Performing Backups

Plan a backup strategy before performing the task of data backup. The backup strategy involves, planning the type of backup and frequency of the backup. To create an efficient backup strategy, you must consider the timeand size of the backup job. You also need to consider the time required to restore a system in the event of failure.
The backup strategies are as follows:

> Normal and Differential backups - Requires more time to backup but takes less time to restore the data because the backup is stored on the smaller amount of disks or taps.

> Normal and Incremental backups - Requires less time to backup but more time to restore because you need to restore all the subsequent incremental backups.

You can choose any of the strategy as per your requirement for the backup process. To perform the backup process on the local computer, you must be an administrator or the backup operator in a local group on that computer.Backup operator refers to a type of local or global group who are assigned required user rights to perform backup and restore process. You can always perform backup of files and folders of which you are the owner.

To perform backup:

1. Select Start > Programs > Accessories > System Tools > Backups. The Welcome to the Backup or Restore Wizard screen appears.
The Welcome to the Backup or Restore Wizard screen enables to create a backup. You can create basic backup by clicking Next. You can also create advance backup by clicking Advanced Mode link. Advanced backup enables to select various backup setting options.

2. Click the Advanced Mode link. The Backup Utility window appears.
The Backup Utility window enables to create a backup using wizard mode or can create the backup manually by clicking Backup tab.

3. Click the Backup tab. The Backup tab appears.
The Backup tab enables to select the drive, file or folder to create backup. It enables to select the path of the backup file in the Backup media or file name text box.

4. Select the drive, files or folders that you want to backup under Click to select the check box for any drive, folder or file that you want to back up. The selected folder for backup appears.
The selected folder has a blue check mark, which indicates that the entire folder is selected for backup. The C drive has dimmed mark, which indicates a partial backup. Any file or folder added in the selected folder will be backed up. However, any file or folder added to the C drive or any other folder will not be backed up. The different options available in this tab are:

> Backup destination - Enables to specify the destination where you want to save the backup data. You can select a file or tape device if it is installed on your machine. > Backup media or file name - Enables to specify the name of the media or a file where you want to store backup.

> Start Backup - Displays the Backup Job Information dialog box. This dialog box enables you to select the advanced option for the backup.

5. Enter name of the backup media or file where you want to store backup in Backup media or file name text box.

6. Select Tools > Options. The Backup Type tab appears.
The Backup Type tab enables to select the required type of backup.

7. Select the required backup type from Default Backup Type drop-down list box.

8. Click the Backup Log tab. The Backup Log tab appears.
The Backup Logs tab enables to select the level of details you want to use when backup logs are created for backups. This is an important troubleshooting tool if the backup completes with some errors.

The different options available on the backup Log tab are:

> Detailed - Enables to log all the information about the backup. It records the name of all files and folders included in backups.

> Summary - Enables to log only important information. It records details of only key operation, such as, starting backup or errors in opening a file.

> None - Does not record any information.

9. Select the appropriate option.

10. Click the Exclude Files tab. The Exclude Files tab appears,
The Exclude Files tab enables to select the files that you want to remove from the backup process. You can exclude certain files from the backup if the administrator performs the backup process and exclude certain files if other user performs the backup process.

The different options available in the Exclude Files tab are:

> Add new - Enables to add files to exclude from the backup process

> Edit - Enables to edit the files that are excluded from the backup process. It enables to change the properties and path of the file. You can also specify whether to exclude the selected file from all the subfolder in that path.

> Remove - Enables to remove the files that are included in the exclude the file from backup process list. The file that you remove will be backed up in the current backup process.

11. Select the required files.

12. Click the General tab. The General tab appears.

The different options available in the General tab are:

> Compute selection information before backup and restore operations - Displays the number of files and bytes that will be backed up or restored during backup or restore operation. This information is displayed before the backup or restore process starts.

> Use the catalogs on the media to speed up building restore catalogs on disk - Enables to specify that you want to use on-media catalog .Catalog contains files and folders that are included in the backup. This option enables to build an on-disk catalog very fast.

> Verify data after the backup completes - Enables to verify the backed up data with the original data on the hard disk to ensure that the data are same. Backed up data files can be compared with the original files but system backups are difficult to verify as the system files changes more frequently.

> Back up the contents of mounted drives - Enables to backup the data of the mounted drive. If this option is not selected and you backup the mounted drive then only the path information of the mounted drive will be backed up.

> Show alert message when I start the Backup Utility and Removable Storage is not running - Displays the alert message box when backup process starts and removable storage is not running. After displaying the alert message, the backup process will start the removable storage automatically.Select this option only if you backup data to a tape or other media that is managed by the removable storage.

> Show alert message when I start the Backup Utility and there is recognizable media available - Displays the alert message box when backup process starts and a new media is available. Select this option only if you backup data to a tape or other media that is managed by the removable storage.

> Show alert message when new media is inserted - Displays the alert message box when new media is identified by the removable storage. Select this option only if you backup data to a tape or other media that is managed by the removable storage.

> Always allow use of recognizable media without prompting - Enables to move the new media that is identified by the removable storage to the backup media pool automatically. Select this option only if you want all new media to be available to the backup programs only.
13. Select the required option.

14. Click OK to return to Backup Utility window.

15. Click Start Backup. The Backup Job Information dialog box appears,

The different options available in the Backup Job Information dialog box are:

> Backup description - Displays the description of the backup. You can enter unique name for the backup.

> Append this backup to the media - Enables to add the backup to the existing backup file or media. This option will not affect any previous backup data stored in the existing backup file or media.

> Replace the data on the media with this backup - Enables to replace the existing backups with the new backup job. This option will erase all the previous backup data.

> If the media is overwritten, use this label to identify the media - Enables to specify the name of the file or media that you are using to save the backup data.

> Allow only the owner and the Administrator access to the backup data - Enables to specify that only the members of the administrator group can access the current backup data. You can select this option only when you select Replace the data on the media with this backup option.

> Start Backup - Enables to start the backup processSchedule - Enables to select the schedule for the backups.

> Advanced - Enables to select the advanced options before starting with the backup process

16. Click Start Backup. The Backup Progress dialog box appears.
The Backup Progress dialog box displays the status of backup process. When the process is running, the Status text box displays the message Preparing to backup shadow copy.

After the backup process is completed, Backup Completion dialog box appears.
Backup Completion dialog box displays the status of backup process as completed. It displays complete information about the backup. The different information displayed in this dialog box are:
> Report - Displays the backup log that contains complete information about the backup process. It also contains information about errors if any occurred during the backup process.

> Drive - Displays the name of the drive where backup file is stored.

> Label - Displays the name of the backup file. The backup file is saved with the extension .bkf. It also displays the date and time when backup file is created.

> Status - Displays the status of the backup process.

> Time - Displays the elapsed and remaining time for the backup process.

> Files - Displays information about the processed and remaining files for backup.

> Bytes - Displays information about the processed and remaining bytes for backup.

Types of Backups

Backup creates a duplicate copy of the content on a hard disk and then records the data on the different storage device. Backup is very useful utility in case the original data on the hard drive is overwritten, deleted or is not available due to hard disk failure. In such cases, the data can be easily restored from the archived copy. Backup utility enables to backup data from the files or folders stored on the local volume or on the network.
The backup utjlity supports five types of backup on your system, they are:

> Normal Backups - Enables to backup all the selected files and folders and marks each file as backed up. Archive attribute is not used in the normal backup, in order to determine which files or folders to back up because it transfers all, the files and folders to the destination media. An archive attribute is a flag that is set on file in case a file is modified. The archive attribute is available in the file properties. The archive attribute is set to clear in this type of backup. Normal backups are time consuming and it requires more storage capacity as compared to other types of backups. However, this type of backups is most efficient to restore the data because it creates a complete backup. Normal backup is usually created the first time when backup set is created. Backup set refers to the collection of files or folders that is backed up and stored in a file or on some other storage device, such as, tape drive.

> Incremental Backups - Enables to create backups of only those files that are created or modified since the last normal or incremental backups and marks the file as backed up. The archive attribute is set to clear. When you perform an incremental backups one day after normal backup is performed, then the incremental backup will contain only those files that are created or modified on that day. Incremental backups are fastest type of backup. This type of backups is less efficient because to restore the backup you first need to restore normal backup and then restore each subsequent incremental backup in order of their creation.

> Differential Backups - Enables to create backups of only those files that are created or modified since the last normal or incremental backups. However, it does not mark the file as backed up. The archive attribute is not cleared. When you perform differential backups for two days, then the differential backup of the second day will contain all the files that are included in the first backup as well as contain the files that are created or modified on the second day. The differential backups are more efficient than the incremental backups because to restore the backup you first need to restore normal backup and then restore the recent differential backup.

> Copy Backups - Enables to create backups of all the files that you have selected. However, it does not mark the file as backed up. The archive attribute is not cleared. Copy backup is useful when you want backup of files between normal and incremental backup, as it does not affect these backup process.

> Daily Backups - Enables to create backups of all the files that you have selected and are modified on the day when daily backup is taken. However, it does not mark the file as backed up. This type of backup is useful when you want backup of the files that are modified on that day without affecting the backup schedule. The archive attribute is not cleared.

Understanding the need of Backups

In every organization, data is stored on storage media, such as, hard disk. Everyday data is generated and used by the employees. The storage media are open to various attacks, such as, virus. In some cases, the system stops functioning, resulting in the loss of data. Hence, there is a need to store this data in alternate storage media. This process of storing data in alternate locations or storage media is referred to as Data Backup. Backup utility enables to protect data from accidental loss.
For instance, as a system administrator you backup important data files of the sales department to an external storage media, such as a tape drive. In the event of system failure, virus attacks or malicious users deleting the files, you can restore the data files from the external storage media and prevent loss of data.

DESASTER RECOVERY

Windows Server 2003 provides a utility named Backup that enables the administrator to perform administrative tasks, such as backing up files and folders, making a schedule for backing up files and folders, and restoring data on the computers running Windows Server 2003. There are different types of backups, which an administrator can perform depending on the requirement of your organization. Before performing the backup, you need to plan the type of backup you want to perform.

Using Remote Assistance

Remote Assistance enables to acquire assistance from the remote user who is an expert or someone who can solve your query. For example, while performing certain task you are not able to continue because of some problem. in such case, you need someone for solving the problem. You can use remote assistance to obtain help.

To make a request using remote assistance:

1. Select Start > Help and Support. The Help and Support Center window appears.

2. Click Remote Assistance under Support. The Remote Assistance window appears,

3. Click Invite someone to help you option. The Use Windows Messenger window appears,

4. Click Sign in. The signing in message appears.

5. Right-click the name of the user from whom you want help. A shortcut menu appears.

6. Select Ask for Remote Assistance. The selected user receives the invitation as an instant message.
7. Click Yes to confirm the session.

The remote assistance session is established. You can now ask the helper to solve the problem. In addition, the remote user can use the window messenger to chat with you, view your screen, and work on your computer with your permission.

Accessing Remote Desktop

After configuring the server to enable remote desktop for administration, you can now access the desktop of the remote computer to perform the required task on the remote machine. Accessing the remote desktop enables troubleshooting, managing, and monitoring the remote computers.
To access the remote desktop:

1. Select Start > Programs > Accessories > Communications > Remote Desktop Connection. The Remote Desktop Connection window appears.

2. Click Options. The General tab appears.

The General tab enables to connect to the desktop of the remote computer by entering appropriate computer name. The window also enables to modify the size of the remote desktop, select the local resources that you want to access when you connect to the remote desktop. It also allows you to select the program that you want to start on connecting the remote desktop. You can also select the option to reconnect in case of disconnection. The different options available in the General tab are:
> Save As - Enables to save the current settings to access the remote desktop.

> Open - Enables to open the saved settings in order to access the remote desktop

3. Select the computer name from the Computer drop-down list box.

4. Enter the appropriate information.

5. Click Connect. The desktop of the remote computer appears.

configuring server to enable Remote Desktop for administration

In large networks where servers are remotely located, it is a difficult task for the administrator to manage the remote servers by physically being present at the remote locations. Windows Server 2003 provides the Remote Desktop for Administration service for remote server management. The service uses Remote Desktop Protocol (RDP) to provide access to the server’s desktop from a remote computer. The services, such as file sharing and management of users and groups also use RDP.
Using Remote Desktop, you can perform most of the administrative tasks on the remote computer, such as, configuring the settings of computer. Additionally, you can troubleshoot any problems occurring at the remote computer. To perform the administrative task on the remote computer you need to configure the server to enable the remote desktop for administration.

Remote Desktop provides the following tools for administration:

> Remote Desktop Connection - Enables you to establish connection to a single remote server for performing administrative tasks on the server. Each new connection opens in a window. Executing multiple copies of this tool can connect multiple servers. A navigable tree helps you to switch betweenthe connections.

> Remote Desktops snap-in - Enables you to establish connections to multiple remote servers simultaneously. Each new connection is displayed in the MMC console. On connecting to a server, the tool opens a default console session to the computer specified in the connection.

To configure server to enable remote desktop for administration:

1. Right-click My Computer. A shortcut menu appears.

2. Select Properties. The System Properties dialog box appears.

3. Click Remote tab. The Remote tab appears,

4. Select Allow users to connect remotely to your computer. The Remote Sessions message box appears,

5. Click OK to return to Remote tab.

6. Click Apply.

7. Click OK.

Working with computer management console

Windows Server 2003 provides the Computer Management console, which contains the set of administrative tools to manage local and remote computers. The Computer Management console combines the administrativetools in a single console, which provides an easy access to these administrative tools.’ It provides various system tools, such as Event Viewer, Device Manager, and Pertormance Log and Alerts. In addition, you can manage the shared folders in the network using the Shared Folders utility of Computer Management Console.
Computer Management Console provides various tools to manage the data storage of the computers, such as Disk Defragmenter to defragment the disks and Disk Management to manage the disks in the network. Only members of the Administrators group have an access to all of the services provided by the Computer Management console.

To access the remote computer, using the Computer Management console:

1. Select Start > Programs > Administrative Tools > Computer Management. The Computer Management window appears.

2. Right-click Computer Management (Local). A shortcut menu appears.

3. Select Connect to another computer. The Select Computer dialog box appears,

4. Click Another computer option.

5. Enter the computer name in the Another computer text box.

6. Click OK. The left pane of the Computer Management window displays the administrative tools of the selected computer.
The Computer Management window enables to access remote computer. After accessing the remote computer, you can perform the required task.

Microsoft Management Console

Windows Server 2003 provides the Microsoft Management console that enables you to access the administrative tools. These tools help you to manage computers, networks, services, and other system components. In addition, MMC enables you to create and save customized consoles that can include frequently used tools. MMC contains all snap-ins, which are the tools that can be added into the MMC.
For example, as a system administrator, you need to manage the remote computer, using the Computer Management console. For this, you need to create a console containing the Computer Management snap-in and save it as a console to your computer. You must use the MMC to create this console.

To create a console for a remote computer using MMC:

1. Select Start > Run. The Run dialog box appears.

2. Enter mmc.

3. Click OK. The Consolel window appears.

4. Select File > Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears.

The options available in the Add/Remove Snap-in dialog box are:

> Snap-ins added to- Displays the location where the snap-in is added

> Description - Displays the information about the item that you have added to the console >

> Add - Enables to add an item in the console, which you have selected in the Snap-ins added to option

> Remove - Enables to remove an item that is present in the console

> About - Displays additional information about the item that you have added to the console

5. Click Add. The Add Standalone Snap-in dialog box appears.
The Add Standalone Snap-in dialog box enables you to add the required snap-in to the console. You can view the information about the item that you select from the Snap-in list.

6. Select Computer Management from the snap-in list.

7. Click Add. The Computer Management dialog box appears.

8. Click Another computer option.

9. Enter the computer name in the Another computer text box.

10. Click Finish. The computer name is added to the console list.

11. Click Close.

12. Click OK.

13. Save the Consolel window as Console.msc file.

Run as acommand

Remote desktop in Windows Server 2003 enables to remotely login to a particular machine and work on that machine. This feature enables the administrator to access and monitor the tasks of the remote user. For example, if the administrator wants to shut down a remote computer running Windows Server 2003, which is located on the 40th floor of the organization and the administrator is seating on the ground floor. This task can be easily performed by using remote desktop utility. Windows Server 2003 provides multiple commands and tools to administer a remote server, they are:

> Run As command

> Microsoft Management Console (MMC)

> Computer Management Console

Identifying the tools to administrator a remote server

Remote desktop in Windows Server 2003 enables to remotely login to a particular machine and work on that machine. This feature enables the administrator to access and monitor the tasks of the remote user. For example, if the administrator wants to shut down a remote computer running Windows Server 2003, which is located on the 40th floor of the organization and the administrator is seating on the ground floor. This task can be easily performed by using remote desktop utility. Windows Server 2003 provides multiple commands and tools to administer a remote server, they are:

> Run As command

> Microsoft Management Console (MMC)

> Computer Management Console

REMOTE DESKTOP

The administrator needs to manage and monitor the remote computers, in order to know the performance of the computers. Windows Server 2003 enables an administrator to administer the remote computers using different tools, such as, Run As, Microsoft Management Console (MMC), and Computer Management Console.
Administrator can access the desktop of the remote machine. You need to configure the remote server to enable remote desktop for administration. Windows Server 2003 also provides remote assistance. Remote assistance enables you to get help from an expert remotely.

Using WMI Event Logging Provider

Windows Management Instrumentation (WMI) is use to set up standards for creating, reading, and modifying management information. The functionality of WMI is similar to a database. The WMI database known as the repository stores information about different components, such as, devices, services, and application. The WMI providers pass the information to the WMI Object Manager that enters the information in the repository.

The WMI providers provide description about the operating system. The administrator can view the information about network configuration, processes that are running, installed services, hardware, and software. You can access the information stored in the WMI repository with the help of management tools, Application Programming Interfaces, scripting tools, or command line using Windows Management Interface Command-line (WMIC). WMIuses Common Information Model (CIM). Objects that are present in the management environment are described by the CIM.

WMIC is an easy command line interface that enables to work with WMI. Computers running on different versions of Microsoft windows can be managed with the help of WMIC. To manage and monitor remote computers with the help of WMIC, WMI needs to be on the local computer that you want to monitor and WMIC can be available remotely.

WMIC enables to perform the following task:

> Local management of a computer - Enables to manage the local computer. You can use WMIC on the local computer to manage that computer.Remote management of a computer - Enables to manage remote computer. You can use WMIC on one computer to manage another computer. > Remote management of multiple computers - Enables to manage multiple remote computers. You can use WMIC on one computer to manage multiple remote computers with a single command.

> Administrative scripting - Enables to manage local, remote, or multiple computers by writing management script with the help of WMIC.

To access the information from the WMI you need to use queries in WMIC. WMI query is known as aliases. Aliases enables to access information that administrator would require for managing and monitoring different computers.

Aliases perform certain task and these tasks can be issued using certain verbs along with the alias. The most useful verbs that can be used with the alias are:

> CALL - Executes the specified methods. For example, to start a particular service enter, service call startservice. It will execute the command to start the service.

> GET - Displays the values of a particular property.

> LIST - Displays all the values for a given alias.

> LIST BRIEF - Displays only the important information about the alias.The output of the WMIC command can be redirected to CSV file, text file, or HTML page. Redirecting the output enables you to analyze the information in much better format.

To view the information about the processes whose processlD is greater than 300 using WMIC:

1. Select Start 4 Programs 4 Accessories 4 Command Prompt. The Command Prompt window appears.

2. Enter WMIC and press enter.

3. Enter process where 'process iD>300' list brief and press enter. The list of all processes whose ID>300 appears.

The Command Prompt - wmic window displays all the processes whose ID is greater than 300.

Using Task Manager

Task Manager enables us to view the information about programs and processes that are running on your computer. If a particular program stops responding then you can view the status of the program and end that program with the help of Task Manager.

To view the Task Manager:

1. Press Ctrl + Alt + Delete. The Windows Security dialog box appears.

2. Click Task Manager. The Windows Task Manager dialog box appears

The Windows Task Manager displays the total number of processes that are running, percentage usage of CPU, and memory allocated to the programs and system. You can view the status of all the programs running on the computer. The different options available in the Windows Task Manager dialog box are:

> End Task - Enables to end the program that is running. You can also end the program that is not responding.

> Switch To - Enables to switch to another program.

> New Task - Enables to start a new program. New task opens Create New Task dialog box that enables to select a program that you want to start.

3. Click the Processes tab. The Processes tab appears.

The Processes tab displays information about all the processes that are running on your computer. It displays all user applications, services, and other system processes including executable. It also displays information about Image name of the processes that are running, user name, CPU usage, and Memory usage.

4. Select View > Select Columns. The Select Columns dialog box appears.
The Select Columns dialog box enables to select the required column names that you want to display in the Processes tab.

5. Select the required column names.

6. Click OK. The selected columns are displayed in the processes tab.

7. Click the Performance tab. The Performance tab appears.

The information displayed on the Performance tab is:

> Cpu Usage - Displays the percentage of time the processors are working in the graph format. The graph shows high percentage if your computer is running slowly.

> CPU Usage History - Displays how busy the computer is over the time in the graphical format. You can change the update speed of the graph by clicking Update Speed from the View menu.

> PF Usage - Displays the paging file used by the computer in Megabytes. Paging files are reserved disk space that backs up committed physical memory on the computer.

> Page File Usage History - Displays the paging file used over the time in the graphical format. The information displayed depends on the option you have selected from the Update speed under the View Menu.

8. Click the Networking tab. The Networking tab appears,

The Networking tab displays information about the network performance in the graphical format. The information displayed on the Networking tab is:

> Adapter Name - Displays the name of the network adapter that connects your computer to a network

> Network Utilizations - Displays the percentage of the network utilization based on the initial connection speed for the interface

> Link Speed - Displays the connection speed of the interface

> State - Displays the status of the network

9. Click the Users tab. The Users tab appears.

The Users tab displays information of all the users who are logged on. It displays the local users as well as the remote users.

The different options available on the Users tab are:

> Disconnect - Enables you to disconnect the user who is connected to your computer.

> Logoff - Enables you to logoff the user who is logged in over the network.

> Send Message- Enables to send the message to a remote user. To send a message you need to select the user and click Send Message.

10. Close the Windows Task Manager dialog box.

Using Performance Console

Monitoring system performance enables you to maintain and administer your operating system. You can monitor the system performance over the network with the help of the performance console. Monitoring the system helps you in understanding the effect of the workload on your system resources. It also helps in identifying problem areas and accordingly the administrator can make appropriate changes to improve the performance of the system.

The Window Server 2003 provides with the following tools as part of the performance console:

> System Monitor - Enables you to monitor and measure the performance of your computer or network computers. It enables you to collect and view the real time performance data of the remote computers. It also stores information about the usage of the hardware resources and activities of the system services on computers you are administering.

> Performance Logs and Alerts - Enables you to collect the performance data automatically from local or remote computers. Data collected in the Performance logs and alerts can be easily imported tospreadsheet program as they are collected in comma separated or tab separated format. Performance log is divided into as follows:

• Logs: Displays information, which the application, services or operating system generates. There are two types of logs, counter and trace. Counter logs displays the information about the hardware usage and activities of the system services of local and remote computer. Trace logs displays information about the activities, such as, disk input/output activity. This information helps to know the performance of the system.

• Alerts: Displays information about the logs when the counter value rises or falls below the specified limit.

To monitor the performance of the computer you can add a counter. You can view the required system information by adding counter.

To monitor the performance of a computer:

1. Select Start > Control Panel > Administrative Tools > Performance. The Performance console appears.

The System Monitor details pane displays the performance of the selected computer. The details of the graph are displayed below the graph. The details table displays the real-time data about memory usage in terms of pages/sec, physical disk usage in terms of average disk queue length and percentage processor time.

2. Right-click the System monitor. A shortcut menu appears.

3. Select Add Counters. The Add Counters dialog box appears.

The options available in the Add Counters dialog box are:

> Use local computer counter - Enables you to view the performance of the local computer.

> Select counter from computer - Enables you to select computer to view the performance.

> Performance object - Enables you to select performance object.Performance object represents the collection of the counters that are associated with a resources or service that can be monitored. Counter refers to data reporting item.

> All Counters - Enables you to select all the counters.

> Select Counters from the list - Enables to select the required counter.

> All instances - Displays all the instances of the counter. Instances refer to one or more occurrences of a counter.

> Select instances from the list - Enables to select the required instances. The Total displays the selected instance. It represents the combined data from the multiple instances of a counter when multiple instances are available. A '0' is displayed in the text box when there is only one instance of the counter. It will display ‘1 when there two processes on the system.

> Add - Enables you to add the counter to view the performance.

> Explain - Explains the counter that you have selected.

4. Select Select Counter from the list option and select the counter from the drop-down list.

5. Select the required object from the Performance object drop-down list.

6. Select the required counters from the Select the counters from the list drop-down list.

7. Select All instances check box to display all the counter instances that are available when system monitor is in use.

8. Click Add. The Performance console appears with the selected counter.

Using Event Viewer

Event viewer enables tj administrator to gather information about hardware and software problems. The event logs are file that contains information about the events that you want to monitor. The administrator can view and set login options for event logs.
Windows Server 2003 records three types of logs in the event viewer:

> Application log - Contains information about events logged by the application or programs. The application developer decides events that are logged in the application log. For example, if an application generates any error then that information will be stored in the application log.

> Security log - Contains information about the security related events that you have specified in the audit policy. It contains event log for valid and invalid logon attempts, creating, opening, and deleting files or folder. For example, if you configure the audit policy to monitor all unsuccessful attempts made by a user to delete a particular file, then the security log will contain information about all the unsuccessful attempts made by the user to delete that file.

> System log - Contains information about events logged by Windows Server 2003 system component. The server predetermines the events that are logged in the system log. For example, at the time of installing some software, if there is any driver failure or if there is any abnormal shutdown then the information about all these events will be stored in the system log.

A computer that is running Windows Server 2003 operating system and is configured as a domain controller records two additional events:

> Directory Service log - Contains information about the events that are logged by the Windows Active Directory directory service. For example, connection problem between the servers are recorded in the directory service log.

> File Replication Service log - Contains information about events logged by Windows File Replication Service. The events logged are related to the copying of information between Domain Controller during a replication cycle. For example, the events that occur while updating the domain controller with the information about system volume changes are stored in the file replication log.

A computer running Windows Server 2003 operating system and configured as a Domain Name System (DNS) server records one additional event, which is Domain Name System log. It contains information about error or important events reported by the DNS server.

To view the application log in the Event Viewer:

1. Select Start > Control Panel > Administrative Tools > Event Viewer. The Event Viewer console appears. The Event Viewer displays different logs. We can select the required log to view the events under that log.

2. In the console tree, click Application. The list of individual application events appears in the details pane,
The Application log displays all the events related to application. The different types of event log displayed are:

> Information - Specifies the successful operation of an application

> Error - Contains information about an event, which specifies the failure operation of an application

> Warning - Provides an alert message, which may not be important now but might indicate the future problem

3. Double-click the required event to view more details about the event from the detail pane. The Event Properties dialog box appears.

The Event Properties dialog box displays the details about the selected event.

4. Click OK.

Monitoring Performance

The administrator needs to monitor and manage the system to know the performance of the system. Periodical monitoring of the resources enables to identify the problems in the hardware and software. Accordingly, the administrator can take appropriate steps to solve the problem and improve the performance of the system. Windows Server 2003 provides you with the tools, such as, the Event Viewer, Performance Console, Task Manager, and WMI Event Logging Provider to monitor the performance of the system.

Managing Terminal Services

In a network infrastructure, the administrator may find it difficult to monitor users and session on each server of the network. For this, the administrator needs the information of the user sessions on the remote server. Windows Server 2003 provides the Terminal Services Manager for this purpose.
The Terminal Services Manager helps you in viewing the administrative information of the Remote Desktop Sessions on the server. The Terminal Services Manager can also be used to send messages to the users of all the remote computers.

To send messages to a remote computer:

1. Select Start 4 Programs 4 Administrative Tools 4 Terminal Services Manager. The Terminal Services Manager message box appears.

2. Click OK. The All Listed Servers - Terminal Services Manager console appears.

3. In the console tree, click the required Connections under All Listed Servers

4. Select Action > Connect to Computer. The Connect to Computer dialog box appears.

5. Enter the name of the computer to which you want to send the message in Type the name of the computer to connect to text box.

6. Click OK.

7. Select Action > Send Message. The Send Message dialog box appears.

8. Enter the required message in the Message text box.

9. Click OK. The message is sent to the selected computer.

Configuring Terminal Services

You can configure the properties of a particular connection. Configuring the properties of a connection enables you to set login options. For example, if you want to assign different User name, Domain, and password for the users who can connect to the terminal server, you can configure the login settings. You can also configure the ability of the administrator to view the users session remotely.

To configure the Terminal services:

1. Select Start > Control Panel > AdmInistrative Tools > Terminal Services Configuration. The Terminal Services Configuration\Connections console appears.

2.In the console tree, click Connections.

3.Select Connections from the detail pane.

4. Select Action 3 Properties. The Properties dialog box appears. The Properties dialog box enables to select the level of encryption from the Encryption level. The default encryption level is Client Compatible, which mean any user can connect to the terminal server irrespective of the encryption capability.

The different options in the Properties dialog box are:

> Comment - Enables to enter the required comment

> Encryption - Enables to select the required encryption level. The different encryption levels are:
• High - Enables to encrypt the data that is sent from the server to client and client to server using 128 bit level of encryption
• Low - Enables to encrypt the data that is sent from the client to server using 56 bit level of encryption. Data is not encrypted when it is sent from the server to the client.
• FIPS Complaint - Enables to encrypt and decrypt the data sent from the client to the server and from server to client using Federal Information Processing Standard (FIPS) encryption

> Use standard Windows authentication - Enables to use the standard windows authentication when you have install another authentication package on the server.
If the user is not capable of the encryption mode that you have selected, then the user will not be able to connect to the terminal server.

5. Select the appropriate Encryption level from the drop-down list box.

6. Click Logon Settings tab. The Logon Settings tab appears.

The Logon Settings tab enables to configure the login settings for the terminal. The different options are:

> Use client-provided logon information - Enables to use the login information provided by the user to connect to the terminal server

> Always use the following logon information - Enables to assign different User name, Domain, and password for the users who can connect to the terminal server by selecting this option

> Always prompt for password - Enables to specify to prompt a user for password, always before logging to the server.

7. Select the appropriate option to set the login settings.

8. Click Sessions tab. The Sessions tab appears. Session tab enables you to configure the settings that determine the behavior of a user session that has been active, ideal, or disconnected. The different options available are:

> Override user settings - Enables to set the time out session for a connection. You can specify when to end the disconnected session. It enables to set the time limit for active and idle session.

> Override user settings when session limit is reached or connection is broken - Enables to select to disconnect or end session when limit that you have set is reached or if the connection is broken.

> Allow reconnection - Enables to set the reconnection option. You can select to connect the user as any client or can connect as the client that was disconnected.

9. Select the appropriate options.

10. Click Environment tab. The Environment tab appears.

The Environment tab enables you to set the initial program. You can configure to start a particular program when the user logs in. The options available are:

> Override settings from user profile and Remote Desktop connection - Enables to override the settings of a user profile.

> Start the following program when the user logs on - Enables to execute a program when the user logs on. The options available are:

• Program path and file name: Enables to enter the name and path of the program that you want to execute.

• Start in: Enables to specify the mode in which you want to start the program

11. Select the appropriate option if you want to set the initial program for the server.

12. Click Remote Control tab. The Remote Control tab appears.

Remote Control tab enables to configure the server to set remote control, which means the ability of the administrator to view the user’s session remotely. Remote control allows the administrator to view and interact with the sessions of the user. You can also configure the remote control that requires the user permission to view the session.

13. Select the appropriate option to set remote control.

14. Click Client Settings tab. The Client Settings tab appears. Client settings tab enables to configure client settings and color depth. You can also disable the required mapping settings. Audio mapping is disabled by default.
15. Select the required option.

16. Click Network Adapter tab. The Network Adapter tab appears. Network Adapter tab enables to select the network adapter and the number of concurrent connections to the terminal server.

17. Select the required network adapter from the Network Adapter drop-down list box.

18. Select appropriate option to set connections.

19. Click Permissions tab. The Permissions tab appears. Permissions tab enables to assign permission for different users. You can assign or deny full control to a particular user. An error message will appear if a particular user who does not have sufficient permission to access the terminal server tries to access the terminal server.

20. Select a user from the Group or user name box and assign the appropriate access.

21. Click OK.

Installing Terminal Servers

To use the terminal services you need to install terminal servers.To install Terminal Server:

1. Select Start > Control Panel. > Add/Remove Programs. The Windows Components screen appears.

2. Select Terminal Server. The Configuration Warning dialog box appears.

3. Click Yes to return to Windows Component screen.

4. Select Terminal Server Licensing.

5. Click Next. The Terminal Server setup screen appears.

6. Click Next. The Select Default Permissions screen appears.

7. Select Full Security.

8. Click Next. The Terminal Server Licensing Setup screen appears.

9. Select the required option for which you want to make this server available.

10. Click Browse and select the location where you want to install the server database.

11. Click Next. The Configuring Components screen appears.

12. Click Next after the set up is complete. The System Settings Change dialog box appears.

13. Click Yes to restart your machine.

Terminal Services

Terminal Services in Windows Server 2003 enables to share the application over the network. It allows the Administrator to control and manage a computer from their desk. For example, in an organization there are 30 computers and the administrator needs to manage and control the working of those computers. It is not possible for the administrator to go to the desk of each computer and manage them. In such a case, it becomes easy for the administrator to manage those computers from their desk using terminal services.

Working with Security Logs

Security logs contain information about security related events that you have specified in the audit policy. For example, if you configure the audit policy to monitor all the unsuccessful attempts made by a user to delete a particular file, then the security log will contain information about all the unsuccessful attempts made by the user to delete that file.

To view security logs:

1. Select Start > Programs > Administrative Tools > Event Viewer. The Event Viewer console appears.

2. In the console tree, click Security. The list of individual security events appears in the details pane, The Security console displays the list of security events that are logged. It logs all the events that you have specif led in the audit policy.

3. Double-click a particular event to view more details about that event from the detail pane. The Event Properties dialog box appears. The Event Properties dialog box displays the details about the selected event.

4. Click OK to return to Event Viewer console.

5. Select View > Filter. The Filter tab appears, Filter tab enables you to view selected events from all the events stored in the security log based on their Event ID, User name, and Computer name. You can also enter the start and end date when the events were generated to display more selected events.

6. Select appropriate Event source and Category from the drop-down list box.

7. Enter the appropriate event id in the Event ID text box.

8. Enter the appropriate user name in the User text box.

9. Enter the appropriate computer name in the Computer text box.

10. Click OK. The selected events appear in the security detail pane.

Enabling Auditing

Auditing is not enabled when you configure the auditing entries of a file or a folder. You enable auditing through audit policy. After enabling auditing, the system looks after the audit settings.

To enable auditing:

1. Select Start > Programs > AdmInistrative Tools > ActIve Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Right-click the Domain. A shortcut menu appears.

3. Select Properties. The Properties dialog box appears.

4. Click the Group Policy tab. The Group Policy tab appears.

The different options available in the Group Policy tab are:

> New - Enables to create a new group policy

> Add - Displays the Add a Group Policy Object Link dialog box that enables to add the required group policy

> Edit- Displays the Group Policy and enables to edit the selected policyOptions - Displays the Default Domain Policy Options and enables to select the required option

> Delete - Enables to delete the selected domain policy> Properties - Displays the Properties dialog of the selected domain policy

> Block Policy inheritance - Enables to prevent the inheritance of policy to the linked domain

5. Select Default Domain Policy.

6. Click Edit. The Group Policy Object Editor window appears.

7. Expand Computer Configuration.

8. Expand Windows Settings.

9. Expand Security Settings.

10. Expand Local Policies.

11. Click Audit Policy. A list of Audit Policies appears in the detail pane.

12. Double-click Audit Object Access from the detail pane. The Audit object access Properties dialog box appears

13. Select Define these policy settings.

14. Select Success option to audit all successful attempts.

15. Select Failure option to audit all unsuccessful attempts.

16. Click OK.

Configuring Auditing

You can configure the audit settings and specify the task you want to monitor. For example, if you want to monitor the deletion of important files by unauthorized users, then you can configure the audit settings. This will keep track of the attempts made by any user to delete that file.
To configure auditing policy settings for local file or folder:

1. Select Start > Programs > AccessorIes > Windows Explorer. The My Documents window appears.

2. Right-click the file or folder you want to audit. A shortcut menu appears.

3. Select Properties. The Properties dialog box appears.

4.Click Security tab. The Security tab appears, The Security tab enables to assign the permission for the selected users. You can assign full access to a file or selected permissions to a file.

5. Click Advanced. The Advanced Security Settings dialog box appears.

6. Click Auditing tab. The Auditing tab appears.

The options available in the Auditing tab are as follows:

> Add - Enables to set up auditing for a new user or group

> Edit - Enables to view or modify auditing for an existing user or group

> Remove - Enables to remove auditing for an existing user or group

7. Click Add. The Select User, Computer, or Group dialog box appears.

The options available in the Select User, Computer, or Group dialog box are:

> Locations - Enables to select the required location.

> Object Types - Enables to select the required type of object, such as, users, Groups, and Computers.

> Enter the object name to select - Enables to enter the name of the object. The examples link displays the format in which you can enter the name of the object.

> Check Names - Specifies the correct name of the object that you have entered in the Enter the object name to select text box.

> Advanced- Enables to select the advanced options to search the object.

8. Click Object Types. The Object Types dialog box appears.

9. Select the required object type.

10. Click OK to return to Select User, Computer, or Group dialog box.

11. Enter the object name in the Enter the object name to select text box.

12. Click OK. The Auditing Entry dialog box appears.

The different options available in the Auditing Entry dialog box are:

> Change - Enables to select different username for which you want to assign access.

> Apply onto - Enables to specify where the object is audited

> Clear All - Clears all the selected access permission.

>Apply these auditing entries to objects and/or containers within this container only - Enables to specify whether to apply the auditing to the selection in the Apply onto and all applicable child object

> Access - Displays various types of access permissions. The two options for the access

permissions are:

• Successful - Audits all successful attempts for the required access type

• Failed - Audits all unsuccessful attempts for the required access type

13. Select the required Access to audit successful or unsuccessful attempts.

14. Click OK. The added auditing entry appears.

15. Click OK.

Auditing

Auditing refers to a process used by operating system to detect and record security related events, such as, an attempt made by the user to create, access, or delete files or folders. The records of such attempt are entered in a file called as Security log.

AUDITING AND TERMINAL SERVICES

Auditing helps the administrator to keep track of certain task performed by the users. You can configure the audit settings in the audit policy as per your requirement. Security related events that you have configured are stored in a separate Security logs file. Terminal Services in Windows Server 2003 enables to share the application over the network. It allows the Administrator to control and manage a computer from their desk.

Logon and Logoff Scripts

When the user logs on to the domain you can specify to run programs or open last used network drives. You can execute such tasks using scripts. You can assign log on scripts to execute tasks when the user logs on to the domain. You can also use లోగోఫ్ఫ్ scripts to execute tasks when the user logs off from the domain.

To Assign Logon Scripts:

1. Open Group Policy Object Editor console. The Group Policy Object Editor Console appears.

2. Expand Windows Settings under User Configuration.

3. Click Scripts (Logon/Logoff). Windows Server 2003 lists the Logon and Logoff Scripts.

4. Double-click Logon. The Logon Properties dialog box appears.

The different options on the Logon Properties dialog box are:

> Up - Moves the script above the selected script

> Down - Move the script below the selected script

> Add - Creates a new logon script

> Edit - Modifies the logon script

> Remove - Deletes the logon script

> Show Files - Displays the scripts

5. Click Add. The Add a Script dialog box appears.

The different options on the Add a Script dialog box are:

> Script Name - Specifies a name for the script

> Browse - Displays the Netlogon folder to add scripts

> Script Parameters - Specifies the conditions for the script

6. Enter the name for the script in the Script Name text box.

7. Enter the parameters for the script in the Script Parameters text box.

8. Click OK to close the Add a Script dialog box.

9. Click Apply.

When the user logons on to the domain on the network, Windows Server 2003 executes the script and displays the appropriate results. Similarly, you can add a logoff script for a user on the domain.

To add a logoff script:

1. Open Group Policy Object Editor Console. The Group Policy Object Editor Console appears.

2. Expand Windows Settings under User Configuration.

3. Click Scripts (LogonlLogoff). Windows Server 2003 lists the Logon and Logoff Scripts.

4. Double-click Log off. The Log off Properties dialog box appears.

5.Click Add. The Add a Script dialog box appears.

6.Enter the name for the script in the Script Name text box.

7.Enter the parameters for the script in the Script Parameters text box.

8.Click OK to close the Add a Script dialog box.

9.Click Apply.

Adding a Computer to the Domain

The computer must be a member of the domain for the domain controller to monitor and control the client computer. The client becomes a member of the domain when you attach the computer to the domain. When you add the computer to the domain, Windows Server 2003 creates a computer account under Domain Computers in Active Directory Users and Computers. You can attach multiple client computers, such as, computers running Window 2000 and Windows XP to the domain.

To add a Windows 2000 computer to the domain:

1. Select Start > Settings > Control Panel. The Control Panel window appears.

2. Double-click System. The System Properties dialog box appears.

3. Click the Network Identification tab. The Network Identification tab appears.

4. Click Properties. The Identification Changes dialog box appears.

5. Select the Domain option.

6. Enter the name of the domain in the Domain text box.

7. Click OK. The Domain User name and Password dialog box appears.

8. Enter the user name in the Name text box.

9. Enter the password in the Password text box.

10. Click OK. Windows attaches the computer to the domain and displays a message box.

To attach a Windows XP computer to the domain:

1. Open the System Properties dialog box. The System Properties dialog box appears.

2. Click the Computer Name tab. The Computer Name tab appears.

3. Click Change. The Computer Name Changes dialog box appears.

4. Select the Domain option.

5. Enter the domain name in the Domain text box.

6. Click OK. Windows XP prompts for the user name and password.

7. Enter the user name and password.

8. Click OK. Windows XP attaches the computer to the domain and displays a message box.

Troubleshooting Logons

Users access the network resources, using a domain user account. You can secure the user accounts to prevent misuse of the accounts. The computer must be a member of Domain computers group on the domain to ensure access to domain resources. You must add the computer to the domain to make the computer a member of the Domain Computers group.

Dleting Domain Groups

Consider a scenario, where an organization is under the process of restructuring. The organization has decided to eliminate the Purchase department. You as the system administrator of the organization have been assigned the task of deleting the Purchase group from the domain.

To delete the Purchase Group:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Users. The list of groups appears.

3. Select Purchases.

4. Select Action > Delete. The Confirmation message box appears.

5. Click Yes. Windows Server 2003 deletes the Purchases group.

Moving Domain Groups

You can move groups in the domain to secure access to the domain. When you move groups, the groups are granted permissions according to the location. For example, as a system administrator, you are asked to mo Sales group to another object in the domain.

To move the Sales group:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of groups appears.

3. Select Sales.

4. Select Action > Move. The Move dialog box appears.

5. Select the location to move Sales account, for example, Built in.

6. Click OK. Windows Server 2003 moves the Sales group under Built in.

Assing User Rights to Groups

Windows Server 2003 enables you to specify permissions to groups in the form of user rights. The domain controller security settings console enables you to assign rights to users and groups on the domain. For example, you can restrict the user or users in a group to logon to the domain controller from the domain controller machine.You can use the deny logon locally rights to enable and disable logon locally rights to users and groups.

To deny Logon locally rights to groups:

1. Select Start > Programs > Administrative Tools > Domain Controller Security Policy. The Default Domain Controller Security Settings console appears.

2. Expand Local Policies.

3. Click User Rights Assignment. The Default User Rights appears.

4. Select Deny log on locally.

5. Select Action > Properties. The Deny log on locally Properties dialog box appears.


The different options available on the Deny log on Locally Properties dialog box are:

> Define this policy setting - Enables the setting to deny logon locally

> Add User or Group - Includes the user or group to deny logon locally

6. Click Add User or Group. The Add User or Group dialog box appears.

7. Click Browse. The Select Users, Computers or Groups dialog box appears,

8. Enter the group name in the Enter the object names to select text area.

9. Click OK. Windows Server 2003 adds the group to the Deny log on Locally Properties.

10. Click Apply.

11. Click OK.

12. Click OK to close the Logon Workstations dialog box.

13. Click Apply in the Account tab of Steve Martins Properties dialog box.

Adding a Member to a Group

Consider a scenario where, you are the system administrator of the company. A user Steve Martins has to be allowed only limited rights on the domain. You must add Steve Martins to the Domain Guests group to restrict permissions to Steve Martins.

To add Steve Martins to the domain guests group:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Users. The list of groups appears.

3. Select Domain Guests.

4. Select Action > Properties. The Domain User Properties dialog box appears.

The options available in the Domain Guests Properties dialog box are:

> Group name(pre-Windows 2000) - Specifies the name that clients using earlier versions of Windows 2000 use to identify the group

> Description - Provides an explanation about the group

> E-mail - Specifies the email address for the group

> Group scope - Specifies the scope of the group

> Group type - Specifies the type for the group

> Notes - Specifies additional information for the group

5. Click the Members tab. The Members tab appears.

6. Click Add. The Select Users, Contacts, or Computers dialog box appears.

7.Enter the domain user name, Steve Martins, in the Enter the object names to select text area.

8.Click OK. Windows Server 2003 adds the user to the group.

9. Click Apply. Windows Server 2003 saves the changes.

10. Click OK.

Managing Domain Groups

You can create groups to mange permissions for a set of users. You can also change the scope of the group. In addition, you can also change the group type. You can secure the domain by adding members to groups. You can manage the groups on the domain by executing tasks, such as adding a member to a group, modifying the group type and scope, assigning user rights to groups, and deleting a group.

Creating a domain group

Windows Server 2003 enables you to assign permissions to users on the domain by creating groups. You can create groups and add users to the group. After adding the users to the group, you can assign permissions to the group. The group permissions are applied to all the users in the group.

To create a domain group:

1. Select All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Built in. The list of groups appears.

3. Select Action > New > Group. The New Object - Group dialog box appears.

The different options on the New Object - Group dialog box are:

> Group name - Specifies the name for the group

> Group name (pre-Windows 2000) - Specifies the group name for computers using a version earlier than Windows 2000

> Group type - Enables to select the group type. Windows Server 2003 supports two types of groups. They are:

• Security: Assigns permissions for Active Directory objects and user rights. In addition to Active Directory objects, security groups also assign permissions for resources on the network.

• Distribution: Enables you to send e-mail to all the users using a single email address. The distribution type of group creates e-mail distribution list in MS-Exchange Server.

> Group scope - Determines the extent to which the permissions are applied to users and groups in the domain. Windows Server 2003 supports universal scope, they are:

• Universal Scope - Assigns permissions to all the objects in the domain under the forest. The universal group can contain user accounts, computer accounts. It also contains global and universal groups from other domains in the forest. You can create groups with universal scope
only when the functionality level of the domain is set to Windows 2000 native and Windows Server 2003.

• Global Scope - Determines that the group can assign permissions to all the objects in the domain under the same forest. A global group can contain only user accounts and global groups of the same domain. You can change a global group to a universal group if the global group is not a member of other global groups in the domain.

• Domain Local Scope - Implies that the group can assign permissions to objects in the same domain only. The domain local groups can contain user and computer accounts from the same domain. It can also contain user and computer accounts from other domains in the same forest. You can convert a domain local group to a universal group if the group does not contain other domain local groups as members.

4. Enter the group name, Sales, in Group name text box.

5. Select the group scope, for example, Domain local.

6. Select the group type, for example, Security.

7. Click OK. Windows Server 2003 creates the domain group and adds it to the Active Directory Users and Computers.

Default Domain Groups

The Active Directory service in Windows Server 2003 configures the Windows Server 2003 computer as a domain controller. The Active Directory service creates default groups to configure and manage the domain. The default groups are created under built in and the users container in the Active Directory Users and Computers console. In addition, the Active Directory service also creates default domain groups under Active Directory Users and Computers console. You can move the groups, under Users container, from one location to another.

Domain Groups under Built in container
You cannot move the groups, under built ins, from one location to another. The default domain groups under built ins container are:

> Administrators - Enables complete and unrestricted access to the domain controller. The members of the Administrator group can manage users in the domain. The administrators can add, delete, and move users and groups in the domain. The Domain Admins and the Enterprise Admins are the members of the Administrators group.

> Operators - Enables to administer domain user accounts and groups. The members of this group own the permissions to log on locally to the domain controller and shut down the domain controller. However, they are restricted from modifying the administrators and Domain Admins group.

> Backup Operators - Enables to perform backup and restoring files and folders on the domain. The members of this group override the deny permissions of other groups for the backup and restore process. The members of this group also possess the rights to log on locally to the domain and shut down the domain.

> Guests - Assigns very restricted rights to the members. The members of this group have read only access on the domain and network resources. The members in the guests group are further restricted access to critical system areas, such as, % System Root % drive and the system properties.

> Network Configuration Operators - Enables users to modify the network configuration, such as TCP/ IP settings on the domain. The members of this group are assigned administrative privileges to modify the network settings.

> Print Operators - Enables users to manage printing operations on the domain controller in the domain. The printing operations include tasks, such as, installing and configuring, and sharing printers. The members of this group can log on locally and shut down the domain controller.

> Remote Desktop Operators - Enables users to remotely access the domain controller. By default user are not permitted to access the domain controller from a remote location. The members of the remote desktop operators group override the permissions to remotely access the domain controller.

> Server Operators - Enables to execute administrative tasks on the domain controller. The administrative functions include tasks, such as, creating shares and managing services. The server operators can also shut down the domain controller on a domain. However, the server operators do not possess the administrative privileges on the domain.

> Users - Enables the users of the group to execute common tasks on the domain, such as running applications, using printers and network shares. The users are restricted from making changes to the
system configuration on the domain controller.

> Incoming Forest Trust Builders - Enables to create one-way trust relationships between domain,controllers in the domain.

> Replicator - Enables the users of the group to execute replication tasks, such as file and folder replication on the domain controller.

Domain Groups under Users Container

In addition to the built ins container, Windows Server 2003 also provides default groups under Users in the Active Directory Users and Computers console. They are:

> Domain Admins - Enables complete access to the domain controller on the domain. This group is a member of the Administrators group by default.

> Domain Computers - Contains all the clients and servers attached to the domain controller in the domain. The computer becomes a member of the Domain Computers group when you attach a computer to the domain.

> Domain Controllers - Contains all the domain controllers in the domain. A domain can contain more than one domain controller. All the domain controllers in the domain are added to the domain controller group by default.

> Domain Users - Contains all the domain users on the domain. All the domain users in the domain are added to the domain users group by default.

> Enterprise Admins - Enables complete and unrestricted access over the domain controller in the domain. The Enterprise Admins group is a member of the administrators group by default.

> Schema Admins - Enables the members of the group to modify the schema. The Active Directory on a domain controller consists of a schema. The schema contains configuration information about the
Active Directory service. The members of the Schema Admins group possess the rights to modify the schema of the Active Directory on the domain.

> Cert Publishers - Possess permissions to issue digital certificates for Users and Computers. There are no default users in the Cert Publishers group.

> Group Policy Creator Owners - Determines the security level for the group. Members of the Group Policy Creator Owners possess the permissions to create and modify the group policy for any object in
the domain controller on the domain.

> Domain Guests - Contains all the guests accounts in the domain. Every domain has a guest account.The domain guests group contains user accounts of the domain guests. All the domain guests in the domain are added to the domain guests group by default.

> RAS and lAS Servers - Possess permissions to access the remote properties of the domain controller in a domain.

Domain groups

The user account stores information about the user. The user information includes the user name, password, and the logon name. The user account validates the user when the user logs on to a Windows Server 2003 domain. The user account verifies the user name and password of the user and enables access to the network resources. You can create domain groups in Windows Server 2003 to simplify the managing users on a domain. When you add users to the group, 9ou can assign permissions to all the users in the group. A group can contain user accounts, computer accounts, and users. The group scope and group type determine the objects in a group.

WORKING WITH DOMAIN GROUPS

Windows Server 2003 enables you to create domain groups and add domain users to these groups. A domain group contains user accounts that enable users to access the domain resources. You can ad domain user accounts to domain groups to ensure security. Windows Server 2003 creates a computer account when you add the computer to a domain. You can add users to domain groups to restrict access to the domain. When you add a user to a group, the user is assigned permissions of the group.

Password Policies

You can protect user accounts on a domain by applying password policies to the domain user accounts. You can ensure that the users do not use the.same password by applying password history options. The age for a password determines the validity of the password. You can secure the password by implementing maximum and minimum ages for the password. The default age of a password in Windows Server 2003 is 42 days. You can also set a length for the password using the minimum password length feature. In addition, you can secure passwords by enabling complexity requirements for passwords and storing passwords using reversible encryption methods.

The default password policies in Windows Server 2003 are:

> Enforce password history - Specifies the number of passwords the user can reuse before creating a new password

> Maximum password age - Specifies the time for expiry of the password. Windows Server 2003 prompts the user to change the password when the password expires.

> Minimum password age - Species the time for which the user can use a password

> Minimum password length - Specifies the number of characters the password must contain

> Password must meet complexity requirements - Specifies that the password must meet the complexity requirements

> Store passwords using reversible encryption - Specifies to store passwords

To view default password policies:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears.

To set password history options:

1. Open Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under SecurIty Settings.

5. Click Password Policy. The Password Policy appears

6. Double-click Enforce password history. The Enforce password history Properties dialog box appears.

7. Select the Define this policy settIng check box.

8. Enter the value in the passwords remembered spin box.

9. Click Apply.

10. Click OK.

To set the Maximum age for passwords:

1. Open Group police Object Editor console. The Group Policy Object Editor console appears

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears.

6. Double-click Maximum password age. The Maximum password age Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the days spin box.

9. Click Apply.

10. Click OK.

To set the Minimum Age for passwords:

1. Open Group Policy Object Editor console. The Group Policy Object Editor console appears

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears.

6. Double-click Minimum password age. The Minimum password age Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the days spin box.

9. Click Apply.

10. Click OK.

To set minimum length for the password:

1. Open Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Password Policy. The Password Policy appears

6. Double-click Minimum password length. The Minimum password length Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the characters spin box.

9. Click Apply.

10. Click OK.

Account Policies

Account policies enable the system administrator to control the user accounts. Using an account policy, the administrator can:

> Set the account lockout duration - Specifies the time after which the account will be locked

> Set the account lockout threshold - Specifies the number of invalid attempts to login to the domain

>Reset the account lockout count - Specifies to restart the account lockout count

To view account policies:

1. Open Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Select the domain controller name.

3. Select Action -> Properties. The Properties dialog box appears.

4. Click the Group Policy tab. The Group Policy tab appears.

5. Select the Default Domain Policy.

6. Click Edit. The Group Policy Object Editor console appears.

7. Expand Windows Settings under Computer Configuration.

8. Expand Security Settings under Windows Settings.

9. Expand Account Policies under Security Settings.

10. Click Account Lockout Policy. The Account Lockout Policy appears.

The different account policies that appear in the Account Lockout Policy are:

> Account lockout duration - Specifies the time after which the account is locked out

> Account lockout threshold - Specifies the number of incorrect attempts, the user can make, before the account is locked

> Reset account lockout count after - Specifies to enable default settings for the account lockout policy.

To set Account Lockout Duration:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Account Lockout Policy. The Account Lockout Policy appears.

6. Double-click Account lockout duration. The Account lockout duration Properties dialog box appears.

7. Select the Define this policy setting check box. The minutes spin box is enabled.

8. Enter the time in the minutes spin box.

9. Click Apply.

10. Click OK.

To set Account Lockout Threshold:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Account Lockout Policy. The Account Lockout Policy appears.

6. Double-click Account lockout threshold. The Account lockout threshold Properties dialog box appears.

7. Select the Define this policy setting check box.

8. Enter the value in the invalid logon attempts spin box.

9. Click Apply.

10. Click OK.

To reset the Account Lockout Count:

1. Open the Group Policy Object Editor console. The Group Policy Object Editor console appears.

2. Expand Windows Settings under Computer Configuration.

3. Expand Security Settings under Windows Settings.

4. Expand Account Policies under Security Settings.

5. Click Account Lockout Policy. The Account Lockout Policy appears.

6. Double-click Reset account lockout count after. The Reset account lockout count after Properties dialog box appears.

7. Select the Define this policy setting check box. The minutes spin box is enabled.

8. Enter the time in the minutes spin box.

9. Click Apply.

10. Click OK.

Securing Domain User Accounts

Users access the network resources, using a domain user account. There are chances that other users can misuse the user account. You can secure the user accounts prevent misuse of the accounts. The user account can be tampered by deleting important files and hacking account passwords.

You can secure the user accounts to solve these problems. You can implement account policies to prevent consecutive attempts to access the domain using incorrect passwords. In addition, you can control password hacking by implementing password polices.

Disabling and Enabling ComDuter Accounts

Consider a scenario, where an employee of a company is on a holiday. You do not want other users to access the network using the employee’s computer. You can disable the account so that other users cannot access the network using the employees account. After the employee returns from the holiday, you can permit access to the employee’s account by enabling the computer account.

To disable a Computer Account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select the computer account to disable.

4. Select Action -> Disable Account. The Active Directory Confirmation message box appears.

5. Click Yes. The Object Disabled message box appears.

6. Click OK. Windows Server 2003 disables the computer account and displays a red cross symbol against the account.

Reset Computer Accounts

You reset the computer account to fix the errors the account. Windows Server 2003 restores the computer account to default settings when you reset the account.

To reset the computer account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select the computer to reset.

4. Select Action -> Reset Account. The Confirmation message box appears.

5. Click Yes. The Active Directory message box appears.

6. Click OK. Windows Server 2003 resets the computer account.

Move Computer Accounts

You can move computers to different objects in the domain. A computer account is assigned permissions when you move the computer account to another location. You can move a computer account anywhere in the domain. You must possess administrative rights to move computer accounts. In addition, you can move computer accounts across domains. You must move computer accounts in the domain to restrict permissions and ensure security. You can use the Move tree tool to move computer accounts across domains.

To move a Computer Account:

1. Open Active Directory Users and Computers console. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select the computer to move.

4. Select Action -> Move. The Move dialog box appears.

5. Select the object to move the computer account.

6. Click OK. Windows Server 2003 moves the computer account to the specified object.

Adding Computer Account to Groups

The computer account on a domain enables the domain to communicate with the client computer. You can restrict access to the computer accounts by adding them to groups. The computer becomes a member of the group when you add a computer to the group. The group permissions are assigned to the computer when the computer becomes a member of the group. You can restrict the computer in a domain by adding the computer to groups and assigning permissions to groups. For example, if a group is denied permission to a network resource and the computer is a member of the group, the computer is denied access to the resource.

To add computer account to a group:

1. Open Active Directory Users and computers console. The Active
Directory Users and Computers console appears.

2. Click computers. The list of computers appears.

3. Select a computer.

4. Select Action 4 Properties. The Properties dialog box appears.

5. Click the Member of tab. The Member of tab appears.

6. Click Add. The Select Groups dialog box appears.

7. Enter the group name in the Enter the object names to select text area.

8. Click OK. Windows Server 2003 adds the Computer-1 account to the group.

Create Computer Account

You can create computer accounts to enable network computers communicate with the domain. Windows Server 2003 creates a computer account when you add the computer to the domain.

To create a computer account:

1. Select Start > All Programs > Administrative Tools > Active Directory Users and Computers. The Active Directory Users and Computers console appears.

2. Click Computers. The list of computers appears.

3. Select Action > New > Computer. The New Object - Computer dialog box appears.

The different options on the New Object-Computer dialog box are:

> Computer name - Specifies a name for a Windows 2000 computer account

> Computer name (pre-Windows 2000) - Specifies a name for a computer running versions earlier than Windows 2000

> User or group - Specifies the group the computer will belong to

> Assign this computer account as a pre-windows 2000 computer - Specifies to create a

> Assign this computer account as a backup domain computer - Specifies to create a backup domain controller for the computer account.

4. Enter the name for the computer in the Computer name text box, for example, Computer-1.

5. Click Next. The Managed dialog box appears.

6. Click Next. The Summary screen appears.

7. Click Finish. Windows Server 2003 creates the Computer-1 account and lists it under Computers.