Using a Recovery Drive 1350 Summary 1351 35 Using Backup 1352 Selecting a Backup Medium 1353 Using Removable Storage 1354 Backing Up to Files 1355 Using CD-ROMs 1355 Developing a Backup Strategy 1355 The Backup Window 1356 Backup Types 1356 Media Rotation 1358 Backing Up Data 1359 Using the Windows 2000 Backup Tab 1360 Using the Windows 2000 Backup Wizard 1369 Executing Jobs from the Command Line 1369 Restoring Data 1372 Selecting Files to Be Restored 1372 Selecting Destinations for Restored Files 1373 Setting Restore Options 1374 Planning for Disaster 1375 Backing Up the System State 1375 Handling Backup and Restore Problems 1376 Backing Up Exchange Servers 1376 Backing Up Encrypted Files 1377 Restoring the System State 1377 Preserving NTFS Permissions 1380 Third-Party Backup Utilities 1380 Summary 1381 36 Planning Fault Tolerance and Avoidance 1382 Mean Time to Failure and Mean Time to Recover 1383 Protecting the Power Supply 1385 Local Power Supply Failure 1385 Voltage Variations 1386 Short-Term Power Outages 1389 Long-Term Power Outages 1390 Disk Arrays 1390 Hardware vs. Software 1391 RAID Levels for Fault Tolerance 1391 Hot-Swap and Hot-Spare Disk Systems 1397 Distributed File System 1397 Clustering 1398 Network Load Balancing 1398 Server Clusters 1398 Summary 1399 37 Using the Registry 1400 Introducing the Registry 1401 The Origins of the Registry 1401 What Registry Data Is Used For 1402 Understanding the Registry s Structure 1404 The Root Keys 1405 Major Subkeys 1406 How Data Is Stored 1410 Using the Registry Editors 1413 What You Get 1413 Regedit vs. Regedt32 1414 A Whirlwind Tour of Regedit 1415 A Whirlwind Tour of Regedt32 1420 Securing the Registry 1427 Backing Up and Restoring the Registry 1428 Choosing a Backup Method 1429 Backing Up the Registry 1430 Restoring the Registry 1432 Summary 1433 38 Troubleshooting and Recovery 1434 Troubleshooting Startup Problems 1435 Figure Out What Happened 1435 Using the Last Known Good Configuration 1436 Using Safe Mode 1437 Using the Emergency Repair Process 1438 Using a Boot Disk to Recover the System 1439 Using the Recovery Console 1440 Booting from Mirrored Boot Partitions 1441 Restoring a Completely Failed Server 1442 Fixing the Underlying Problem 1443 Maybe It ll Go Away 1443 Check the Microsoft Knowledge Base 1443 Undo Anything You ve Changed 1443 Check Event Viewer 1444 Check Device Manager 1445 Use System Information to Check the Configuration 1445 Check the Services 1446 Examine the Boot Log 1448 Use the File Signature Verification Utility 1449 Use the System File Checker 1450 Editing the Boot.ini File 1450 Restore from a Backup 1451 Reinstall Windows 1451 Miscellaneous Challenges 1452 Adding a Processor to the System 1452 Windows Hangs When Shutting Down 1453 Uninstalling Windows 1454 Summary 1455 PART VII APPENDIXES A A Quick Guide to Interface Changes 1458 B Optional Components 1466 C The OSI Reference Model 1474 D Using the Windows 2000 Recovery Console 1482 E Windows 2000 Support Tools 1494 GLOSSARY 1499 INDEX 1517