Exam 70 294 Planning Implementing and Maintaining a

Slides: 94

Download presentation

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security Goals v Introduce security configuration v Introduce auditing v Set audit policy on a domain controller v Set audit policy on a stand-alone server or computer v View the Security log v Audit user access to Active Directory objects v Assign user rights to users and groups 12. 1 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security Goals (2) v Implement account policy v Implement security templates v Use the Security Configuration and Analysis console to configure security v Troubleshoot security configuration issues 12. 2 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration v Security configuration is the process of setting up a security policy v For an individual system v For a network v Security policies are required v Guard against unauthorized internal users v Protect from external threats 12. 3 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (2) v Use security configuration v To set up security policies v. Account v. Local v To create access control policies v. Services v. Registry v. Files 12. 4 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (3) v Use security configuration v To define event logs settings v To determine group membership settings (restricted groups) v To create public key policies v To set Internet Protocol (IP) security policies 12. 5 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (4) v Factors to consider while designing security policies v Physical distribution of the network v Business model of the organization v Network load due to inter-computer dataflow and access v Overall computer usage 12. 6 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (5) v Windows Server 2003 Security Configuration tools v Group Policy Object Editor is used to apply security settings centrally for the computers in a domain. v Use the Security Settings extension in the Group Policy Object Editor to apply different categories of security policies 12. 7 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (6) Categories of security policies v Account policies v Can only be set for the entire domain v Password policy v Account lockout policy v Kerberos policy 12. 9 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (7) Categories of security policies v Local policies v Audit policy v User rights assignment v Security options 12. 11 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (8) Categories of security policies v Event log allows you to specify security log settings v Maximum size of the event log file v Logging options v Event log access rights 12. 12 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (9) Categories of security policies v Restricted Groups allows you to define additional control over the membership of key groups v Defining a group as a restricted group v Setting the membership for the group v Configuring member groups and users for the restricted group 12. 13 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (10) v Categories of security policies v. System Services allows you to configure the startup settings for services on a computer v. Startup mode settings: Automatic, Manual, and Disabled v. Can specify which security group or user can modify a service’s properties (start, stop, or pause) 12. 14 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (11) Categories of security policies v Registry security settings allow you to set permissions for users to read, modify, and add new keys to the Registry v File System v Allows you to set access permissions for folders and files on the computer v Settings only apply to computers with NTFS drives 12. 16 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 1) Introducing Security Configuration (12) Categories of security policies v Wireless Network (IEEE 802. 11) Policies control network security settings for supported wireless networking devices v Public Key Policies are used to configure the public key encryption v IP Security Policies are used to configure IP security for TCP/IP-based communication between servers, clients, and domain controllers using Microsoft’s version of IPSec 12. 18 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 2) Introducing Auditing v Auditing is used to track user activities and object access on the computers on a network v Regular auditing ensures security of network resources v Auditing can discover security breaches v Auditing can help in resource planning for the computers on the network 12. 19 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 2) Introducing Auditing (2) v Steps in setting up a security audit v Determine carefully the events to be audited on each computer v. Security events that can be tracked v Who logged on to a computer and when? v What files were accessed or folders were created? v What printers were used? v What Registry keys were accessed when, and by whom? v What actions the users attempted to perform on them? 12. 20 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 2) Introducing Auditing (3) v Steps in setting up a security audit v Decide the computers, users, or groups to be tracked v Activate the audit object access policy. 12. 21 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 2) Introducing Auditing (4) v Activating the audit object access policy v Configure the audit object access policy in the Properties dialog box and the System ACL editor for the object v Select who you are going to audit v Choose what file system actions you want to monitor in the SACL editor for the file or folder 12. 22 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 2) Introducing Auditing (5) v Monitoring a particular event v Define an audit policy in the Audit Policy folder v The audit policy tells the operating system what to record in the Security event log on each computer v On a domain controller, modify the default domain policy by using the Group Policy Management console v Only Domain Administrators and Enterprise Administrators can configure auditing at the domain level 12. 23 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 2) Introducing Auditing (6) v Audited events are stored in the Security event log v Success and failure can both be recorded v Security log can be viewed using the Event Viewer v The Security log entries allow identification of existing security problems in the overall network, as well as on individual computers 12. 25 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 3) Setting Audit Policy on a Domain Controller v Unauthorized access to a domain must be monitored v Set up an audit policy on a domain controller by configuring Group Policy v Link the GPO to the default Domain Controllers OU v You must have the Manage auditing and security log right on the system to configure auditing 12. 27 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 3) Setting Audit Policy on a Domain Controller (2) v Setting up auditing is a two-step process v Step 1 v. Configure the audit policy to track particular events, for success, for failure or both v Step 2 v. Open the specific resource you wish to audit v. Enable auditing by selecting the type of event you want to track and the user group or groups for which you want to track that event 12. 28 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 4) Setting Audit Policy on a Stand-Alone Server or Computer v Problems auditing stand-alone servers and workgroup computers running Windows 2000 or XP Professional v They do not belong to a domain v A domain controller-based audit policy cannot be applied to them v Stand-alone computers and the network computers may be able to access each other and hence require monitoring 12. 35 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 4) Setting Audit Policy on a Stand-Alone Server or Computer (2) v Audit policy should be set for stand-alone computers v To monitor network access attempts v To monitor local security events 12. 36 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 5) Viewing the Security Log v Problems with implementation of audit policies v Increases the overhead on a computer v Slows down CPU performance v Security event log can become inundated with entries v Solutions v Set a schedule for checking the Security log regularly v Specify a maximum file size for Security log 12. 40 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 5) Viewing the Security Log (2) v Be aware when the Security log reaches the maximum file size v You may lose data if the log becomes full before you archive it v Archiving is the process of saving a history of events so you can track trends in resource usage v When the log is full, the operating system will stop recording events 12. 41 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 5) Viewing the Security Log (3) v Set filters to control what is recorded in the log v Event type: Information, Warning, Error, or Success or Failure audit v Event source: Choose a particular source, such as Spooler, LSA (Local Security Authority), or SC (Service Control) Manager v Category: Account Logon, Account Management, Directory Service Access, Privilege Use, Object Access events, and so on v Event ID v User v Computer v Specific time periods 12. 43 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 6) Auditing User Access to Active Directory Objects v Active Directory objects v Are the essential building blocks of a Windows Server 2003 network v Include users, computers, OUs, groups, published printers, and so on v Audit policies for Active Directory objects v Are set based explicitly on their functionality v An audit policy set for an Active Directory object is inherited by its child object through Policy Inheritance by default 12. 48 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 7) Assigning User Rights to Users and Groups v User rights are different from permissions v Permissions allow a user access to certain resources v User rights allow the user to perform certain restricted actions, such as shutting down the system or logging on locally 12. 51 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 7) Assigning User Rights to Users and Groups (2) v User Rights Assignment policy is used to grant users rights v Rights should be assigned to groups for ease of administration v Users can be added to the group to grant them the same level of user rights v. Assign user rights to allow particular users to carry out specific functions v. This increases the security of the system 12. 52 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy v Account policies v Used to set the user account properties that control the logon process v Types of policies v. Account lockout policies v. Password policies v. Kerberos policies 12. 56 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (2) v Configuring account policies v Group Policy Object Editor snap-in v Group Policy Management console (GPMC) 12. 57 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (3) v Account lockout policy v Objective of the policy is to prevent users from guessing passwords v There is immediate replication of Active Directory data between Windows Server 2003 domain controllers when an account is locked out 12. 58 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (4) v Account Lockout policy is configured by setting following policies v Account lockout threshold: Specify the number (0 to 999) of allowed invalid logon attempts v Account lockout duration: Specify the time duration (0 to 99999 minutes) during which the account remains disabled v Reset account lockout counter after: Set the time (1 and 99999 minutes) duration that must elapse after an invalid logon attempt before the account lockout counter is reset to 0 12. 59 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (5) v Password policy v Allows you to specify how users must manage their passwords v Factors to be considered v. Password history v. Password age v. Password length v. Complexity requirements v. Encryption and storage methods 12. 60 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (6) v Kerberos policies v The Kerberos V 5 authentication protocol is implemented through a Key Distribution Center (KDC) v They are applicable to domain user accounts or computer accounts only v They define settings such as ticket lifetimes and logon restriction enforcement 12. 61 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (7) v Kerberos policy settings v Enforce user logon restrictions policy: If enabled, the KDC performs certain checks before issuing a session ticket v Validity of the user account v User rights policy on the target computer v Maximum lifetime for service ticket: Sets the maximum length of time for a Logon Session Ticket v Maximum lifetime for user ticket: Sets the maximum length of time that the Ticket Granting Ticket (TGT) will be valid v Maximum lifetime for user ticket renewal: Sets the maximum lifetime for both the Ticket Granting Ticket (TGT) and the Logon Session Ticket 12. 63 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 8) Implementing Account Policy (8) v Kerberos policy settings v Maximum tolerance for computer clock synchronization v. Sets the maximum number of minutes that the clock on the KDC can be different from the clock on the Kerberos client v. This acts as a deterrent in replay attacks 12. 64 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 9) Implementing Security Templates v Security template v A group of security settings used to implement security in computers running Windows 2000 or later operating systems v A text-based file with an. inf file extension v You can import these templates into GPOs, and apply the set of common security settings to multiple computers with similar functionality v You can use them to save and restore security settings of a computer 12. 71 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 9) Implementing Security Templates (2) v Windows Server 2003 provides several predefined security templates located in the folder %Systemroot%SecurityTemplates v The predefined security templates have four standard security levels v Basic v Compatible v Secure v Highly Secure 12. 72 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 9) Implementing Security Templates (3) v Implementing security templates consists of five steps 1. Accessing the Security Templates console v. You can access the Security Templates console in an existing console by adding the Security Templates snap-in to it v. You can also create a new Microsoft Management Console (MMC), and add the Security Templates snap-in to it 12. 74 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 9) Implementing Security Templates (4) v Implementing security templates consists of five steps 2. Customizing a predefined security template v. You can edit a predefined security template v. Save the modified template as a new template 3. Defining a new security template v. You can define security settings in a new customized security template according to the specific security requirements of your organization 12. 75 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 9) Implementing Security Templates (5) v Implementing security templates consists of five steps 4. Importing a security template to a GPO v. To apply the same security settings to multiple objects using a GPO, you can import an appropriate security template into the GPO 12. 76 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 9) Implementing Security Templates (6) v Implementing security templates consists of five steps 5. Exporting security settings to a security template v. You can export the initial security configuration for a computer to a security template. v. Similarly, the effective security settings (the security settings currently applied on the computer) for a computer can be exported to a security template v. The initial security template can be used to restore the settings 12. 77 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 10) Using the Security Configuration and Analysis Console v Use the Security Configuration and Analysis snap-in to configure the local security settings on a computer v Importing a security template v Comparing the template to the currently configured computer settings v Performing a “what-if” analysis 12. 81 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 10) Using the Security Configuration and Analysis Console (2) v Analyzing the comparisons v The security settings that match are marked by a green check mark icon v The security settings that do not match are marked with a red x icon v Action v Update the security settings on the computer that do not match the database settings 12. 83 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 11) Using the Security Configuration and Analysis Console to Configure Security v Use the Security Configuration and Analysis tool to configure security on individual computers v Set security settings by removing or updating any inconsistencies discovered in the analysis v You can construct a composite database security template by importing templates (either predefined or customized) into the database 12. 87 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 12) Troubleshooting Security Configuration Issues Improving the success rate for network security v Examine the level of security requirements for the network v High level of security v Reduces efficiency v Increases cost and administrative effort v Low level security leads to unauthorized access, which can have serious repercussions v Identify existing and potential problems in the Security event log and update the security settings accordingly 12. 92 © 2004 Pearson Education, Inc.

Exam 70 -294 Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure Lesson 12: Configuring Active Directory Security (Skill 12) Troubleshooting Security Configuration Issues (2) Improving the success rate for network security v Determine network usage for certain resources that may cause problems in the future v Identify security patterns that may cause problems in the future 12. 93 © 2004 Pearson Education, Inc.