MCSA/MCSE Windows Server 2003 Network Security Administration

603 Pages·2004·15.66 MB·English

MCSA/MCSE:
Windows®
Server 2003 Network
Security Administration
Study Guide
Russ Kaufmann
Bill English
SYBEX®
4332.book Page i Sunday, June 6, 2004 1:52 PM
MCSA/MCSE:
Windows Server 2003 Network
Security Administration
Study Guide
4332.book Page ii Sunday, June 6, 2004 1:52 PM
4332.book Page iii Sunday, June 6, 2004 1:52 PM
MCSA/MCSE:
Windows® Server 2003 Network
Security Administration
Study Guide
Russ Kaufmann
Bill English
San Francisco • London
4332.book Page iv Sunday, June 6, 2004 1:52 PM
Associate Publisher: Neil Edde
Acquisitions and Developmental Editor: Maureen Adams
Production Editor: Mae Lum
Technical Editors: Craig Vazquez, Chris N. Crane, J. Kevin Lundy
Copyeditor: Sarah Lemaire
Compositor: Craig Woods, Happenstance Type-O-Rama
Graphic Illustrator: Interactive Composition Corporation
CD Coordinator: Dan Mummert
CD Technician: Kevin Ly
Proofreaders: Laurie O’Connell, Nancy Riddiough
Indexer: Nancy Guenther
Book Designers: Bill Gibson, Judy Fung
Cover Designer: Archer Design
Cover Photographer: Photodisc, Victor Arre
Copyright © 2004 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. No
part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but
not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written per-
mission of the publisher.
An earlier version of this book was published under the title MCSA/MCSE: Windows 2000 Network Security
Administration Study Guide © 2003 SYBEX Inc.
Library of Congress Card Number: 2003100046
ISBN: 0-7821-4332-6
SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States
and/or other countries.
Screen reproductions produced with FullShot 99. FullShot 99 © 1991-1999 Inbit Incorporated. All rights reserved.
FullShot is a trademark of Inbit Incorporated.
The CD interface was created using Macromedia Director, COPYRIGHT 1994, 1997-1999 Macromedia Inc. For
more information on Macromedia and Macromedia Director, visit http://www.macromedia.com.
Microsoft® Internet Explorer © 1996 Microsoft Corporation. All rights reserved. Microsoft, the Microsoft Inter-
net Explorer logo, Windows, Windows NT, and the Windows logo are either registered trademarks or trade-
marks of Microsoft Corporation in the United States and/or other countries.
SYBEX is an independent entity from Microsoft Corporation, and not affiliated with Microsoft Corporation in
any manner. This publication may be used in assisting students to prepare for a Microsoft Certified Professional
Exam. Neither Microsoft Corporation, its designated review company, nor SYBEX warrants that use of this pub-
lication will ensure passing the relevant exam. Microsoft is either a registered trademark or trademark of
Microsoft Corporation in the United States and/or other countries.
TRADEMARKS: SYBEX has attempted throughout this book to distinguish proprietary trademarks from
descriptive terms by following the capitalization style used by the manufacturer.
The author and publisher have made their best efforts to prepare this book, and the content is based upon final
release software whenever possible. Portions of the manuscript may be based upon pre-release versions supplied
by software manufacturer(s). The author and the publisher make no representation or warranties of any kind
with regard to the completeness or accuracy of the contents herein and accept no liability of any kind including
but not limited to performance, merchantability, fitness for any particular purpose, or any losses or damages of
any kind caused or alleged to be caused directly or indirectly from this book.
Manufactured in the United States of America
10 9 8 7 6 5 4 3 2 1
4332.book Page v Sunday, June 6, 2004 1:52 PM
To Our Valued Readers:
Thank you for looking to Sybex for your Microsoft certification exam prep needs. We at Sybex
are proud of the reputation we’ve established for providing certification candidates with the
practical knowledge and skills needed to succeed in the highly competitive IT marketplace.
With its release of Windows Server 2003, and the revised MCSA and MCSE tracks, Microsoft
has raised the bar for IT certifications yet again. The new programs better reflect the skill set
demanded of IT administrators in today’s marketplace and offers candidates a clearer struc-
ture for acquiring the skills necessary to advance their careers.
Sybex is proud to have helped thousands of Microsoft certification candidates prepare for
their exams over the years, and we are excited about the opportunity to continue to provide
computer and networking professionals with the skills they’ll need to succeed in the highly
competitive IT industry.
The authors and editors have worked hard to ensure that the Study Guide you hold in your
hand is comprehensive, in-depth, and pedagogically sound. We’re confident that this book
will exceed the demanding standards of the certification marketplace and help you, the
Microsoft certification candidate, succeed in your endeavors.
As always, your feedback is important to us. Please send comments, questions, or suggestions
to [email protected]. At Sybex, we’re continually striving to meet the needs of individuals
preparing for IT certification exams.
Good luck in pursuit of your Microsoft certification!
Neil Edde
Associate Publisher—Certification
Sybex, Inc.
4332.book Page vi Sunday, June 6, 2004 1:52 PM
Software License Agreement: Terms and Conditions
The media and/or any online materials accompanying media during this warranty period, you may obtain a
this book that are available now or in the future contain replacement of identical format at no charge by sending
programs and/or text files (the "Software") to be used in the defective media, postage prepaid, with proof of pur-
connection with the book. SYBEX hereby grants to you chase to:
a license to use the Software, subject to the terms that
follow. Your purchase, acceptance, or use of the Soft- SYBEX Inc.
ware will constitute your acceptance of such terms. Product Support Department
The Software compilation is the property of SYBEX 1151 Marina Village Parkway
unless otherwise indicated and is protected by copyright Alameda, CA 94501
to SYBEX or other copyright owner(s) as indicated in Web: http://www.sybex.com
the media files (the "Owner(s)"). You are hereby
granted a single-user license to use the Software for your After the 90-day period, you can obtain replacement
personal, noncommercial use only. You may not repro- media of identical format by sending us the defective
duce, sell, distribute, publish, circulate, or commercially disk, proof of purchase, and a check or money order for
exploit the Software, or any portion thereof, without the $10, payable to SYBEX.
written consent of SYBEX and the specific copyright
Disclaimer
owner(s) of any component software included on this
media. SYBEX makes no warranty or representation, either
In the event that the Software or components include expressed or implied, with respect to the Software or its
specific license requirements or end-user agreements, contents, quality, performance, merchantability, or fit-
statements of condition, disclaimers, limitations or war- ness for a particular purpose. In no event will SYBEX,
ranties ("End-User License"), those End-User Licenses its distributors, or dealers be liable to you or any other
supersede the terms and conditions herein as to that par- party for direct, indirect, special, incidental, consequen-
ticular Software component. Your purchase, accep- tial, or other damages arising out of the use of or inabil-
tance, or use of the Software will constitute your ity to use the Software or its contents even if advised of
acceptance of such End-User Licenses. the possibility of such damage. In the event that the Soft-
By purchase, use or acceptance of the Software you fur- ware includes an online update feature, SYBEX further
ther agree to comply with all export laws and regula- disclaims any obligation to provide this feature for any
tions of the United States as such laws and regulations specific duration other than the initial posting.
may exist from time to time. The exclusion of implied warranties is not permitted by
some states. Therefore, the above exclusion may not
Software Support
apply to you. This warranty provides you with specific
Components of the supplemental Software and any legal rights; there may be other rights that you may have
offers associated with them may be supported by the that vary from state to state. The pricing of the book
specific Owner(s) of that material, but they are not sup- with the Software by SYBEX reflects the allocation of
ported by SYBEX. Information regarding any available risk and limitations on liability contained in this agree-
support may be obtained from the Owner(s) using the ment of Terms and Conditions.
information provided in the appropriate read.me files or
Shareware Distribution
listed elsewhere on the media.
Should the manufacturer(s) or other Owner(s) cease to This Software may contain various programs that are
offer support or decline to honor any offer, SYBEX distributed as shareware. Copyright laws apply to both
bears no responsibility. This notice concerning support shareware and ordinary commercial software, and the
for the Software is provided for your information only. copyright Owner(s) retains all rights. If you try a share-
SYBEX is not the agent or principal of the Owner(s), ware program and continue using it, you are expected to
and SYBEX is in no way responsible for providing any register it. Individual programs differ on details of trial
support for the Software, nor is it liable or responsible periods, registration, and payment. Please observe the
for any support provided, or not provided, by the requirements stated in appropriate files.
Owner(s).
Copy Protection
Warranty
The Software in whole or in part may or may not be
SYBEX warrants the enclosed media to be free of phys- copy-protected or encrypted. However, in all cases,
ical defects for a period of ninety (90) days after pur- reselling or redistributing these files without authoriza-
chase. The Software is not available from SYBEX in any tion is expressly forbidden except as specifically pro-
other form or media than that enclosed herein or posted vided for by the Owner(s) therein.
to www.sybex.com. If you discover a defect in the
4332.book Page vii Sunday, June 6, 2004 1:52 PM
Acknowledgments
As with every book I’ve worked on, there are many more people whose efforts are reflected
in these pages but whose names are not on the cover. Without their help, this book would not
be in your hands.
I’d also like to thank my co-author, Russ Kaufmann, who came into this project after it
started and did a bang-up job with his chapters even though he experienced several setbacks
that were out of his control. Russ, thanks for writing this book with me and for being such a
good friend. I would be honored to work with you again.
Neil Salkind, my agent from StudioB, did his usual great job in pulling together the contrac-
tual elements that enabled me to co-author this book. Thanks, Neil, for being such an outstand-
ing agent.
As always, my wife Kathy supported me in this project. Thanks, Kathy, for your love and
friendship.
Finally, I’d like to thank Jesus Christ, who gave me the talent and opportunity to write this
book and without whom I’d be lost forever.
Bill English
Nowthen, Minnesota
It seemed to me that this project would never end. Just when I thought I was back on sched-
ule, or even ahead of schedule, something else would come up to twist and turn my life into new
shapes. Construction at my home was one of the biggest obstacles. Power outages, wires shorted
out by nails, network lines dug up in the yard, huge amounts of dust clogging fans and causing
circuits to overheat, and having to move the servers and all of the network infrastructure from
place to place within the house all contributed to massive amounts of gray hair. Then, to top it
off, we had an addition to the family: Raymond, a very large, bouncing baby boy of about 132
lbs. was added to our family. Okay, he is not a baby; he is my 14-year-old nephew. We love him
a lot, but adding him to the family came with huge amounts of stress. Between everything, it was
amazing that I was able to work at all. It is truly amazing how many obstacles get in the way
of completing a project like this one.
I would like to thank the people at Sybex for their hard work. Thanks to the understanding
of Mae Lum and Maureen Adams, we were able to get it all done. Mae and Maureen were fan-
tastic in keeping the material organized and keeping a semblance of a schedule. Craig Vazquez
did a great job combing through the material and checking it for technical accuracy. Kevin
Lundy stepped in and was great in updating some content to keep things on schedule. The entire
Sybex team did a wonderful job.
I would like to thank my agents, Neil Salkind and Laura Lewin, who somehow kept me from
flipping out and checking into the local mental ward. I swear, if just one more deadline popped
up out of nowhere I was going to… Never mind, it all worked out. They really did save the day
on more than one occasion. Thanks, guys!
I have to give special thanks to Bill English. Okay, I really don’t have to do it, but he has
earned it. Bill made this revision possible by driving the first edition of this book to its comple-
tion. Without Bill English being involved, I would have never taken on the first edition, much
less this revision. I really hope that I have the opportunity to work with him again in the future.
Not only is he a colleague that I admire, he is a friend whom I can depend on again and again.
4332.book Page viii Sunday, June 6, 2004 1:52 PM
viii Acknowledgments
Ben Smith and David Lowe of Microsoft were extremely helpful during this process. When-
ever I was not exactly sure what Microsoft was looking for with the test objectives, each of them
took the time to help me out. Ben provided many answers to technical questions during the pro-
cess. David, while not directly involved in answering my questions, was a fantastic conduit to
information. Without his help, I would have had to spend several days hunting down answers.
Another person who deserves his own paragraph in the acknowledgments is Brian Komar.
You should recognize Brian from his many contributions to our community: TechNet articles,
Microsoft Official Courseware contributions, MEC and TechEd speeches, and several books.
Brian was extremely helpful. I am not saying this just because I owe him a box of golf balls.
There are others who deserve acknowledgment for this project even though they did not do
any of the work. My family helped in so many ways that I cannot name them all. My special
thanks go to my wife of over twenty years, Annabelle, and my two children, David and Eric.
Without their support, I would never have completed my part of this project.
This book has been a great experience for me, and I have to thank everyone involved for its
success. I hope to have a chance to work with all of you again in the future.
Russ Kaufmann
Westminster, Colorado
Sybex would like to thank copyeditor Sarah Lemaire, Happenstance Type-O-Rama, and
indexer Nancy Guenther for their valuable contributions to this book.
4332.book Page ix Sunday, June 6, 2004 1:52 PM
Contents at a Glance
Introduction xxi
Assessment Test xxxiv
Chapter 1 Configuring, Deploying, and Troubleshooting
Security Templates 1
Chapter 2 Configuring Security Based on Computer Roles 45
Chapter 3 Installing, Managing, & Troubleshooting Hotfixes &
Service Packs 87
Chapter 4 Configuring IPSec and SMB Signing 131
Chapter 5 Implementing Security for Wireless Networks 175
Chapter 6 Deploying, Managing, and Configuring SSL Certificates 217
Chapter 7 Configuring, Managing, and Troubleshooting
Authentication 271
Chapter 8 Configuring and Troubleshooting Virtual Private
Network Protocols 321
Chapter 9 Installing, Configuring, and Managing
Certificate Authorities 357
Chapter 10 Managing Client-Computer and Server
Certificates and EFS 407
Chapter 11 Configuring & Managing Groups, Permissions,
Rights, & Auditing 449
Appendix A Responding to Security Incidents 495
Glossary 511
Index 533