MCITP Chapt

Guide to er 5
Microsof Config
uring,
t
Manag
Window ing,
s Server and
2008 Troubl
eshoot
Server ing
Adminis Resou
tration rce
Acces
(Exam s
#70-
646)
 Learning Objectives
• Set up security for folders and files
• Configure shared folders and shared folder security
• Install and set up the Distributed File System
• Configure disk quotas
• Implement UNIX compatibility

MCITP Guide to Microsoft Windows Server 2008, 2

Server Administration (Exam #70-646)
 Managing Folder and File Security
• Steps for sharing resources
– Creating accounts and groups
– Create access control lists (ACLs)
• Types of ACLs
– Discretionary ACL (DACL)
• Configured by a server administrator or owner of an
object
– System control ACL (SACL)
• Contains information used to audit the access to an
object

MCITP Guide to Microsoft Windows Server 2008, 3

Server Administration (Exam #70-646)
 Managing Folder and File Security
(cont’d.)
• DACL and SACL controls for folders and files
– Attributes
– Permissions
– Auditing
– Ownership

MCITP Guide to Microsoft Windows Server 2008, 4

Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
• Attributes
– Stored as header information with each folder and file
– Along with other characteristics including volume
label, designation as a subfolder, date of creation, and
time of creation
• Read-only and hidden attributes
– Set on General tab in an NTFS folder’s or file’s
properties dialog box
• Advanced attributes
– Archive, index, compress, and encrypt

MCITP Guide to Microsoft Windows Server 2008, 5

Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
(cont’d.)

Figure 5-1 Attributes of a folder on an NTFS formatted disk

Courtesy Course Technology/Cengage Learning
MCITP Guide to Microsoft Windows Server 2008, 6
Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
(cont’d.)
• Archive attribute
– Checked to indicate that the folder or file needs to be
backed up because it is new or changed
• Index Attribute vs. Windows Search Service
– Index attribute and accompanying Indexing Service
are legacy features for continuity with earlier
operating systems

MCITP Guide to Microsoft Windows Server 2008, 7

Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
(cont’d.)
• Windows Search Service
– Install the File Services role via Server Manager
• Indexed files include:
– Files in the Documents folder for an account
– e-mail files
– Photos and multimedia files
– Files that are commonly accessed
• Maintain Windows Search Service through Control
Panel

MCITP Guide to Microsoft Windows Server 2008, 8

Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
(cont’d.)

Figure 5-3 Configuring advanced

indexing options
Courtesy Course Technology/Cengage
Learning

MCITP Guide to Microsoft Windows Server 2008, 9

Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
(cont’d.)
• Compress Attribute
– Reduce the amount of disk space used for files
– Disadvantage of compressed files is increased CPU
overhead to open the files and to copy them
• Encrypt Attribute
– Only user who encrypts folder or file is able to read it

MCITP Guide to Microsoft Windows Server 2008, 10

Server Administration (Exam #70-646)
 Configuring Folder and File Attributes
(cont’d.)
• Microsoft Encrypting File System (EFS)
– Sets up a unique, private encryption key associated
with the user account that encrypted the folder or file
– Uses both symmetric and asymmetric encryption
techniques
• Activity 5-1: Encrypting Files
– Objective: Encrypt files in a folder

MCITP Guide to Microsoft Windows Server 2008, 11

Server Administration (Exam #70-646)
 Configuring Folder and File
Permissions
• Permissions
– Control access to an object,
such as a folder or file
• Use Edit button on the folder
properties Security tab
– Change which groups and
users have permissions to a
folder

Figure 5-4 Configuring folder permissions

Courtesy Course Technology/Cengage Learning
MCITP Guide to Microsoft Windows Server 2008, 12
Server Administration (Exam #70-646)
 Configuring Folder and File
Permissions (cont’d.)

Table 5-1 NTFS folder and file permissions

MCITP Guide to Microsoft Windows Server 2008, 13

Server Administration (Exam #70-646)
 Configuring Folder and File
Permissions (cont’d.)
• Activity 5-2: Configuring Folder Permissions
– Objective: Configure permissions on a folder so that
users can modify its contents
• Inherited permissions
– Parent object permissions apply to child object
• Activity 5-3: Removing Inherited Permissions
– Objective: Remove inherited permissions on a folder
• Activity 5-4: Configuring Special Permissions
– Objective: Configure special permissions for a folder
to grant a group expanded access

MCITP Guide to Microsoft Windows Server 2008, 14

Server Administration (Exam #70-646)
 Configuring Folder and File
Permissions (cont’d.)

Figure 5-5 Advanced Security Settings dialog box

Courtesy Course Technology/Cengage Learning
MCITP Guide to Microsoft Windows Server 2008, 15
Server Administration (Exam #70-646)
 Table 5-2 NTFS folder and file special permissions

MCITP Guide to Microsoft Windows Server 2008, 16

Server Administration (Exam #70-646)
 Configuring Folder and File Auditing
• Auditing
– Track activity on a folder or file, such as read or write
activity
• NTFS folders and files
– Audit combination of any or all of activities listed as
special permissions
• Activity 5-5: Auditing a Folder
– Objective: Configure auditing on a folder to monitor
how it is accessed and who is making changes to the
folder

MCITP Guide to Microsoft Windows Server 2008, 17

Server Administration (Exam #70-646)
 Configuring Folder and File Auditing
(cont’d.)

Figure 5-8 Folder auditing

selections
Courtesy Course Technology/Cengage
Learning

MCITP Guide to Microsoft Windows Server 2008, 18

Server Administration (Exam #70-646)
 Configuring Folder and File Ownership
• Folders
– Owned by the account that creates them
• Owners have ability to change permissions for
folders they create
• Taking ownership
– Transfer ownership
– Administrator can always take ownership

MCITP Guide to Microsoft Windows Server 2008, 19

Server Administration (Exam #70-646)
 Configuring Folder and File Ownership
(cont’d.)

Figure 5-9 Taking ownership of a folder

Courtesy Course Technology/Cengage Learning
MCITP Guide to Microsoft Windows Server 2008, 20
Server Administration (Exam #70-646)
 Configuring Shared Folders and
Shared Folder Permissions
• Shared folder
– Users can access over the network
• Changed in Windows Server 2008 from previous
versions
– Make person offering share more aware of security
options
• Activity 5-6: Enabling Sharing a Folder
– Objective: Turn on file sharing and public folder
sharing

MCITP Guide to Microsoft Windows Server 2008, 21

Server Administration (Exam #70-646)
 Configuring Shared Folders and
Shared Folder Permissions (cont’d.)

Figure 5-10 File Sharing dialog box

Courtesy Course Technology/Cengage Learning

MCITP Guide to Microsoft Windows Server 2008, 22

Server Administration (Exam #70-646)
 Configuring Shared Folders and
Shared Folder Permissions (cont’d.)

Figure 5-11 Sharing tab

Courtesy Course Technology/Cengage
Learning

MCITP Guide to Microsoft Windows Server 2008, 23

Server Administration (Exam #70-646)
 Configuring Shared Folders and
Shared Folder Permissions (cont’d.)
• Share permissions for an object
– Differ from the NTFS access permissions set through
the Security tab
– NTFS and share permissions are cumulative
• Four share permissions associated with a folder
– Reader
– Contributor
– Co-owner
– Owner

MCITP Guide to Microsoft Windows Server 2008, 24

Server Administration (Exam #70-646)
 Configuring Shared Folders and
Shared Folder Permissions (cont’d.)
• Folder caching options
– Only the files and programs that users specify will be
available offline
– All files and programs that users open from the share
will be automatically available offline
– Files or programs from the share will not be available
offline
• Activity 5-7: Configuring a Shared Folder
– Objective: Configure a shared folder, share
permissions, and offline access

MCITP Guide to Microsoft Windows Server 2008, 25

Server Administration (Exam #70-646)
 Publishing a Shared Folder in Active
Directory
• Publish an object
– Make it available for users to access when they view
Active Directory contents
• Directory Service Client (DSClient)
– Software that enables older operating systems to
search Active Directory
• Activity 5-8: Publishing a Shared Folder
– Objective: Publish a shared folder in Active Directory

MCITP Guide to Microsoft Windows Server 2008, 26

Server Administration (Exam #70-646)
 Troubleshooting a Security Conflict
• Review folder and share permissions for:
– User account
– All of the groups to which user belongs
• Effective Permissions tab
– Helps troubleshoot permissions conflicts
– To access:
• Right-click a folder or file, click Properties, click the
Security tab, click the Advanced button, and click the
Effective Permissions tab

MCITP Guide to Microsoft Windows Server 2008, 27

Server Administration (Exam #70-646)
 Troubleshooting a Security Conflict
(cont’d.)
• Take into account what happens when a folder or
files in a folder are copied or moved
• Activity 5-9: Troubleshooting Permissions
– Objective: View the effective permissions on a folder

MCITP Guide to Microsoft Windows Server 2008, 28

Server Administration (Exam #70-646)
 Figure 5-13 Examining effective permissions as a troubleshooting aid
Courtesy Course Technology/Cengage Learning

MCITP Guide to Microsoft Windows Server 2008, 29

Server Administration (Exam #70-646)
 Implementing a Distributed File System
• Distributed File System (DFS)
– Simplify access to the shared folders on a network
• By setting up folders to appear as though they are
accessed from only one place
– Makes managing folder access easier for server
administrators
– Configured using the DFS Management tool in the
Administrative Tools menu
– Shared folder contents can be replicated to one or
more DCs or member servers

MCITP Guide to Microsoft Windows Server 2008, 30

Server Administration (Exam #70-646)
 Implementing a Distributed File System
(cont’d.)
• Advantages
– Save time searching
– NTFS access permissions apply
– Fault tolerance
– Load balancing
– Improved access for Web-based internet and intranet
– Backups made more easily
– Important information is not lost when a disk drive on
one server fails
– Users always have access to shared folders even in
the event of a disk failure
MCITP Guide to Microsoft Windows Server 2008, 31
Server Administration (Exam #70-646)
 DFS Models
• Stand-alone
– No Active Directory implementation available to help
manage the shared folders
– Provides only a single or flat level share
• Domain-based
– Takes full advantage of Active Directory
– Available only to servers and workstations that are
members of a domain

MCITP Guide to Microsoft Windows Server 2008, 32

Server Administration (Exam #70-646)
 DFS Topology
• Hierarchical structure of DFS in domain-based
model
• Namespace root
– Main container in Active Directory
– Holds links to shared folders that can be accessed
from the root
– Populated by shared folders for users to access
• Replication group
– Set of shared folders replicated or copied to one or
more servers in a domain

MCITP Guide to Microsoft Windows Server 2008, 33

Server Administration (Exam #70-646)
 Installing DFS
• Installed as a service within the File Services role

Figure 5-14 Selecting to

install DFS
Courtesy Course
Technology/Cengage Learning

MCITP Guide to Microsoft Windows Server 2008, 34

Server Administration (Exam #70-646)
 Figure 5-15 Configuring the namespace type
Courtesy Course Technology/Cengage Learning
MCITP Guide to Microsoft Windows Server 2008, 35
Server Administration (Exam #70-646)
 Installing DFS (cont’d.)
• Activity 5-10: Creating a Namespace Root
– Objective: Configure a namespace root

MCITP Guide to Microsoft Windows Server 2008, 36

Server Administration (Exam #70-646)
 Managing a Domain-Based
Namespace Root System
• Tasks involved in managing the namespace root
– Creating a folder in a namespace
– Delegating management
– Tuning a namespace
– Deleting a namespace root
– Using DFS replication

MCITP Guide to Microsoft Windows Server 2008, 37

Server Administration (Exam #70-646)
 Managing a Domain-Based
Namespace Root System (cont’d.)
• Creating a Folder in a Namespace
– Folder target is a path in the Universal Naming
Convention (UNC) format
– Universal Naming Convention (UNC)
• Naming convention that designates network servers,
computers, and shared resources
• Activity 5-11: Adding a Folder and Folder Target in
DFS
– Objective: Add a folder in DFS

MCITP Guide to Microsoft Windows Server 2008, 38

Server Administration (Exam #70-646)
 Managing a Domain-Based
Namespace Root System (cont’d.)
• Delegating Management
– Day-to-day activities can be managed by an assistant
or by another person
– Right-click namespace and click Delegate
Management Permissions
• Tuning a Namespace
– Configure the order for referrals
– Configure cache duration for a namespace or folder
– Configure namespace polling
– Configure folder targets as enabled or disabled

MCITP Guide to Microsoft Windows Server 2008, 39

Server Administration (Exam #70-646)
 Managing a Domain-Based
Namespace Root System (cont’d.)
• Deleting a Namespace Root
– Delete namespace root via the DFS Management tool
– Click namespace root and click Delete
• Using DFS Replication
– Defined two or more folder targets
– Decide which server is to be the primary group
member
– Click a folder under the namespace root in the tree of
the DFS Management tool
– Replication is handled by the File Replication Service

MCITP Guide to Microsoft Windows Server 2008, 40

Server Administration (Exam #70-646)
 Managing a Domain-Based
Namespace Root System (cont’d.)
• Important improvements to DFS replication
– Enables faster and more reliable recovery
– Faster for all sizes of files
– More efficient over LANs and WANs

MCITP Guide to Microsoft Windows Server 2008, 41

Server Administration (Exam #70-646)
 Configuring Disk Quotas
• Advantages of disk quotas
– Prevent users from filling the disk capacity
– Encourage users to help manage disk space
– Track disk capacity needs
– Provide server administrators with information about
when users are nearing or have reached their quota
limits
• Quotas can be set on any local or shared volume

MCITP Guide to Microsoft Windows Server 2008, 42

Server Administration (Exam #70-646)
 Configuring Disk Quotas (cont’d.)
• Parameters
– Enable quota management
– Deny disk space to users exceeding quota limit
– Do not limit disk usage
– Limit disk space to
– Set warning level to
– Log event when a user exceeds their quota limit
– Log event when the user exceeds their warning level

MCITP Guide to Microsoft Windows Server 2008, 43

Server Administration (Exam #70-646)
 Configuring Disk Quotas (cont’d.)
• Activity 5-12: Configuring Disk Quotas
– Objective: Enable disk quotas and then set a disk
quota for a specific group of users

MCITP Guide to Microsoft Windows Server 2008, 44

Server Administration (Exam #70-646)
 Using UNIX Interoperability in Windows
Server 2008
• Subsystem for UNIX-based Applications (SUA)
– Provides compatibility with UNIX and Linux systems
• SUA functionality
– Run UNIX/Linux applications with few or no changes
to the program source code.
– Run UNIX/Linux scripts
– Use popular UNIX/Linux shells
– Run most UNIX/Linux commands
– Run the popular vi UNIX/Linux editor

MCITP Guide to Microsoft Windows Server 2008, 45

Server Administration (Exam #70-646)
 Using UNIX Interoperability in Windows
Server 2008 (cont’d.)
• Compiler
– Program that reads lines of program code in a source
file and converts the code into machine-language
instructions the computer can execute
• Script
– Consists of lines of commands that are executed
when you run the script
• Shell
– Interface between the user and the operating system
– Korn or C shell

MCITP Guide to Microsoft Windows Server 2008, 46

Server Administration (Exam #70-646)
 Using UNIX Interoperability in Windows
Server 2008 (cont’d.)
• Dynamic-link library (DLL)
– Contain program code that can be called and run by
Windows applications
• Server for Network Information Services
– Provides a naming system for shared resources on a
UNIX/Linux network

MCITP Guide to Microsoft Windows Server 2008, 47

Server Administration (Exam #70-646)
 Using UNIX Interoperability in Windows
Server 2008 (cont’d.)
• New features for SUA
– More transparent ability for UNIX/Linux applications to
connect to Oracle and SQL Server databases
– Inclusion of true 64-bit libraries
– New utilities
– Use Microsoft Visual Studio for designing UNIX/Linux
applications

MCITP Guide to Microsoft Windows Server 2008, 48

Server Administration (Exam #70-646)
 Summary
• Discretionary access control lists
– Manage access to resources
• Folder and file attributes provide one level of
security
• Permissions provide another level of security
• Folders can be shared for users to access over a
network
• Use Effective Permissions capability to troubleshoot
a security conflict

MCITP Guide to Microsoft Windows Server 2008, 49

Server Administration (Exam #70-646)
 Summary (cont’d.)
• Distributed File System (DFS)
– Set up shared folders that are easier for users to
access and can be replicated for backup and load
distribution
• Disk quotas
– Manage the resources put on a server disk volume
• Subsystem for UNIX-based Applications
– Provides compatibility with UNIX and Linux systems

MCITP Guide to Microsoft Windows Server 2008, 50

Server Administration (Exam #70-646)