Connection Authorization Policies (CAPs) Connection authorization policies (CAPs) allow administrators to specify users, user groups, and optionally, computer groups that can access a TS Gateway server. TS Gateway Management creates CAPs. CAPs simplify administration and enhance security by providing a greater level of control over access to remote computers on the corporate network. Using CAPs, administrators can require that users, user groups, or computer groups meet specific conditions to access a TS Gateway server. Specific conditions can be listed for each CAP. For example, administrators can specify connection requirements such as the use of a smart card, may define specific user groups that are allowed to connect to resources on the corporate network, may define specific resources to which users can connect, may define specific user group membership requirements, and so forth. A user is granted access to a TS Gateway server only if he or she meets or exceeds the conditions specified in the CAP that contains their group name. Resource groups and Resource Authorization Policies (RAPs) After CAPs are defined, resource groups must be created and Resource Authorization Policies (RAPs) defined that allow users access from the TS Gateway server to specific remote computers on the network. CAPs and RAPs are created and managed by using TS Gateway Management console. Resource groups enable administrators to define the groups of remote computers that users can access. RAPs enable the management of user access to resource groups. Users connecting to the network through a TS Gateway server are granted access to specific remote computers on the network, only if they meet or exceed the conditions specified in at least one RAP. Instead of creating a resource group manually, a security group can be defined in Active Directory directory service, and is used to manage access conditions. To ensure that the right users have access to the correct remote computers on the network, administrators must plan and create resource groups carefully. Evaluation is required to determine which users should have access to each resource group, and then one or more RAPs must be created to grant the users access as needed. Monitoring capabilities TS Gateway Management provides the ability to view information active connections from clients to remote computers on the network through TS Gateway. This information includes the IP address of the client, the name of the user logged on to the client, the name of the remote computer to which the client is connected, and the length of time that the connection is idle, if applicable. Administrators can also specify events that they want to monitor, and then monitor these events by using Event Viewer.
cached the passwords for those accounts. For example, an administrator can specify in advance any accounts that an RODC will need to cache. This way, the RODC can authenticate those accounts (once their credentials have been cached), even if the WAN link to the hub site is offline. Administrator role separation The local administrator role of an RODC can be delegated to any domain user without granting that user any user rights for the domain or other domain controllers. This permits a local branch user to log on to an RODC and perform maintenance work on the server, such as upgrading a driver. However, the user in the branch office cannot log on to any other domain controller or perform any other administrative tasks in the domain. In this way, the user in the branch office can be delegated the ability to effectively manage the RODC in the branch office without compromising the security of the rest of the domain. Administration role separation provides a flexible administration model while enhancing security, especially in branch offices where some local control or maintenance may be needed but the central network and servers must be protected. New MMC snap-in functions The Active Directory and Services snap-in in Windows Server 2008 includes a Find command on the toolbar and on the Action menu. This command helps to find the site in which a domain controller is placed; this can help with troubleshooting replication problems between domain controllers in branches and hubs. To help manage RODCs, there is now a Password Replication Policy tab on the domain controller Properties sheet. An administrator can click the Advanced button on this tab to see what: passwords have been sent to the RODC passwords are currently stored on the RODC accounts have authenticated to the RODC, including accounts that are not currently defined in the security groups that are allowed or denied replication—the administrator can see who is using the RODC and can determine whether to allow or deny password replication Read-only Domain Name System The Domain Name System (DNS) Server service can be installed on an RODC. An RODC is able to replicate all application directory partitions that DNS uses, including ForestDNSZones and DomainDNSZones. If the DNS server is installed on an RODC, clients can query it for name resolution as they would query any other DNS server. This allows
AD DS maintenance. Any clients that are specifically bound to a stopped domain controller would simply contact another domain controller through discovery. Read-Only Domain Controllers (RODCs) A read-only domain controller (RODC) is a new type of domain controller available in the Windows Server 2008 operating system, designed primarily to be deployed in remote locations. RODC is covered in detail in the Remote Locations section of this paper. Server and Domain Isolation In a Microsoft Windows-based network, administrators can logically isolate server and domain resources to limit access to authenticated and authorized computers. For example, a logical network can be created inside the existing physical network, where computers share a common set of requirements for secure communications. Each computer in this logically isolated network must provide authentication credentials to other computers in the isolated network in order to establish connectivity. This isolation prevents unauthorized computers and programs from gaining access to resources inappropriately. Requests from computers that are not part of the isolated network are ignored. Two types of isolation can be used to protect a network: Server isolation—In a server isolation scenario, specific servers are configured using IPSec policy to accept only authenticated communications from other computers. For example, the database server can be configured to accept connections from the Web application server only. Domain isolation—To isolate a domain, administrators can use Active Directory domain membership to ensure that domain member computers accept only authenticated and secured communications from domain member computers. The isolated network consists of only computers that are part of the domain. Domain isolation uses IPSec policy to provide protection for traffic sent between domain members, including all client and server computers. Server and domain isolation can help protect specific high-value servers and data as well as protect managed computers from unmanaged or rogue computers and users.
from multiple backups if the item was stored on an incremental backup. Now, the user can simply choose the backup date for the items they wish to restore. Simplified recovery of the operating system—Backup works with the new Windows Recovery tools to make it easier to recover the operating system. Users can recover to the same server, or, if the hardware fails, he or she can recover to a new server that has no operating system. Support for DVD media—Users can manually back up volumes directly to DVD. Backup also retains support for backing up manually to shared folders and hard disks. Scheduled backups are stored on hard disks. Improved Scheduling—Backup now includes a wizard to guide the IT staff through the process of creating daily backups. System volumes are automatically included in all scheduled backups. Windows Server 2008 provides the backup and recovery solutions needed to complete a high availability solution that protects both the organization’s data and the operating systems on the servers in the network. It also eases the administrative burden of ensuring mission critical data is properly backed up, while speeding up data recovery. Windows Reliability and Performance Monitor Windows Server 2008 includes the Windows Reliability and Performance Monitor, which provides IT Professionals with tools to easily monitor and assess system performance and reliability. (Note: In some pre-release versions of Windows Sever 2008, this feature was called “Windows Performance Diagnostic Console.”) Windows Reliability and Performance Monitor is an MMC snap-in that combines the functionality of several previous tools, including Performance Logs and Alerts, Server Performance Advisor, and the System Monitor. It provides an easy-to-use graphic interface for customizing performance data collection and Event Trace Sessions. It also includes Reliability Monitor, another MMC snap-in that tracks changes to the system and compares them to changes in system stability, providing a graphical view of their relationship. Windows Reliability and Performance Monitor is a tool designed to provide IT Professionals and network administrators with the performance information needed to effectively manage networks. To view real-time status in Resource View, the console must run as a member of the Administrators group. To create Data Collector Sets, configure logs, or view reports, the console must run as a member of the Administrators group or the Performance Log Users Group.