Windows NT uses domains (groups of servers that share a single security database) as the basic unit of security. Windows 2000 expands this system with Active Directory. In older Windows NT networks, servers could be assigned one of three roles:

Windows 2000 still follows this basic system, with one exception: rather than PDCs and BDCs, all Windows 2000 domain controllers act as peers. Any domain controller can be used for authentication, and any controller can be used to make changes to the Active Directory database.

Although Windows 2000 domain controllers act as peers in most respects, certain operations require one server to act as an operations master. There are five separate roles held by operations masters, which may be one server or several different servers:

Windows 2000 servers that will be used to share files and printers may require additional consideration in your security design. NTFS security and printer security should be configured to allow access to groups, and users should be assigned to those groups to allow them access.

Often, a Windows 2000 Server is dedicated to a specific application: for example, a database server. The security considerations for these servers depend on the application. Some applications, such as database servers, may have their own security systems separate from that of Windows 2000.

RAS (Remote Access Service) allows users to access Windows 2000 networks by dialing in to modems. RAS requires its own security considerations. RAS security can be configured in two ways:

Another consideration is the type of authentication used by RAS. The available authentication methods are discussed later in this chapter.

Desktop computers are basic network clients and typically use such operating systems as Windows 95/98/Me or Windows 2000 Professional. You typically control the security of these computers’ activity on the network by managing the user accounts used to log on to the network.

Your security design should specify these settings, as well as basic security measures -- for example, training users to store data in a secure area of the network rather than on a local hard disk.

Portable computers are treated similarly to desktop computers, but introduce additional risks: for example, they can easily be lost or stolen, allowing unauthorized access to their disks and potentially to the network. Your security design should include a plan to deal with these risks.

Kiosks are application-specific computers or terminals. These may include special-purpose machines (such as point-of-sale terminals) as well as ordinary computers that are made available for public use running an application. These should be carefully secured by using a user account with the bare minimum of privileges needed, because they may be open to the public.

The most basic form of authentication uses clear-text (plain ASCII text) passwords transmitted across the network. This is the least secure method: because passwords are transmitted across the network as text, they are vulnerable to snooping.

Clear-text authentication is not used by any critical Windows 2000 services, but it may be required for certain applications. These include the following:

Windows 9x computers use the LM (LAN Manger) authentication protocol for user authentication. Windows NT and Windows 2000 use a more secure authentication protocol called NTLM . Windows NT and 2000 have to support the older, less secure LM protocol to be compatible with Windows 9x computers. There are a few important differences between LM and NTLM:

Windows 2000 introduces Kerberos authentication, a new system that can be used instead of NTLM if both clients and servers are running Windows 2000 and are configured to use Kerberos. Kerberos is based on RFC 1510. When a client attempts to log on to the network in this system, the following process occurs:

Digest authentication is an alternate means of authenticating users accessing resources on Internet Information Server (IIS). Normally, users trying to access protected files on IIS must have a user account on either IIS itself or another server that IIS has a trust relationship with.

There are many security issues both with the standard Windows authentication and with digest authentication. Neither IIS nor Windows (any version) has a reputation of having impenetrable security, so you’ll usually have to balance security, convenience, and interoperability when designing a networking solution. There are pros and cons to both types of IIS authentication:

There are a few things to check to make sure that the domain controller and user accounts are set up to work with digest authentication:

Users won’t be able to use digest authentication until they have changed their passwords. Digest authentication can be set up with Windows 2000 and IIS 5.0 by using the following steps:

Smart cards are credit card-sized devices with enough storage to contain numerous encryption and authentication keys, as well as encrypted data. For example, the encryption key used to store EFS files can actually be stored on the smart card, so that files cannot be decrypted without it. Smart cards are meant to address some of the inherent security limitations of the traditional username/password, but there are also drawbacks. The physical card and a personal identification number (PIN) are used together for identification, just as the username and password are used together. Table 33-1 addresses some of the advantages of smart cards.

Smart cards don’t have to be deployed as the only means of authentication on a network. You can use smart cards for only those resources that require additional security and continue to use usernames and passwords in other areas.

The first thing you should do before proceeding in implementing a smart card authentication system is map out which resources would be more secure in a smart card environment. After you determine where they will be used and who will use them, you can figure out how much equipment you need to buy.

Once you have the physical equipment (the smart cards and the smart card readers), you can get started with converting some or all computers to require smart card authentication. There a few steps you’ll need to do in order to get the system up and running:

The RADIUS client-server authentication protocol is commonly used by Internet Service Providers to authenticate incoming connections. RADIUS is an acronym for Remote Authentication Dial-In User Service and is often used in conjunction with other authentication protocols, such as Point-to-Point Protocol (PPP).

As with Kerberos, Microsoft has its own implementation of RADIUS that differs slightly from the standard. The most significant difference is that the Microsoft version, called Internet Authentication Service (IAS), uses Active Directory to authenticate users.

You won’t need to memorize each step of the authentication process for the exam, but you should be familiar with the basic process that happens during authentication. Following is a list of the steps involved with IAS authentication on a Windows 2000 RAS server:

A few options will cause this list of steps to vary. If at any time the RAS server doesn’t receive a response from the IAS server, the RAS server will automatically try to connect to a backup IAS server. Also, the RAS server will attempt to connect the user with the most secure protocol possible. Its first choice is Extensible Authentication Protocol (EAP), which can be used with smart cards and certificates, MS-CHAP, CHAP, and PAP.

Certificates are documents that include identification and a public key used for encryption. These provide a more secure method of authentication than basic authentication methods, such as Kerberos. Certificates are discussed further in the next section of this chapter.

SSL (Secure Sockets Layer) is an encrypted protocol used to access secure web documents. IIS supports SSL with compatible browsers. SSL uses public-key encryption, using certificates granted by a certificate authority.

Despite Microsoft’s positioning of Windows 2000 as the answer to all networking questions, many networks still include non-Windows systems. Your security design should include policies for these systems. The following are third-party systems supported by Windows 2000:

A certificate authority verifies the identity of users and issues certificates using a key-based system. Windows 2000 comes with Certificate Services, which can be used for issuing certificates. It’s also used to help manage EFS encryption and smart card authentication. The use of certificate services allows you to become your own certificate authority. Assuming you’re logged with an administrator account, you can install certificate services by performing the following steps:

Most large organizations will need more than one server to handle all the certificate traffic. Certificate authority servers are arranged in a trust hierarchy, with a root certificate authority being the master. Certificate Services allows the following CA server roles:

Certificates can be managed using the Microsoft Management Console (MMC). Some certificates will have a time limit and expire automatically; on occasion, a certificate may even have to be revoked. The CA server handles most of the certificate issuing and expiring by itself, and a certificate revocation list (CRL) is published periodically by the CA.

The easiest way to manage a large number of certificates is by creating policies and templates. You’ll need to create a public key policy to allow computers to automatically receive certificates from a CA. You can do this by using the following steps:

Figure 33-1. The Group Policy dialog

Follow those steps for all the computers you want to authorize. If you ever need to check to see if a certificate was processed, you can look at all the pending certificate requests in the certification authority snap-in of the MMC. There is a pending requests folder that lists all the requests that have not been processed yet. If a requested certificate isn’t in the pending folder, it should be in either the issued or revoked folder, both of which are located in the same place as the pending folder.

Outside users or groups of users, connecting from another domain or another Active Directory, can be authenticated with the use of certificates, but the outside certificate must be linked to an actual user account in the local Active Directory. This mapping is required to allow Windows 2000 to employ its native user management security while also having the additional security of a certificate issued by a trusted CA.

There a few different ways to map certificates, depending on how many people you want to authorize and the level of monitoring required. Table 33-2 lists the different certificate mapping options.

Some companies need to have a very high level of security, and some companies don’t have the personnel needed to manage the certificate process efficiently. If you don’t have the resources or time to securely manage certificates, you can hire an outside organization to handle your certificates. In any case, you can outsource the CA process.

Although Windows 2000 can work with outside certificate authorities, many of the tools and options are unavailable when you use an outside certificate authority. One example is that computer certificates cannot be automatically granted or renewed. Another is that smart card certificates must be issued from a CA within its own Active Directory.

If an outside company is used as the certificate authority, you also risk that the company can go out of business or have a catastrophic security failure. Also, the reason you have certificates in the first place is to have a higher level of security. If your company’s business plan is dependent on keeping information private, keep in mind that with an outside certificate authority another company is potentially holding the keys to your network.