source: http://www.petri.co.il/forums/showthread.php?t=52923
Hi
I'd like to ask for some help and discussion about forum member's
experiences and approaches to Windows file auditing. My network is a
Windows 2008 Domain. There are 35 machines in the domain.
I was playing around with this yesterday and enabled auditing on our
Windows 2008 Storage Server. I did this via the local security policy:
Security Settings>Local Policies>Audit Policies>Audit object
access and checked both success and failure. I had also set this via the
default domain policy.
Next, I turned on auditing for Authenticated Users for one folder and
all its subfolders. There were about 15 - 20 people accessing data from
this folder. I turned on the following Success Audit settings for the
folder: Traverse folder/execute file, List folder/read data, Create
files/write data, Create folders/append data, Delete subfolders and
files and Delete.
Just before I did this I saved and cleared the Security log and configured it to archive events when the log exceeded 20MB.
Everything worked as it should - I could see security events being
logged that showed Event ID's 5140 Share accessed, 4656 handle
requested, 4658 handle closed, 4663 attempt to access object, and 4660
object deleted.
What I was not was not expecting was that the security log would log so
many events. In one hour 380MB of logs had been archived. One of the
archived logs (remember they are 20MB each), was created and archived in
just 20 seconds, but on average it took about 10mins for the 20MB limit
to be reached.
So, after an hour's worth of logging I turned auditing off at both the
local and GPO level, and removed auditing from the folder.
Today, I enabled auditing via the local security policy only, leaving
the GPO auditing settings alone (Audit object access = Not defined), and
set up auditing for the same folder exactly as it was configured
yesterday. The logging is far less intense than it was yesterday. In
nearly three hours the log is just over 3MB in size which is quite
acceptable (or is it?).
So, what did I do wrong? Is it wrong to have both GPO and local security
policy audit settings duplicated? What sort of log size do others see
when object access auditing is turned on? Any good tips or tricks out
there that anyone would like to share?
Thanks!
source: http://www.petri.co.il/forums/showthread.php?t=52923
Tuesday, January 8, 2013
SBS 2008 and Terminal Server CALS Licensing
source: http://forums.techsoup.org/cs/community/f/20/p/27644/96161.aspx#96161
When you purchase SBS 2008 you actually get two licenses. One for the SBS 2008 running on one computer ( this is the SBS package which includes Windows Server 2008, Exchange, WSUS, Hyper-V, and other stuff) and also a license for a 2nd Windows Server 2008 that can run on an additional computer.
The main SBS computer's Client Access Licenses (CALs)- (in your case 5 ) can be used to access that computer locally, or to access it remotely using a feature called Remote Web Workplace (RWW). This is not terminal services.
If you install the Server 2008 license on a second computer and join it to the SBS domain, then you can install Terminal Services and the Terminal Services license manager on that second server. At that point you have to purchase Terminal Services CALs (TS CALs) and install them into the license manager. These are NOT the same as the server CALs that came with SBS 2008.
Terminal Services presents a remote desktop to each licensed user or device when they log in. Remote Web Workplace allows each user to control and use his workstation remotely just as if he was sitting at his desk.
I suggest buying the "Windows Small Business Server 2008 Administrator's Companion" by Russel and Crawford for additional understanding of SBS. Its not hard to use SBS, but you do need to learn some server technologies which can be more easily grasped by reading rather by trying to figure it out.
Hal
When you purchase SBS 2008 you actually get two licenses. One for the SBS 2008 running on one computer ( this is the SBS package which includes Windows Server 2008, Exchange, WSUS, Hyper-V, and other stuff) and also a license for a 2nd Windows Server 2008 that can run on an additional computer.
The main SBS computer's Client Access Licenses (CALs)- (in your case 5 ) can be used to access that computer locally, or to access it remotely using a feature called Remote Web Workplace (RWW). This is not terminal services.
If you install the Server 2008 license on a second computer and join it to the SBS domain, then you can install Terminal Services and the Terminal Services license manager on that second server. At that point you have to purchase Terminal Services CALs (TS CALs) and install them into the license manager. These are NOT the same as the server CALs that came with SBS 2008.
Terminal Services presents a remote desktop to each licensed user or device when they log in. Remote Web Workplace allows each user to control and use his workstation remotely just as if he was sitting at his desk.
I suggest buying the "Windows Small Business Server 2008 Administrator's Companion" by Russel and Crawford for additional understanding of SBS. Its not hard to use SBS, but you do need to learn some server technologies which can be more easily grasped by reading rather by trying to figure it out.
Hal
Saturday, January 5, 2013
How to Configure SBS 2008 to Host POP3/IMAP4
How to Configure SBS 2008 to Host POP3/IMAP4
19 Sep 2008 9:00 AM
[Today's post comes to us courtesy of Shawn Sullivan]
Today’s post will discuss the steps necessary to allow your SBS 2008 server to host POP3 and IMAP4 services for external clients. This process consists of four parts:
Enabling POP3/IMAP4 on SBS 2008
After SBS 2008 setup completes, the POP3 and IMAP4 services are both stopped and set to manual for startup type. You can run the services.msc console to start them and change the startup type to automatic.
Launch the Exchange Management Console as administrator and expand Server Configuration > Client Access and click on the POP3 and IMAP4 tab. Here you can view the banner string, binding, authentication, connection, and retrieval settings for both services.
Launch the Exchange Management Shell as administrator and run Get-ImapSettings | fl or Get-PopSettings | fl to get the complete list of configuration settings in one list.
By default, both the POP3 and IMAP4 services require a TLS authenticated connection using an X.509 certificate. Exchange setup creates a certificate matching the server’s internal fully qualified domain name (FQDN) and configures both services to use it for TLS. When you run the “Internet Address Management Wizard” to configure you external FQDN, another certificate matching your external address is created and configured for POP3 and IMAP4 services. You can view your exchange certificates in the Exchange Management Shell with Get-ExchangeCertficate:
You need to change the certificate that POP3 and IMAP4 uses for TLS to the certificate that has been created by the “Internet Management Address Wizard”. This is done either through the management console or shell.
Run the Set-PopSettings or Set-ImapSettings with the –X509CertificateName option and enter the name of the certificate:
Or open the properties of POP3 or IMAP4, click on the Authentication tab, enter the certificate name.
Port forwarding POP3/IMAP4 through your firewall to the SBS 2008 server
For POP3, you need to open either TCP 110 or 995. For IMAP4, open either TCP 143 or 993, depending on whether you are configuring the client to encrypt the traffic with SSL or not. Whatever ports you are opening, they need to point to the IP address of the SBS 2008 server.
Windows Firewall is enabled on SBS 2008 by default with exceptions for both POP3 and IMAP4. Configuration changes will not be necessary.
Configuring POP3/IMAP4 settings on the client
Other than choosing the FQDN of the server you are connecting to and configuring user account settings, there are a couple of things to note about client setup.
To comply with Exchange’s default settings, Microsoft clients like Outlook, Outlook Express, or Windows Mail will need to configure POP3 to connect using SSL (port 995).
For IMAP, Outlook 2007 will allow you to authenticate with TLS using port 143. Earlier versions of Outlook, Outlook Express, and Windows Mail will need to connect using SSL (port 993).
If you are configuring your SBS 2008 server as your outgoing SMTP server, then you will need to authenticate using TLS on port 587. Once again, full details in the following blog post: How to Configure Trusted SMTP Relay in Exchange on SBS 2008.
Today’s post will discuss the steps necessary to allow your SBS 2008 server to host POP3 and IMAP4 services for external clients. This process consists of four parts:
- Enabling the POP3/ IMAP4 services on the SBS 2008 server.
- Port forwarding POP3 /IMAP4 through the firewall to the SBS 2008 server.
- Configuring Exchange 2007 for authenticated client SMTP relay.
- Configuring POP3/IMAP4 and SMTP settings on the client.
Enabling POP3/IMAP4 on SBS 2008
After SBS 2008 setup completes, the POP3 and IMAP4 services are both stopped and set to manual for startup type. You can run the services.msc console to start them and change the startup type to automatic.
Launch the Exchange Management Console as administrator and expand Server Configuration > Client Access and click on the POP3 and IMAP4 tab. Here you can view the banner string, binding, authentication, connection, and retrieval settings for both services.
Launch the Exchange Management Shell as administrator and run Get-ImapSettings | fl or Get-PopSettings | fl to get the complete list of configuration settings in one list.
By default, both the POP3 and IMAP4 services require a TLS authenticated connection using an X.509 certificate. Exchange setup creates a certificate matching the server’s internal fully qualified domain name (FQDN) and configures both services to use it for TLS. When you run the “Internet Address Management Wizard” to configure you external FQDN, another certificate matching your external address is created and configured for POP3 and IMAP4 services. You can view your exchange certificates in the Exchange Management Shell with Get-ExchangeCertficate:
You need to change the certificate that POP3 and IMAP4 uses for TLS to the certificate that has been created by the “Internet Management Address Wizard”. This is done either through the management console or shell.
Run the Set-PopSettings or Set-ImapSettings with the –X509CertificateName option and enter the name of the certificate:
Or open the properties of POP3 or IMAP4, click on the Authentication tab, enter the certificate name.
Port forwarding POP3/IMAP4 through your firewall to the SBS 2008 server
For POP3, you need to open either TCP 110 or 995. For IMAP4, open either TCP 143 or 993, depending on whether you are configuring the client to encrypt the traffic with SSL or not. Whatever ports you are opening, they need to point to the IP address of the SBS 2008 server.
Windows Firewall is enabled on SBS 2008 by default with exceptions for both POP3 and IMAP4. Configuration changes will not be necessary.
Configuring POP3/IMAP4 settings on the client
Other than choosing the FQDN of the server you are connecting to and configuring user account settings, there are a couple of things to note about client setup.
To comply with Exchange’s default settings, Microsoft clients like Outlook, Outlook Express, or Windows Mail will need to configure POP3 to connect using SSL (port 995).
For IMAP, Outlook 2007 will allow you to authenticate with TLS using port 143. Earlier versions of Outlook, Outlook Express, and Windows Mail will need to connect using SSL (port 993).
If you are configuring your SBS 2008 server as your outgoing SMTP server, then you will need to authenticate using TLS on port 587. Once again, full details in the following blog post: How to Configure Trusted SMTP Relay in Exchange on SBS 2008.
source: http://blogs.technet.com/b/sbs/archive/2008/09/19/how-to-configure-sbs-2008-to-host-pop3-imap4.aspx
Subscribe to:
Posts (Atom)