07-Implementing Security Using Group Policies

Bạn đang xem bản rút gọn của tài liệu. Xem và tải ngay bản đầy đủ của tài liệu tại đây (739.44 KB, 34 trang )

(1)<div class='page_container' data-page=1>

Module 7:

Implementing

Security Using Group

</div>
(2)<div class='page_container' data-page=2>

Module Overview

• Configuring Security Policies

• Implementing Fine-Grained Password Policies

• Restricting Group Membership and Access to Software

</div>
(3)<div class='page_container' data-page=3>

Lesson 1: Configuring Security Policies

• What Are Security Policies?

• What Is the Default Domain Security Policy?

• What Are the Account Policies?

• What Are Local Policies?

• What Are Network Security Policies?

• What Is Windows Firewall With Advanced Security?

• Demonstration: Overview of Additional Security Settings

</div>
(4)<div class='page_container' data-page=4></div>
(5)<div class='page_container' data-page=5>

What Is the Default Domain Security Policy?

• Provides account policies for the domain; other settings

are not configured by default

• Use to provide security settings that will affect the 
entire domain

• Use domain policy to provide security settings, as a 
best practice. Use separate GPOs to provide other 
types of settings

Domain
Default domain policy

</div>
(6)<div class='page_container' data-page=6>

What Are the Account Policies?

Description
Password
Account lockout
Kerberos
Policies

• Enforce password history: 24 passwords

• Max password age: 42 days

• Min password age: 1 day

• Min password length: 7 characters

• Complex Password: enabled

• Store password using reversible encryption: disabled

• Lockout duration: not defined

• Lockout threshold: 0 invalid logon attempts

• Reset account lockout after: not defined
Account policies consist of:

• Can only be applied at the domain level

</div>
(7)<div class='page_container' data-page=7>

What Are Local Policies?

Every computer running Windows 2000 and later has a local 
 security policy that is part of local Group Policy



Domain policy will override local policies in cases of conflict



In a workgroup, you must configure local security policies to 
 provide security



You can assign local rights through local Group Policies



Security options control many different aspects of a 
 computer’s security



</div>
(8)<div class='page_container' data-page=8>

What Are Network Security Policies?

Windows XP
Windows 
Vista
Wireless
Wired
Wireless only
GPO

Separate wireless policies for Windows XP and Windows Vista



Windows Vista policies contain more options for wireless



Windows Vista wireless policies can deny access to 
 wireless networks



802.1x authentication can be configured via Group Policy



Only Vista and later can receive wired network policies



Define the available networks and authentication methods for wireless 
connections for Windows Vista and Windows XP clients, and

</div>
(9)<div class='page_container' data-page=9>

What Is Windows Firewall With

Advanced Security?

Supports filtering for both incoming and outgoing traffic



Used for advanced settings configuration



Provides integrated firewall filtering and IPsec protection settings



Allows rule configuration for various criteria, such as users, groups, and
TCP and UDP ports



Provides network location-aware profiles



Can import or export policies



A stateful host-based firewall that allows or blocks network traffic 
 according to its configuration

Windows

Server 2008 Internet
LAN
Firewall

</div>
(10)<div class='page_container' data-page=10>

Demonstration: Overview of Additional

Security Settings

</div>
(11)<div class='page_container' data-page=11>

Demonstration: What Is the Default Domain

Controller Security Policy?

In this demonstration, you will see the default domain
controller policy settings

Provides an extra layer of security for domain controllers



Allows many user rights to be configured



Provides enabled auditing



</div>
(12)<div class='page_container' data-page=12>

Lesson 2: Implementing Fine-Grained Password

Policies

• What Are Fine-Grained Password Policies?

• How Fine-Grained Password Policies Are Implemented

• Implementing Fine-Grained Password Policies

</div>
(13)<div class='page_container' data-page=13>

What Are Fine-Grained Password Policies?

Administrator 
group

Manager

group End user group

Password 
changes: 7

days

Password 
changes: 14

days

Password 
changes: 30

days

</div>
(14)<div class='page_container' data-page=14>

How Fine-Grained Password Policies

Are Implemented

Considerations when implementing PSOs:

Password Settings Container and Password Setting Objects
are new schema object classes



PSOs can only be applied to users or global groups



PSOs can be created through ADSI Edit or LDIFDE



A PSO has the following settings available:

• Password policies

• Account lockout policies

• PSO Link

</div>
(15)<div class='page_container' data-page=15>

Implementing Fine-Grained Password Policies

• Shadow groups can be used to apply a PSO to all users 
that do not already share a global group membership

• A user or group could have multiple PSOs linked to them

• The precedence attribute is used to resolve conflicts

• Lower precedence values have higher priority

• PSOs linked directly to user objects override PSOs linked 
to a user’s global groups

</div>
(16)<div class='page_container' data-page=16>

Demonstration: Implementing Fine-Grained

Password Policies

</div>
(17)<div class='page_container' data-page=17>

Lesson 3: Restricting Group Membership and

Access to Software

• What Is Restricted Group Membership?

• Demonstration: Configuring Restricted Group Membership

• What Is a Software Restriction Policy?

• Options for Configuring Software Restriction Policies

</div>
(18)<div class='page_container' data-page=18>

What Is Restricted Group Membership?

Group Policy can control group membership:

• For any group on a local computer by applying a GPO to the
OU that holds the computer account

</div>
(19)<div class='page_container' data-page=19>

Demonstration: Configuring Restricted

Group Membership

</div>
(20)<div class='page_container' data-page=20>

What Is a Software Restriction Policy?

• A policy-driven mechanism that identifies and controls software
on a client computer

• A mechanism restricting software installation and viruses

• A component with two parts:

• A default rule with three options: Unrestricted, Basic,
and Disallowed

</div>
(21)<div class='page_container' data-page=21>

Options for Configuring Software

Restriction Policies

Certificate Rule
Checks for digital

signature on application
Use when you want to 
restrict Win32

applications and 
ActiveX content

Certificate Rule
Checks for digital

signature on application
Use when you want to 
restrict Win32

applications and 
ActiveX content

Internet Zone Rule
Controls how Internet 
Zones can be accessed
Use in high-security

environments to control 
access to Web

applications

Internet Zone Rule
Controls how Internet 
Zones can be accessed
Use in high-security

environments to control 
access to Web

applications

Hash Rule

Use to employ MD5 or 
SHA1 hash of a file to 
confirm identity

Use to allow or prohibit 
a certain version of a file 
from being run

Hash Rule

Use to employ MD5 or 
SHA1 hash of a file to 
confirm identity

Use to allow or prohibit 
a certain version of a file 
from being run

Path Rule

Use when restricting the 
path of a file

Use when multiple files 
exist for the same

application

Essential when SRPs are 
strict

Path Rule

Use when restricting the 
path of a file

Use when multiple files 
exist for the same

application

</div>
(22)<div class='page_container' data-page=22>

Demonstration: Configuring Software

Restriction Policies

</div>
(23)<div class='page_container' data-page=23>

Lesson 4:Managing Security Using

Security Templates

• What Are Security Templates?

• Demonstration: Applying Security Templates

• What Is the Security Configuration Wizard?

• Demonstration: Configuring Server Security Using the
Security Configuration Wizard

• Options for Integrating the Security Configuration Wizard
and Security Templates

</div>
(24)<div class='page_container' data-page=24>

What Are Security Templates?

Security templates:

Allow administrators to apply consistent security 
 settings to multiple computers



Can be applied via Group Policy



Can be designed based on server roles



</div>
(25)<div class='page_container' data-page=25>

Demonstration: Applying Security Templates

</div>
(26)<div class='page_container' data-page=26>

What Is the Security Configuration Wizard

SCW provides guided 
attack surface

reduction by:

• Disabling unnecessary
services and IIS

Web extensions

• Blocking unused ports
and secure ports that are
left open using IPSec

• Reducing protocol
exposure

• Configuring audit settings

SCW supports:

• Rollback

• Analysis

• Remote configuration

• Command-line support

• Active Directory
integration

</div>
(27)<div class='page_container' data-page=27>

Demonstration: Configuring Server Security

Using the Security Configuration Wizard

</div>
(28)<div class='page_container' data-page=28>

Options for Integrating the Security Configuration

Wizard and Security Templates

Options:

• Policies created with the SCW can be applied individually

• Other Security templates can be incorporated into the SCW

</div>
(29)<div class='page_container' data-page=29>

Demonstration: Importing Security Configuration

Policies into Security Templates

</div>
(30)<div class='page_container' data-page=30>

Lab: Implementing Security by Using Group

Policies

• Exercise 1: Configuring Domain Security Settings

• Exercise 2: Implementing Fine-Grained Password Policies

• Exercise 3: Configuring Restricted Groups and Software
Restriction Policies

• Exercise 4: Configuring Security Templates

• Exercise 5: Verifying the Security Configuration

Logon information

Virtual machine 6425A-NYC-DC1NYC-CL1, ,

NYC-SVR1

User name Administrator
Password Pa$$w0rd

</div>
(31)<div class='page_container' data-page=31>

Lab Review

• You want to control which wireless networks your

Windows Vista clients will have access to. What is the best
way to accomplish this?

• You need to harden security on all the database servers
across your organization. What tool is best suited for this
task?

</div>
(32)<div class='page_container' data-page=32>

Module Review and Takeaways

• Considerations

</div>
(33)<div class='page_container' data-page=33>

Beta Feedback Tool

• Beta feedback tool helps:

 Collect student roster information, module feedback, and

course evaluations.

 Identify and sort the changes that students request, thereby

facilitating a quick team triage.

 Save data to a database in SQL Server that you can later

query.

</div>
(34)<div class='page_container' data-page=34>

Beta Feedback

• Overall flow of module:

 Which topics did you think flowed smoothly, from topic to

topic?

 Was something taught out of order?

• Pacing:

 Were you able to keep up? Are there any places where the

pace felt too slow?

 Were you able to process what the instructor said before

moving on to next topic?

 Did you have ample time to reflect on what you learned? Did

you have time to formulate and ask questions?

• Learner activities:

 Which demos helped you learn the most? Why do you think

that is?

 Did the lab help you synthesize the content in the module?

Did it help you to understand how you can use this

knowledge in your work environment?

 Were there any discussion questions or reflection questions

</div>