Apply Your Knowledge

Exercises

1.1 Analyzing a Local Computer's Security Settings

In this exercise, you use the Security Configuration and Analysis snap-in to perform an analysis of the local computer's security.

Estimated time: 20 minutes

Open your custom security console or create one that contains the Security Configuration and Analysis snap-in.
Right-click the Security Configuration and Analysis node and select Open Database from the context menu.
Create a new database by entering the name securitydb .
Select the security template you are loading into the database for this exercise.
Right-click the Security Configuration and Analysis node and select Analyze Computer Now to start the analysis.
Provide an error log name and pathname and click OK to start the analysis process. After the analysis is complete, you are returned to the Security Configuration and Analysis snap-in.
Compare the database settings to those of the local computer. How are they different? How are they the same? What do you need to change to implement the required security?

1.2 Importing a Security Template into Group Policy

In this exercise, you import a security template into a Group Policy Object.

Estimated time: 15 minutes

Open the Active Directory Users and Computers console.
Locate the domain or OU to which you want to apply the security template.
Right-click the appropriate OU or domain and select Properties from the context menu. The Properties dialog box appears. Select the Group Policy tab.
To create a new GPO, click the New button. Supply a name for the new GPO and press Enter.
Click the Edit button to open the Group Policy Editor for the selected GPO.
Expand the nodes as follows : Computer Configuration, Windows Settings, Security Settings. Right-click the Security Settings node and select Import Policy from the context menu.
Select the template to be imported.

Review Questions

1:	You are trying to explain to your CIO why using security templates to configure security is a better idea than directly configuring a GPO. What are some reasons that you might present to him to support your position?
2:	You have just completed an analysis of one of your Windows Server 2003 computers using the `secedit.exe` command. How can you now most easily view the analysis output produced?
3:	Security templates in Windows Server 2003 have what file extension?

Exam Questions

1:	You are the administrator of a Windows Server 2003 Active Directory network. Your network consists of 1,500 Windows XP Professional client computers spread out over 15 OUs with approximately 100 computers each. Your network also has 300 Windows Server 2003 servers fulfilling various roles, including domain controllers, file servers, print servers, IIS servers, and Certificate Services servers. You have just finished creating a customized security template that specifies the Account Policy and auditing settings that are required by your organization's corporate policy for specific departments. What is the best way for you to apply this template to only the Sales, Marketing, Production, and Engineering OUs? Import the security template at the domain level into a GPO. Import the security template into each required OU by using a GPO. Script the `secedit.exe` command to apply the security template to the required computers. Manually apply the security template to each of the computers.
2:	You are the network administrator for Just Right Tops, LLC. Your network consists of three geographically distant sites that function as three different domains. No site has a direct link to any other site. You have recently completed the creation of two custom security templates that are to be applied to all computers in all three sites of your company network. How can you most easily deploy these security templates at all three sites? Create and configure a new domain controller for each remote site. Apply the security templates to the domain controllers. Place a new domain controller in each site and allow Active Directory to replicate. Export the security templates into `.inf` files by using the Security Configuration and Analysis snap-in. Deliver the security templates to the remote location and import them into the appropriate GPOs. Establish connectivity between all sites and force the remote site domain controllers to perform replication with the local site domain controllers after implementing the new security templates. Re-create the security templates at each remote site and then import them into the appropriate GPOs.
3:	You are the network administrator of the Gidget's Widgets, LLC, corporate network. You have instructed Andrea, your assistant administrator, to configure file access auditing for all files in the `CorpDocs` folder on your file server. In which node of the Group Policy Editor will Andrea find the auditing options? Account Policies Local Policies Restricted Groups File System
4:	You are the network administrator for Sunbrew Dairy Farms, Inc. You are currently interviewing a candidate for the position of assistant network administrator. You have asked Christopher, the candidate, what the `secedit.exe` command can be used for. Which of the following answers that Christopher gives you are correct? (Choose all that apply.) `secedit.exe` can be used to analyze the current security settings. `secedit.exe` can be used to apply new security settings to a computer. `secedit.exe` can be used to apply new security settings to a GPO. `secedit.exe` can be scripted, allowing it to be run on many computers across the entire network.
5:	You are interviewing Austin for the position of assistant network security administrator. When you ask him what the best uses for an Organizational Unit are, what correct answers do you expect to hear from him? (Choose two correct answers.) OUs can be used to group together objects for simplified network administration. OUs can be used to create child domains within the DNS namespace. OUs can be used to create child domains with the Active Directory forest environment. OUs can be used to apply role-specific settings to groups of like objects.
6:	In a Windows Server 2003 Active Directory environment, what constitutes the security boundary? The domain The Organizational Unit The forest The security principal
7:	Austin is the network administrator for the Eternal Light Group, LLC. He is attempting to perform an analysis of a computer by using the Security Configuration and Analysis snap-in. What is the correct order of performance of the following steps? (Delete any steps that are not needed.) Select the security template to be used in the analysis. Right-click Security Configuration and Analysis and then select Analyze Computer Now. Select the log file to be used in the analysis. Right-click Security Configuration and Analysis and then select Open Database. Right-click Security Configuration and Analysis and then select Configure Computer Now. Select the database to be used in the analysis. 2, 1, 3, 4, 6, 5 4, 1, 6, 2, 5, 3 4, 6, 1, 2, 3 2, 6, 1, 3, 4
8:	You have just completed an analysis of a computer by using the Security Configuration and Analysis snap-in. When you examine the results, you notice several items that have red circle with white X icons next to them. What do they indicate ? The item is not defined in the analysis database and was not examined on the computer. The item is defined in the analysis database and on the computer, and it matches the currently configured setting. The item is defined in the analysis database but not on the computer. The item is defined in the analysis database and on the computer, but it does not match the currently configured setting.
9:	You are the network administrator for Gidget's Widgets, LLC. You are trying to explain to one of your assistant administrators, Hannah, how the `secedit.exe` command can be used to apply security templates to computers. Which of the following additional switches do you need to make sure she uses with the `secedit /configure` command? (Choose all that apply.) `/analyze` `/db` `/log` `/cfg`
10:	Chris is creating a security plan for her network that will be using a role-based approach. If her domain has the following types of servers, how many different security policies should she plan on using? Domain Controllers File Servers Print Servers IIS Servers DHCP Servers 5 6 7 8
11:	Chris is creating a security plan for her network that will be using a role-based approach. What is the first step in implementing a role-based security configuration for her Active Directory network? Implementing a Domain Baseline Security Policy Implementing a Domain Controller Baseline Security Policy Implementing a Member Server Baseline Security Policy Implementing role-specific security policies for her different member servers
12:	Christopher is preparing to implement a role-based security solution on his Windows Server 2003 Active Directory network. He, however, does not know the starting configuration of his workstation clients . He proposes that he will just apply the `Setup Security.inf` security template located on each computer to that computer to restore the settings to a known state with all settings being the same across all client workstations. What is wrong with his proposal? The `Setup Security.inf` security template is found only on domain controllers. The `Setup Security.inf` security template is specific to the specific computer and can vary from one computer to the next. The `Setup Security.inf` security template is found only on computers that are upgraded from a previous operating system. The `Setup Security.inf` security template cannot actually be used to apply security settings to a computer; it is only a record of the initial security configuration the computer had.
13:	Where can you find the preconfigured security templates that are installed with Windows Server 2003? `%systemroot%\templates` `%systemroot%\security\templates` `%systemroot%\security\` `%systemroot%\security\default\templates`
14:	What limitation of the Security Configuration and Analysis snap-in can you get around by using Group Policy Objects? Security Configuration and Analysis cannot be used to implement security policies on a computer. Security Configuration and Analysis cannot be used to implement security policies at the domain level. Security Configuration and Analysis cannot be used to determine the current security configuration of a computer. Security Configuration and Analysis has no command-line equivalent.
15:	Christopher is preparing to use the `secedit.exe` command to analyze the security on one of his member servers. If Christopher is using the secure workstation security template as his comparison point and needs to ensure that the analysis database is clear before importing the security template, which of the following choices represents the correct command that Christopher should enter to perform the analysis? [View full width] [View full width] secedit /analyze /overwrite /db c:\sectst\sectst1.sdb /cfg C:\WINDOWS\security\templates \securedc.inf /log c:\sectst\sectst1.log [View full width] [View full width] secedit /configure /db c:\sectst\sectst1.sdb /cfg C:\WINDOWS\security\templates\securedc .inf /log c:\sectst\sectst1.log [View full width] [View full width] secedit /analyze /db c:\sectst\sectst1.sdb /cfg C:\WINDOWS\security\templates\securews.inf /log c:\sectst\sectst1.log [View full width] [View full width] secedit /analyze /overwrite /db c:\sectst\sectst1.sdb /cfg C:\WINDOWS\security\templates \securews.inf /log c:\sectst\sectst1.log

Answers to Review Questions


A1:	By using security templates, you can perform configuration and testing on a computer that will not result in changes being applied across the network until they are ready. In addition, by using a security template, you are in effect using a script: You can ensure that all changes will be identical to all computers they are applied to, even if they are in different OUs or domains. For more information, see the section "The Windows Server 2003 Security Templates."

A2:	Although `secedit.exe` allows you to analyze and configure computers throughout the network from the command line, you cannot easily view the analysis reports created from it except through Security Configuration and Analysis. Although you can view the log file in a text editor, such as Notepad, accurately determining the results of the analysis is not easy. For more information, see the section "The Security Configuration and Analysis Snap-in."

A3:	Security templates are flat text files that have the `.inf` file extension. For more information, see the section "The Windows Server 2003 Security Templates."

Answers to Exam Questions


A1:	B. The best way to apply the settings to only computers that require them is to import the template into a GPO associated with each OU that requires the settings. Importing the security template into the domain-level GPO would apply the settings to all computers in the domain, most likely with unwanted side effects. For more information, see the section "Group Policy Security Extensions."

A2:	B. Because you created custom security templates using the Security Configuration and Analysis snap-in, you can simply export them into `.inf` files and transfer them to the remote sites via any available means. When they are at the remote sites, the security templates can be imported to the appropriate GPOs, thus placing them into effect. For more information, see the section "Group Policy Security Extensions."

A3:	B. The Local Policies node of the Group Policy Editor contains three subnodes: Audit Policy, User Rights Assignment, and Security Options. Andrea will find the auditing items she will need to configure in the Audit Policy subnode. For more information, see the section "The Security Configuration and Analysis Snap-in."

A4:	A, B, D. The `secedit.exe` command can be used to analyze a computer, configure a computer, export a computer's security settings to a template, import the settings from a template, validate the context of a template, and create a rollback template. Because `secedit.exe` is a command-line tool, you can script it and use it on many computers across an entire network. For more information, see the section "secedit.exe."

A5:	A, D. Organizational Units can be used, very efficiently in fact, to group together objects that are similar in nature for easier administration. As well, you can apply security and other configuration settings to an OU to quickly have these settings applied to the objects within the OU itself. OUs should not be thought of as just containers to hold objects for the sake of better organizing Active Directory from a visual standpoint; they are actually very powerful administrative tools when properly used. Permissions to perform administrative functions can be assigned through delegation to nonadministrators at the OU level as well, further enhancing the administrative benefit of OUs. For more information, see the section "Implementing Enterprise Security."

A6:	C. Contrary to the popular belief in the past, the forest is the only absolute security boundary in a Windows Server 2003 Active Directory domain. Domains are only administrative boundaries: A user with Domain Admin credentials in one domain could possibly gain domain administrative credentials in other domains through unscrupulous actions. For more information, see the section "Implementing Enterprise Security."

A7:	C. The correct steps to be used to perform an analysis of a computer with the Security Configuration and Analysis snap-in are as follows: Select Open Database, select the database, select the security template, select Analyze Computer, and select the log file. For more information, see the section "The Security Configuration and Analysis Snap-in."

A8:	D. A red circle with white X icon next to an item in the Security Configuration and Analysis snap-in results indicates that the item is present in both the database and the computer but does not match the currently configured setting. For more information, see the section "The Security Configuration and Analysis Snap-in."

A9:	B, C, D. The `/db` switch specifies the pathname and filename of the database to be used, the `/log` switch specifies the pathname and filename of the error log to be used during the process, and the `/cfg` switch specifies the pathname and filename of the security template to be loaded into the database. For more information, see the section "secedit.exe."

A10:	C. Chris should be using seven (7) different security policies as follows: Domain Baseline Policy, Domain Controllers OU Policy, Member Servers OU Baseline Policy, File Servers OU Policy, Print Servers OU Policy, IIS Servers OU Policy, and DHCP Servers OU Policy. Each type of server has specific security requirements that necessitate different security policies. The domain itself needs a Baseline Security Policy that takes care of things such as password and account lockout policies. Also, the Member Servers OU needs a Baseline Security Policy to configure items that apply to all member servers such as auditing and user rights assignments. For more information, see the section "Using Role-Based Security Templates."

A11:	A. The first step to successfully implementing a role-based security solution is to create the baselinethe starting point. Thus, Chris needs to implement a Domain Baseline Security Policy before she moves on. For more information, see the section "Implementing Enterprise Security."

A12:	B. Christopher's mistake is in the fact that he proposes to use the `Setup Security.inf` security template located on each client workstation to apply the same settings across all his workstations. The `Setup Security.inf` security template is created during the installation of Windows on the computereither clean or upgradeand varies from one computer to the next. For more information, see the section "The Windows Server 2003 Security Templates."

A13:	B. The preconfigured security templates that install with Windows Server 2003 can be found in the `%systemroot%\security\templates` directory. Typically, this is `C:\WINDOWS\security\templates` . For more information, see the section "Planning and Implementing Role-Based Security Using Security Templates."

A14:	B. The only real failing in Security Configuration and Analysis is that it cannot be used to analyze or configure security on anything other than the local computer. It does not have the capability to be targeted at a remote computer like some of the other MMC snap-ins. For more information, see the section "The Security Configuration and Analysis Snap-in."

A15:	D. Only option D meets all the specified requirements that Christopher has for performing this analysis: He must use the secure template for a member server ( `securews.inf` ), and he must ensure that the database is cleared prior to importing the security template. Response C appears to meet these requirements but does not provide for clearing the database before importing the security template. For more information, see the section "secedit.exe."