I would like to install Server Hack Intrusion prevention Protection sofware

I would like to have some Hack / Intrusion prevention software, which would clearly log every activity catgorically and display with good user friendly interface.

The ultimate monitoring would be in gateway mode..or if you do have a managed switch you put it on the port that is used for monitoring.

As for individual solutions you could install snort on the target linux machine and it could monitor that machine for you. Windows does have lot of solutions you could use something simple as zone alarm..or black ice for something more advanced.
Not what you’re looking for? Ask an Expert.

Server 2008 GPO ADMX / ADM Question

We have a mixture of 2003 and 2008 servers. All DCs are 2003 and this is not planning to change anytime soon.
Up to date all GPO work was done via the GPMC on a DC or a XP workstation with the relevant tools installed.

We want to configure the firewall settings for all the Server 2008 servers via GPO.

Ive installed the GPMC feature on a utility std 2008 server as Im aware Ill need to do this as 2008 and Vista use ADMX files now.

This is where Ive got up to but need to ask some guidance on:

1. Do I have to convert all my existing ADM files to ADMX using the MS convertor? Since I only have 2003 DCs I think not but want to ask just in case.

2. Do I have to have a combination of ADM and ADMX files on my DCs, i.e. the ADMs to service the 2003 servers and the ADMX to service the 2008 servers? Can they live side by side? Id intend to use WMI filters to have the 2008 policies apply to 2008 servers.

3. Is it best to have the 2008 servers in a separate OU rather than share the OU with the 2003 servers?

4. Where do I find the 2008 GPO files I need to import to configure the new firewall settings in 2008 and how do I import them? Is it like with 2003 where you just copy them locally?

Sorry to ask such questions, hope someone can help,

Thanks,

Reckon I’ve posted this too early as now have answered all my own Qs but thanks if you read this late and had some input.

Unable to apply update Windows installer to version 4.5

I receive this error. There is sufficient space available. I am trying to install KB942288. Without this I cannot install SQL server 2008.

0.905: ================================================================================
0.905: 2009/05/06 08:56:06.485 (local)
0.905: c:\90930a3783eff80126\UPDATE\update.exe (version 6.3.4.1)
0.905: InitializeCustomStringTable: Failed to create a custom string table.
0.905: Not enough storage is available to process this command.
43.759: Message displayed to the user: Not enough storage is available to process this command.
43.759: User Input: OK
43.759: installation did not complete.
44.367: Message displayed to the user: installation did not complete.
44.367: User Input: OK
44.367: Update.exe extended error code = 0×8
44.367: Update.exe return code was masked to 0×643 for MSI custom action compliance.

Have you tried to download it from windows update?

This seems to be a bug within the full redistributable package.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=d03b5ae6-7367-4c0d-9a42-1f79731b6258
Not what you’re looking for? Ask an Expert.

Server 2008 Shadow Copy not working to antoher volume

I just installed Server 2008 64-bit. I’m getting an error trying to setup Shadow Copies of volume D (450GB) to save them to voluume S (260GB). I get popup error titled “Shadow Copies”, “Failed to create the storage area association”. There are no errors in the event log to say anything about the popup error.

Well, that’s strange:-( Maybe one more thing - try to adjust to allowed space for shadow copies to as low number as possible (while having them disabled).
It might help asi the system is supposed to delete everything above this quota.
To be honest I don’t understand well the line called Shadow Copy Volume: \\?\GLOBALROOT etc…

Really sorry, don’t have any better ideas:-(
Martin

is Preparing a 2k3 PDC for a 2k8 BDC, the same as migrating to a 2k8 DC ?

Hello,
I was recently “given” the responsibility of of maintaining the corporate network at my office, and through my investigations I have found little to no failover systems exist.

My primary concern is my PDC. There is no backup domain controller in the entire domain. This scares the S@#$ out of me.
So, I have recently rolled out a HyperV server, and I want to use a VM as a BDC. First, is this suggested? or should I go dedicated hardware (something I loath to do).

If it is suggested (even as a temporary solution until I can get dedicated hardware), is the process for setting up the 2k3 Domain to accept the 2k8 as a BDC the same as if I was promoting the 2k8 as a primary?

Specifically, I’m assuming that I need to do an “adprep /forestprep” and then the “adprep /domainprep” from the 2k8 dvd. But after that… do I use the dcpromo command ? Wouldn’t that make it the PDC?

If anybody can suggest some good tutorials or whatnot that would be apreciated as well.

Any other help/suggestions is greatly apreciated,

Oliver.

Firstly, there’s no longer a concept of PDC and BDC. That was phased out when Windows 2000 was introduced. Instead, all DCs are the same, with the exception of the 5 FSMO roles. These roles are allocated to particular DCs (and 1 DC can hold multiple roles), and define the DC which handles certain routine operations in Active Directory which can only occur at a single DC to ensure duplications do not occur.

Promoting your 2008 Server as a DC in a 2003 domain is very easy. It’s essentially a case of preparing the domain and then promoting the server. For resilience, make it a DNS server and Global Catalog server too. See the procedure at the end of this comment for more details.

Running a DC on a Hyper-V machine is supported and is something which is certainly possible. The only complication to watch out for is that if you make the Hyper-V Host install a member of the domain, ensure you keep a physical DC. In other words, don’t virtualise all your DCs into Hyper-V and then make the Hyper-V machine a member of that domain. You’ll have issues.

You can transfer the FSMO roles to the 2008 DC if you wish for it to handle those particular Active Directory tasks.

-Matt

–

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click “NTDS Settings” and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

If you wish the new server to become the holder of one or more Operations (FSMO) roles, you will need to transfer these roles to the new server. In a single-domain environment, you gain no benefits from spreading FSMO roles between Domain Controllers

The current FSMO role configuration for your network can be found by running the command “netdom query fsmo” at a command prompt on a Domain Controller.

To transfer one or more of these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

-tigermatt
Not what you’re looking for? Ask an Expert.