How to Tune up Windows Server 2008

[Akiraa]

Event Viewer

Sometime for Admin it needs not to monitor individual servers. You can use Event Viewer Event Viewer to connect to the monitored computer, and then it snap mode Connect to Another Computer (Connect to another computer). Information about detected events will be sent in real time.

Assigning multiple password policies : In the past, could only have one password policy for the domain - for example, one rule for the minimum password length, duration or complexity. In Server 2008 you can assign more or less stringent rules for different groups with any level of detail. For maximum flexibility, prepare a number of policies.

Avoid downtime : In case of cancellation of the domain controller you can use the domain controller locator to find the nearest controller and connect to it. However, by default, this feature is disabled. It can be activated by using the Group Policy TryNextClosestSite.

Switching to the closest domain controller : Use Group Policy to configure client computers to switch to the "Select next» (next closest) domain controller for the next (when the last back in operation after failure). Using Group Policy Server 2008, you can specify the time interval after which a client computer searches, checking that the connection is established with the local domain controller.

Tracking of elevated human : Only one person is always in need of administrative rights - the administrator. However, other users can elevate their privileges to perform

certain tasks. Watch for the actions of users, by activating a process audit (auditing process creation), section categories detailed tracking of security audits.

Restore master : Master > Initial Configuration Tasks appears on the screen when first entering the user, and then disappears. However, it is convenient for the development stages of these types of initial tasks, such as the naming server and the destination time zone. To restore "master", just type oobe in the Run (Run).

Common setting in IIS : In Server 2008, with the services of Internet Information Services 7.0 is a regime of export configuration with a Web-server to a file, which greatly simplifies the organization of server farms. Once the file is saved in the shared directory and all of the new server is given the general configuration file their adjustment will occur automatically. Full details about the installation can be found at learn.iis.net/page.aspx/211/shared-configuration.

Never configure PowerShell : This advice - directly from the PowerShell Team at Microsoft. As part of the initial assembly of PowerShell 1.0 is installed several XML-files.

You can prepare your own XML-files for personal use - it is quite acceptable. But many users are making changes to the files provided by the specialists of Microsoft. Do so not worth it, because after the next version of the program (which will be soon) the old files are deleted and replaced with new ones. And all your efforts are in vain. So save your settings in their own files and save yourself a nuisance in the future.

Installing a new backup utility : To install Windows Server Backup (instead of the slower and less convenient Ntbackup.exe), go to Start | Administrative Tools | Server Manager (Start | Administrative Tools | Server Manager) and click on Features, then Add a Feature. Add the Windows Server Backup.

[Akiraa]

The NetStat Command

Some administrators Windows Server use the netstat command on a regular basis, some - only for diagnostic purposes. I prefer to use this tool to identify the causes of system problems and malfunctions. For the netstat command provides ten parameters, provides detailed information for solving various problems. However, it is less useful information can be obtained without any parameters.

Most often used with a parameter netstat-a, to list all connections and listening ports. Here are some other options that may be useful when using this utility. A fully qualified domain name. The-f option allows you to find the FQDN for the external address. When using netstat with this parameter, names are resolved both in internal and external network.

Port Address of Process : The combination of parameters-a-n-o lets find out which process ID (PID) corresponds to a particular port. And if you add to this combination option-b, for each process will be used by friendly names.

netstat - Open Ports View : The netstat tool you can open other ports to query and view their status. Netstat-a in the command line to start the query.

AD restore deleted objects : To accidentally deleted AD accounts or groups to restore, Microsoft offers only the complicated and dangerous method of the authorized recovery. Much easier is a small tool from Mark Russinovich with (formerly Sysinternals)

net accounts - DC Check Account : Apart from the AD computer account, the DC from the command line are also examined. Use the command net accounts one can see the password policies. In the role of the computer security should be appropriate to the PDC emulator must be primary.

dcdiag - Check the Domain Controller : With this tool you can dcdiag.exe many functions of a DC's through, test and detect any errors quickly. To test run to start the multiple input ranges of the dcdiag from the command line.

AD service manually stop / start : In contrast to server 2003 it is now possible to stop the AD service or restart, this feature ersparrt reboot.
This feature can be found under the services of the domain controller

[Akiraa]

Windows Server 2008 Security Tips :

• To protect the network environment, use one or more of the available technologies Transport Layer Security.
• Since even the most reliable infrastructures are vulnerable places, it is advisable to create multiple levels of security for critical network data.
• It is strongly recommended not to install a local database on the server AD RMS RMS. It is better to use the full remote SQL Server.
• Pay very serious attention to securing the server root CA Certificate Services Active Directory, because breach in the security of this server compromise the whole chain of CA.
• Keep the root CA server in a physically locked position and turn it off if it is not currently needed - or take advantage of server virtualization Windows.
• Use technology to protect IPSec generated in the medium traffic and to protect servers and workstations in both cases, unsafe access to the Internet, and in configurations of private networks.

Windows Server 2008 Group Management Tips :

• Create groups based on administrative needs. When you create a group based on a function and someone else will play that role, you only need to change or add the group you need. No need to change the permissions granted to the user account. Many times it is advantageous to create a group that has only one member to change the permissions individually.
• Use local groups to provide access to resources on local computers when the computer is not a member of a domain.
• If you have multiple groups that can add user accounts, do it always the most restrictive. However, make sure you grant user rights and permissions correct for that users can perform its task.
• Provided you have a group that allows the user tasks that you need Use it instead of creating a new group. Create groups only when you have none that meets the needs of the user.
• Use the special identity 'authenticated users' instead of 'all' for the maximum grant permissions and user rights. By doing so you minimize the risk of unauthorized access, because Windows Server 2003 only valid user accounts added to that special identity.
• Limit the number of users in the Administrators group. The members of this group on a local computer have all the control. Binds only to a user when it has to perform administrative tasks only.