Category: CSE Project Reports

In Active Directory forest, from any domains universal groups can include users. Thus, in order to control security across the domains, they are utilized. Whenever operating on domain functional level of Windows Server 2003 or Windows 2000 Native, only universal groups exist. When controlling several domains, it frequently supports to group worldwide groups in universal groups. 

In Active Directory deployment of Windows server 2003, domains are regarded as boundary of logical security that permits for management, creation and administration of related resources. Domain can be thought of as logical division like neighborhood in a city.

Even though the essential features and names are similar, the domains of Active Directory change significantly from those in Windows NT. When compared to Windows NT domain, several objects can be accumulated by active directory domain. Moreover, the domains of active directory can be joined mutually into forests and trees in order to structure more difficult hierarchical structures. 

Domain functional levels: these levels are same like modes in Windows 2000 server. The functional level of Windows 2003 server domain consist of all of latest features that are included in Windows server 2003, however needs that each SC operate Windows 2003 server. The native domain functional level of Windows 2000 provides each of the native mode functionality in Windows 2000; however each of the DC should either operate Windows 2000 server or Windows 2003 server.

The mixed domain functional level of Windows 2000 provides minimum amount of functionality, however it assist DCs operating WindowsNT4 server, Windows 2003 server, and Windows 2000 server. Observe that domains cannot be translated into Windows 2000 Mixed domain functional level from Windows 2000 Native domain functional level back.

The most significant threats to domain controllers are those that try to achieve access on domain controller towards the database of security. All the passwords and accounts of user are contained by DC; therefore computer access offers a hacker about unrestricted access towards the network. Usual assaults consist of:

• Attaining access towards the database of security in order to adapt rights of user to offer managerial access towards unauthorized users.
• Attaining access towards communications of domain controller through connections of network, so as to exploit, monitor and capture information of security like user passwords and accounts.
• Attaining physical access towards server in order to copy database of security onto detachable media for soon analysis.
• Attaining access towards domain controller in order to adapt computers on domain to permit ‘rouge’ computer so as to take part in the domain.

Domain controllers are the heart of Windows-based network. As the name suggests, the activities on the domain can be controlled by them. To just single function their roles can be restricted, or the domain controller can be organized to include number of related functions. Significantly, this decision depending on the network size and several users and processes will access the data. The better the network, the more specialized domain controllers tends to become. Basic measures of security consist of:

• In order to secure information on system volume, NTFS file system must be used.
• Securing the domain controller essentially in an access-controlled location.
• Extracting every service that will not be utilized on the domain controller.
• Needing smart card access on domain controllers when probable. Passwords are randomly produced and encrypted by making use of stronger methods of encryption. 

In general, the domain controller authenticates the logons of domain and controls the master database and security policy for the purpose of domain. Even though domain controllers and servers can authenticate logons of user, only the domain controllers alter to passwords or additional changes to computer and user accounts. In the network, in order to configure security for domain controllers, one has to start with a recognized state (baseline). Whenever a server is promoted to DC, the security information template of DC is applied. For DCs, the baseline security is offered that is identical to the setup security information for other server types. In addition, two other predefined security templates are present that can be utilized on domain controllers, they are: the hisecdc.inf and securedc.inf. 

          If there are member servers or DCs that are not functioning Windows NT 4.0 SP4 or later in the domain, then securedc.inf template can be utilized. This template offers string security, however it does not need strong encryption, SMB signing, or utilization of NTLM v2 authentication protocol. On the other hand, SMB signing as well as strong passwords are found to be necessary for hisecdc.inf template.  Before using this template in mixed environment on a DC, test every scenario carefully as few down-level clients ay not be capable of connecting to domain controller through hisecdc.inf template. 

Role/function played by domain structure/relationships in a Windows domain 

Understanding Active Directory Domains and Trusts 

The security, access to resources, information flow, and the relationship type between various domain forests, domains and domain trees can be controlled all through the environment of enterprise network by the active directory trusts structure and domains of Windows Server 2003. This can relieve managerial burden of multi-domain structures and large domains by saving expense, time and effort. A relationship can be made among two domains that allows passwords of authentication from one domain to the other or among both ways domains, whenever a trust relationship is created among them.   

Active Directory

It is defined as the directory service’s Microsoft implementation that permits to search and store any object in multiple domains of single domain.  Everything in the domain is classified as objects by the directory services. The objects consist of computers, servers, application data, users, printers, file shares, etc. All these objects will be located in Active Directory in a single file that consists of objects as well as plan information known as ntds.dit.

Domains

Domain is defined as a security container, a data base application of Active Directory, and is the common container for explaining internet namespace and DNS. Beginning with Windows 2000 Server domains and enduring Windows Server 2003, an individual domain can be created and can be secure all the trust and security functions that need several domains making use of Windows NT. 

Domain Controllers 

For a Windows 2003 server, Domain controller is defined as specialized function. Towards domain controller, server can be promoted in such a way that it can replicate, construct and receive Active Directory database copy. Information regarding all the objects available in domain is included by domain controller, and the users of network can explore it to observe resources, people and computers all the time on the domain. The database of domain controller is updated continuously so that most of the recent information is contained by all the users. At last, as changes takes place, the domain controller replicates or exceeds to other domain controllers along its most recent database. Every domain controller is not equal with Windows NT domains. A PDC (Primary Domain Controller) has to be produced in every domain, which holds the Active Directory database’s master copy. BDCs (Backup Domain Controllers) that held database copy is another type of domain controller. 

Domain Tree Trusts 

Trust can be created among all the domains, which states that among two or more domains, resources can be shared forth and back as if the resources were one of the domain controller’s parts. Among two NT domains, a one-way non transitive trust can only be created, whenever domain trusts of Windows NT is used. A trust can be created where only an individual domain is trusted and another one is trusting. It must be considered that trust is not assured by interrelationship, whenever generating trust. By the introduction of Windows 2003 Server and Windows 2000 Server Active directory, two-way transitive trusts can be automatically generated in similar domain among various domains so that trust among two domains is two-way.  

Domain Forest Trusts 

Among two unrelated domain trees, trust relationships can be produced, however the relationships of two-way transitive trust cannot be generated automatically. Similar to the generation of domain trust relationships with Windows NT, forest trust relationships must also be produced. As this is defined as link among two unrelated domains, relationships of trust must be generated carefully with higher security element. Both domains can be owned; separate namespaces can be maintained, and to access resources on second domain one domain must be permitted and must restrict on how the resources are accessed on first domain by second domain.

Any other domain can be accessed transparently by the users in forest through two-way transitive trusts. Transitive trust is the one in which two or more parent domains as well as their child domains trust each other. Depending on the parent trust, the trust present at parent level crosses down to child domains. Transparent trust is defined as the one in which the user does not know anything about how the relationships of trust shifts several domain trees and domains. 

This assignment addresses the following learning outcome(s) of the module:

• To critically explain how to respond to various types of attack that can be applied to a Windows 2000 and Windows NT systems, and apply that knowledge to actually respond to an attack.
• To explain in a systematic manner the importance of systems configuration and management and to undertake systems configuration and management for Windows 2000 and Windows NT systems;
• To perform an Information Technology Health Check (ITHC) and understand the role and limitations of an ITHC in securing Windows 2000 and Windows NT systems.

You are required to produce a 2500 word report, discussing the Windows Domain structure. Assume a Windows 2000/2003/2008 Domain running in native mode. In particular attention should be paid to:

•  What role/function is the domain structure/relationships play in a Windows domain?
• What are the security risk/threats to the Windows domain structure?
• Giving practical examples how can we enumerate/explore a Windows domain structure?
• How do Windows domains and domain structures communication with each other?
• What is best practice in securing a Windows domain structure?