Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Chapter 11. Securing Infrastructure Roles

The first computers were all-purpose megaliths. They were used for every approved computing purpose within an organization. "Approved" is the operative word here. It was sometimes difficult to get new applications approved, and once approved, a new application could take years to develop and implement. As computing needs grew, specialized systems were adopted: a payroll system, financials, inventory control. Many of these systems were installed outside of the official data center. Computers as functional units, as role-fulfilling parts of the greater computational whole became the norm. Today, some organizations still attempt to use one computer for all things; these organizations are large and should perhaps know better, or they are very small with smaller budgets and few requirements. Most organizations, however, have many computers and, if asked, can easily sort them into roles such as desktops, databases, domain controllers, messaging, firewalls, DNS servers, WINS servers, DHCP servers, and many others. All these computers, though they play different roles, have many common elements. Chapters 7 through 10 examine the role of the Windows Server 2003 domain controller and how to use Group Policy to secure all systems joined to the domain. They do not, however, provide the specifics of how to maximize the use of this process to address the multiple computer and user roles on the network. Likewise, in Chapter 3, the use of Local Security Policy to manage users and secure individual desktop computers and servers is detailed, but a way to quickly apply and enforce recommended security settings or to automate the process of dealing with multiple Windows systems that are not joined in a domain is not discussed. This chapter addresses these issues: the details of what to put into and how to best use Group Policy and automating the application of security on standalone computers. The following topics and techniques are discussed:

The development of security templates to address the general needs of servers on the network.

The use of incremental templates to further relax or tighten settings for specific infrastructure roles.

The details of how these templates can be used with Group Policy in a domain setting.

How to use Security Configuration and Analysis outside of the domain to secure these servers in an automated fashion.

Security specifics that cannot be incorporated into security templates.

Although this chapter describes these techniques as a way to harden infrastructure servers, these same techniques can be used to secure other server roles, to manage specific collections of users, and to secure workstations.

These infrastructure roles are discussed:

Domain Name Services (DNS)

Windows Internet Naming Service (WINS)

Dynamic Host Control Protocol (DHCP)