Windows Server Security 2008 Support Services

This post provides Windows Server 2008 Security Guide. This guide provides instructions and recommendations to help strengthen the security of computers running Windows Server® 2008 that are members of an Active Directory® domain.

In addition to the guidance that the Windows Server 2008 Security Guide prescribes, this Solution Accelerator provides tools, step-by-step procedures, recommendations, and processes that significantly streamline the deployment process. This guide not only provides you with effective security setting guidance. It also provides you with a reproducible method that you can use to apply the guidance to both test and production environments.

The key tool that this Solution Accelerator provides for you is the GPOAccelerator. The tool enables you to run a script that automatically creates all the Group Policy objects (GPOs) you need to apply this security guidance. The Windows Server 2008 Security Guide Settings workbook that accompanies this guide provides another resource that you can use to compare and evaluate the Group Policy settings.

Microsoft engineering teams, consultants, support engineers, partners, and customers have reviewed and approved this prescriptive guidance to make it:
• Proven. Based on field experience.
• Authoritative. Offers the best advice available.
• Accurate. Technically validated and tested.
• Actionable. Provides the steps to success.
• Relevant. Addresses real-world security concerns.

Microsoft has published security guides for Windows Server 2003 and Windows 2000 Server. This guide references significant security enhancements in Windows Server 2008. The guide was developed and tested with computers running Windows Server 2008 joined to a domain that uses Active Directory® Domain Services (AD°DS).

Exchange server support

As Windows Server 2008 adoption becomes more widespread many of my clients are asking me about the Windows Server Backup tool and the differences between it and old school NT Backup. The most obvious is that it's a simple backup tool and not at all application aware. In other words when you set it to backup an Exchange server it won't know to truncate logs or create a restorable backup of an Exchange database. According to a recent post by the Microsoft Exchange team this is by design.

Right after we shipped Service Pack 1, we started hearing from customers who were upset with the fact that they cannot take Exchange-aware online backups with Windows Server Backup. These customers had enjoyed the integration of Exchange and Windows Backup (NT Backup) for many years, and for many versions of Exchange and Windows. We also saw quite a but of discussion activity on this issue in various Exchange communities (this blog, internal discussion groups, MVP and MCT communities, etc.).

They also added they are planning to release a VSS-based plug-in for Server Backup that will be Exchange aware. Al thought most enterprises choose a more robust backup solution like Microsoft DPM or Veritas/Symantec, many SMB customers are used to the local NTBackup paradigm and see no reason to change. I think this move by MSFT is a smart one and I applaud their effort to respond quickly to a perceived deficiency in their flagship Server product.