Server 2008 has made a number of changes to security features. Some
changes can be readily seen, such as Windows Firewall and Network
Access Protection (NAP). But these configurable components are only
part of the big picture. Some security components in Windows Server
2008 are installed by default and need no configuration or management.
Others call for very little setup and configuration.
begin this section by looking at the “less configurable” security
pieces, and then we move on to the components that could be considered
highly configurable. Regardless of how configurable they are, all these
components are parts of a whole, and it’s important to understand them
in order to build a secure environment.
Built-in Security Features
begin, let’s look at the security features that are added when Windows
Server 2008 is installed. These features require little to no
configuration, and some of them can be managed:
This is a role-based management tool for controlling access to
resources by assigning users to roles in Windows Server 2008. You can
also track what permissions are granted to each role in your network.
This tool allows you to track security events on your server. Auditing
allows you to monitor the creation, access, and modification of
objects. It tracks user activities and provides warnings about
potential security problems.
Security Configuration Wizard:
This tool determines the minimum required functionality of the server
to perform tasks, based on its installed roles. All other ports,
services, and functionality are disabled. To run the Security
Configuration Wizard, perform the following steps:
Server Manager, highlight Server Manager in the console tree. In the
Details pane you can see that the Server Summary Security Information
is directly below the Computer Information.
Click Run Security Configuration Wizard.
On the first screen of the Security Configuration Wizard, click Next.
the Configuration Action screen, choose to create a new security
policy. The following other choices are available on this screen:
Edit an existing security policy
Apply an existing security policy
Rollback the last applied security policy
the next screen, select a server to use as a baseline for this security
policy. You need to have Administrator permissions to this server.
Choose the DNS name or IP Address and Click Next.
the Security Configuration screen, review the database configuration
(you will receive a pop up warning asking to allow Active X controls,
click Yes) and then click Next.
On the Role-Based Service Configuration screen, click Next.
Select the server roles that this server performs and click Next.
Select the client features this server performs and click Next.
Select the options used in administration of this server and click Next.
Select any additional services that this server is running and click Next.
how to handle unspecified services. You can choose not to change the
startup mode of the service or to disable the service. Click Next.
Confirm the selections in this screen and click Next.
ready to configure Network Security. (This section of the wizard
configures the Windows Firewall settings for this server.) Click Next.
Select or unselect the network security rules or add additional rules and click Next.
ready to configure the registry settings. (This section of the wizard
configures the protocols used for communication with other computers.)
Choose whether Server Message Block (SMB) security signatures are required. Select the attributes and click Next.
settings for whether you Require LDAP Signing; click the radio box to
choose the minimum default security level for LDAP; then click Next.
Choose the outbound authentication methods and click Next.
Choose Outbound Authentication using Domain Accounts and click Next.
View the Registry Settings Summary section and click Next.
the audit policy for this server; these are the settings that will be
used for success/failure audits for the server. Click Next.
Choose one of the following choices from the Auditing Objectives list:
Confirm your selections and click Next.
On the Save Security Policy screen, click Next.
Name the security policy file (the .xml
extension will automatically be added later), change the location, add
a description, view the security policy, or include security templates
to this policy, and click Next.
Choose to apply this policy later or to apply it now. Click Next.
On the final screen of the wizard, note the location of this security policy file and the name and then click Finish.
Software Restriction Policies:
This tool is used to identify and control the ability of software to
run on a local computer, organizational unit (OU), domain, or site.
Managing these polices at the OU, domain, or site level requires the
use of the Group Policy Management console. To manage software
restriction policies on the local computer, do the following:
Select Start, Administrative Tools, Local Security Policy.
In the console tree, click Software Restriction Policies.
Either right-click and select New Software Restrictions Policy or select Action, New Software Restrictions Policy.
In the object view, choose security levels, enforcement, designated file types, trusted publishers, and additional rules.
additional rules, you have the option of creating a new rule for
certificates, hashes, network zones, and paths. The rules are used to
override the default security level in place on the local machine.
software restriction policies will apply only to the local computer. If
restriction policies need to be implemented on a large scale, you
should instead use the Group Policy Management console.
Security Configuration and Analysis:
This tool analyzes and configures the local security policy for the
server. It provides recommendations alongside the current security
settings and flags areas where the current security settings do not
match recommendations. It also enables you to resolve those security
issues by directly configuring the local security policy and importing
Encrypting File System (EFS):
This tool provides a transparent file-encrypting technology for storing
encrypted files on an NTFS volume. EFS is managed through Group Policy
or the Encrypting File System Wizard. To encrypt a file or folder using
the Encrypting File System Wizard, perform the following steps:
Open the Control Panel and double-click User Accounts.
Under Tasks, click Manage Your File Encryption Certificates.
On the first page of the Encrypting File System Wizard, click Next.
Select a certificate to use or create a new certificate and click Next.
Choose to back up the certificate and key now or later and then click Next.
the folder or volume(s) with encrypted files. You can choose to update
encrypted files later by checking the box below the folder and volume
selections. Click Next.
Review the certificate details and click Close.
Internet Explorer Enhanced Security Configuration (IE ESC):
This security component reduces your server’s exposure to web-based
attacks. The only configuration is to turn IE ESC on or off for the
Administrators and Users group. (By default, IE ESC is turned on for
User Account Control (UAC)
are familiar with User Account Control (UAC) from Windows Vista.
Windows Server 2008 has added UAC into its security repertoire. Like
some of the other security components in Windows Server 2008, UAC is
installed when you install Windows Server 2008. It is usually managed
using Group Policies, although you can set up UAC under the local
security policy. So what does the inclusion of UAC mean for Windows
Server 2008, and how does it improve overall security?
provides the ability to enter credentials during a user session to
perform administrative tasks without switching users or using the Run
To view and set UAC settings in the Local Security Policy tool, perform the following steps:
Select Start, Administrative Tools, Local Security Policy.
the console tree, expand Local Policies and click Security Options.
Scroll down to the bottom of the screen to see the available UAC
options (see Figure 1).
Figure 1. Available UAC settings in the Local Security Policy tool.
Double-click each UAC setting you want to configure, select the UAC option, and click OK.
Additional Security Components
Windows Server 2008 comes with additional security components that need to be set up after Windows Server 2008 is installed:
Windows Server 2008 has built-in capabilities to work with smart cards.
Smart card readers should be installed and configured according to
Trusted Platform Module (TPM) management:
TPM is a hardware-based security architecture for providing access to
systems. An installed TPM chip (v.1.2) and TCG-compliant BIOS are
needed. Windows Server 2008 has an MMC snap-in for managing TPM devices
on the local server. No further configuration is needed to take
advantage of TPM.
BitLocker drive encryption:
BitLocker provides full drive encryption and an integrity check of boot
components. You install BitLocker by using the Add Features Wizard, as
In Server Manager choose Add Feature, BitLocker Drive Encryption and click Next.
On the next page, which asks you to confirm that you want to install the feature, click Install.
the results page, which inform you that you must restart your server to
finish the installation of BitLocker, click Close. When you are
prompted to restart the server and finish the installation, click Yes.
When the BitLocker installation is complete, click Close.
important and often-overlooked part of the security picture is Windows
Update. In fact, when you look at the security information in Server
Manager, you see that Configure Updates is directly below Windows
Firewall. It is important to ensure that Windows Server 2008 is kept up
to date by using either Windows Update or another update management
package, such as WSUS or System Center Configuration Manager. All the
security you put in place is useless if you forget to patch a hole that
has been discovered.