PROPOSAL OF WINDOWS NETWORK

Transcription

1 PROPOSAL OF WINDOWS NETWORK By: Class: CMIT 370 Administering Windows Servers Author: Rev: 1.0 Date: Page 1 of 10

2 OVERVIEW This is a proposal for Ear Dynamics to integrate a Windows Network Infrastructure. Ear Dynamics has three locations Mississippi, Lowa and Georgia. They are planning for an IT Infrastructure that can grow with them with least required maintenance. The main staffs are at Georgia office and want to setup secure remote access for Lowa office. For the company to setup & implementation of Network & System, Microsoft windows server can play precious role. In this proposal, we are going to cover some roles of Windows server 2012 r2, edition of Windows Server, Active Directory Domain services (ADDS), Group Policy Object (GPO), DNS, File Services, Remote Services and Windows server update services (WSUS). This Window Server network will provide the best network services to Ear Dynamics and prepare the company for quick growing with a minimum required maintenance. WINDOWS SERVER 2012 R2 In Windows server 2012 r2, there are four editions are available as below: Windows Server 2012 R2 Products and Editions Roles & Features Datacenter Standard Essentials Foundation Maximum number based on licenses based on Page 2 of 10

3 of users licenses Maximum number of 64-bit sockets Maximum RAM 4 TB 4 TB 64 GB 32 GB Server can join a domain Yes Yes For migration only For migration only Active Directory Yes Yes Required Yes (optional) Domain Services DNS Server Yes Yes Yes Yes File Services Yes Yes Yes Yes Hyper-V Yes (Unlimited VM) Yes (2 VM) No No RODC Yes Yes No No Storage Spaces Yes Yes Yes Yes Windows Server Update Services (WSUS) Yes Yes Yes No (Windows Server 2012 R2 Products and Editions Comparison) Ear Dynamics solution is on based on Microsoft Windows Server 2012 R2 & its Datacenter edition because Microsoft Windows Server 2012 R2 Datacenter gives us greater flexibility and agility when it comes to growing your company. As per above comparison chart of windows server edition we can see that in Datacenter have unlimited Virtual Machines (VM), WSUS, DNS, WSUS & File services. For a growing company virtualization is very important to save the Cost of owner in IT Infrastructure. We have flexibility to create unlimited Numbers of virtual machine using Windows Server 2012 r2 role called Hyper-V. After installation the Hyper-V role we can add a Virtual machine and install the Operation system (OS) on them. ACTIVE DIRECTORY The Active Directory (AD) is nothing just like a centralised directory which can be accessed through the LAN and it s the base of Windows Server Network. Being a centralised distributed database it stores and manages all the information about your network resources, as well as application-specific data from directory-enabled applications. Using the active directory system administrator can manage users, computers, and objects into a hierarchical collection of containers known as the logical structure. For good administration security and scalability purpose Active Directory objects can be categorised in 2 parts: Container object: Forest, Tree, Domain, OU & Leaf Object: Computers, Printer, users. Page 3 of 10

4 In this container, forest is largest container object which provide the fundamental security boundary within AD. A forest contains one or more tree and tree contains the domain and in domain OU is a smallest container object used for delegation & applying security.. (Active directory design-june 09, 2001) The model of AD being used will be the Single Forest Model with a Domain Controller (DC) located in Georgia office. The Georgia will also have an Additional Domain Controller (ADC) for fault tolerance and recovery. Now the Name of domain, DC & ADC will be as below: Domain Name: Eardynamics.com At Georgia Office: Primary Domain Controller (DC) Name: DC1 & FQDN Name: DC1. Eardynamics.com Additional Domain Controller (ADC) Name: DC2 & FQDN Name: DC2. Eardynamics.com At Mississippi Office: Read-only Domain controllers (RODC) Name: DC3 & FQDN Name: DC3. Eardynamics.com At Lowa Office: Read-only Domain controllers (RODC) Name: DC4 & FQDN Name: DC4. Eardynamics.com Due to being data security on priority, we can do an implementation of Read-only Domain Controllers (RODC) into our Windows Network at our branch sites. RODC is unidirectional replication, means each RODC will have a pristine copy of our AD on it from the DC1, but unable to replicate back to the DC1, thus restricting potentially malicious updates that can originate in a branch office because no changes can replicate from an RODC, only the RODC in the branch office can be compromised. (Advantages That an RODC Can Provide to an Existing Deployment-April 26, 2012) As we are going to use RODC at each of our branch sites Mississippi & Lowa and our at Georgia office, DC1 must have Flexible Single-Master (FSMO) roles on it. Page 4 of 10

5 There are five FSMO roles on Windows server 2012 R2 as below: 1. Schema Master (One per forest) It s collection of classes and attributes. Responsible for schema update. Schema also update when you are installing the exchange server. Only DC than can process schema update. 2. Domain Naming Master (One per forest) Used to add and to remove domains and application partitions to/from the forest. Must be online when domains or application partitions are added or removed. 3. RID Master (One per domain) Allocates active and standby RID pools to replica DC in the same domain. Must be online for newly promoted domain controllers to obtain a local RID pool that is required to advertise or when existing domain controllers have to update their current or standby RID pool allocation. 4. Primary Domain Controller (One per domain) Receives password updates when passwords are changed for the computer and for user accounts that are on replica domain controllers Consulted by replica DC that service authentication requests that have mismatched passwords. Default target domain controller for Group Policy updates. Target domain controller for legacy applications that perform writable operations and for some admin tools Must be online and accessible 24 hours a day, seven days a week. 5. Infrastructure Master (One per domain) A separate infrastructure master is created for each application partition including the default forest-wide and domain-wide application partitions created by Windows Server 2003 and later domain controllers. Updates cross-domain references and phantoms from the global catalog. After Installation of ADDS Role and promote the Windows Server as Domain controller by default all FSMO roles will be automatically install on Primary domain Controller (DC1). Forest wide there are two FSMO roles and remaining three FSMO roles are domain wide. Ear Dynamics can do Kerberos authentication on Network which is a default authentication of windows server 2012 r2. Active Directory Domain Services (ADDS) is the recommended and Page 5 of 10

6 default technology for storing identity information. Active Directory is required for default NTLM and Kerberos implementations. (Active Directory FSMO roles in Windows) GROUP POLICY Group Policy is simply the easiest way to reach out and configure computer and user settings on networks based on Active Directory Domain Services (AD DS). If your business is not using Group Policy, you are missing a huge opportunity to reduce costs, control configurations, keep users productive and happy, and harden security. Think of Group Policy as touch once, configure many. Therefore we can say that Group Policy provides an infrastructure for centralized configuration management of the operating system and applications that run on the operating system. For Ear Dynamics we will setup our GPO structure based on their business requirements. First of all we need to create the Organizational Units (OU) & GPO to further link with GPO but before doing it, we ll classify department, Job function & location etc. to use these information to create OU as HR, Account, Marketing, Sales, IT, Manager, Executive, Assistant, Mississippi, Lowa and Georgia. Once we have created these OUs we can then go to Group Policy management to create the GPO to assign permissions and linking them to the correct OU. We can apply the GPO on Computer or User as per requirements. Here we are going to setup a password Policy as below: First of all, create a new GPO at the top level of the domain as Domain Password Policy. Edit the Domain Password Policy GPO and go to Computer Configurations Policy Windows Settings Security Settings Account Policy Password Policy and configured the password policies settings to the configuration you desire. Page 6 of 10

7 Once you have configured the password policy settings make the Domain Password Policy GPO the highest in the Linked GPO processing order. This is an example of GPO; apart from this we can apply thousands of GPO s to users and computers to achieve the maximum security and control on Network. We will additionally set the advanced Audit policy beneath Security Settings Advanced Audit Policy Configuration can facilitate your organization audit compliance with vital businessrelated and security-related rules by following exactly outlined activities, such as: A group administrator has changed settings or information on servers that contain finance data. User within a defined group has accessed an important file. The correct system access control list is applied to every file and folder/ registry key on a computer or file share as a verifiable safeguard against undetected access. These Advanced Audit policy settings permit you to pick solely the behaviours that you just need to watch. You ll exclude audit results for behaviours that square measure of very little or no concern to you, or behaviours that make associate degree excessive range of log entries. Audit policy settings underneath Security Settings Advanced Audit Policy Configuration square measure obtainable within the following categories: Global Object Access, Account Logon, Logon, Account Management, Logon/Logoff, Object Access, Detailed Tracking, DS Access, Policy Change, Privilege Use, System, etc. (Group Policy for Beginners-April 27, 2011) DNS Domain Naming Service (DNS) is necessary for any domain environment as we can t remember the IP address for all host/website. To resolve this issue now we have DNS which help us to map the IP addresses with namespaces. The namespace for Company will be Eardynamics.com. Preferred DNS is: IP Address of DC1. Eardynamics.com Alternate DNS is: IP Address of DC2. Eardynamics.com Page 7 of 10

8 Now in Windows server 2012 r2 Active Directory integrated DNS permits Active Directory storage and replication of DNS zone databases. because the company grows we are going to implement DNS zones and any we will divide DNS namespace into domains & additionally divide your DNS namespace into zones that store name data regarding one or additional DNS domains. A zone is that the authoritative supply for data regarding every DNS name that's enclosed within the zone. A zone starts with one DNS name. If other domains are added below the initial domain, these domains will either be a part of an equivalent zone or belong to a different zone. The instance below shows what the microsoft.com zone breakdown would appear as if. As you'll be able to see you continue to have the microsoft.com domain, however the new zone is example.microsoft.com zone currently. (Understanding Zones) FILE SHARING SERVICES We need to also implement a file sharing system on our Network that enable to user access his data from one centralized place and may apply the Disk Quota. Introduce with the release of Windows Server 2003 R2 is that the file server Resource Manager (FSRM). file server Resource Manager may be a suite of tools for Windows Server that enables administrators to know, control, and manage the number and kind of information that's hold on their servers. By using file server Resource Manager, administrators will place quotas on folders and volumes, actively screen files, and generate comprehensive storage reports. This set of advanced instruments not solely helps the administrator with efficiency monitor existing storage resources, however it additionally aids within the coming up with and implementation of future policy changes. The next tool for our file sharing setup we'll explore is that the Distributed file system (DFS) that Page 8 of 10

9 permits administrators to group shared folders placed on totally different servers by transparently connecting them to at least one or a lot of DFS namespaces. A DFS namespace could be a virtual view of shared folders in a corporation. Using the DFS tools, an administrator selects that shared folders to present within the namespace, designs the hierarchy during which those folders seem, and determines the names that the shared folders show within the namespace. Once a user views the namespace, the folders seem to reside on one, high-capacity hard disk. Users will navigate the namespace with no need to grasp the server names or shared folders hosting the information. DFS conjointly provides several different edges, together with fault tolerance and load-sharing capabilities, creating it ideal for every type of organizations. REMOTE SERVICES The Lowa site needs a secure remote access to Georgia office, so same can be fulfilled through Virtual Private Network (VPN). There are two main methods that help provide secure connectivity between non-public networks and enabling network access for remote users. Dial-up/ leased line connections & VPN connections VPN connections use either Point-to-Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol/Internet Protocol security (L2TP/IPSec) over associate intermediate network. A VPN solution includes advanced security technologies such as data encryption, authentication, authorization, and Network Access Quarantine Control. There are two types of VPN connections: Remote access VPN & Site-to-site VPN. For the authentication we'll use the Secure Socket Layer (SSL) protocol that provides us with a layer of on-line security such as that of what you discover with on-line banking and looking. we are able to simply expand out our remote services through group Policy if alternative users need these services. WSUS (WINDOWS SERVER UPDATE SERVICES) Windows Updates are an important part of our day to day update systems and servers. WSUS Download updates from Microsoft & Store locally. Allow you to approve or decline updates. Put computers into groups for administrative purposes. The WSUS Configuration will be as below; 1-Type of updates: Critical/Definition/Drivers/Feature packs/security/service Pack/Tools/update Rollups/Updates 2-Update for: Windows Operating System Page 9 of 10

10 Microsoft Products. 3-Can only get updates that are on the upstream server. To Set Client side Targeting in WUS we need to 1-Create an OU (Client side Targeting) on Domain Controller (DC) and make the members to client computers. 2-Open the Group Policy Management & Create GPO for OU Client side Targeting and edit it to set the Policy. Configure automatic update, Specify the Microsoft update service location, Client side Targeting. This will be done at Georgia office to make sure that our system administrators are ready to download Microsoft updates, take a look at those updates so deploy those updates as required. We are going to set this up as a virtual machine on one of our servers and can enable this server to go out and appearance for updates on a periodic basis as outline in WSUS GPO. No different servers or clients are directed to Microsoft for updates, instead they'll be directed to WSUS server that may have updates that are tested and approved for downloading. SUMMARY For a growing company it's necessary to hold an IT solution which will simply grow with you. Ear Dynamics helps to provide the Microsoft & Virtualization solution to save the cost of owner in terms of save the value of Server area, electricity, software & hardware etc. we've enforced a Windows Server 2012 R2 Datacenter primarily based system, with Microsoft Remote desktop service (RDS) for the client. And, as a result of we work with the world s leading technology vendors and partners, you gain better of breed solutions and services to assist you meet your business goals. REFERENCES: Windows Server 2012 R2 Products and Editions Comparison Active directory design (June 09, 2001) Advantages That an RODC Can Provide to an Existing Deployment (April 26, 2012) Active Directory FSMO roles in Windows Group Policy for Beginners (April 27, 2011) Understanding Zones Page 10 of 10