Foreword

Congratulations! By picking up this book, you have taken a big step forward in your career. Whether you are an IT guru with years of experience, a neophyte fresh to the exciting world of information technology, or somewhere in the middle, this book will help you get to your destination by providing you with the information and tools you need to take the challenge of a very exciting test: Implementing and Administering Security in a Microsoft Windows 2000 Network.

Computer security seems to be a topic that is forever in the news. Not many a week goes by without some new computer hack, crack, flaw, or vulnerability being discovered and announced. System administrators find themselves on the receiving end of this threat most often-and all of sudden, it seems like that admin is no longer the most powerful person in the organization. The problem is not that Windows 2000 (or Windows XP and Windows .NET Server) is any more a security risk than any other operating system available for use. The problem lies in the fact that the vast majority of publicly accessible computers are running Windows-based operating systems, many of them Windows 2000. This sheer disadvantage (in terms of the number of available targets), combined with the desire of unscrupulous individuals to embarrass admins and Microsoft alike, is what leads to problems. The additional fact that many Windows admins don't really fully understand the criticality of highly secure computers and how to keep them secure only makes the situation that much greater a problem-and that much more attractive an opportunity to people who would seek to gain unauthorized access to a system or network.

Securing a Windows 2000 network does not have to be a difficult process. Microsoft has taken many steps to see to it that you have in your hands as much power as possible to secure your network. That is the good news. To that end, you should be very careful when configuring the security settings for your computers and your entire network. Simply rushing out to enforce a more secure network on your organization is not going to work-you will either find yourself making mistakes (which will often be quite costly), creating new vulnerabilities, or interfering with the daily work routine of your users. It's conceivable that you could even have all three of these issues come biting at your heels all at once. That is the bad news.

But don't fret; all is not lost. With a careful and methodical study of the nuances of Windows 2000 security, you can properly secure your systems and still allow your users' daily work to continue-with minimal negative impact. This book aims not to make you a Windows 2000 security expert but instead to make you into a Windows 2000 administrator who is more aware of the available and necessary options, considerations, and procedures.

This Microsoft Certified Professional (MCP) exam, number 70-214, is an elective exam for the prestigious Microsoft Certified Systems Engineer (MCSE) and Microsoft Certified Systems Administrator (MCSA) certifications. At the time of this exam's release, the Windows 2000 certification track was two years old. The 70-214 exam is a result of the critical need for a security-based examination that verifies an administrator's ability to implement and maintain secure Windows 2000 networks during these two years. It makes sense, after all; you can trace all the existing design exams to a corresponding implementing exam. In this case, exam 70-214 pairs up with the already existing exam 70-220 (Designing Security for a Microsoft Windows 2000 Network).

What Are the MCSA and MCSE?

It's hard for some of us to believe (or even remember), but the MCP program turned 10 years old in the spring of 2002. From its humble beginnings as not quite an organized system, the Microsoft MCP program has grown into one of the largest and most prestigious information technology certification programs. Microsoft most certainly leads the way in number and subject matter of exams delivered, with one or more exams to fit just about every person. Today, Microsoft has a dozen different IT certification tracks, ranging from networking to office suites. The MCSA and MCSE tracks specifically deal with the networking side of Microsoft's product line.

MCSA Background

Microsoft's newest networking certification track, the Microsoft Certified Systems Administrator, or MCSA, is a little over a year old at the time of this writing. In that year, it has quickly gained popularity as a solid foundation for people who handle day-to-day administration and maintenance of Windows 2000 networks.

Typical duties of the MCSA certified individual include managing, supporting, and troubleshooting daily needs associated with the operation of a Windows 2000 network. Microsoft specifies that an MCSA will typically have 6 to 12 months of hands-on experience managing and supporting workstations and servers in an existing Windows 2000 infrastructure. This is a key distinction from the MCSE certification, which may involve designing and implementing a new Windows 2000 infrastructure.

Some typical job titles that MCSAs can have include:

• Systems Administrator

• Network Administrator

• Information Systems Administrator

• Network Operations Analyst

• Network Technician

• Technical Support Specialist

MCSE Background

The Microsoft Certified Systems Engineer, or MCSE, certification has existed for some time now, dating back to the Windows NT 3.51 days and possibly even earlier. The MCSE certification had come under much fire during the Windows NT 4.0 track due to the ease of obtaining it; many people simply memorized the material and took the exams, achieving the MCSE certification without having enough (or in some cases, any) real hands-on experience with the product. Microsoft took great pains when it rolled out the Windows 2000 MCSE track to ensure that it corrected these issues by changing the testing experience. New question types and larger, more complex question banks were implemented in an effort to once again make the MCSE certification meaningful and difficult to attain. From all accounts, it appears that Microsoft's efforts have been largely successful, although no amount of work and planning can stop all individuals who would look to circumvent the system.

The typical duties of the Windows 2000 MCSE certified individual include planning, designing, and implementing Windows 2000 server solutions and architectures. In other words, an MCSE-certified individual should expect to spend more time designing and implementing new solutions than would the MCSA-certified individual. For this reason, the exam requirements for the MCSE certification include three design exams. To this end, Microsoft recommends that the MCSE certified individual have one or more years of real-world, hands-on experience analyzing business and technical requirements to support planning, designing, and implementing solutions capitalizing on Microsoft products and technologies-not including only Windows 2000.

Some typical job titles of MCSEs include:

• Systems Engineer

• Network Engineer

• Systems Analyst

• Network Analyst

• Technical Consultant