Windows 2000 Server System Administration Handbook

Chapter 1 The Windows 2000 System Administration Migration Path

Brief Overview of Windows 2000 Server

Windows 2000 System Administration Overview

Increased Reliability, Availability, and Scalability

Easier Management and Lower Costs

Comprehensive Internet and Application Server

Why the Change

Migrating to Windows 2000 Server

Getting Ready

Streamlining

Planning

Testing

Deployment

Setting Up Windows 2000 Server

Installing Windows 2000 Server

Upgrading to Windows 2000 Server

Summary

FAQs

Chapter 2 Overview of Windows 2000 Administration

Introduction to Network Administration

Designing and Setting Up the Network

Managing the Network

Protecting the Network

Documenting the Network

Microsoft Management Console

Introduction to Active Directory

Key Concepts

Features and Benefits of Active Directory

Beyond Active Directory

Using Windows 2000 Help

Summary

FAQs

Chapter 3 Setting Up User Accounts

Defining an Acceptable Use Policy

Template: Acceptable Use/Security Policy

Introduction to User Accounts

Requirements for New User Accounts

Default User Account Settings

Creating a Domain User Account

Active Directory Users and Computers

Creating User Accounts

Setting Password Requirements

Security Templates

Changing Account (Password) Policies

Setting Properties for User Accounts

Modifying User Accounts

Managing User Accounts

Deleting User Accounts

Changing User Passwords

Enabling an Account

Disabling an Account

Other Active Directory Users and Computer Functions

Best Practices

Using Active Directory Users and Computers

Administrative Logon

Account (Password) Policies

Summary

FAQs

Chapter 4 Using Groups to Organize User Accounts

Introduction to Groups

Group Type

Group Scope

Implementing Group Strategies

Why Use Groups

Structuring Groups

Implementing Groups

Preparing to Create Groups

Information Needed to Create a Group

Creating a Group

Assigning Users to a Group

Configuring Group Settings

Managing Groups

Implementing Local Groups

Preparing to Create Local Groups

Creating a Local Group

Implementing Built-in Groups

Built-in Domain Local Groups

Built-in Global Groups

Built-in Local Groups

Built-in System Groups

Built-in Group Behavior

Best Practices

Managing Groups

Using Universal Groups

Switching Modes

Summary

FAQs

Chapter 5 Administering File Resources

Introduction

Using Microsoft Windows NT File System (NTFS) Permissions

NTFS Folder Permissions

NTFS File Permissions

How Windows 2000 Applies NTFS Permissions

Access Control Lists

Combining NTFS Permissions

Permission Inheritance

Assigning NTFS Permissions

Planning NTFS Permissions

Managing NTFS Permissions

Special Access Permissions

Using Special Access Permissions

Changing NTFS Permissions

Copying and Moving Files and Folders

Copying Files

Moving Files

Sharing Resources

Securing Network Resources

Shared Folder Permissions

Creating Shared Folders

Developing a Shared Folder Strategy

Sharing Folders

NTFS Permissions and Shared Folders

Troubleshooting Access Problems

Solving Permission Problems

Best Practices

Avoiding Permission-Related Access Problems

Guidelines for Managing Shared Folder Permissions

Summary

FAQs

Chapter 6 Administering User Accounts

Managing User Profiles

User Profiles Overview

Contents of a User Profile

Settings Saved in a User Profile

Local User Profiles

Roaming User Profiles

Creating Home Folders

Home Directories and My Documents

Creating Home Directories

Introduction to Group Policies

Applying Group Policy

Best Practices 2

Allowing for Different Hardware Configurations

Combining the Power of Profiles and Policies

Tightening Security on Home Directories

Summary

FAQs

Chapter 7 Administering Printer Resources

Introduction to Administering Printers

Terminology

Planning the Print Environment

Creating the Print Environment

Printer Properties

General

Sharing

Ports

Advanced

Security

Device Settings

Managing Printer Permissions

Security/Sharing Permissions

Printer Ownership

Managing Printers

Assigning Forms to Paper Trays

Assigning Separator Pages

Creating a Printer Pool

Specifying Printer Priorities

Redirecting a Printer

Removing Printer Drivers

Managing Documents in a Print Queue

Setting Priority, Notification, Printing Time

Administering Printers by Using a Web Browser

Best Practices

Organize Printers by Business Function or Geographic Location

Put Print Devices on a Separate Network

Allow Clients Access to Web Printing Interfaces

Restart Print Spool Service Periodically

FAQs

Chapter 8 Managing Storage Data

Managing Data Compression

Compressing Files and Folders

Managing Disk Quotas

Encrypting Data

File Encryption

Decryption of Files

Storing Encrypted Files on Remote Servers

Accessing Encrypted Data

Moving and Renaming Encrypted Data

Decrypting Data

The Recovery Agent

Using Disk Defragmenter

Analyzing a Drive

Viewing Reports

Defragmenting NTFS File System Partitions

Troubleshooting Data Storage

Best Practices

FAQs

Chapter 9 Monitoring Event Logs

Introduction to Monitoring Event Logs

Viewing Event Logs

Monitoring Security Events

Auditing Files and Folders

Auditing Registry Entries

Analyzing Security Events

Managing Event Logs

Best Practices

Summary

FAQs

Chapter 10 Backing Up and Restoring Data

Introduction to Backing Up and Recovering Data

Types of Backups

Necessary Permissions and User Rights

System State Data

Emergency Repair Disk

Back Up and Restore Options

Backing Up Data

Restoring Data

Authoritative Restore

Maintaining Media

Best Practices

Summary

FAQs

Chapter 11 Advanced Administration of Windows 2000

Administering Windows 2000

Microsoft Management Console

Windows 2000 System Administration

Windows 2000 Network Administration

Adapters and Protocols

Configuring Adapters and Protocols

DHCP Manager

DNS Management

Windows Internet Naming Service (WINS)

Terminal Services

Quality of Service

Routing and Remote Access

Remote Access Service Dial Out

Virtual Private Networks

Demand Dial Routing

Network Address Translation (NAT)

Internet Authentication Service

Connection Manager Administration Kit

Customizing Windows 2000 Tools for Your Environment

Creating Custom MMC Consoles

Using the Task Scheduler

Understanding the Logon Process

Logon Authentication

Secondary Logon Services

Windows 2000 Resource Kit

Direct X Diagnostic Utility

Command Line Kill

Sysprep

Setup Manager

Sysdiff

Dependency Walker

Shutdown

Netdiag

Summary

FAQs

Chapter 12 Administering Active Directory

Introduction to Administering Active Directory

Active Directory Concepts

Active Directory Components

Using Active Directory Management Utilities

Publishing Objects in Active Directory

Sharing Resources

Locating Objects in Active Directory

Controlling Access to Objects

User Authentication

Object-based Access Control

Active Directory Permissions

Delegating Administrative Control of Objects

Delegation of Control Wizard

Overview of Active Directory Service Interface (ADSI)

Best Practices

Summary

FAQs

Chapter 13 Implementing Group Policy

Introduction to Windows 2000 Group Policy

Group Policy Structure

Types of Configurations

Type of Group Policies

Group Policy Objects

Group Policy Containers

Group Policy Templates

How Group Policy Is Applied in Active Directory

Order of Inheritance

Creating a Group Policy Object

Group Policy and Slow Networks

Filtering the Scope of GPO

Modifying Group Policy Inheritance

Modifying Group Policy

Group Policy Tab

Group Policy Editor

Adding Administrative Templates

Using the Group Policy Management Snap-in

Group Policy Configuration Example

Delegating Administrative Control of a Group Policy Object

Creating a Group Policy Object

Modifying a Group Policy Object

Managing a Group Policy Object Link to a Site, Domain, or Organizational Unit

Guidelines for Implementing Group Policy

Best Practices

Summary

FAQs

Chapter 14 Managing User Environments Using Group Policy

Introduction to Managing User Environments

Types of Group Policy for Managing User Environments

Group Policy Snap-In for the Microsoft Management Console

Using Administrative Templates

Assigning Registry-Based Policies

Creating Custom Administrative Templates

Adding Administrative Templates

Using Scripts

Assigning Script Policies to Users and Computers

Folder Redirection

FAQs

Chapter 15 Managing Software by Using Group Policy

Introduction

Introduction to Managing Software Deployment

Deploying Software

Creating Software Packages

Creating a Non-Windows Installer Package File

Managing Software

Maintaining Software

Upgrading Software

Removing Software

Summary

FAQs

Chapter 16 Administering User Accounts and Groups

Introduction to Administration of User Accounts and Groups

Creating Multiple User Accounts

Migrating Users from an NT 4.0 Domain

Creating New Active Directory Users in Bulk

Importing Users from Novell Directory Services (NDS)

Administering Logon Names

Lockout Settings

Password Requirements

Configuring Account Policies Using Group Policy

Troubleshooting User Logon Problems

Unable to Find a Domain Controller

Unable to Load the User Profile

Missing Computer Account

Redirecting User Data to a Network Share

Setting Up Accounts for Mobile Users

Multilink and Bandwidth Allocation Protocol (BAP)

Using Universal Groups

Windows NT 3.x and 4.x Groups Types

Windows 2000 Group Types

Best Practices

Summary

FAQs

Chapter 17 Implementing Security in a Windows 2000 Network

Introduction to Securing a Windows 2000 Network

Applying Security Policies

The Security Settings Extension to Group Policy

Order of Precedence

Creating, Modifying, and Analyzing Security Configurations

Security Configuration and Analysis Snap-in

SECEDIT.EXE

Configuring an Audit Policy

Analyzing Security Configurations

Security Configuration Templates

Implementing Public Key Security

Components of Public Key Services

Using Public Key Services

Enabling and Administering File Encryption

Encrypted File System Architecture

Using the Encrypted File System

Guidelines for Using EFS

Best Practices

Summary

FAQs 7

Chapter 18 Sharing File Resources by Using DFS

Introduction to DFS

Setting Up a Fault-Tolerant DFS Root

Setting Up a Stand-Alone DFS Root

Setting Up Child Nodes

Configuring Child Nodes as Replica Sets

Administering DFS

Connecting to an Existing DFS Root

Command-Line Administration

Removing DFS Roots and Nodes

Client Interactions with DFS

Security Concerns

Best Practices

Summary

FAQs

Chapter 19 Implementing Disaster Protection

Introduction

Protecting a Windows 2000 Network from Disasters

Backing Up Data

The Recovery Console

Advanced Startup Options

Recovering from a System Failure

Repairing and Restoring Active Directory

Authoritative Restore

Summary

FAQs

Index