Файловый архив студентов. Файловый архив студентов.
1276 вузов, 4770 предметов.
/ Регистрация
FAQ Обратная связь Вопросы и предложения
Добавил:
Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Алматинский университет энергетики и связи
Предмет:
[НЕСОРТИРОВАННОЕ]
Файл:

20411B-ENU-TrainerHandbook

.pdf
Скачиваний:
237
Добавлен:
01.05.2015
Размер:
16.48 Mб
Скачать
☆
The main tasks for this exercise are as follows:
Exercise 3: Configuring DFS-R
Scenario

Administering Windows Server® 2012 10-43

Task 2: Enable access-based enumeration for the BranchDocs namespace

 

•

In DFS Management, in the \\Adatum.com\BranchDocs Properties dialog box, on the AdvancedMCT

 

tab, select the Enable access-based enumeration for this namespace check box.

USE

Task 3: Add the ResearchTemplates folder to the BranchDocs namespace

• Add a new folder to the BranchDocs namespace:

 

o Folder name: ResearchTemplates

 

o Add a folder target:

.ONLY

 

Path: \\LON-SVR4\ResearchTemplates

 

 

 

Create share

 

 

Local path: C:\BranchDocs\ResearchTemplates

 

Permissions: All users have read and write permissions

Task 4: Add the DataFiles folder to the BranchDocs namespace

1.On LON-SVR1, open Windows Explorer, in the address bar type, type \\Adatum.com\BranchDocs\STUDENT and then press Enter.

2.Verify that both ResearchTemplates and DataFiles display, and then close the window. USE• Add a new folder to the BranchDocs namespace:

You have been asked to ensure that the files contained in the new DFS namespace are replicated to both LON-SVR1 and LON-SVR4 to ensure data availability.

PROHIBITED

1.Create another folder target for DataFiles.

2.Configure replication for the namespace.

3.To prepare for the next module.

Task 1: Create another folder target for DataFiles

1.In DFS Management, expand Adatum.com\BranchDocs, and then click DataFiles.

2.In the details pane, notice that there is currently only one folder target.

10-44 Optimizing File Services

3.Add a new folder target:

o Path to target: \\LON-SVR4\DataFiles o Create share

o Local path: C:\BranchDocs\DataFiles

o Permissions: All users have read and write permissions o Create folder

4.In the Replication dialog box, click Yes. The Replicate Folder Wizard starts.

Task 2: Configure replication for the namespace

1.Complete the Replicate Folder Wizard: o Primary member: LON-SVR1

o No topology

o Use defaults elsewhere, and accept any messages.

2.Create a new replication topology for the namespace: o Type: Full mesh

o Schedule and bandwidth: Use default settings

3.In the details pane, on the Memberships tab, verify that the replicated folder displays on both LON-SVR4 and LON-SVR1.

Task 3: To prepare for the next module

When you finish the lab, revert the virtual machines to their initial state. To do this, complete the following steps:

1.On the host computer, start Hyper-V Manager.

2.In the Virtual Machines list, right-click 20411B-LON-DC1, and then click Revert.

3.In the Revert Virtual Machine dialog box, click Revert.

4.Repeat these steps for 20411B-LON-SVR1 and 20411B-LON-SVR4.

Results: After completing this exercise, you will have configured DFS-R.

Question: What are the requirements for deploying a namespace in Windows Server 2008 mode?

Question: What are the benefits of hosting a namespace on several namespace servers?

PROHIBITED USE STUDENT .ONLY USE MCT

Administering Windows Server® 2012

Module Review and Takeaways

Review Questions

Question: How do FSRM templates for quotas and file screens provide a more efficient FSRM management experience?

Question: Why does DFS-R make a more efficient replication platform than FRSM?

10-MCT45 USEONLY

STUDENT . PROHIBITED USE

MCT USE ONLY. STUDENT USE PROHIBITED

 

 

11-1

 

 

 

 

 

Module 11

 

MCT

 

USE

Configuring Encryption and Advanced Auditing

Contents:

 

 

.ONLY

Module Overview

11-1

Lesson 1: Encrypting Files by Using Encrypting File System

11-2

Lesson 2: Configuring Advanced Auditing

11-6

Lab: Configuring Encryption and Advanced Auditing

11-13

Module Review and Takeaways

11-17

 

 

Module Overview

As an administrator of the Windows Server® 2012 operating system, you should ensure the continued security of the files and folders on your servers. You can encrypt sensitive files by using native Windows Server 2012 tools. However, you must be aware of some considerations and implementation methods in

order to provide a reliable environment.

STUDENT

By using Windows Server 2012, you can understand how files and folders are being used on your

 

Windows Server 2012 computers. You can also audit file and folder access. Auditing file and folder access

can give you insight into general usage, and more critical information, such as unauthorized usage

 

attempts.

 

This module describes the Windows Server 2012 tools that can help you to provide increased file system

security on your servers.

USE

Objectives

After completing this module, you will be able to:

•

Encrypt files by using EFS.

PROHIBITED

•

Configure advanced auditing.

 

 
Note: If you are not using certificates from a CA and you want to allow EFS to be used on a file share, then you must configure the file server computer account to be trusted for delegation. Domain controllers are trusted for delegation by default.
11-2

Configuring Encryption and Advanced Auditing

Lesson 1

MCT

Encrypting Files by Using Encrypting File System

USE

Encrypting File System (EFS) is a built-in component of the NTFS file system that enables encryption and

decryption of file and folder contents on an NFTS volume. It is important to understand how EFS works

before implementing EFS in your environment. You should also know how to recover the encrypted files,

and troubleshoot issues when EFS encryption does not work properly.

 

 

 

 

Lesson Objectives

 

 

After completing this lesson, you will be able to:

.ONLY

•

Describe EFS.

• Explain how EFS works.

• Explain how to recover EFS–encrypted files.

•

Explain how to encrypt a file by using EFS.

What Is EFS?

 

STUDENT

EFS is a feature that can encrypt files that are

 

 

 

 

stored on an NTFS formatted partition. By default,

 

 

this option is available to all users. You can also

 

 

use EFS to encrypt files on a file share.

 

 

After a file is encrypted by using EFS, it can

 

 

only be accessed by authorized users. If a user is

 

 

authorized, then access to the file is transparent

 

 

and it can be opened like an unencrypted file. If a

 

 

user is not authorized, attempts to open the file

 

 

 

 

 

will result in an access denied message.

 

 

 

EFS encryption acts as an additional layer of

 

 

 

 

USE

security in addition to NTFS permissions. If users

are given NTFS permission to read a file, they must still be authorized by EFS to decrypt the file.

The default configuration of EFS requires no administrative effort. Users can begin encrypting files

PROHIBITED

immediately, and EFS automatically generates a user certificate with a key pair for a user if one does not

already exist. Using a certification authority (CA) to issue user certificates enhances manageability of the

certificates.

 

 

 

 

 

 

 

 

You can disable EFS on client computers by using Group Policy. In the Properties of the policy, navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Polices\Encrypting Files System, and then click Don’t allow.

Administering Windows Server® 2012 11-3

How EFS Works

MCT

EFS uses a combination of public-key and

 

 

USE

symmetric-key encryption to protect files from

attack. EFS uses a symmetric key to encrypt the

file, and a public key to protect the symmetric key.

Symmetric key encryption uses the same key

to encrypt and then decrypt a file. This type of

 

 

encryption is faster and stronger than public key

 

 

encryption. Because it is difficult to secure the

 

 

symmetric key during a cross-network transfer,

 

 

it requires additional security. Symmetric key

 

 

encryption is the typical method for encrypting

 

 

large amounts of data.

.ONLY

 

EFS uses public key encryption to protect the symmetric key that is required to decrypt the file contents. Each user certificate contains a private key and a public key that is used to encrypt the symmetric key.

1.When a user encrypts a file, EFS generates a file encryption key (FEK) to encrypt the data. The FEK isSTUDENT encrypted with the user’s public key, and the encrypted FEK is then stored with the file. This ensures

that only the user who has the matching EFS encryption private key can decrypt the file. After a user encrypts a file, the file remains encrypted for as long as it is stored on the disk.

2.To decrypt files, the user can open the file, remove the encryption attribute, or decrypt the file by

using the cipher command. When this occurs, EFS decrypts the FEK with the user’s private key, and then decrypts the data by using the FEK.Only the user with the certificate and its private key can decrypt the symmetric key.Note: In addition to the user that encrypted the file, additional copies of the symmetric key

are encrypted with the recovery agent public key, and are available to any other authorized users.

Recovering EFS–Encrypted Files

If a user who encrypted a file by using EFS loses the private key for any reason, then you need a method for recovering the EFS–encrypted file. The private key is part of a user certificate that is used for encryption. Backing up a user certificate is one method for recovering EFS–encrypted files. The backed-up user certificate can be imported into another profile and you can use it to decrypt

the file. However, this method is difficult to implement when there are many users.

A better method for recovering EFS-encrypted files is to make use of a recovery agent. A recovery

agent is an individual who is authorized to decrypt all EFS encrypted files. The default recovery agent is the domain administrator. However, you can delegate the recovery agent role to any user.

PROHIBITED USE

11-4 Configuring Encryption and Advanced Auditing

 

MCT

 

 

 

When you add a new recovery agent through Group Policy, the agent is added automatically to all

 

 

 

newly encrypted files, but the agent is not automatically added to the existing encrypted files. Because

 

 

the recovery agent for a file is set at the time that the file is encrypted, an encrypted file must be accessed

and saved to update the recovery agent.

USE

To back up the recovery agent certificate, you should always export the certificate with the private key

and keep it in a secure location. The two reasons to back up the private key for the recovery agent (or the

recovery key) are:

•

To secure against system failure. The domain administrator key that is used by default for EFS

.ONLY

 

recovery is stored only on the first domain controller in the domain. If anything happened to this

 

domain controller, EFS recovery would be impossible.

• To make the recovery key portable. The recovery key is not automatically available to the recovery

 

agent on all computers. The recovery key must be installed in the recovery agent’s profile. If roaming

 

profiles are not used, then exporting and importing the recovery key is a method to update the

 

recovery agent’s profile on a particular computer.

 

 

Demonstration: Encrypting a File by Using EFS

STUDENT

This demonstration shows how to:

• Verify that a computer account supports EFS on a network share.

• Use EFS to encrypt a file on a network share.

• View the certificate used for encryption.

• Test access to an encrypted file.

Demonstration Steps

Verify that a computer account supports EFS on a network share

USE

1. On LON-DC1, open Active Directory Users and Computers.

2. Verify that that LON-DC1 is trusted for delegation to any service.

Use EFS to encrypt a file on a network share

1.

Log on to LON-CL1 as Adatum\Doug with a password of Pa$$w0rd.

1.On LON-DC1, navigate to C:\Users\. Notice that Doug has a profile on the computer. This is where PROHIBITED the self-signed certificate is stored. It cannot be viewed in the Microsoft Management Console (MMC) Certificates snap-in unless Doug logs on locally to the server.

2.Navigate to C:\Users\Doug\AppData\roaming\Microsoft\SystemCertificates\My\Certificates. This is the folder that stores the self-signed certificate for Doug.2. Navigate to3. \\LON-DC1\Mod11Share.

Administering Windows Server® 2012

Test access to an encrypted file

1.Log on to LON-CL1 as Adatum\Alex.

2.Attempt to open \\LON-DC1\Mod11Share\MyEncryptedFile by using Microsoft Word. The attempt will fail because the file is encrypted by Doug.

11MCT-5 USEONLY

STUDENT . PROHIBITED USE

11-6 Configuring Encryption and Advanced Auditing

Lesson 2

Configuring Advanced Auditing

Auditing logs report a variety of activities in your enterprise to the Windows® Security Log. You can then monitor these auditing logs to identify issues that warrant further investigation. Auditing can log successful activities as well, to provide documentation of changes. It can also log failed and potentially malicious attempts to access enterprise resources. When configuring auditing, you will specify audit settings, enable an audit policy, and then monitor events in the security logs.

Lesson Objectives

After completing this lesson, you will be able to:

•Describe audit policies.

•Explain how to specify audit settings for a file or folder.

•Explain how to enable audit policy.

•Explain how to evaluate events in the security log.

•Describe the advanced audit policy configuration.

•Explain how to configure advanced auditing.

Overview of Audit Policies

Audit policy configures a system to audit categories of activities. If audit policy is not enabled, a server will not audit those activities.

You can view audit policies in Group Policy, under Computer Configuration. In Computer Configuration, expand Policies\Windows Settings \Security Settings\Local Policies, and then click Audit Policy. To configure auditing, you must define the policy setting. In the Group Policy Management Editor, double-click any policy setting, and select the Define These Policy Settings check box. Then, select whether to

enable auditing of Success events, Failure events, or both.

The following table defines each audit policy and its default settings on a Windows Server 2012 domain controller.

 

 

 

Audit policy

Description

Default setting

setting

 

 

 

 

 

Audit Account

Creates an event when a user or computer

Successful account

Logon Events

attempts to authenticate by using an Active

logons are audited.

 

Directory® account. For example, when a user logs

 

 

on to any computer in the domain, an account

 

 

logon event is generated.

 

 

 

 

PROHIBITED USE STUDENT .ONLY USE MCT

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]
Помощь Обратная связь Вопросы и предложения Пользовательское соглашение Политика конфиденциальности