Professional Windows Server 1002003 Security A Technical Reference [Electronic resources]

2.1 What Changed?

I'll start by briefly summarizing a number of minor and often unnecessary changes that are likely to cause frustrated W2K administrators to say, "Why on earth did they do that?" Then I'll conclude the chapter with a quick summary of new features and enhancements that make WS2003 even better than W2K from the point of view of administering the platform. The changes listed here are more or less in the order you might encounter them as you begin administering the new platform.

2.1.1 Where Are the Icons?

By default, the only icon on the WS2003 desktop is Recycle Bin, which can be a bit unnerving the first time you log on to a WS2003 machine. To make icons for My Computer, My Network Places, My Documents, and Internet Explorer visible on the desktop, do the following:

Right-click on desktop Properties Desktop Customize Desktop General select icons to make visible on desktop

You can also hide/display all desktop icons at any time by:

Right-click on desktop Arrange Icons By Show Desktop Icons

2.1.2 Display Properties

If you've opened the Display Properties using the earlier procedure, you'll immediately notice that they've renamed some of the tabs and rearranged where the settings are found. There's a lot of this renaming and rearranging in WS2003, and it can be frustrating to administrators who are used to the way they've been performing common tasks in W2K. Table 2-1 compares the Display Properties tabs and settings for the two platforms.

2.1.3 System Properties

While we're right-clicking on desktop items, let's open the System Properties page by right-clicking on My Computer and selecting Properties. Again, note that some of the tabs and settings for this commonly used item have been renamed and rearranged as detailed in Table 2-2.

2.1.4 Network Connections

Right-click on My Network Places and select Properties. In W2K, this opens the Network and Dial-up Connections window, but in WS2003 this window is called Network Connectionsanother subtle name change. Exploring the various menu options available, note that:

Advanced Dial-up Preferences

now becomes:

Advanced Remote Access Preferences

even though it still refers only to dial-up connections. For more on network connections, see

Connections in Chapter 4.

2.1.5 Start Menu

Let's continue by examining the changes to the Start menu, the launching point for running applications on W2K and WS2003. There are a few improvements here, but there are also a lot of unnecessary changes that will require you to perform familiar actions 200 times in totally different ways (since psychologists say it takes about 200 repetitions of an action to form a habit). The most frustrating change to me is placing the All Programs option at the

bottom of the Start menu in WS2003, when in W2K the equivalent Programs option is found near the

top of the menu. Argh! Anyway, Table 2-3 summarizes the main differences between the Start menu in the two platforms.

Of course, you can also switch to the good old Classic Start menu if you prefer by doing the following:

Right-click on Taskbar Properties Start Menu Classic Start menu

2.1.6 Administrative Tools

Fortunately, the administrative tools haven't changed much from W2K to WS2003, but there are a few things that may trip you up initially. First, the default set of tools installed on a standalone server has changed somewhat, as Table 2-4 shows. The base platforms compared in this table are Windows 2000 Advanced Server and Windows Server 2003, Enterprise Edition.

While a few of these tools have been enhanced with new functionality in WS2003, some of them have also been changed in ways that might be more frustrating than helpful to administrators. A good example of this is the Routing and Remote Access console, in which the Routing and Remote Access Setup Wizard used to enable and configure RRAS has been completely redesigned without really adding that much new functionality (see

Routing and Remote Access in Chapter 4 for more information).

Another seemingly arbitrary change in functionality is Computer Management: the useful System Information node under System Tools in the W2K version of this tool has disappeared in the WS2003 version. As a result, to access System Information you now have to do the following:

Start All Programs Accessories System Tools System Information

Of course, you might consider starting System Information from the command line, but unfortunately its executable

msinfo32.exe isn't in the default system path. To access it, you either have to type the full path (

C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe ) or add this path to your PATH environment variable. Alternatively, you can create a shortcut to the tool on your desktop or modify your Start menu. The point is, why make this change to Computer Management in the first place? Another seemingly arbitrary change is the omission of the Logical Drives node under Storage, but this is not as significant because the same information can be obtained from the Disk Management node anyway. For more on Computer Management, see

Administrative Tools in Chapter 4.

2.1.7 Control Panel

There isn't much to trip you up regarding changes to Control Panel utilities, other than the following:

• Add/Remove Hardware is now called Add Hardware (but you can still remove it too).

• Add/Remove Programs is now called Add or Remove Programs (does Microsoft have something against forward slashes?).

• Date/Time is now called Date and Time (it seems they do in fact have something against slashes).

• Network and Dial-up Connections is now Network Connections (but you can still create dial-up connections too).

• Printers is now called Printers and Faxes (even if you aren't running a fax server).

• Regional Options is now called Regional and Language Options (which makes sense I suppose).

• Sounds and Multimedia is now called Sounds and Audio Devices (even though video codecs are included).

In addition, there are three new Control Panel utilities also found in XP, namely: Speech, Stored User Names and Passwords, and Taskbar and Start Menu.

2.1.8 Browse the Web

Let's try one more thing: start Internet Explorer and see what happens. You'll see a dialog box saying,

Microsoft Internet Explorer's Enhanced Security Configuration is currently configured on your server. This enhanced level of security reduces the risk of attack from Web-based content that is not secure, but may also prevent web sites from displaying correctly and restrict access to network resources.

This feature is one of the "secure out-of-the-box" enhancements of WS2003, which installs in a more-or-less locked-down state as opposed to W2K which installs in a more-or-less wide-open state. Basically what it means is that the security setting for the Internet zone is set to High, so if you want to browse a relatively benign site like Google, you can either:

• Add google.com to your Trusted Sites zone by entering the URL and then:

  File Add this site to Trusted Sites Zone

• Change the setting for the Internet zone to Medium so you can browse any Internet site:

  Internet Explorer Tools Internet Options Security Internet Medium

• Disable the Internet Explorer Enhanced Security Configuration feature entirely:

  Control Panel Add or Remove Programs Add/Remove Windows Components clear checkbox for Internet Explorer Enhanced Security Configuration

The best solution is the first one, and in general you shouldn't be browsing the Web on a server anyway, use a workstation instead to download drivers and perform similar tasks.

While this new security feature is probably to be commendedwho is going to read the Drudge Report on their server anywaydon't you think Microsoft could have at least added

*.microsoft.com to the Trusted Sites zone by default? After all, when you use Help and Support to search for information on some topic, the results list includes some links to Knowledge Base articles on support.microsoft.com. When you try to read those articles and all those security dialog boxes start popping up, it can be more than a bit annoying.