Aaron Curtis's List: IT 426 BYUH

• Instead of each workstation having to connect to the Internet to update Windows, each workstation connects to the Microsoft SUS Server instead and updates from there. Microsoft SUS Server alone requires access to the public Internet as it connects to Windows Update.
• By connecting to Windows Update, Microsoft SUS Server provides notification of critical updates as well as performing automatic distribution of those updates to your workstations and servers.

• This article describes how to have your software deployment policy applied to users who are not in an OU.
• reate a folder to hold the MSI package on a server. Share the folder by applying permissions that let users and computers read and run these files. Then, copy the MSI package files into this location.
• If the Windows Installer file resides on the local hard disk, do not use a local path. Instead, use the UNC path of the local computer to indicate the location of the installation files. A UNC path takes the form \\servername\sharename\path\filename.msi.
• Changes to a GPO are not immediately applied on the target computers. Instead, changes are applied according to the current Group Policy update interval.

2 more annotations...

• Microsoft decided to include a “light” version of WinINSTALL called WinINSTALL LE (WinINSTALL Limited Edition) in the Valueadd folder on the Windows 2000 product CD. Administrators could then use WinINSTALL LE to repackage legacy applications into .MSI packages that could then be deployed using Group Policy. Microsoft apparently also decided to leave it to third-party vendors to develop full-featured .MSI packaging tools to meet the needs of customers who needed to deploy third-party and custom applications across their enterprise.

• Important Implementing a security template on a domain controller may change the settings of the Default Domain Controller Policy or Default Domain Policy. The applied template may overwrite permissions on new files, registry keys and system services created by other programs. Restoring these policies might be required after you apply a security template. Before you follow these steps on a domain controller, create a backup of the SYSVOL share.
  
• • In the Available Stand Alone Snap-ins  list, click Security Configuration and Analysis, click  Add, click Close, and then click  OK.
  • In the left pane, click Security Configuration and Analysis and view the  instructions in the right pane.
  • Right-click Security Configuration and  Analysis, and then click Open Database.
  • In the  File name box, type the name of the database file, and then  click Open.
  • Click  the security template that you want to use, and then click  Open to import the entries that are contained in the template  to the database.
  • Right-click Security Configuration and  Analysis in the left pane, and then click Configure  Computer Now.

• As we analyze what a security template is, we need to understand that it is really a portion of a GPO.
• a security template is nothing more than a text based file that can update all of these security settings in a GPO
• The account policies control user passwords and when the user forgets their password at logon.
• User rights control access to what a user and/or group can do on a computer.
• n the past, the only way to ensure that the three default logs (application, system, and security) were configured properly was to configure each server separately. These settings that can be made to control the size of the log file, the retention method of the log file, and the number of days to retain the log, and whether or not the guests group can access the security log.
• With security templates, you can configure the system services offline, test them, then roll them out with a GPO
• if you configure the security template from a Windows XP Professional computer that has a default installation, you won’t be able to configure certain services in the security template such as IIS and File Replication Service. The solution to this problem is to create and manage security templates from computers that have all of the necessary services that you need to configure on the target computers.

• Here is a list of the security templates that you will find in this folder.

   
   
  •  
    Compatws.inf – This is required by older applications that need to have weaker security to access the Registry and the file system.
     
  •  
    DC security.inf – This is used to configure security of the Registry and File system of a computer that was upgraded from Windows NT to Windows 2000/2003.
     
  •  
    Hisecdc.inf – This is used to increase the security and communications with the domain controllers.
     
  •  
    Hisecws.inf – This is used to increase security and communications for the client computers and member servers.
     
  •  
    Notssid.inf – This is used to weaken security to allow older applications to run on Windows Terminal Services.
     
  •  
    Ocfiless.inf – This is for optional components that are installed after the main operating system is installed. This will support services such as Terminal Services and Certificate Services.
     
  •  
    Securedc.inf – This is used to increase the security and communications with the domain controllers, but not to the level of the High Security DC security template.
     
  •  
    Securews.inf – This is used to increase security and communications for the client computers and member servers.
     
  •  
    Setup security.inf – This is used to reapply the default security settings of a freshly installed computer.
    
• security templates, they are used to centralize security on many computers at one time. The breadth that a security template covers is rather large, providing control over some of the most important security settings on any computer

7 more annotations...

• From a time-saving perspective, Terminal Services lets administrators install, configure, manage and maintain applications centrally on a few servers. This is usually much faster and easier to do than deploying applications on hundreds or thousands of desktop machines at different sites across an enterprise. And by making the job of the administrator easier, companies also save money on IT support costs for their information systems infrastructure. Furthermore, centrally-deployed applications are usually easier to maintain (for example, patching and upgrading) and simpler to troubleshoot when things go wrong. As a result, downtime is reduced, users are more productive, and business booms along.
• n a terminal server environment all application logic runs on the server, the processing and storage requirements for client machines are minimal
• First off, let's take note that Terminal Services in Windows Server 2003 is light-years ahead of its predecessor in Windows 2000 Server.
• up to two users can simultaneously connect to your server to remotely administer it.
• Terminal Services so secure you don't need a VPN tunnel when you're connecting to it over a public network like the Internet.
• powerful encryption algorithms
• Citrix, the company that actually developed the underlying technology behind Windows Terminal Services, wisely chose not to rest on its laurels but to continue refining and enhancing their product line until today they have a compelling suite of applications called Citrix MetaFrame Access Suite. This package consists of a handful of key products that run on Windows Server 2003 and go beyond what Windows Terminal Services itself can do.
• While Microsoft clients for Terminal Services are currently limited to Windows and Mac platforms, Citrix clients are available for Windows, Mac, various flavors of UNIX, and even EPOC handheld devices.
• What gives Presentation Server a lot of its power is its ICA (Independent Computing Architecture) protocol, the presentation protocol used on the Citrix platform for transmitting keystrokes, mouse movements, and screen updates between thin clients and the presentation server. ICA is the Citrix counterpart of Microsoft's Remote Desktop Protocol (RDP) used by Terminal Services, and it's illuminating to compare their capabilities:
• Both Terminal Services and Presentation Server have their own licensing requirements and they're complex, so you really need to do your research to see which one gives you the most bang for your buck (or whether you'll even be saving any money at all moving your business from a client/server to a terminal server computing environment).
• he hardware you use to run a terminal server on generally has to be top quality and pretty beefy, and such machines come with their own hefty price tag as well

9 more annotations...

• As part of the licensing service setup, the installation routine asks if you want to set up the license server for your “Enterprise” or “Domain or Workgroup.” The option chosen here (called the “scope”) dictates how the license server communicates with your Terminal Servers and lets you control which Terminal Servers can receive licenses from your licensing server. You can configure your license server so that it provides licenses for either:

   
   
  • An entire Active Directory site. (Enterprise licensing server)  
  • An entire domain or workgroup. (Domain/workgroup licensing server).
• f you choose the “Enterprise” installation option, your licensing server will respond to a license request from any Terminal Server in the same Active Directory site. If Terminal Servers from multiple domains exist in that Active Directory site, the license server will provide licenses for all of them.

• Choosing the “Your domain or workgroup” option causes the license server to behave differently, depending on whether it’s part of an Active Directory domain.

   

  In AD environments, this choice causes your licensing servers to only respond to license requests from Terminal Servers in the same Active Directory domain. If an Active Directory domain crosses multiple Active Directory sites, the licensing server will fulfill requests from multiple sites. This option is useful in situations where there are multiple business units partitioned into different domains on the same network. A license server from one domain won’t give licenses to clients connecting to Terminal Servers from a different domain.

1 more annotation...