Windows Server

Network Access Protection with Cisco switches

Brian S. Tucker — Thu, 04 Oct 2007 06:22:43 GMT

Recently at TechEd Australia, New Zealand and Hong Kong I've been presenting on Network Access Protection using 802.1x dynamic Virtual LAN's (VLANs) and Cisco switches. I've done this before actually in my previous blogcasts doing NAP with IPSEC but I got feedback that IPSEC was all too hard - and in fact is quite difficult in Windows Server 2003 and Windows XP. Thankfully Vista and Windows Server 2008 IPSEC configuration is stacks easier but doesn't help existing large deployments of previous Windows platforms. VLAN'ing offers a great alternative to segmenting networks and is much easier to deploy aswell.

Of course with any infrastructure deployments there's things that must be considered such as security. In a VLAN'd environment what are the known attack scenarios? Heres one - and this effectively knocks out switching too. If I can potentially MAC flood your switch - which means that I send so many MAC addresses at a switch port that I flood the table beyond its capacity, then I effectively force the switch to being a hub. This means every packet gets sent to every port on the switch and effectively knocks out the VLANs. Cisco have written an article on this and how to prevent it by implementing port level security. Enabling this feature essentially places a limit on the number of MAC addresses a switch port will accept. Of course there are some scenarios where you want a switch port to take a lot of addresses such as a wireless access point connecting into it but even then it shouldn't be unlimited or beyond the reasonable amount of clients you expect to connect.

In this blogcast I've combined each segment that Ive made into a single 28min blogcast that covers the demo environment and shows you how to configure Network Access Protection from the server to the client and even the switch itself with a little bit of troubleshooting at the end. In fact I've shared the Cisco switch config below for your use!

Click here for the Cisco Switch config I used

Blogcast provided by Michael Kleef of Microsoft.

How to Build a Lab with Virtual PC 2007

Brian S. Tucker — Wed, 24 Jan 2007 00:09:40 GMT

Having a problem making a lab work in Virtual PC 2007 (or 2004)? The blogcast shows the following:

How to create an image which is almost exactly the same as building a real server or workstation.
How to add that image to VPC 2007.
How to make a Windows 2003 Server into a Domain Controller.
Configure Active Directory Sites & Services, DNS and IP informaition.
Network them together in VPC 2007.
Images include WIndows 2003 DC, Member server and Vista workstation in a full lab environment on a laptop computer all with Internet access.

Once you have your base lab installed and running, you can test just about any applicaiton!

Note: If you want to learn simply how to build your first Active Directory domain, the process in this video is the same as a live environment! It's the exact same process, but in VPC 2007.

Download Virtual PC 2007 here! You will need to provide your Windows Live ID to get the download for now. It's free!

You can learn more about Virtual PC 2007 from the Virtual PC Guy's WebLog.

This Blogcast was mady by request by: Luciano Guimaraes. You can request your own video in the request forum!

Interested in making your own blogcast? Get a free trial of Camtasia Studio from TechSmith!

How to Create a Lab Environment with Virtual PC 2004

Brian S. Tucker — Wed, 10 May 2006 01:24:09 GMT

I tend to build labs often to test applications and I find Virtual PC 2004 works well for me. I can create 6 servers and or workstations and run them all at once on my laptop to see how things work before I go into production. The video will show how to create a Virtual Image on a Windows XP workstation and connect it via the network to another Virtual Image session and also how to get both of them to the Internet. I can have a DC, SMS server, MOM server, SQL server XP client all running on my laptop to test anything I like!

How to roll back a Security Configuration Wizard Policy to remove the lock down

Brian S. Tucker — Tue, 07 Mar 2006 23:27:01 GMT

Security Configuration Wizard (SCW) makes it so easy to roll back a policy that I nearly didn't record this blogcast. I went ahead as I appreciate that you may not have had chance to try this for yourself and it's always nice to see someone else demonstrate something before you go ahead yourself.

The blogcast shows how to roll back a server to it's previous configuration following the application of a (SCW) policy.

IMHO SCW's roll back feature is one of it's most important capabilites as it enables the over-zealous administrator to recover from a situation whereby they've locked the system down to the point that it's absolutely useless!

This blogcast forms part of a SCW series which includes the following earlier parts:
Do your systems meet your security policy? Here's an easy way to find out

How to create a new policy for Security Configuration Wizard (SCW)

How to dramatically reduce your system's attack surface - use Security Configuration Wizard (SCW)

Windows Server 2003 R2 Blogcast: Part II: Installed Components

Brian S. Tucker — Fri, 10 Feb 2006 01:40:34 GMT

Hello folks,

As promised here is part 2 of my Windows Server 2003 R2 Blogcast Series. In part 1 I went through an upgrade from SP1 to R2 and explained what that looks like. In this session I discuss what components get installed and go through what this looks like in Add/Remove programs. In the second part of the session I'm going to add the Printer Management capability through the Manage your Server Component and show the change it makes to the Active Directory.

In Part 3 which I will post early next week I'm going to cover the Integrated Branch Office capabilities that are now in R2. Look out for that one!

Enjoy!

Windows Server 2003 R2 Upgrade Blogcast Part 1

Brian S. Tucker — Mon, 06 Feb 2006 06:31:42 GMT

Hi folks,

As promised here is Part 1 of my Windows Server 2003 R2 blogcast series. In this session I focus on what you need to think about when performing an upgrade to R2 from Windows Server 2003 SP1. Now there are a couple of things I left out that I wanted to mention here.

Server Preparation - In the session I mention some things you need to consider when upgrading a server. I forgot to mention a couple of key components of this. First of all all make sure you have a full backup of the server including the system state. This is really important and should just be part of your day to day activities but nonetheless worth mentioning here.
- If the server is an Active Directory domain controller and the AD schema version is earier than the R2 schema then setup will not be able to continue. In this case you wil need to run an adprep.exe /forestprep to prepare the domain controller for the upgrade. This will need to be performed on the server that is the schema operations manager and you should use the Adprep tool that comes on the R2 product CD in the \Cmpnents\r2\adprep directory.
- R2 includes approximately 20 new optional components and among those 3 of have feature that require extensions to the AD schema. These components are: Distributed File System Replication Servces (DFS-R); Identity Management for Unix and the Print Management Console. The schema master is only upgraded under the following conditions:
  - Enabling the new R2 features in your environment
  - Upgrading a Windows Server 2003 domain controller to R2
  - Performing a Windows Server 2003 R2 clean installation

In Part 2 I'm going to take you through the components that we added during the upgrade I did in the first session.

Enjoy!

How to create a new policy for Security Configuration Wizard (SCW)

Brian S. Tucker — Fri, 03 Feb 2006 01:41:59 GMT

The BlogCast is a little long (ten minutes) as it takes you through the entire wizard which includes creating an IPsec policy the easy way!

This BlogCast follows on from my earlier post that shows how to install SCW.

How to dramatically reduce your system's Attack Surface - Use Security Configuration Wizard

Brian S. Tucker — Mon, 30 Jan 2006 08:00:00 GMT

SCW is an abbreviation for Security Configuration Wizard which is a means of turning off the features of Windows Server that aren't required by YOUR applications.

SCW takes the guess work out of which services you can turn off, which network ports can be disabled, how much backward compatibility can be disabled and how IPsec can be enabled.

The beauty of SCW is that it ships with a knowledge base that contains definitions of the required functionality of the majority of Microsoft applications - hence removing the guesswork AND it can easily be extended (by adding XML knowledge base files) for third party applications too.

SCW is an optional install option for Windows Server 2003 Service Pack 1.

I know many of you are often too busy to try new software out as quickly as you'd like hence I'm recording a series of BlogCasts to SHOW you how to get benefit from SCW.

There's a great deal of additional information available for Security Configuration Wizard at this link including details of how to extend the knowledge base.

Watch Part 2 Here!

Windows Server Update Services / WSUS Part 2

Brian S. Tucker — Tue, 14 Jun 2005 22:24:51 GMT

Part 2 shows how to configure Group Policy so that your servers and or workstations are properly managed by your WSUS server(s).

Windows Server Update Services / WSUS Part 1

Brian S. Tucker — Tue, 14 Jun 2005 22:21:10 GMT

WSUS has a lot of great features and I can see the true benefit of having it in your organization. Many organizations will need to choose whether WSUS is a more appropriate alternative to SMS. The BlogCast shows how to configure your WSUS server from top to bottom.

Microsoft Virtual Server 2005 Basics

Brian S. Tucker — Thu, 26 May 2005 22:27:07 GMT

This is a product overview of Virtual Server 2005 from Microsoft. It is intended to demonstrate the product as well as showcase common uses.

Windows Server 2003 Disk Quotas

Brian S. Tucker — Tue, 24 May 2005 17:19:23 GMT

Windows quotas allow you to determine how much drive space a user or group can have on a server volume, not just a share. If you have a server where drive space is critical and you need to make sure users don't take up too much space, quotas may be the answer.

Windows 2003 Access-based Enumeration

Brian S. Tucker — Fri, 29 Apr 2005 17:22:09 GMT

If you are running Windows Server 2003 with Service Pack1, you have a new feature available to you. This utility allows you to hide shared folders to users that do not have access. The bottom line is that if you don't have access to the folder, you can't see it anymore. Novell has been doing this for years and it's great Microsoft finally saw the need to implement this. Download it!

SBS 2003: SPAM Filter Issue

Brian S. Tucker — Fri, 29 Apr 2005 17:17:36 GMT

There was a configuration issue at a client site recently. As the client didn't use the same ISP to host there mail as they did for Internet Access, a spam blocker called SPF stopped a client’s e-mail being sent to this particular address. This blogcast shows a simply method of resolving this issue.

Configuring NAT and Demand-Dial VPN using RRAS

Brian S. Tucker — Thu, 21 Apr 2005 21:36:16 GMT

These are the demos that I didn't get time to do in Part 11 of our 12 part webcast series on Windows Server 2003 Administration. Part 11 was all about Routing. Click HERE to see the full webcast!