The Advanced System Information—Policy tool enables you to create an RSoP query and view the results in an HTML report that appears in the Help And Support Center window. This report can be printed, and it can be saved to an .htm file. Although this report does not contain as much information as the results of RSoP queries generated with the Resultant Set Of Policy Wizard or the Gpresult command-line tool, it can be run easily by novice users who have RSoP authority. The results of the Advanced System Information—Policy tool RSoP query are obtained from RSoP Logging mode for the currently logged on user on the computer on which the query is performed. The report generated displays policy-related information for the following categories:

•       Computer name, associated domain, and current site

•       User name and associated domain

•       Applied GPOs for the computer and user

•       Security group memberships for the computer and user

•       Microsoft Internet Explorer settings

•       Scripts: logon, logoff, startup, shutdown

•       Security settings

•       Programs installed

•       Folder redirection

•       Registry settings

To create an RSoP query for an existing user and computer, you must either be logged on to the local computer as a user, be a member of the local Administrators, Domain Administrators, or Enterprise Administrators group, or have permission to generate RSoP for the domain or OU in which the user and computer accounts are contained. You must be an enterprise administrator if the RSoP query includes site GPOs that cross domain boundaries in the same forest. This section describes how to create RSoP que¬ries in Logging mode and Planning mode.

To create an RSoP query with the Resultant Set Of Policy Wizard Logging mode, complete the following steps:

1.      Click Start, and then click Run.

2.      In the Run dialog box, type tame in the Open box, and then click OK.

3.      In the MMC, from the File menu, click Add/Remove Snap-In.

4.      In the Add/Remove Snap-In dialog box, click Add.

5.      In the Add Standalone Snap-In dialog box, select Resultant Set Of Policy, click

Add, and then click Close.

6.      In the Add/Remove Snap-In dialog box, click OK.

7.      In the MMC, right-click the Resultant Set Of Policy icon on the RSoP Wizard con¬

sole, and then select Generate RSoP Data.

8.      In the Welcome To The Resultant Set Of Policy Wizard page, click Next.

9.      On the Mode Selection page, shown in Figure 11-1, select Logging Mode,

10. On the Computer Selection page in the Resultant Set Of Policy Wizard, shown in Figure 11-2, select This Computer, or to search for a different computer, click Another Computer, and then click Browse to select the appropriate computer. If you want to display user policy settings only, click the Do Not Display Policy Settings For The Selected Computer In the Results check box.

11. On the User Selection page, shown in Figure 11-3, select Current User to view policy settings for the current user, or to search for a different user, click Select A Specific User, and select a user in the list. If you want to display computer policy settings only, click the Do Not Display User Policy Settings In the Results check box. Click Next.

Resultant Set of Policy Wizard

12.  On the Summary Of Selections page, shown in Figure 11-4, review your selections. Click Next.

14. The RSoP console opens. Click the folders in the console tree to view the data in the details pane.

1.      Describe what happens in a nonauthoritative restore.

In a nonauthoritative restore, the distributed services on a domain controller are restored from backup media and the restored data is then updated through normal replication. Each restored directory partition is updated with that of its replication partners.

2.      Describe what happens in an authoritative restore.

An authoritative restore brings a domain or a container back to the state it was in at the time of backup and overwrites all changes made since the backup.

3.      Which method of restore should you use if you accidentally delete an OU?

Authoritative.

4.      Which method of restore should you use if a domain controller has completely

failed due to hardware or software problems?

Nonauthoritative.

5.      Which of the following Ntdsutil command parameters should you use if you want

to restore the entire directory?

a. Restore database

b. Restore subtree

c. Database restore

d. Subtree restore

The correct answer is a. Database restore and subtree restore are not Ntdsutil command parameters. Restore subtree is used to restore a portion or a subtree of the directory.

Passwords are the keys to access control. You can do much for the security of your network if you implement a strong password policy and help users to develop strong passwords.

What Makes a Strong Password?

A strong password must be defined in the context of its use. No matter the system, we know that in general long passwords are more secure than short ones. And we know that passwords that are not dictionary -words or the same as account names, pet names, parents' names, and so on are harder to guess or crack. However, because password-cracking software is specific to the operating systems it is used on, and because ordinary desktop computers have the speed and memory available to crack ordinaiy passwords in ever reduced amounts of time, creating strong passwords requires more than following the recommendations of the assigned password policy in the domain.

Password crackers work by attempting dictionary and heuristic attacks followed by a brute-force attack. Dictionary attacks simply hash each word in the dictionary using the algorithm that is used by the authentication process, and then compare each password hash with the hashed dictionary words. Heuristic attacks make assumptions about user behavior and attempt to guess some portion of the password. They understand, for example, that users' first choice for including capital letters is at the front of a word, and their first choice for including numbers is at the end. Brute-force attacks simply try each possible permutation of the existing letters and numbers.

Modern password crackers meant for Windows systems also start with an attempt to crack the LAN Manager password. This password can be a maximum of 14 characters in length, splits the password into two seven-character words and hashes them independently, and does not distinguish between uppercase and lowercase letters. This makes it very easy to use a brute-force attack against these passwords. Users can decrease the likelihood of their password being successfully attacked by creating passwords longer than 14 characters. This means that the LM-style cracking attacks will not work, because no LM password hash will be stored. Designers can assist by designing authentication practices that limit or remove the use of LM passwords and remove the LM password hash from the account database. For more information about these methodologies, see Lesson 2 earlier in this chapter.

Just as authentication can be made more robust by selecting more secure authentication protocols, the process can also be improved by strengthening password controls. The first criteria for establishing secure account and password requirements is to not treat the development of an account policy as a trivial activity. Configuring the policy is a trivial activity; determining how to best secure an organization using these settings is not. Without implementing a proper account and password policy, your attempt to secure access to information resources will be futile.

After this lesson, you will be able to

•       Describe the process for establishing account and password requirements for information security.

•       Describe the qualities of strong passwords and password policies.

•       Describe the password policies available for Windows Server 2003-based networks.

•       Explain the technical controls for password policies and their limitations.

•       Determine organizational climate and information sensitivity.

•       Describe options for managing the need for multiple policies.

•       Design a strong password policy.

•       Explain the considerations for deciding to design an account lockout policy.

•       Design an account lockout policy.

•       Recommend alternatives to password-based authentication.

Estimated lesson time: 45 minutes

The Process: Establishing Account and Password Requirements for Information

Follow this process to establish account and password requirements:

1. Design a strong password policy. This includes the following steps:

a. Make sure you understand the qualities of a strong password policy and the password policies that you can use in Windows Server 2003-based networks. These characteristics are implemented using technical controls, training, and enforcement.

Designing a Logical Authentication Strategy

b.      Identify the technical controls available for password policies, and review their

limitations. To design a strong password policy, the designer must under¬

stand how to use the technical controls that are available in Windows Server

2003 and how these controls need to be supported. It is crucial that you don't

just fill in the settings in the interface but that you take into account the realities of the workplace. The design should support the technical controls.

c.      Determine the climate of the organization and the sensitivity of the information the policy will protect. Security experts agree that a password policy must

be created, but there is great disagreement about how that policy should be

set. Part of your job is to determine the appropriate policy for the organization at hand. This involves more than just understanding technical issues such

as how to make a complex password or that longer passwords are harder to

crack. You must also examine the culture of the organization, its tolerance for

risk, and the nature of the data it protects.

d.      Identify the need, if any, for more than one password policy and how this can

be managed.

e.      Review password policy guidelines, and design the password policy.

2.      Decide whether you want an account lockout policy, and if you clo, design it. An

account lockout policy is a technical control that can block account access.

3.      Be aware of alternatives to password-based authentication and be ready to make

recommendations. Password-based authentication will always be subject to the

weaknesses of human memory and misunderstanding. Strong password policies

are often obviated by human practices such as writing down passwords in obvious

places, and it is difficult to convince all employees to construct strong passwords

and not to share them. Therefore, it is imperative that you be aware of and ready

to recommend alternatives to password authentication.

The rest of this lesson teaches the key elements of this process.