Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

2.1 What Changed?

I'll start by briefly summarizing a number of minor
and often unnecessary changes that are likely to cause frustrated W2K
administrators to say, "Why on earth did they do
that?" Then I'll conclude the
chapter with a quick summary of new features and enhancements that
make WS2003 even better than W2K from the point of view of
administering the platform. The changes listed here are more or less
in the order you might encounter them as you begin administering the
new platform.

If you're already familiar with the Windows XP Professional platform, the transition to WS2003 will be considerably easier because the desktop for the two platforms is almost identical, except that the (in my opinion) ugly Luna theme of XP is replaced by the standard Windows Classic theme in WS2003. For a good introduction to XP, see Windows XP in a Nutshell (O'Reilly).

2.1.1 Where Are the Icons?

By default, the only icon on the WS2003 desktop is Recycle Bin, which
can be a bit unnerving the first time you log on to a WS2003 machine.
To make icons for My Computer, My Network Places, My Documents, and
Internet Explorer visible on the desktop, do the following:

Right-click on desktop Properties Desktop Customize Desktop General select icons to make visible on desktop

You can also hide/display all desktop icons at any time by:

Right-click on desktop Arrange Icons By Show Desktop Icons

2.1.2 Display Properties

If you've opened the Display Properties using the
earlier procedure, you'll immediately notice that
they've renamed some of the tabs and rearranged
where the settings are found. There's a lot of this
renaming and rearranging in WS2003, and it can be frustrating to
administrators who are used to the way they've been
performing common tasks in W2K. Table 2-1 compares
the Display Properties tabs and settings for the two platforms.

2.1.3 System Properties

While we're right-clicking on desktop items,
let's open the System Properties page by
right-clicking on My Computer and selecting Properties. Again, note
that some of the tabs and settings for this commonly used item have
been renamed and rearranged as detailed in Table 2-2.

2.1.4 Network Connections

Right-click on My Network Places and select Properties. In W2K, this
opens the Network and Dial-up Connections window, but in WS2003 this
window is called Network Connectionsanother subtle name
change. Exploring the various menu options available, note that:

Advanced Dial-up Preferences

now becomes:

Advanced Remote Access Preferences

even though it still refers only to dial-up connections. For more on
network connections, see

Connections in Chapter 4.

2.1.5 Start Menu

Let's continue by examining the changes to the Start
menu, the launching point for running applications on W2K and WS2003.
There are a few improvements here, but there are also a lot of
unnecessary changes that will require you to perform familiar actions
200 times in totally different ways (since psychologists say it takes
about 200 repetitions of an action to form a habit). The most
frustrating change to me is placing the All Programs option at the

bottom of the Start menu in WS2003, when in W2K
the equivalent Programs option is found near the

top of the menu. Argh! Anyway, Table 2-3 summarizes the main differences between the
Start menu in the two platforms.

Of course, you can also switch to the good old Classic Start menu if
you prefer by doing the following:

Right-click on Taskbar Properties Start Menu Classic Start menu

2.1.6 Administrative Tools

Fortunately, the administrative tools haven't
changed much from W2K to WS2003, but there are a few things that may
trip you up initially. First, the default set of tools installed on a
standalone server has changed somewhat, as Table 2-4 shows. The base platforms compared in this
table are Windows 2000 Advanced Server and Windows Server 2003,
Enterprise Edition.

While a few of these tools have been enhanced with new functionality
in WS2003, some of them have also been changed in ways that might be
more frustrating than helpful to administrators. A good example of
this is the Routing and Remote Access console, in which the Routing
and Remote Access Setup Wizard used to enable and configure RRAS has
been completely redesigned without really adding that much new
functionality (see

Routing and Remote Access in
Chapter 4 for more information).

Another seemingly arbitrary change in functionality is Computer
Management: the useful System Information node under System Tools in
the W2K version of this tool has disappeared in the WS2003 version.
As a result, to access System Information you now have to do the
following:

Start All Programs Accessories System Tools System Information

Of course, you might consider starting System Information from the
command line, but unfortunately its executable

msinfo32.exe isn't in the
default system path. To access it, you either have to type the full
path (

C:\Program Files\Common Files\Microsoft
Shared\MSInfo\msinfo32.exe ) or add this path to your PATH
environment variable. Alternatively, you can create a shortcut to the
tool on your desktop or modify your Start menu. The point is, why
make this change to Computer Management in the first place? Another
seemingly arbitrary change is the omission of the Logical Drives node
under Storage, but this is not as significant because the same
information can be obtained from the Disk Management node anyway. For
more on Computer Management, see

Administrative
Tools in Chapter 4.

2.1.7 Control Panel

There isn't much to trip you up regarding changes to
Control Panel utilities, other than the following:

• Add/Remove Hardware is now called Add Hardware (but you can still
  remove it too).

• Add/Remove Programs is now called Add or Remove Programs (does
  Microsoft have something against forward slashes?).

• Date/Time is now called Date and Time (it seems they do in fact have
  something against slashes).

• Network and Dial-up Connections is now Network Connections (but you
  can still create dial-up connections too).

• Printers is now called Printers and Faxes (even if you
  aren't running a fax server).

• Regional Options is now called Regional and Language Options (which
  makes sense I suppose).

• Sounds and Multimedia is now called Sounds and Audio Devices (even
  though video codecs are included).

In addition, there are three new Control Panel utilities also found
in XP, namely: Speech, Stored User Names and Passwords, and Taskbar
and Start Menu.

2.1.8 Browse the Web

Let's try one more thing: start Internet Explorer
and see what happens. You'll see a dialog box
saying,

Microsoft Internet Explorer's Enhanced Security
Configuration is currently configured on your server. This enhanced
level of security reduces the risk of attack from Web-based content
that is not secure, but may also prevent web sites from displaying
correctly and restrict access to network resources.

This feature is one of the "secure
out-of-the-box" enhancements of WS2003, which
installs in a more-or-less locked-down state as opposed to W2K which
installs in a more-or-less wide-open state. Basically what it means
is that the security setting for the Internet zone is set to High, so
if you want to browse a relatively benign site like Google, you can
either:

• Add google.com to your Trusted
  Sites zone by entering the URL and then:

  File Add this site to Trusted Sites Zone

• Change the setting for the Internet zone to Medium so you can browse
  any Internet site:

  Internet Explorer Tools Internet Options Security Internet Medium

• Disable the Internet Explorer Enhanced Security Configuration feature
  entirely:

  Control Panel Add or Remove Programs Add/Remove Windows Components clear checkbox for Internet Explorer Enhanced Security Configuration

The best solution is the first one, and in general you
shouldn't be browsing the Web on a server anyway,
use a workstation instead to download drivers and perform similar
tasks.

While this new security feature is probably to be commendedwho
is going to read the Drudge Report on their server
anywaydon't you think Microsoft could have at
least added

*.microsoft.com to
the Trusted Sites zone by default? After all, when you use Help and
Support to search for information on some topic, the results list
includes some links to Knowledge Base articles on support.microsoft.com. When you try to read
those articles and all those security dialog boxes start popping up,
it can be more than a bit annoying.