Chapter Summary

In this chapter, we examined some of the many options that are available to create and maintain more secure Windows Server 2003 networks.

KEY TERMS

Before taking the exam, make sure you are comfortable with the definitions and concepts for each of the following key terms. You can use Appendix A, "Glossary," for quick reference.

• 802.1x

• Extensible Authentication Protocol (EAP)

• IPSec

• Internet Key Exchange (IKE)

• Microsoft Management Console (MMC)

• RADIUS

• Remote Assistance

• Remote Desktop for Administration

• Remote Desktop Protocol (RDP)

• Terminal Services

• Transport Mode

• Tunnel Mode

• Wireless LAN (WLAN)

Remote Assistance and Remote Desktop for Administration are both Remote Desktop Protocol “based services and can be used to remotely manage a computer. Remote Assistance is typically initiated by a user (the Novice) asking an administrator (the Expert) for help by using Windows Messenger or an email request. A file request can also be used if required. After the Expert has accepted the invitation , he or she can view and even take control of the remote computer if the Novice allows. This provides a means to help the remote user with problems on his or her computer. Remote Desktop for Administration is the replacement for Terminal Services Administration mode in Windows 2000 and does not require an invitation request to be sent. An administrator can initiate a connection to a server and remotely administer the server ”even shutting it down or restarting it. Only two concurrent Remote Desktop for Administration connections can be created to any one server.

With the recent rise in popularity and availability of wireless LANs, security issues have begun to occur within organizations using WLANs. Although several vendors create full-featured security solutions for 802.11 wireless networks, Microsoft has also provided a basic security implementation within Windows Server 2003. Using Group Policy, you can configure wireless network policies that can be used to determine what wireless networks your clients can connect to and how the connection must be made with respect to authentication and encryption.

IPSec can be used to secure communications both on your intranet and between endpoints over the Internet. VPNs can be created using IPSec and L2TP to ensure authenticity, integrity, and confidentiality of data in transit. The IPSec implementation in Windows Server 2003 has received several improvements since Windows 2000, most notably the capability to pass through NAT devices. Also, the Diffie-Hellman key exchange has been increased to a maximum of 2,048 bits to further increase the security of the secret key.