|
|
|
|
HOME | ADD A TUTORIAL | NEW TUTORIALS | TOP RATED | POPULAR | |
|
|
|||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
| |
|
Tutorial Quick Links: Requirements Upgrade paths Installation Backup and Recovery File System Fault Tolerance NTFS Permissions Optimization and Tuning Network Connections Remote Access Terminal Services INSTALLATION REQUIREMENTS Windows 2000 Server will run on Intel and Alpha platforms and requires the following: Windows 2000 Server:
UPGRADE PATHS Listed below are important upgrade paths that you will need to know:
INSTALLING As in NT 4.0, there are 2 installation options. You can use WINNT.EXE or WINNT32.EXE depending on your situation. Winnt.exe is used for a clean installation on a computer running DOS or Windows 3.x and can use the following installation switches:
Use Winnt32.exe for a clean installation or upgrade on an NT 4.0 server. This is the option that most of you will be using. There are a number of switches that can be used with winn32.exe. Below are a couple of the important ones:
Windows 2000 supports unattended installations, of course. Setup Manager is used to create unattended setup files which will work with Windows 2000 Professional and server, but not for a domain controller. Windows 2000 includes a new utility called SysPrep.exe, which an installation "image" that can be duplicated using imaging software while avoiding problems with duplicated SIDS, computer names etc. For the most part you will find Windows 2000 installation is very similar to NT 4.0. which is why the following instructions are going to be fairly brief. The installation is so easy that you probably won't even need this guide. If you have a computer that will boot from the CD, then this is probably the way to go, otherwise you will be creating 4 setup disks using the makeboot.exe utility on the installation CDROM. Just like the NT 4.0 installation, we will start with the text based portion of the setup. You will be presented with an option to press enter to install Windows 2000. You can also press r to repair a damaged installation or F3 to abort the installation. After you press enter you will read the license agreement and press F8 to accept. You will now be presented with a list of all of the disks and partitions that are on the system. Like NT 4 installation, you will have the option to create a new partition or select an existing one to install onto. Press C and you will arrive at the option to select NTFS, FAT or leave it the way it is. Files will be copied to your disk. After a reboot, the GUI based portion of setup will begin. As you can see the installation follows the same format as NT 4.0. Windows 2000 is Plug and Play. The first portion of the GUI setup will detect your hardware and install drivers for it. Next you will have the option to select the locale for the computer. Then you will enter your name and orginization followed by the license key. After you click next you will be prompted for the licensing mode and will have the option of per seat or per server. Make sure you choose the option that will accomodate the environment that you will be using the server in. Next, you will enter the computer's name and an Administrative password(don't lose this). Now you will see a list of services that you can choose to install. This will obviously vary depending on which services you will need to use on your network. Now you will be prompted to enter the date and time zone. The services that you selected in the previous step will now be installed. Now you will have the option to select whether you want typical network settings or want to specify custom settings. The typical option would be using DHCP. Select the "custom" option if you wish to specify IP parameters and/or add other protocols. After this, you will be prompted to add the server or create a new workgroup or domain. If you are adding the server to an existing domain, you will need to have an account established. Now the install will finish and the machine will be rebooted. The installation is finished. By default, all Win2K servers are installed as Standalone Member Servers. DCPROMO.EXE is the Active Directory Installation Wizard and is used to promote a non-domain controller to a DC and vice versa. BACKUP AND RECOVERY Recovery Console: Now that you have installed Windows 2000, you should immediately take steps to protect your installation by installing the Recovery Console. Recovery Console is similar to the emergency repair disk in NT 4.0, but with many functionality enhancements. Recovery Console will allow you to You can start and stop services, read and write data on a local drive (including drives formatted with the NTFS file system), copy data from a floppy disk or CD, format drives, fix the boot sector or master boot record, and perform other administrative tasks. With Windows NT 4.0, many administrators would create a FAT partition that would allow them to boot to a DOS prompt. The recovery console eliminates the need to create a FAT partition for this purpose. Recovery Console is set up as follows: Insert the installation CD and switch to the I386 directory. Type C:\>winnt32 /cmdcons. When asked for confirmation, answer "yes". The file will be copied to the hard disk. After rebooting the computer you will be able to select "Microsoft Windows 2000 Command Console" and start Windows 2000 in command mode. You will be prompted for a Windows 2000 installation that you wish to repair and will be prompted for the Adminstrator password. Once you are in, there is a wide variety of commands that you will be able to perform. Type HELP for a list of all of the commands. Some of the more important commands are:
The Backup program has been greatly enhanced in order to support Active Directory and a much wider variety of backup media including removable disks, network drives, logical drives and tape devices are now supported. Another nice feature is that an integrated scheduling option has been added which relieves the need to use AT or other scheduling utility. Other: Windows 2000 has several other utilities to aid in the event of a failure, many of which are included in "Advanced Options" which are accessed by pressing F8 at the boot menu. In order to troubleshoot failures, it is a good idea to understand the boot process which occurs in the following steps:
When working with the boot.ini file, you need to understand ARC naming conventions. ARC is an architecture-independant way of naming drives for x86, risc, alpha, etc. NT uses this convention in its boot.ini file to determine which disk holds the OS. The table below will explain the different options.
Below are the various recovery tools included in Windows 2000. FILE SYSTEM Disk systems now support FAT32, NTFS, and FAT. The convert.exe utility can be used to convert a FAT or FAT32 partition to NTFS. NTFS partitions cannot be converted to FAT or FAT32. If such a need exists, the partition must be deleted and recreated as FAT or FAT32. The NTFS file system has many new capabilities as follows: The Distributed File System has also been enhanced. There are two types of DFS implementations: Stand-alone and Fault Tolerant. Stand-alone DFS stores the configuration information on a single node (server). Child nodes can only go one level below root, and can exist on any server. Fault Tolerant DFS stores the DFS configuration information in Active Directory. There can be two identical shares on different servers configured as a single child node to provide fault tolerance. You can have multiple levels of child volumes and file replication is supported. Clients must have DFS software installed. Windows NT4, Windows 2000 and Windows 98 include this software while Windows 95 clients must download the appropriate DFS client software from Microsoft.com Windows 2000 features a new storage type is called "dynamic disks". Dynamic disks' advantages include an unlimited number of volumes created per disk. NTFS Volumes can be extended and we can now include space from different disks. Perhaps the most important item is that the disk configuration is stored on the disk itself. This means that we can move disks between computers (within reason) and have the data available with little additional effort. If you perform an upgrade from NT4, or do a fresh install the disk type is still "Basic", but can be converted to dynamic. If you had RAID of any type set up on the NT4 server that was upgraded, you can continue to maintain those configurations with basic disks. However, if you want to add a new array or mirror set, you will be required to convert to dynamic disks. In a fresh install you will also need to convert before implementing any mirroring or RAID configurations. Once you have converted to dynamic disks, there is no reverse conversion. You must delete and start again. FAULT TOLERANCE In order to understand how fault tolerance works it is first best to understand the following concepts regarding hard disk configurations.
NTFS PERMISSIONS File and Directory Permissions: NTFS permissions are largely the same. The following tables will break down each of the permissions types. The following table displays the different permissions for files.
The following table displays the different permissions for directories.
The Read & Execute and List Folder Contents folder permissions appear to be exaclty the same, however, they are inherited differently, thus are different permissions. Files can inherit the Read & Execute permissions but can't inherit the List Folder Contents permission. Folders can inherit both.
Files moved from an NTFS partition to a FAT partition do not retain their attributes or security descriptors, but will retain their long filenames. As with NT 4.0, Windows 2000 also supports special access permissions which are made by combining other permissions. The following tables will show special access permissions and how the recipe to make them.
Remember that file permissions override the permissions of its parent folder. Anytime a new file is created, the file will inherit permissions from the target folder. Share Permissions: Shares are administered through the MMC, My Computer or through Explorer and permissions can be set on a share in the "Share Permissions" tab. Share level permissions only apply when a file or folder is being accessed via the network and do not apply to a user logged into the machine locally. The following are the different share-level permissions:
These permissions are identical to NT 4.0, however, there is one new change. As we discussed above the Deny permission can also be applied to shares. The Deny permission overrides all others. When folders on FAT and FAT32 volumes are shared, only the share level permissions apply as these systems do not support file and directory permissions. When folders on NTFS volumes are shared, the effective permission of the user will be the most restrictive of the two. This means that if Bob is trying to access a file called mystuff located on myshare and he has share permissions of read and file permissions of full control, his effective permissions would be read. Conversely, if his share permissions are full control and his file permissions are read, he will still only have read permissions to mystuff OPTIMIZATION AND TUNING Performance Monitor is included in Windows 2000 and is an MMC snap-in. Just as in NT 4.0, there are performance counters that can be used to determine the source of performance problems. The following is a list of important counters and suggested thresholds. Processor: Memory: Physical Disk: Logical Disk: Network: Windows 2000 Performance Monitor has several different logging methods. Many 3rd party performance applications utilize the Trace log feature. Counter logs allow you to log performance values at a designated interval for local or remote Win2K computers. Alert logs can send a message or run a script/program when a pre-determined threshold has been surpassed. Performance Monitor now offers more flexibility for exporting data as it can now be saved in HTML, binary, binary circular, .csv, and .tsv. NETWORK CONNECTIONS Windows 2000 supports many industry standard protocols including: Like Windows 98, Windows 2000 supports a new feature called Automatic Private IP Addressing. When "Obtain An IP Address Automatically" is enabled, but the client cannot obtain an IP address from a DHCP server, Automatic Private IP addressing assigns an address in the form of 169.254.x.x and a class B subnet mask of (255.255.0.0). The computer broadcasts this address to its local subnet and if no other computer responds to the address, the computer allocates this address to itself. Remember that a computer that picks up one of these addresses will only be able to communicate with other computers have compatible addresses and subnet masks. RAS Policies are a new feature in Windows 2000. Now it is possible to build an entire set of rules called a RAS Policy to dictate several conditions that must exist before a user can connect. It allows the flexibility to require that a user must be dialing from a specific IP address or from a range of addresses, during the right time of day, from the appropriate caller id location using the appropriate protocol. We can restrict access by group membership or the type of service requested. All of these are configurable and optional. Once the user has met all of the conditions, we can apply a profile, which can include items such as the IP address to use for this session, the authentication type that is allowed, any restrictions such as idle time and the rules for BAP with multilink sessions. Windows 2000 now provides support for VPNs. A virtual private network (VPN) is the extension of a private network that encompasses links across shared or public networks like the Internet. With a VPN, you can create a connection between two computers across a shared or public network that emulates a point-to-point private link. Windows 2000 supports a couple of different VPN protocols. Point to Point Tunneling Protocol(PPTP) creates an encrypted "tunnel" through an untrusted network and is supported by Windows 95/98/NT4/2000. Layer Two Tunneling Protocol(L2TP) works like PPTP in that it creates a "tunnel", but uses IPSec encryption in order to support non-IP protocols and authentication. The table below illustrates the features of each:
Windows 98 supported Internet Connections Sharing(ICS) which is now also supported in Windows 2000. ICS allows multiple PCs to share a single connection with the aid of Network Address Translation(NAT) and is intended for small office/home office(SOHO) environments. You should not use this feature on a computer running DNS server, DHCP server or a Windows 2000 Domain Controller. When you enable ICS, the network adapter connected to the network is given a new static IP address configuration. Existing TCP/IP connections on the computer are lost and need to be re-established. NAT can be configured separately from ICS and provides the following features and benifits that are do not exist when used with ICS alone: REMOTE ACCESS RAS has changed rather dramatically. Several new RAS protocols are now available to make our communications over dial up lines or the Internet much more secure and more flexible. These new protocols include Extensible Authentication Protocol (EAP), Layer Two Tunneling Protocol (L2TP), Bandwidth Allocation Protocol (BAP), Internet Protocol Security (IPSec) and Remote Authentication Dial-In User Service (RADIUS). EAP gives the ability to use Transport Level Security, another encryption methodology for usernames and passwords. L2TP enables to create a tunnel through a public network that is authenticated on both ends, uses header compression, and relies on IPSec for encryption of data passed through the tunnel. Bandwidth Allocation Protocol allows to set up Multilink capabilities, but if a user isn’t using the bandwidth of multiple lines, we can drop one of the lines assigned to that user and use it for another user. IPSec is essentially a driver at the IP layer that provides encryption very low down in the protocol stack. RADIUS is an RFC based standard that allows us to provide authentication services from the corporate network to a client that is attaching to an ISP that wants access to our server. The ISP’s dial up server that hosts the client is a client to the Radius Server Service (IAS) on the corporate network. The IAS server allows the user to connect. TERMINAL SERVICES Terminal Services are now a core function built in to every version of Windows 2000 from Server and above. There have also been some enhancements to the old "Windows NT 4.0 Terminal Server Edition" including the ability to "Shadow" or "remote control" client systems. Terminal Services is installed through the "add/remove programs" applet. Once you've done this and installed the Client software (also provided), the workstation connects to the server and starts a virtual session on the server. Only screen, keyboard, and mouse information is exchanged between the client and server making it an ideal solution for remote dial up networking - or using a shared application on a single server. RDP (Remote Desktop Protocol) is the client-to-server protocol that supports this functionality. The client doesn't need to be an extremely capable system in that the execution of the program happens at the server. There are clients available for Windows 3.1, Windows 95/98, and NT. Applications that can run on Terminal Services are many, but the preferred applications are Windows 32 bit programs because they can be tailored to use memory more efficiently. Don't undersize the server for this program. Add at least 8MB of RAM per user that you're going to support to the Terminal Services server. Microsoft states that a quad processor Pentium Pro with 512MB of RAM will concurrently support about 60 typical users. Each client must have a Client access license for Terminal Server and one for NT server (two licenses per client). After installing Terminal Services, you should re-install any applications on the server that you would like clients to use while connected to Terminal Services. When you "add/remove" programs, the system changes into a "program installation" mode that enables all users access to the application while attached. You can accomplish the same by issuing a "change user" command at the command prompt and performing the installation from there. Some programs require an application compatibility script to be run in the terminal services environment. Microsoft supplies such a script for Office 2000 in the Office 2000 Resource Kit. |
|
|
| |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||
|
Advertise | Contact Us | About Us | | Disclaimer | Privacy Policy | |
|
||
|
Sponsored Links | |
MCSE Boot Camp, Cisco Training Classes, CISSP, A+ Certification, MCSD - Nationwide IT Showcase |
||
Resources