|
|
|
|
HOME | ADD A TUTORIAL | NEW TUTORIALS | TOP RATED | POPULAR | |
|
|
|||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
| |
|
Tutorial Quick Links: Installation Backup and Recovery File System Hardware Devices Permissions Printers Registry Optimization and Tuning User Environment Network Connections Remote Access Security Acronyms Installation The following are the installation requirements for a Windows 2000 Professional workstation:
The following table lists some of the common switches available for use with WINNT.EXE
Use Winnt32.exe for a clean installation or upgrade from Windows 9.x or NT Workstation. There are a number of switches that can be used with winn32.exe. Below are a couple of the important ones:
Windows 2000 Professional supports unattended installations. The /U switch is used for unattended installations and is followed by the location of the answer and installation files. Unattended installations can be done for clean installs as well as upgrades. Unattended installations can be fully automated. The default answer file that ships with Win2K is called unattend.txt and can be modified. Setup Manager can also create answer files. Windows 2000 comes with a variety of tools that can be helpful during installations. Understand the following concepts:
Recovery Console: Now that you have installed Windows 2000, you should immediately take steps to protect your installation by installing the Recovery Console. Recovery Console is similar to the emergency repair disk in NT 4.0, but with many functionality enhancements. Recovery Console will allow you to You can start and stop services, read and write data on a local drive (including drives formatted with the NTFS file system), copy data from a floppy disk or CD, format drives, fix the boot sector or master boot record, and perform other administrative tasks. With Windows NT 4.0, many administrators would create a FAT partition that would allow them to boot to a DOS prompt. The recovery console eliminates the need to create a FAT partition for this purpose. Recovery Console is set up as follows: Insert the installation CD and switch to the I386 directory. Type C:\>winnt32 /cmdcons. When asked for confirmation, answer "yes". The file will be copied to the hard disk. After rebooting the computer you will be able to select "Microsoft Windows 2000 Command Console" and start Windows 2000 in command mode. You will be prompted for a Windows 2000 installation that you wish to repair and will be prompted for the Adminstrator password. Once you are in, there is a wide variety of commands that you will be able to perform. Type HELP for a list of all of the commands. Some of the more important commands are:
The Backup program has been greatly enhanced in order to support Active Directory and a much wider variety of backup media including removable disks, network drives, logical drives and tape devices are now supported. Another nice feature is that an integrated scheduling option has been added which relieves the need to use AT or other scheduling utility. Other: Windows 2000 has several other utilities to aid in the event of a failure, many of which are included in "Advanced Options" which are accessed by pressing F8 at the boot menu. In order to troubleshoot failures, it is a good idea to understand the boot process which occurs in the following steps:
When working with the boot.ini file, you need to understand ARC naming conventions. ARC is an architecture-independant way of naming drives for x86, risc, alpha, etc. NT uses this convention in its boot.ini file to determine which disk holds the OS. The table below will explain the different options.
Below are the various recovery tools included in Windows 2000. File System Disk Manager is the old Disk Administrator and is a snap-in. It can be used to defragment, create, and manage volumes and disks. Disk systems now support FAT32, NTFS, and FAT. The convert.exe utility can be used to convert a FAT or FAT32 partition to NTFS. NTFS partitions cannot be converted to FAT or FAT32. If such a need exists, the partition must be deleted and recreated as FAT or FAT32. The NTFS file system has many new capabilities as follows: The Distributed File System has also been enhanced. There are two types of DFS implementations: Stand-alone and Fault Tolerant. Stand-alone DFS stores the configuration information on a single node (server). Child nodes can only go one level below root, and can exist on any server. Fault Tolerant DFS stores the DFS configuration information in Active Directory. There can be two identical shares on different servers configured as a single child node to provide fault tolerance. You can have multiple levels of child volumes and file replication is supported. Clients must have DFS software installed. Windows NT4, Windows 2000 and Windows 98 include this software while Windows 95 clients must download the appropriate DFS client software from Microsoft.com Windows 2000 features a new storage type is called "dynamic disks". Dynamic disks' advantages include an unlimited number of volumes created per disk. NTFS Volumes can be extended and we can now include space from different disks. Perhaps the most important item is that the disk configuration is stored on the disk itself. This means that we can move disks between computers (within reason) and have the data available with little additional effort. Dynamic volumes are not supported for Zip disks or laptops. Basic disks can be upgraded to dynamic disks without restarting the computer, but backward conversion causes all data to be lost. Simple volumes are created on dynamic disks and are made up of one physical disk. Spanned volumes combines many physical disks(up to 32), and are written to sequentially until all are full. Striped volumes are created from multiple disks(up to 32) and are written to concurrently. There are no fault tolerant disk configurations available in Windows 2000 Professional. Hardware Devices Plug and play is now supported in Windows 2000. Both APM and ACPI are supported for power management. Must be supported by computer's BIOS. ACPI is new, APM is legacy. Device Manager is still used for the usual activities: troubleshooting, updating drivers, etc. and still have the familiar red and yellow warnings. Changes to network adapters no longer require the computer be rebooted, and if they are plug and play, are automatically configured. NTFS Permissions File and Directory Permissions: NTFS permissions are largely the same. The following tables will break down each of the permissions types. The following table displays the different permissions for files.
The following table displays the different permissions for directories.
The Read & Execute and List Folder Contents folder permissions appear to be exaclty the same, however, they are inherited differently, thus are different permissions. Files can inherit the Read & Execute permissions but can't inherit the List Folder Contents permission. Folders can inherit both.
Files moved from an NTFS partition to a FAT partition do not retain their attributes or security descriptors, but will retain their long filenames. As with NT 4.0, Windows 2000 also supports special access permissions which are made by combining other permissions. The following tables will show special access permissions and how the recipe to make them.
Remember that file permissions override the permissions of its parent folder. Anytime a new file is created, the file will inherit permissions from the target folder. Share Permissions: Shares are administered through the MMC, My Computer or through Explorer and permissions can be set on a share in the "Share Permissions" tab. Share level permissions only apply when a file or folder is being accessed via the network and do not apply to a user logged into the machine locally. The following are the different share-level permissions:
These permissions are identical to NT 4.0, however, there is one new change. As we discussed above the Deny permission can also be applied to shares. The Deny permission overrides all others. When folders on FAT and FAT32 volumes are shared, only the share level permissions apply as these systems do not support file and directory permissions. When folders on NTFS volumes are shared, the effective permission of the user will be the most restrictive of the two. This means that if Bob is trying to access a file called mystuff located on myshare and he has share permissions of read and file permissions of full control, his effective permissions would be read. Conversely, if his share permissions are full control and his file permissions are read, he will still only have read permissions to mystuff When comparing either Share or NTFS permissions, the least restrictive always wins out. When comparing both Share and NTFS permissions, take the least restrictive of each category and then the more restrictive of those two. Printers A Printer is a physical piece of equipment (AKA print device), a logical printer is what the user sees on the screen of the local computer (AKA software), print processor, print router, and printer pools are all self-explanatory. Print spools hold documents until they are ready to be printed. Printers can be located in AD and can be found by querying the location of a printer that can staple, print on specific papers, or can be chosen by printer type to name a few. Windows 2000 Professional automatically downloads the drivers for clients running Windows 2000, Windows NT 4/3.51 and Windows 9x. Print Pooling allows jobs to be dispersed across more than one printer, making them behave as one. Printer pools must contain printers that use the same driver. If a printer experiences a jam in the middle of a job, you can select "resume" to continue where you left off. Registry
The registry editors included with Windows 2000 include Regedt32 and Regedit. Each registry editor has advantages and disadvantages. You can perform most tasks with either registry editor, but certain tasks are easier with one registry editor. The following are advantages of Regedt32:
Performance Monitor is included in Windows 2000 and is an MMC snap-in. Just as in NT 4.0, there are performance counters that can be used to determine the source of performance problems. The following is a list of important counters and suggested thresholds. Processor: Memory: Physical Disk: Logical Disk: Network: Windows 2000 Performance Monitor has several different logging methods. Many 3rd party performance applications utilize the Trace log feature. Counter logs allow you to log performance values at a designated interval for local or remote Win2K computers. Alert logs can send a message or run a script/program when a pre-determined threshold has been surpassed. Performance Monitor now offers more flexibility for exporting data as it can now be saved in HTML, binary, binary circular, .csv, and .tsv. Paging File A paging file(pagefile.sys) is responsible for managing virtual memory and stores data that is not resident in RAM. There is a lot of conflicting information on Microsoft's website regarding the recommended size of the paging file and we are not sure which is correct. Some references say that it should be 1.5x the amount of physical RAM and others say that it should be physical RAM +12mb as in NT 4.0. You can see the conflicting recommendations in the following support articles: http://support.microsoft.com/support/kb/articles/Q216/8/99.ASP http://support.microsoft.com/support/kb/articles/Q197/3/79.ASP http://support.microsoft.com/support/kb/articles/Q259/1/51.ASP What you will more likely see on the exam are questions that attempt to see if you understand situations in which the page file should be increased rather than memorizing recommended settings. One such situation is when SQL Server is employed. In this case it is recommended that the paging file be set to 1.5x the amount of physical RAM. http://www.microsoft.com/TechNet/sql/Technote/sql7prep.asp For better performance, the paging file should be distributed across multiple drives that do not contain system or boot files. Driver Signing Driver signing is the verification by MS that the drivers you are installing have been tested and will work. You can set limits on users for installing drivers by choosing Warn, Ignore or Block if the driver isn't signed properly. Use the System File Checker (SFC /scannow) to check the digital signatures of drivers on a computer. Other options include /quiet, /scanboot, /scanonce, /cancel, and others. User Environment Profiles User profiles are used to keep users' desktop settings and preferences available to them each time they log on. Roaming user profiles will keep this information on the network server so users can access their profile from any computer on the network. Ntuser.dat and Ntuser.man are the same as in NT 4.0 for creating mandatory profiles. Local profiles are stored in C:\Documents and Settings\username. Offline Files Offline files can be configured to allow users to cache network information normally stored on servers. The Synchronization Manager is used to manage those files once it is set up. Offline files are stored in the systemroot\CSC directory. Offline files supports 3 types of caching as follows: Localization There are 24 localized versions of Win2K. UNICODE is a character set that supports world-wide communications and has characters for French, Russian, and other foreign languages. RTL and API allow developers to create a single program for an application and allow these programs to be used correctly in other languages. Locales are localized language and customs settings and are listed below: Software Packages Software can be efficiently deployed, updated and removed using Group Policies and two technologies built into Windows 2000 - Windows Installer and Software Installation and Maintenance. Windows Installer will replace Setup.exe for many applications. Its advantages include the ability to build custom installations, enable programs to "repair" themselves if a critical file is missing or corrupt and to remove themselves very cleanly when necessary. Software Installation and Maintenance combines Group Policies and Active Directory technologies to enable an administrator to install, manage and remove software across the network. This is only available for Windows 2000 clients. When you deploy software, you can choose to assign it or publish it. Assigned software can be targeted at users or computers. If you assign an application to a USER, the icons show up on the desktop and/or start menu, but the program is only installed when the user runs it for the first time. If it is assigned to a COMPUTER, it's installed the next time the system is restarted. If you publish an application, the user can install it through Add/Remove Programs or through opening a file that requires that particular program(a file association). Published programs cannot self repair, cannot be published to computers and are not advertised on the users' desktop or start menu - only through add/remove programs. Assigned applications require a windows installer file(.msi) while published applications can use Windows Installer files or ZAP files. A .ZAP file is an administrator created text file that specifies the parameters of the program to be installed and the file extensions associated with it. Installations that utilize .ZAP files cannot self repair or install with higher privileges and will typically require user intervention to completely install. You can deploy upgrades using GPO's simply by specifying which program is to be upgraded and whether or not it is a mandatory upgrade. You can apply service packs or patches by "re-deploying" an existing Group Policy with the new information regarding the service pack. Fax Support Windows 2000 Professional ships with built-in fax support with a single user license. Faxing is managed via the Fax Service Management tool which will be installed when a fax device is installed on the computer. The "virtual" fax machine will appear as an icon in the printers folder. In order for faxes to be sent, the user must have appropriate permissions to send them. These permissions can be viewed by finding the fax icon in the printer folder and viewing the Security tab in the properties. In order to receive faxes, the "Enable to Receive" must be selected. Network Connections Windows 2000 supports many industry standard protocols including: The same tools are still in use for troubleshooting TCP/IP: PING, IPCONFIG, TRACERT, ARP, NBSTAT, NETSTAT, ROUTE, etc. PATHPING is new and can be used to troubleshoot lost data packets. Like Windows 98, Windows 2000 supports a new feature called Automatic Private IP Addressing. When "Obtain An IP Address Automatically" is enabled, but the client cannot obtain an IP address from a DHCP server, Automatic Private IP addressing assigns an address in the form of 169.254.x.x and a class B subnet mask of (255.255.0.0). The computer broadcasts this address to its local subnet and if no other computer responds to the address, the computer allocates this address to itself. Remember that a computer that picks up one of these addresses will only be able to communicate with other computers have compatible addresses and subnet masks. RAS Policies are a new feature in Windows 2000. Now it is possible to build an entire set of rules called a RAS Policy to dictate several conditions that must exist before a user can connect. It allows the flexibility to require that a user must be dialing from a specific IP address or from a range of addresses, during the right time of day, from the appropriate caller id location using the appropriate protocol. We can restrict access by group membership or the type of service requested. All of these are configurable and optional. Once the user has met all of the conditions, we can apply a profile, which can include items such as the IP address to use for this session, the authentication type that is allowed, any restrictions such as idle time and the rules for BAP with multilink sessions. Windows 2000 now provides support for VPNs. A virtual private network (VPN) is the extension of a private network that encompasses links across shared or public networks like the Internet. With a VPN, you can create a connection between two computers across a shared or public network that emulates a point-to-point private link. Windows 2000 supports a couple of different VPN protocols. Point to Point Tunneling Protocol(PPTP) creates an encrypted "tunnel" through an untrusted network and is supported by Windows 95/98/NT4/2000. Layer Two Tunneling Protocol(L2TP) works like PPTP in that it creates a "tunnel", but uses IPSec encryption in order to support non-IP protocols and authentication. The table below illustrates the features of each:
Windows 98 supported Internet Connections Sharing(ICS) which is now also supported in Windows 2000. ICS allows multiple PCs to share a single connection with the aid of Network Address Translation(NAT) and is intended for small office/home office(SOHO) environments. When you enable ICS, the network adapter connected to the network is given a new static IP address configuration. Existing TCP/IP connections on the computer are lost and need to be re-established. NAT can be configured separately from ICS and provides the following features and benefits that do not exist when used with ICS alone: Remote Access RAS has changed rather dramatically. Several new RAS protocols are now available to make our communications over dial up lines or the Internet much more secure and more flexible. These new protocols include Extensible Authentication Protocol (EAP), Layer Two Tunneling Protocol (L2TP), Bandwidth Allocation Protocol (BAP), Internet Protocol Security (IPSec) and Remote Authentication Dial-In User Service (RADIUS). EAP gives the ability to use Transport Level Security, another encryption methodology for usernames and passwords. L2TP enables to create a tunnel through a public network that is authenticated on both ends, uses header compression, and relies on IPSec for encryption of data passed through the tunnel. Bandwidth Allocation Protocol allows to set up Multilink capabilities, but if a user isn’t using the bandwidth of multiple lines, we can drop one of the lines assigned to that user and use it for another user. IPSec is essentially a driver at the IP layer that provides encryption very low down in the protocol stack. RADIUS is an RFC based standard that allows us to provide authentication services from the corporate network to a client that is attaching to an ISP that wants access to our server. The ISP’s dial up server that hosts the client is a client to the Radius Server Service (IAS) on the corporate network. The IAS server allows the user to connect. Security Users Local user accounts are managed from the Computer Management Snap-in while domain accounts are managed from the Active Directory User and Computers snap-in. Local accounts only give access to local resources. In a domain model, if a user wishes to access network resources, they will need to have an account in the directory with appropriate permissions to the resources that they are trying to access. There are 2 local user accounts that are created during installation which are Administrator and Guest(disabled by default). Groups There are 2 types of groups in Windows 2000 - Security and Distribution. It is not recommended to use local groups in a domain environment. There are several built-in local groups as follows:
Local Group Policy Group policy is managed using the Group Policy snap-in. Group Policy allows one to control specific rights to local groups and edit administrative templates. Below are the common security templates for Windows 2000 Workstation.
Local Account and Lockout Policies Allow administrators to manage user's password and lockout configurations including password length, complexity, lockout threshold, duration, etc. Event Viewer Like its predecessors, Windows 2000 is still using the Event Viewer to monitor security, system and application events. Event Viewer is accessed through the Computer Management snap-in. The security log writes events to the logs based on audit policy. Auditing is disabled by default as it can slow system performance. The following table shows the different security events that can be added to an audit policy.
Acronyms Acronyms you really must know(not including the ones you already know!) 1. ACL - access control list 2. ACPI - advanced configuration and power interface 3. AD - active directory 4. APM - advanced power management 5. APIPA - automatic private internet protocol addressing 6. CA - certificate authority 7. CAL - client access license 8. DHCP - dynamic host control protocol 9. DNS - domain name system 10. EAP - extensible authentication protocol 11. EFS - encrypting file system 12. FEK - file encryption key 13. GPO - group policy object 14. GPT - group police template 15. HCL - hardware compatibility list 16. IAS - internet authentication services 17. ICS - internet connection sharing 18. IPSec - internet protocol security 19. L2TP - layer two tunneling protocol 20. LDAP - lightweight directory access protocol 21. LPD - line printer daemon 22. MMC - microsoft management console 23. NAT - network address translation 24. NTFS - NT file system 25. ODBC - open database connectivity 26. OSI - open systems interconnection (model) 27. OU - organizational unit 28. PCMCIA - personal computer memory card interface adapter 29. PPP - point to point protocol 30. PPTP - point to point tunneling protocol 31. PXE - preboot execution environment 32. RAS - remote access service 33. RIPrep - remote installation preparation 34. RIS - remote installation services 35. RRAS - routing and remot access service 36. SAM - security accounts manager 37. SMP - symmetric multiprocessing 38. SMS - systems management server 39. Sysprep - system preparation 40. TFTP - trivial file transfer protocol 41. UDF - unique database file 42. UNC - universal naming convention 43. VPN - virtual private network 44. WDM - windows32 driver model |
|
|
| |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||
|
Advertise | Contact Us | About Us | | Disclaimer | Privacy Policy | |
|
||
|
Sponsored Links | |
MCSE Boot Camp, Cisco Training Classes, CISSP, A+ Certification, MCSD - Nationwide IT Showcase |
||
Resources