Common administrative tasks

This section provides information about common administrative tasks:

  • Backing up and restoring data
  • Changing group memberships
  • Checking event logs
  • Creating administrative scripts
  • Creating logon scripts
  • Creating user and group accounts
  • Deploying and upgrading software
  • Installing a DHCP server
  • Installing a domain controller
  • Managing applications on a local computer
  • Managing applications remotely
  • Managing directory replication
  • Managing disks and volumes
  • Managing files and folders
  • Managing network printers
  • Managing servers remotely
  • Managing services
  • Monitoring network traffic
  • Monitoring security-related events
  • Monitoring server performance
  • Resetting user passwords
  • Safeguarding your system
  • Scheduling tasks
  • Setting up DNS
  • Setting up TCP/IP
  • Setting user and group security


Backing up and restoring data

The Backup utility helps you protect data from accidental loss if your system’s hardware or storage media fails. For example, you can use Backup to create a duplicate copy of the data on your hard disk and then archive the data on another storage device. The backup storage medium can be a logical drive such as your hard disk, a separate storage device such as a removable disk, or an entire library of disks or tapes organized and controlled by a robotic changer. If the original data on your hard disk is accidentally erased or overwritten, or becomes inaccessible because of a hard disk malfunction, you can easily restore the data from the archived copy.

Two of the most common tasks are backing up files to a file or tape and restoring files from a file or tape. You can also back up data from the command line. For more information about other tasks for backing up and restoring data, see How To.

To back up files to a file or tape

  1. XOX

    2. The Backup or Restore wizard starts by default, unless it is disabled. You can use this wizard or go to the next step to work in Advanced Mode.

  2. Click the Advanced Mode link on the Backup or Restore wizard.
  3. Click the Backup tab, and then on the Job menu, click New.
  4. Select the files and folders you want to back up by clicking the box to the left of a file or folder in Click to select the check box for any drive, folder, or file that you want to back up.
  5. In Backup destination, do one of the following:
    • Choose File if you want to back up files and folders to a file. This is selected by default.
    • Choose a tape device if you want to back up files and folders to a tape.
  6. In Backup media or file name, do one of the following:
    • If you are backing up files and folders to a file, type a path and file name for the backup (.bkf) file, or click the Browse button to find a file.
    • If you are backing up files and folders to a tape, choose the tape you want to use.
  7. Select any backup options you want, such as the backup type and the log file type, by clicking the Tools menu, and then clicking Options. When you have finished selecting backup options, click OK.
  8. Click Start Backup, and then make any changes to the Backup Job Information dialog box.
  9. If you want to set advanced backup options such as data verification or hardware compression, click Advanced. When you have finished setting advanced backup options, click OK.
  10. Click Start Backup to start the backup operation.

Caution

  • XOX

Notes

  • XOX
  • XOX
  • If the Backup or Restore wizard does not start by default, you can still use it to back up files by clicking Wizard Mode on the Welcome tab.
  • To back up and restore Microsoft SQL Server database files, it is recommended that you use the built-in backup and restore utilities that SQL has. For more information, see the Microsoft SQL Server documentation.
  • Some tape drives may not support hardware compression.
  • XOX
  • You can only back up the System State data on a local computer. You cannot back up the System State data on a remote computer.
  • Backup files usually have the extension .bkf. You can use any extension you like, but it is highly recommended that you use .bkf which has file associations that will ensure that the backup file is recognizable.
  • Backup operators and administrators can back up and restore encrypted files and folders without decrypting the files or folders.
  • If you have Windows Media Services running on your computer, and you want to back up the files associated with these services, see "Running Backup with Windows Media Services" in the Windows Media Services online documentation. You must follow the procedures outlined in the Windows Media Services online documentation before you can back up or restore files associated with Windows Media Services.

To restore files from a file or tape

  1. XOX

    2. The Backup or Restore wizard starts by default, unless it is disabled.

  2. Click the Advanced Mode link on the Backup or Restore wizard.
  3. Click the Restore and Manage Media tab, in Click to select the check box for any drive, folder, or file that you want to restore, select the files and folders you want to restore by clicking the box to the left of a file or folder.
  4. In Restore files to, do one of the following:
    • Click Original location if you want the backed up files and folders to be restored to the folder or folders they were in when they were backed up. Skip to step 6.
    • Click Alternate location if you want the backed up files and folders to be restored to a folder that you designate. This option will preserve the folder structure of the backed up data; all folders and subfolders will appear in the alternate folder you designate.
    • Click Single folder if you want the backed up files and folders to be restored to a folder that you designate. This option will not preserve the folder structure of the backed up data; the files will appear only in the folder that you designate.
  5. If you selected Alternate location or Single folder, type a path for the folder under Alternate location, or click the Browse button to find the folder.
  6. On the Tools menu, click Options, click the Restore tab, and then do one of the following:
    • Click Do not replace the file on my computer if you do not want the restore operation to copy over files that are already on your hard disk.
    • Click Replace the file on disk only if the file on disk is older if you want the restore operation to replace older files on your disk with newer files from your backup.
    • Click Always replace the file on my computer if you want the restore operation to replace files on your disk regardless of whether the backup files are newer or older.
    • Click OK to accept the restore options you have set.
  7. Click Start Restore.
  8. If you want to change any of the advanced restore options, such as restoring security settings and junction point data, click Advanced. When you are done setting advanced restore options click OK.
  9. Click OK to start the restore operation.

Caution

  • Choosing Always replace the file on my computer could cause you to lose data if a file you are working on is contained in the backup.
  • XOX

Notes

  • XOX
  • XOX
  • You can also use the Restore wizard to restore files by clicking Restore Wizard on the Tools menu.
  • To back up and restore Microsoft SQL Server database files, it is recommended that you use the built-in backup and restore utilities that SQL has. For more information, see the Microsoft SQL Server documentation.
  • In order to restore the System State data on a domain controller, you must first start your computer in Directory Services Restore Mode. This will allow you to restore the SYSVOL directory and the Active Directory directory service database.
  • You can only restore the System State data on a local computer. You cannot restore the System State data on a remote computer.
  • Backup operators and administrators can back up and restore encrypted files and folders without decrypting the files or folders.


Changing group memberships

A group is a collection of users that you can use to simplify the administration of user permissions and rights. In addition, you can use a group to delegate administrative tasks, filter Group Policy settings, and create e-mail distribution lists. Users belonging to a particular group receive all the permissions and rights assigned to that group. By changing group memberships for a user, you can quickly change the resources to which that user has access, as well as the tasks delegated to the user and the Group Policy settings that apply to the user. You can change the membership of Active Directory groups to change users’ permissions and rights within a domain or forest. You can also change the membership of local groups to change users’ permissions and rights on a specific computer.

Some of the most common tasks are adding or removing members from Active Directory groups and adding or removing members from groups on a local computer. You can also use the command line to change group memberships, either in a domain or on a local computer. For more information about other tasks for managing group memberships in a domain, see Manage groups. For more information about other tasks for managing group memberships on a local computer, see Manage local groups.

To add or remove a member from an Active Directory group

  1. Open Active Directory Users and Computers.
  2. In the console tree, double-click the domain node.
  3. Click the folder that contains the group to which you want to add or remove a member.
  4. In the details pane, right-click the group, and then click Properties.
  5. Click the Members tab, and then do one of the following:
    • To add a member to a group, click Add. In Enter the object names to select, type the name of the user, group, or computer that you want to add to the group, and then click OK.
    • To remove a member from a group, click the member you want to remove, and then click Remove.

Notes

  • XOX
  • XOX
  • In addition to users and computers, groups can include contacts and other groups.
  • To add members to a group, you can click the members you want to add, click Adds the selected objects to a group you specify. on the toolbar, and then type the name of the group to which they will be added. You can also drag a member object to a group, or right-click the object, and then click Add to a group from the shortcut menu.
  • When you administer a domain, security principals in the parent domain or other trusted domains are not visible on the Member Of tab of a domain users properties. The only domain accounts that you can add or view are the present domain groups. Only domain groups in the present domain are shown, even if the member belongs to other trusted domain groups.

To add or remove a member from a group on a local computer

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Right-click the group to which you want to add or remove a member and click Properties.
  4. Do one of the following:
    • To add a member to a group, click Add. In Enter the object names to select, type the name of the user, group, or computer that you want to add to the group, and then click OK.
    • To remove a member from a group, click the member you want to remove, and then click Remove.

Notes

  • XOX
  • XOX
  • A user who belongs to a group has all the rights and permissions granted to that group. If a user is a member of more than one group, then the user has all the rights and permissions granted to every group he or she belongs to. For more information, see Understanding local groups.
  • You should not add a new user to the Administrators group unless the user will perform only administrative tasks. For more information, see Why you should not run your computer as an administrator.
  • If the computer participates in a domain, you can add user accounts and global groups from that domain and from trusted domains to a local group.


Checking event logs

Depending on its server role, a computer running a Windows Server 2003 operating system records events in the following types of logs: application, security, directory service, File Replication service, and DNS server. You can use Event Viewer to monitor these logs and gather information about the hardware, software, and system problems on a computer. Event Viewer displays five types of events within each log: error, warning, information, success audit, and failure audit.

Some of the most common tasks are viewing an event log and connecting to another computer. You can also check event logs from the command line. For more information about other tasks for checking event logs, see How To.

To view an event log

  1. Open Event Viewer.
  2. In the console tree, click the log you want to view.
  3. In the details pane, view the list of individual events.
  4. If you want to see more details about a specific event, in the details pane, double-click the event.

Notes

  • XOX However, you must be a member of the Administrators group on the target computer to open the Security log, or any log when targeting a remote computer.
  • XOX
  • To refresh the view, on the Action menu, click Refresh. When you open a log, Event Viewer displays the current information for the log. While you view the log, the display is not updated unless you refresh the Event Viewer window. If you switch to another log and then return to the first log, the display for the first log is automatically refreshed. When you refresh the view of an event log, only the view is updated, no changes are made to the log. The Refresh command is not available for archived logs, because those files can no longer be updated.

To connect to another computer

  1. Open Event Viewer.
  2. In the console tree, right click Event Viewer (Local), and then click Connect to another computer.
  3. Click Another computer, type the name of the computer, and then click OK. You can also find another computer on the network by clicking Browse.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the target computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • The other computer can be a workstation running XOX, XOX, Windows 2000 Professional, Windows NT Workstation, or a server or domain controller running Windows NT Server, Windows 2000 Server, or a Windows Server 2003 operating system.


Creating administrative scripts

With scripts, you can automate a wide range of common administrative tasks, such as:

  • Administering users, groups, and organizational units.
  • Configuring computers.
  • Managing event logs.
  • Maintaining files, folders, and disks.
  • Monitoring performance, processes, and services.
The Windows Server 2003 family supports two scripting environments:
  • The command processor runs files that contain batch language commands. Batch language has limited capabilities, but earlier operating systems supported it and you may need to continue using existing batch files. For more information about batch files, see Using batch files.
  • Windows Script Host (WSH) runs files that contain Microsoft Visual Basic Scripting Edition (VBScript) or Jscript commands. VBScript and Jscript provide all the capabilities of batch language plus many more. For example, scripts written in VBScript or Jscript can interact with Active Directory Service Interfaces (ADSI) to manage objects stored in Active Directory, and they can interact with Windows Management Instrumentation (WMI) to access system resources.

In addition to the two scripting languages, WSH provides two runtime programs: WScript.exe and CScript.exe. After you create a WSH script containing VBScript or Jscript commands, you use WScript or CScript to run the script. WScript runs the script as a Windows-based process and CScript runs the script as a console-based process.

Administrators often want to manage objects in Active Directory, such as organizational units, groups, and users. The following example script shows how you can use WSH, VBScript, and ADSI to create an Active Directory organizational unit, group, and user. After creating the three Active Directory objects in the current domain, the script assigns a password to the new user account, enables the user account, and adds the user account to the group.

To create an example script

  1. Open Notepad.
  2. Copy and paste, or type, the following:

Set oRoot   = GetObject("LDAP://rootDSE")
Set oDomain = GetObject("LDAP://" &
      oRoot.Get("defaultNamingContext"))

Set oOU=oDomain.Create("organizationalUnit",
    "ou=Demo OU")
oOU.Put "Description", "Demonstration OU"
oOU.SetInfo

Set oGroup = oOU.Create("Group", "cn=Demo
     Group")

oGroup.Put "sAMAccountName", "DemoGroup"

oGroup.Put "Description", "Demonstration
     Group"
oGroup.SetInfo

Set oUser = oOU.Create("User", "cn=Demo User")

oUser.Put "sAMAccountName", "DemoUser"

oUser.Put "Description", "Demonstration User"

oUser.SetInfo

oUser.SetPassword "qW5rty"

oUser.AccountDisabled = False
oUser.SetInfo

oGroup.Add oUser.ADSPath
  3. On the File menu, click Save As.
  4. In Save as type, click All Files.
  5. In File name, type a file name, followed by .vbs, and then click Save. The file is saved as a VBScript.

Notes

  • XOX
  • The root of the current domain cannot contain an organizational unit named Demo OU.

To run the example script

  1. Open Command Prompt.
  2. Change to the directory where the script is located
    3. .
  3. Type the following:

    wscript ScriptName.vbs

    where ScriptName.vbs is the name of the script.

Notes

  • XOX
  • XOX
  • This example starts the script from the command prompt. You can also start the script by clicking Start, clicking Run, typing wscript ScriptName.vbs in Open, and then clicking OK.
  • This example runs the script as a Windows-based process. To run it as a console process, type cscript instead of wscript.

For more information, see Windows Script Host, Windows Script at the Microsoft Web site,(http://www.microsoft.com/) and the System Administration Scripting Guide at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)


Creating logon scripts

You can use logon scripts to assign tasks that will be performed when a user logs on to a particular computer. The scripts can carry out operating system commands, set system environment variables, and call other scripts or executable programs. The Windows Server 2003 family supports two scripting environments: the command processor runs files containing batch language commands, and Windows Script Host (WSH) runs files containing Microsoft Visual Basic Scripting Edition (VBScript) or Jscript commands. You can use a text editor to create logon scripts. Some tasks commonly performed by logon scripts include:

  • Mapping network drives.
  • Installing and setting a user's default printer.
  • Collecting computer system information.
  • Updating virus signatures.
  • Updating software.

The following example logon script contains VBScript commands that use Active Directory Service Interfaces (ADSI) to perform three common tasks based on a user's group membership:

  1. It maps the H: drive to the home directory of the user by calling the WSH Network object's MapNetworkDrive method in combination with the WSH Network object's UserName property.
  2. It uses the ADSI IADsADSystemInfo object to obtain the current user's distinguished name, which in turn is used to connect to the corresponding user object in Active Directory. Once the connection is established, the list of groups the user is a member of is retrieved by using the user's memberOf attribute. The multivalued list of group names is joined into a single string by using VBScript's Join function to make it easier to search for target group names.
  3. If the current user is a member of one of the three groups defined at the top of the script, then the script maps the user's G: drive to the group shared drive, and sets the user's default printer to be the group printer.

To create an example logon script

  1. Open Notepad.
  2. Copy and paste, or type, the following:
    Const ENGINEERING_GROUP     = "cn=engineering"
Const FINANCE_GROUP         = "cn=finance"
Const HUMAN_RESOURCES_GROUP = "cn=human resources"

Set wshNetwork = CreateObject("WScript.Network")
wshNetwork.MapNetworkDrive "h:",
     "\\FileServer\Users\" & wshNetwork.UserName

Set ADSysInfo = CreateObject("ADSystemInfo")
Set CurrentUser = GetObject("LDAP://" &
     ADSysInfo.UserName)
strGroups = LCase(Join(CurrentUser.MemberOf))

If InStr(strGroups, ENGINEERING_GROUP) Then

    wshNetwork.MapNetworkDrive "g:",
     "\\FileServer\Engineering\"
    wshNetwork.AddWindowsPrinterConnection
     "\\PrintServer\EngLaser"
    wshNetwork.AddWindowsPrinterConnection
     "\\PrintServer\Plotter"
    wshNetWork.SetDefaultPrinter
     "\\PrintServer\EngLaser"

ElseIf InStr(strGroups, FINANCE_GROUP) Then

    wshNetwork.MapNetworkDrive "g:",
     "\\FileServer\Finance\"
    wshNetwork.AddWindowsPrinterConnection
     "\\PrintServer\FinLaser"
    wshNetWork.SetDefaultPrinter
     "\\PrintServer\FinLaser"

ElseIf InStr(strGroups, HUMAN_RESOURCES_GROUP) Then

    wshNetwork.MapNetworkDrive "g:",
     "\\FileServer\Human Resources\"
    wshNetwork.AddWindowsPrinterConnection
     "\\PrintServer\HrLaser"
    wshNetWork.SetDefaultPrinter
     "\\PrintServer\HrLaser"

End If
  3. On the File menu, click Save As.
  4. In Save in, click the directory that corresponds to the domain controller's Netlogon shared folder (usually SystemRoot\SYSVOL\Sysvol\DomainName\Scripts where DomainName is the domain's fully qualified domain name).
  5. In Save as type, click All Files.
  6. In File name, type a file name, followed by .vbs, and then click Save. WSH uses the .vbs extension to identify files that contain VBScript commands.

Notes

  • XOX
  • To use the example logon script, you need to change the group names, network drive letters, and Universal Naming Convention (UNC) paths to match your system environment.
  • To run a logon script, you need to assign the script to a user or a group. For more information, see To assign a logon script to a user or group.

For more information about creating and using logon scripts, see Logon Scripts, Windows Script at the Microsoft Web site (http://www.microsoft.com/), and the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/).


Creating user and group accounts

User accounts are used to authenticate, authorize or deny access to resources for, and audit the activity of individual users on your network. A group account is a collection of user accounts that you can use to assign a set of permissions and rights to multiple users simultaneously. A group can also contain contacts, computers, and other groups. You can create user accounts and group accounts in Active Directory to manage domain users. You can also create user accounts and group accounts on a local computer to manage users specific to that computer.

Some of the most common tasks are creating user accounts in Active Directory, creating group accounts in Active Directory, creating user accounts on a local computer, and creating groups on a local computer. You can also use the command line to create user and group accounts in Active Directory or on a local computer. For more information about other tasks for managing Active Directory user accounts and groups, see Manage users, groups and computers. For information about other tasks for managing user accounts and groups on a local computer, see How To.

To create a user account in Active Directory

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the folder in which you want to add a user account.

    Where?

    • Active Directory Users and Computers
    • domain node
    • folder
  3. Point to New, and then click User.
  4. In First name, type the user's first name.
  5. In Initials, type the user's initials.
  6. In Last name, type the user's last name.
  7. Modify Full name to add initials or reverse order of first and last names.
  8. In User logon name, type the user logon name, click the UPN suffix in the drop-down list, and then click Next.

    If the user will use a different name to log on to computers running Windows 95, Windows 98, or Windows NT, then you can change the user logon name as it appears in User logon name (pre-Windows 2000) to the different name.

  9. In Password and Confirm password, type the user's password, and then select the appropriate password options.

Notes

  • XOX
  • XOX
  • To add a user, you can also click Create a new user in the current container on the toolbar.
  • To add a user, you can also copy any previously created user account.
  • A new user account with the same name as a previously deleted user account does not automatically assume the permissions and group memberships of the previously deleted account because the security ID (SID) for each account is unique. To duplicate a deleted user account, all permissions and memberships must be manually recreated.
  • When a user account is created with the new user wizard from within the details pane, you can quickly edit the user properties by closing the wizard, clicking the new account, and then pressing ENTER. To open the new user wizard from within the details pane, right-click in the details pane, click New, and then click User.
  • For interoperability with other directory services, you can create an InetOrgPerson user object. To create a new inetOrgPerson, in step three, click InetOrgPerson instead of User.
  • When creating a new user, the full name attribute is created in the FirstName LastName format by default. The full name attribute also governs the display name format is shown in the global address list. You can change the display name format by using ADSI Edit. If you do so, this will also change the full name format. For more information, see article Q250455, "How to Change Display Names of Active Directory Users" in the Microsoft Knowledge Base.

To create a group account in Active Directory

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the folder in which you want to add a new group.

    Where?

    • Active Directory Users and Computers
    • domain node
    • folder
  3. Point to New, and then click Group.
  4. Type the name of the new group.

    By default, the name you type is also entered as the pre-Windows 2000 name of the new group.

  5. In Group scope, click one of the options.
  6. In Group type, click one of the options.

Notes

  • XOX
  • XOX
  • To add a group, you can also click the folder in which you want to add the group, and then click Create a new group in the current container. on the toolbar.
  • If the domain in which you are creating the group is set to the domain functional level of Windows 2000 mixed, you can select only security groups with Domain local or Global scopes. For more information, see Group scope.
  • When a group account is created with the new group wizard from within the details pane, you can quickly edit the group account properties by closing the wizard, clicking the new account, and then pressing ENTER. To open the new group wizard from within the details pane, right-click in the details pane, click New, and then click Group.

To create a user account on a local computer

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. On the Action menu, click New User.
  4. Type the appropriate information in the dialog box.
  5. Select or clear the check boxes for:
    • User must change password at next logon
    • User cannot change password
    • Password never expires
    • Account is disabled
  6. Click Create, and then click Close.

Notes

  • XOX
  • XOX
  • A user name cannot be identical to any other user or group name on the computer being administered. It can contain up to 20 uppercase or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < >

    A user name cannot consist solely of periods (.) or spaces.

  • In Password and Confirm password, you can type a password containing up to 127 characters. However, if the network consists of computers running Windows 95 or Windows 98, consider using passwords no longer than 14 characters. If your password is longer, you may not be able to log on to the network from those computers.
  • You should not add a new local user to the local Administrators group unless the user will perform only administrative tasks. For more information, see Why you should not run your computer as an administrator.

To create a group on a local computer

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. On the Action menu, click New Group.
  4. In Group name, type a name for the new group.
  5. In Description, type a description of the new group.
  6. To add one or more users to a new group, click Add.
  7. In the Select Users, Computers, or Groups dialog box, do the following:
    • To add a user or group account to this group, under Enter the object names to select, type the name of the user account or group account that you want to add, and then click OK.
    • To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add, and then click OK.
  8. In the New Group dialog box, click Create, and then click Close.

Notes

  • XOX
  • XOX
  • A local group name cannot be identical to any other group or user name on the local computer being administered. It can contain up to 256 uppercase or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < >

    A group name cannot consist solely of periods (.) or spaces.


Deploying and upgrading software

You can deploy and upgrade software to remote computers in managed environments by using Group Policy Software Installation to assign Windows Installer packages. Windows Installer packages are deployed and managed within a Group Policy object, which is in turn associated with a particular Active Directory container—either a site, a domain, or an organizational unit. You can use Add or Remove Programs in Control Panel to install, upgrade, or manage an application on a local computer. You can also use Remote Desktop Connection to install or upgrade an application by using Add or Remove Programs on a remote computer. For more information, see Add or Remove Programs overview and Remote Desktop Connection.

Some of the most common tasks are deploying software to remote computers, upgrading software on remote computers, and installing or upgrading software on a local computer.

To deploy software to remote computers

  1. Open Group Policy Object Editor.
  2. Do one of the following:
    • To assign software applications to computers, in the console tree, double-click Computer Configuration.
    • To assign or publish software applications to users, in the console tree, double-click User Configuration.
  3. Double-click Software Settings, and then click Software Installation.

    Where?

    • Group Policy object
    • Computer Configuration or User Configuration
    • Software Settings
    • Software Installation
  4. Right-click Software Installation, click New, and then click Package.
  5. Click the Windows Installer package you want to assign, and then click Open.
  6. In Deploy Software, click Assigned.

Notes

  • XOX
  • Group Policy Software Installation is available to computers running Windows 2000, XOX, and the Windows Server 2003 family in an Active Directory environment.
  • To use Group Policy Software Installation, you must create a new Group Policy object or edit an existing Group Policy object for a site, domain, or organizational unit. You can also link a Group Policy object to a site, domain, or organizational unit in Active Directory Users and Computers or Active Directory Sites and Services. For more information about ways to open Group Policy Object Editor, see Group Policy.
  • Many software applications come with Windows Installer packages (.msi files). For more information, see your software manufacturer’s documentation.

To upgrade software on remote computers

  1. Open Group Policy Object Editor.
  2. Do one of the following:
    • To upgrade software applications on remote computers, in the console tree double-click, Computer Configuration.
    • To upgrade software applications for users, in the console tree, double-click User Configuration.
  3. Double-click Software Settings, and then click Software Installation.

    Where?

    • Group Policy object
    • Computer Configuration or User Configuration
    • Software Settings
    • Software Installation
  4. Right-click Software Installation, click New, and then click Package.
  5. Click the Windows Installer package that will serve as the upgrade package, and then click Open.
  6. In Deploy Software, click Assigned.
  7. In the details pane, right-click the Windows Installer package that will function as the upgrade (not the package to be upgraded).
  8. Click Properties, and then click the Upgrades tab.
  9. Click Add to create or add to the list of packages that are to be upgraded by the current package.
  10. Under Choose a package from, click Current Group Policy object (GPO) or A specific GPO as the source of the package to be upgraded. If you click A specific GPO, click Browse, and then click the Group Policy object that you want.
  11. Review the list of packages under Package to upgrade, which lists all of the other packages that are assigned or published within the selected Group Policy object. Depending on the Group Policy object, this list may have zero or more entries.
  12. Click the package that you want to upgrade, and then do one of the following:
    • To replace an application with a completely different application, click Uninstall the existing package, then install the upgrade package.
    • To install a newer version of the same product while retaining the user's application preferences, click Package can upgrade over the existing package.
  13. On the Upgrades tab, select the Required upgrade for existing packages check box if you want the upgrade to be mandatory. If this is an upgrade under Computer Configuration in the Group Policy console tree, the check box is unavailable and selected, because packages can only be assigned to computers, not published.

Notes

  • XOX
  • Group Policy Software Installation is available to computers running Windows 2000, XOX, and the Windows Server 2003 family in an Active Directory environment.
  • To use Group Policy Software Installation, you must create a new Group Policy object or edit an existing Group Policy object for a site, domain, or organizational unit. You can also link a Group Policy object to a site, domain, or organizational unit in Active Directory Users and Computers or Active Directory Sites and Services. For more information about ways to open Group Policy Object Editor, see Group Policy.
  • Many software applications come with Windows Installer packages (.msi files). For more information, see your software manufacturer’s documentation.

To install or upgrade software on a local computer by using Add or Remove Programs

  1. Open Add or Remove Programs in Control Panel.
  2. Click Add New Programs, and then click CD or Floppy.
  3. Follow the instructions on your screen.

Notes

  • XOX
  • When using Add or Remove Programs, you can only install programs that were written for Windows operating systems.


Installing a DHCP server

All computers on a TCP/IP network must have an IP address in order for the network to properly function. You can configure IP addresses manually at each computer, or you can install a DHCP server that automatically assigns IP address leases to each client computer on the network. Most client operating systems seek an IP address lease by default, so no configuration on the client computer is necessary to implement a DHCP-enabled network.

Before a DHCP server can start leasing IP addresses to client computers, you must create and activate a scope. A scope is a range of possible IP addresses for a network. Before you create a scope, make sure that the IP address range you want to use provides enough IP addresses for all of the computers on your network. Also, determine whether any devices on your network, such as DNS servers, WINS servers, or legacy printers, will need to use static IP addresses. If there are devices that need static IP addresses, create an exclusion range of IP addresses at the beginning of the IP address range. An exclusion range is a group of IP addresses that the DHCP server will not lease to client computers. Once the exclusion range has been defined, you can assign all statically configured devices an IP address from the exclusion range.

Some of the most common tasks are installing a DHCP server, creating a scope, and activating a scope. You can also perform these tasks from the command line. For more information about other tasks for managing DHCP, see How to.

To install a DHCP server

  1. Open Windows Components wizard.
  2. Under Components, scroll to and click Networking Services.
  3. Click Details.
  4. Under Subcomponents of Networking Services, click Dynamic Host Configuration Protocol (DHCP), and then click OK.
  5. If prompted, type the full path to the Windows Server 2003 distribution files, and click Continue.

    Required files are copied to your hard disk.

Notes

  • XOX
  • DHCP servers must be configured with a static IP address.

To create a new scope

  1. Open DHCP.
  2. In the console tree, click the applicable DHCP server.

    Where?

    • DHCP
    • applicable DHCP server
  3. On the Action menu, click New Scope.
  4. Follow the instructions in the New Scope wizard.

Notes

  • XOX
  • Depending on the starting and ending IP addresses for your scope, the DHCP console suggests a default subnet mask useful for most networks. If you know a different subnet mask is required for your network, you can modify the value as needed.
  • When you finish creating a new scope, you might need to complete additional tasks, such as activating the scope for use or assigning scope options.

To activate a scope

  1. Open DHCP.
  2. In the console tree, click the applicable scope.

    Where?

    • DHCP
    • Applicable DHCP server
    • Applicable superscope (if used)
    • Applicable scope
  3. On the Action menu, click Activate.

Notes

  • XOX
  • Activating a scope is needed only for new scopes to start lease distribution. You must activate a scope to make it available for DHCP clients.
  • Do not activate a scope until you specify the options you want.
  • The Action menu command changes to Deactivate when the selected scope is currently activated. Do not deactivate a scope unless you are retiring it permanently from use on your network.
  • If you want to use DHCP to assign IP address leases to clients on a subnet that is separated from your DHCP server by a router, you must have DHCP message forwarding enabled on the router. If you are using a computer running a member of the Windows Server 2003 family as a router, you can use the DHCP Relay Agent service provided with the Routing and Remote Access service. For more information, see DHCP/BOOTP relay agents and Configure the DHCP Relay Agent.


Installing a domain controller

Domain controllers provide network users and computers with the Active Directory directory service, which stores and replicates directory data and manages user interactions with the domain, including user logon processes, authentication, and directory searches. Every domain must contain at least one domain controller. You install a domain controller by installing Active Directory on any member or stand-alone server (except those with restrictive license agreements).

When you install the first domain controller in your organization, you are creating the first domain (also called the root domain) and the first forest. You can add additional domain controllers to an existing domain to provide fault tolerance, improve service availability, and balance the load of existing domain controllers.

You can also install a domain controller to create a new child domain or new domain tree. Create a new child domain when you want a new domain that shares a contiguous namespace with one or more domains. This means that the name of the new domain contains the full name of the parent domain. For example, sales.microsoft.com would be a child domain of microsoft.com. Create a new domain tree only when you need a domain whose Domain Name System (DNS) namespace is not related to the other domains in the forest. This means that the name of the new domain tree’s root domain (and all of its children) does not contain the full name of the parent domain. A forest can contain one or more domain trees.

Before installing a new domain controller, you will need to consider pre-Windows 2000 compatible security levels and identify the DNS name of the domain. For more information, see Checklist: Creating an additional domain controller.

The most commonly performed tasks when installing a domain controller are creating a new domain in a new forest, creating a new child domain in an existing domain tree, creating a new domain tree in an existing forest, and adding a domain controller to an existing domain.

For information about important decisions you need to make when installing a domain controller, see Using the Active Directory Installation Wizard.

To create a new domain in a new forest

  1. Open the Active Directory Installation Wizard.
  2. On the Domain Controller Type page, click Domain controller for a new domain, and then click Next.
  3. On the Create New Domain page, click Domain in a new forest, and then click Next.
  4. On the New Domain Name page, type the full DNS name for the new domain, and then click Next.
  5. On the NetBIOS Domain Name page, verify the NetBIOS name, and then click Next.
  6. On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next.
  7. On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location, and then click Next.
  8. On the DNS Registration Diagnostics page, verify if an existing DNS server will be authoritative for this forest or, if necessary, choose to install and configure DNS on this server by clicking Install and configure the DNS server on this computer, and set this computer to use this DNS server as its preferred DNS server, and then click Next.
  9. On the Permissions page, select one of the following:
    • Permissions compatible with pre-Windows 2000 server operating systems
    • Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems
  10. Review the Summary page, and then click Next to begin the installation.
  11. Restart the computer.

Notes

  • XOX
  • The server on which you perform this procedure will be promoted to the first domain controller in the forest root domain.
  • The wizard options on the Permissions page affect application compatibility with pre-Windows 2000 and Windows Server 2003 operating systems and are not related to domain functionality.
  • The Active Directory Installation Wizard allows Active Directory domain names up to 64 characters or up to 155 bytes. Although the limit of 64 characters is usually reached before the limit of 155 bytes, the opposite could be true if the name contains Unicode characters consuming three bytes. These limits do not apply to computer names.

To create a new child domain in an existing domain tree

  1. Open the Active Directory Installation Wizard.
  2. On the Domain Controller Type page, click Domain controller for a new domain, and then click Next.
  3. On the Create New Domain page, click Child domain in an existing domain tree, and then click Next.
  4. On the Network Credentials page, type the user name, password, and user domain of the user account you want to use for this operation, and then click Next.
  5. On the Child Domain Installation page, verify the parent domain and type the new child domain name, and then click Next.
  6. On the NetBIOS Domain Name page, verify the NetBIOS name, and click Next.
  7. On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next.
  8. On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location, and then click Next.
  9. On the DNS Registration Diagnostics page, verify the DNS configuration settings are accurate, and then click Next.
  10. On the Permissions page, select one of the following:
    • Permissions compatible with pre-Windows 2000 server operating systems
    • Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems
  11. On the Directory Services Restore Mode Administrator Password page, type and confirm the password you want to assign to this server's Administrator account that will be used when the computer is started in Directory Services Restore Mode, and then click Next.
  12. Review the Summary page, and then click Next to begin the installation.
  13. Restart the computer.

Notes

  • To perform this procedure, you must be a member of the Domain Admins group (in the parent domain) or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.
  • The server on which you perform this procedure will be promoted to the first domain controller in a new child domain.
  • When a child domain is added to an existing tree domain, a two-way, transitive, parent and child trust is established by default.
  • The wizard options on the Permissions page affect application compatibility with pre-Windows 2000 and Windows Server 2003 operating systems and are not related to domain functionality.
  • The Active Directory Installation Wizard allows Active Directory domain names up to 64 characters or up to 155 bytes. Although the limit of 64 characters is usually reached before the limit of 155 bytes, the opposite could be true if the name contains Unicode characters consuming three bytes. These limits do not apply to computer names.

To create a new domain tree in an existing forest

  1. Open the Active Directory Installation Wizard.
  2. On the Domain Controller Type page, click Domain controller for a new domain, and then click Next.
  3. On the Create New Domain page, click Domain tree in an existing forest.
  4. On the Network Credentials page, type the user name, password, and user domain of the user account you want to use for this operation, and then click Next.
  5. On the New Domain Tree page, type the full DNS name for the new domain, and then click Next.
  6. On the NetBIOS Domain Name page, verify the NetBIOS name, and then click Next.
  7. On the Database and Log Folders page, type the location in which to install the database and log folders, or click Browse to choose a location, and then click Next.
  8. On the Shared System Volume page, type the location in which to install the Sysvol folder, or click Browse to choose a location, and then click Next.
  9. On the DNS Registration Diagnostics page, verify if an existing DNS server will be authoritative for this forest or, if necessary, choose to install and configure DNS on this server by clicking Install and configure the DNS server on this computer, and set this computer to use this DNS server as its preferred DNS server, and then click Next.
  10. On the Permissions page, select one of the following:
    • Permissions compatible with pre-Windows 2000 server operating systems
    • Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems
  11. On the Directory Services Restore Mode Administrator Password page, type and confirm the password you want to assign this server's Administrator account that will be used when the computer is started in Directory Services Restore Mode, and then click Next.
  12. Review the Summary page, and then click Next to begin the installation.
  13. Restart the computer.

Notes

  • To perform this procedure, you must be a member of the Domain Admins group (in the forest root domain) or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.
  • The server on which you perform this procedure will be promoted to the first domain controller in a new domain tree.
  • When a new domain tree is created in an existing forest, a two-way, transitive, tree root trust is established by default.
  • The wizard options on the Permissions page affect application compatibility with pre-Windows 2000 and Windows Server 2003 operating systems and are not related to domain functionality.
  • The Active Directory Installation Wizard allows Active Directory domain names up to 64 characters or up to 155 bytes. Although the limit of 64 characters is usually reached before the limit of 155 bytes, the opposite could be true if the name contains Unicode characters consuming three bytes. These limits do not apply to computer names.

To install an additional domain controller in an existing domain

  1. Open the Active Directory Installation Wizard.
  2. On the Domain Controller Type page, click Additional domain controller for an existing domain , and then click Next .
  3. On the Network Credentials page, type the user name, password, and user domain of the user account you want to use for this operation, and then click Next . See Note below for more information.
  4. On the Additional Domain Controller page, enter the full DNS name of the existing domain for which the server will become a domain controller, and then click Next .
  5. On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next .
  6. On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location, and then click Next .
  7. On the Directory Services Restore Mode Administrator Password page, type and confirm the password you want to assign to this server's Administrators account that will be used when the computer is started in Directory Services Restore Mode, and then click Next.
  8. Review the Summary page, and then click Next to begin the installation.
  9. Restart the computer.

Notes

  • XOX
  • To create an additional domain controller from restored backup files, start the Active Directory Installation Wizard by typing dcpromo /adv at a command prompt.


Managing applications on a local computer

Managing applications involves adding or removing applications, changing the configuration of an application, or scheduling an application to run at a specific time. You can use Add or Remove Programs in Control Panel to add or remove an application, modify an existing application, repair a damaged application, or add or remove components of Windows. You can use Task Scheduler or the at command to schedule an application to run at a specific time.

You can also update your operating system and other Microsoft software by using Windows Update in Help and Support Center to download items such as security fixes, critical updates, the latest Help files, drivers, and Internet products. For more information, see Windows Update.

Some of the most common tasks are adding, removing, or changing an application and scheduling an application to run at a specific time. You can also run an application at a scheduled time from the command line by using the at command. For more information about other tasks for managing applications, see Managing applications remotely.

To add, remove, or change an application

  1. Open Add or Remove Programs in Control Panel.
  2. Do one of the following:
    • To add a new application from a CD or floppy disk, click Add New Programs, click CD or Floppy, and then follow the instructions on your screen.
    • To add a new application from your network, click Add New Programs, click the program you want to add, and then click Add. Follow the instructions on your screen.
    • To change or remove an application, click Change or Remove Programs, click the program you want to change or remove, and then click Change/Remove. Follow the instructions on your screen.

Caution

  • Some programs do not provide Change options and may be removed without prompting you further.

Notes

  • XOX
  • XOX
  • Only applications written for Windows operating systems can be used with Add or Remove Programs.
  • Many software applications provide tools for setting configuration properties or adding or removing components. You will often see these tools listed in an application’s program group on the Start menu or in Control Panel. For more information, see the software manufacturer’s documentation.

To schedule an application to run at a specific time

  1. Open Task Scheduler.
  2. Double-click Add Scheduled Task.
  3. Follow the instructions in the Scheduled Task Wizard.

Notes

  • To perform this procedure, you must be a member of the Administrators, Backup Operators, or Server Operators group, or have been delegated the appropriate authority, on the local computer. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • For more information, see Task Scheduler.


Managing applications remotely

You can manage the applications for an entire system from a remote location by using the remote administration features of the Windows Server 2003 family. With the Remote Desktops snap-in, you can access remote computers for installations, deletions, or modifications of applications on those computers. In addition, with Group Policy Software Installation, you can assign or publish applications. You assign an application to users or computers when you want everyone to have the application on his or her computer. When the users log on to their computers, the application installs. You publish an application to users when you want the application to be available to the users who are managed by your Group Policy object. These users then determine when to install the application.

Some of the most common tasks are creating a new connection to a remote computer, assigning an application to users or computers, and publishing an application to users. For more information about other tasks for managing applications remotely, see How To.

To create a new connection to a remote computer

  1. Open Remote Desktops snap-in.
  2. In the console tree, right-click Remote Desktops.
  3. Click Add new connection.
  4. In the Add New Connection dialog box, in Server name or IP address, type the name or TCP/IP address of the server. Or, click Browse to look for a server.
  5. Optionally, in Connection Name, type a friendly name for this connection.
  6. Clear the Connect to console check box if you do not want to connect to the console of the server.
  7. Optionally, in Logon information, supply the user name, password and domain to automatically log on to the server. Click OK.

Notes

  • XOX
  • Depending on the configuration of the Terminal server, you might be prompted to supply your password upon connection even if you specify it in the Add New Connection dialog box.

To assign an application to users or computers

  1. Open Group Policy Software Installation.
  2. In the console tree, click Software Installation.

    Where?

    • Group Policy object
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software Installation
  3. In the details pane, right-click, point to New, and then click Package.
  4. In the Open dialog box, click the Windows Installer package, and then click Open.
  5. In the Deploy Software dialog box, click Assigned, and then click OK.

Notes

  • To open Group Policy Software Installation, see Group Policy.
  • The Open dialog box shows the packages that are located at a software distribution point that you specify as the default.
  • If the Windows Installer package is located on a different network drive, navigate to the correct software distribution point in the Open dialog box, click the package, and then click Open.

To publish an application to users

  1. Open Group Policy Software Installation.
  2. In the details pane, right-click, point to New, and then click Package.
  3. In the Open dialog box, click the Windows Installer package to be published, and then click Open.
  4. In the Deploy Software dialog box, click Published.

Notes

  • XOX
  • To open Group Policy Software Installation, see Group Policy.
  • Packages can be published only to users, not to computers.
  • The Open dialog box shows the packages that are located at a software distribution point that you specify as the default.
  • If the Windows Installer package is located on a different network drive, navigate to the correct software distribution point in the Open dialog box, click the package, and then click Open.
  • The application is available for users to install either by using Add or Remove Programs in Control Panel or by opening a file with an extension that you have associated with the application.


Managing directory replication

Except for very small networks, directory data must reside in more than one place on the network to be equally useful to all users. Through replication, the Active Directory directory service maintains replicas of directory data on multiple domain controllers, ensuring directory availability and performance for all users. Active Directory relies on configuration information that you provide about sites, subnets, and site links to manage and optimize the process of replication.

Some of the most common tasks are creating sites, creating site links, and creating a subnet and associating it with a site. For more information about other tasks for managing directory replication, see Manage sites.

To create a site

  1. Open Active Directory Sites and Services.
  2. Right-click the Sites folder, and then click New Site.
  3. In Name, type the name of the new site.
  4. Click a site link object, and then click OK.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group, or the Domain Admins group of the root domain in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • For more information about sites, see Sites overview.

To create a site link

  1. Open Active Directory Sites and Services.
  2. In the console tree, right-click the intersite transport protocol you want the site link to use, and then click New Site Link.

    3. Where?

    • Active Directory Sites and Services
    • Sites
    • Inter-Site Transports
    • inter-site transport protocol you want the site link to use
  3. In Name, type the name to be given to the link.
  4. Click two or more sites to connect, and then click Add.
  5. Configure the site link's cost, schedule, and replication frequency.

Caution

  • If you create a site link that uses SMTP, you must have an enterprise certification authority (Enterprise CA) available and SMTP must be installed on all domain controllers that will use the site link.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group, or the Domain Admins group of the root domain in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • Creating a site link between two or more sites is a way to influence replication topology. By creating a site link, you provide Active Directory with information about what connections are available, which ones are preferred, and how much bandwidth is available. Active Directory uses this information to choose times and connections for replication that will afford the best performance.
  • For more information about configuring the site link's cost, schedule, and replication frequency, see Configure replication between sites and Managing replication.

To create a subnet and associate it with a site

  1. Open Active Directory Sites and Services.
  2. In the console tree, double-click Sites.
  3. Right-click Subnets, and then click New Subnet.
  4. In Address, enter the subnet address.
  5. In Mask, enter the subnet mask that describes the range of addresses included in this site's subnet.
  6. Select a site with which to associate this subnet, and then click OK.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group, or the Domain Admins group of the root domain in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • Any IP address within the subnet range is a valid entry.


Managing disks and volumes

Managing disks and volumes includes creating and formatting partitions, logical drives, and volumes; setting disk quotas to limit disk usage; defragmenting volumes to improve file-system performance; and checking for file-system errors and bad sectors on a hard disk. The Windows Server 2003 family provides many tools you can use to effectively manage disks and volumes on new or existing systems. These tools include Disk Management, Disk Defragmenter, disk quotas, and error checking.

Some of the most common tasks are creating partitions or logical drives, formatting basic volumes, extending basic volumes, and defragmenting volumes. You can also manage disks and volumes from the command line. For information about disk quotas, see Disk quotas. For information about error checking, see Detecting and repairing disk errors. For more information about other tasks for managing disks and volumes, see How To.

To create a partition or logical drive

  1. XOX
  2. XOX
  3. Right-click an unallocated region of a basic disk, and then click New Partition, or right-click free space in an extended partition, and then click New Logical Drive.
  4. In the New Partition wizard, click Next, click Primary partition, Extended partition, or Logical drive, and then follow the instructions on your screen.

Notes

  • XOX
  • XOX
  • You can create primary partitions, extended partitions, and logical drives only on basic disks. You should create basic volumes instead of dynamic volumes if this computer also runs MS-DOS, Windows 95, Windows 98, Windows Millennium Edition, Windows NT 4.0, or XOX.
  • On a master boot record (MBR) disk, you can create up to four primary partitions, or three primary partitions, one extended partition, and unlimited logical drives.
  • On a GUID partition table (GPT) disk, you can create up to 128 primary partitions.

To format a basic volume

  1. XOX
  2. XOX
  3. Right-click the partition, logical drive, or basic volume you want to format (or reformat), and then click Format.
  4. Select the options you want, and then click OK.

Notes

  • XOX
  • XOX
  • You cannot format system, boot, OEM, or unknown partitions.
  • File compression is supported only on NTFS volumes with cluster sizes 4 KB and smaller.
  • If you select the Perform a quick format check box, the files are removed from the disk but the disk is not scanned for bad sectors. Use this option only if this disk has been previously formatted and you are sure the disk is not damaged.

To extend a basic volume

  1. Open Command Prompt.
  2. Type:

    diskpart

  3. At the DISKPART prompt, type:

    list volume

    Make note of the number of the basic volume you want to extend.

  4. At the DISKPART prompt, type:

    select volume n

    Selects the basic volume, n, you want to extend into contiguous, empty space on the same disk.

  5. At the DISKPART prompt, type:

    extend [size=n]

    Extends the selected volume by size=n megabytes (MB).

Notes

  • XOX
  • XOX
  • To extend a basic volume, it must either not be formatted with a file system or it must be formatted with the NTFS file system.
  • You can only extend a basic volume onto the same disk.
  • You can only extend a basic volume if it is followed by contiguous unallocated space.
  • For more information about Disk Management and the diskpart command, see Disk Management and DiskPart.

To defragment a volume

  1. Open Disk Defragmenter.
  2. Click the volume that you want to defragment, and then click Defragment.

    3. After the defragmentation is complete, Disk Defragmenter displays the results in Estimated disk usage after defragmentation.

  3. Click View Report to view the Defragmentation Report, which displays detailed information about the volume you defragmented.

Notes

  • XOX
  • XOX
  • You should analyze volumes before defragmenting them. This tells you whether you need to take the time to defragment them.
  • A volume must have at least 15% free space for Disk Defragmenter to completely and adequately defragment it. Disk Defragmenter uses this space as a sorting area for file fragments. If a volume has less than 15% free space, Disk Defragmenter will only partially defragment it. To increase the free space on a volume, delete unneeded files or move them to another disk.
  • You cannot defragment volumes that the file system has marked as dirty, which indicates possible corruption. You must run chkdsk on a dirty volume before you can defragment it. You can determine if a volume is dirty by using the fsutil dirty query command. For more information about the chkdsk command, see Chkdsk. For more information about the fsutil dirty command, see Fsutil dirty.
  • The time that Disk Defragmenter takes to defragment a volume depends on several factors, including the size of the volume, the number and size of files on the volume, the percentage of fragmentation in the volume, and available system resources.
  • You can defragment only local file system volumes, and you can run only one instance of Disk Defragmenter at a time.
  • To stop or temporarily interrupt defragmenting a volume, click Stop or Pause, respectively.
  • If you start Disk Defragmenter while performing a backup on the same volume, Disk Defragmenter stops.
  • Running the defrag command and Disk Defragmenter are mutually exclusive. If you are using Disk Defragmenter to defragment a volume and you run the defrag command at a command prompt, the defrag command fails. Conversely, if you run the defrag command, and open Disk Defragmenter, the defragmentation options in Disk Defragmenter are unavailable.
  • For more information about Disk Defragmenter and the defrag command, see Disk Defragmenter and Defrag.


Managing files and folders

Managing files and folders includes storing and securing resources, making those resources available to network users, and managing changes in those resources. The Windows Server 2003 family provides many tools you can use to manage files and folders. These tools include Shared Folders, shadow copies of shared folders, Distributed File System (DFS), Encrypting File System (EFS), and Offline Files. When a folder is shared, users can connect to the folder over the network and gain access to the contents of the shared folder. With shadow copies of shared folders, users can view the contents of network folders as they existed at points of time in the past.

Some of the most common tasks are sharing a folder or drive, enabling shadow copies of shared folders, and changing settings for shadow copies of shared folders. You can also manage files and folders from the command line. For more information about other tasks for managing files and folders, see How To.

To share a folder or drive

  1. XOX
  2. In the console tree, click Shares.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
    • Shares
  3. On the Action menu, click New Share.
  4. Follow the steps in the Share a Folder Wizard, and then click Finish.

Important

  • When you create a shared resource, determine how to secure that resource. There are several methods you can use to secure shared resources. For more information, see Share permissions.

Notes

  • XOX
  • XOX

To enable shadow copies of shared folders

  1. Open Computer Management (Local).
  2. In the console tree, right-click Shared Folders, point to All Tasks, and then click Configure Shadow Copies.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
  3. Select the volume where you want to enable shadow copies of shared folders, and then click Enable.

Notes

  • XOX
  • XOX
  • You can also access shadow copies of shared folders by right-clicking on a fixed NTFS volume in My Computer or in Disk Management, clicking Properties, and then clicking the Shadow Copies tab.
  • You can also use Disk Management to manage shadow copies of shared folders on remote servers. On the Action menu, point to All Tasks, and then click Configure Shadow Copies.
  • Enabling shadow copies of shared folders also creates a default schedule and settings for subsequent shadow copies. To make changes to these defaults, click Settings.
  • Shadow copies are enabled on a per volume basis; you cannot select specific shares on a volume to be copied or not copied.

To change settings for shadow copies of shared folders

  1. Open Computer Management (Local).
  2. In the console tree, right-click Shared Folders, point to All Tasks, and then click Configure Shadow Copies.

    3. Where?

    • Computer Management
    • System Tools
    • Shared Folders
  3. Select the volume where you want to make changes, and then click Settings.
  4. In this dialog box, you can change the settings described in the following table.
    5. Setting | Notes
Storage volume | This indicates where you would like to store the shadow copies of the selected volume. The default is to use the same volume. It is recommended that you use a separate volume on another disk which provides better performance for heavily used file servers. You can only change the storage volume when there are no shadow copies present. If you need to change the storage volume for a volume that already has been enabled, you must delete all of the shadow copies on that volume, then change the storage volume.
Details | Clicking Details will open a dialog box that lists the shadow copies that are currently stored. This dialog box also gives information about the total space and available storage space on the disk.
Storage limits | The default size is 10 percent of the size of the volume that holds the source files being shadow copied. If the shadow copies are stored on a separate volume from the source files, you should change this default to reflect the amount of the storage volume that you are willing to dedicate to shadow copies. The storage limit must be at least 100 MB, which will only allow for a single shadow copy to be retained. If you set a restrictive storage limit, you should test to ensure that the number of shadow copies you have scheduled will fit within those restraints. If shadow copies are deleted prematurely due to storage limits, you may be defeating the purpose of enabling shadow copies of shared folders.
Schedule | Clicking Schedule will open the task scheduler with the information needed to create a task schedule for taking shadow copies of shared folders on a regular basis. Before creating the schedule, take a look at your current users work patterns and design a strategy that will schedule shadow copies at a time of day that will work best for your users. The default schedule is Monday through Friday at 7:00 A.M. and 12:00 P.M. For more information about creating a schedule for shadow copies of shared folders, see Defining a schedule for shadow copies.

Notes

  • XOX
  • XOX


Managing network printers

To create a secure and effective network printing environment, you must consider variables such as what client operating systems are used on your network, what printing permissions you want to assign to different users, and what procedures you will use to manage the printers once they are connected to the network. The easiest way to connect and manage network printers is through Active Directory. You can also use Group Policy to change the default behavior of the printing environment and to provide computers and users a standard set of preferences.

Some of the most common tasks are publishing a printer in Active Directory, remotely managing printers, setting Group Policy for printers, and setting or removing permissions for a printer. You can also manage network printers from the command line. For more information about other tasks for managing network printers, see How To.

To publish a printer in Active Directory

  1. Open Printers and Faxes.
  2. Right-click the printer you want to publish, and then click Sharing.
  3. On the Sharing tab, click Share this printer, and then type a name for the shared printer.
  4. Select the List in the Directory check box to publish the printer in Active Directory.

Notes

  • XOX
  • Only a shared printer can be published. If you stop sharing a printer, the printer is no longer published.
  • If you add a printer using the Add Printer Wizard and click Share this printer, the printer will be published by default if the Group Policy settings Automatically publish new printers in Active Directory and Allow printers to be published are enabled, as they are by default.
  • You must open Active Directory Users and Groups to publish printers that are managed through print servers that are running Windows NT 4.0 or an earlier operating system.
  • Printers you add using the Add Printer Wizard are shared by default if you add them from a computer running a product in the Windows Server 2003 family. However, printers are not shared by default if you add them using the Add Printer Wizard from a computer running XOX.
  • You must have the Manage Printers permission for the printer you want to share or to publish.
  • You can create printer names that contain spaces, special characters, and more than eight characters. However, some clients do not recognize or correctly handle such names. The entire qualified name of a shared printer (for example \\PRINTER2\PSCRIPT) must contain 32 or fewer characters.

To remotely manage printers

  1. Double-click My Network Places, and then locate the print server for the printers you want to manage.
  2. Double-click the print server, double-click the Printer folder icon on that server, and then click a printer.

    3. Important

    • To facilitate stronger network security, remote printer management is not available by default. To enable remote printer management, in Group Policy, you must enable the Allow Print Spooler to Accept Client Connections policy.
  3. Change the print server, printer, or printing preference settings as required.

Notes

  • You can change printer settings only if you have Manage Printers permission.
  • If you are having trouble finding your printer and you are logged on to a Windows Server 2003 domain, you can find your printer by clicking Start, pointing to Search, and then clicking Printers.
  • You can also drag the Printers and Faxes folder of any print server (or specific printers from any Printers and Faxes folder) to the Printers and Faxes folder on your computer. This is an easy way to manage any printer without having to search for it.

To set Group Policy for printers

  1. Start Group Policy according to the object you want to set printer policy to.
  2. After selecting the properties page of the object you want to set printer policy to, select the Group Policy node.
    • If you want to set policies that apply only to computers, expand the Computer Configuration node, and then expand Administrative Templates.
    • If you want to set policies that apply only to users, expand the User Configuration node, expand Administrative Templates, and then expand Control Panel.
  3. Double-click Printers to open a listing of policies.
  4. Double-click the printer policy you want to set.
  5. On the Policy tab, enable or disable the policy by selecting or clearing the appropriate radio button. With some policies, you might need to enter additional information.

Note

  • If you do not want to change the current state of the policy setting, leave it as it is (not configured) to save processing time.

To set or remove permissions for a printer

  1. XOX
  2. Right-click the printer for which you want to set permissions, click Properties, and then click the Security tab.
  3. Do one of the following:
    • To change or remove permissions from an existing user or group, click the name of the user or group.
    • To set up permissions for a new user or group, click Add. In Select Users, Computers, or Groups, type the name of the user or group you want to set permissions for, and then click OK to close the dialog box.
  4. In Permissions, click Allow or Deny for each permission you want to allow or deny, if necessary. Or, to remove the user or group from the permissions list, click Remove.

Notes

  • To change device settings, you must have the Manage Printers permission. For information about printing security permissions, see Assigning printer permissions.
  • XOX
  • To view or change the underlying permissions that make up Print, Manage Printers, and Manage Documents, click the Advanced button.
  • A printer must be shared in order for the permission settings to affect the users and groups listed.
  • You can also view the permissions assigned to you by clicking the group you belong to on the Security tab. For information on finding out what group you belong to, see To identify members of a local group.


Managing servers remotely

Windows Server 2003 operating systems provide tools that you can use to manage servers from a remote location. These tools expand your flexibility because you can work as though you are physically present at each computer in your organization. The tools include the Remote Desktops snap-in, Active Directory Users and Computers, Web Interface for Remote Administration, and the Windows Server 2003 Administration Tools Pack. By understanding the advantages and security requirements of each tool, you can choose the most appropriate one for your remote administration and management tasks. For example, if you want to remotely manage a group of servers instead of just one server, Active Directory is the preferred tool to use. Each server that you want to manage remotely must be enabled for remote administration.

Some of the most common tasks are managing servers remotely by using the Remote Desktops snap-in and managing servers remotely by using Active Directory Users and Computers. For more information on installing and using the Windows Server 2003 Administration Tools Pack to manage servers remotely from XOX, see Windows Server 2003 Administration Tools Pack. For more information about using Web Interface for Remote Administration, see Using Web Interface for Remote Administration. For more information about other tasks for managing servers remotely, see How To.

To manage servers remotely by using the Remote Desktops snap-in

  1. Open Remote Desktops snap-in.
  2. In the console tree, right-click Remote Desktops.
  3. Click Add new connection.
  4. In the Add New Connection dialog box, in Server name or IP address, type the name or TCP/IP address of the server. Or, click Browse to look for a server.
  5. Optionally, in Connection Name, type a friendly name for this connection.
  6. Clear the Connect to console check box if you do not want to connect to the console of the server.
  7. Optionally, in Logon information, supply the user name, password and domain to automatically log on to the server. Click OK.

Important

  • To complete this procedure, the Remote Desktop option must be enabled on each remote computer.

Notes

  • XOX
  • Depending on the configuration of the Terminal server, you might be prompted to supply your password upon connection even if you specify it in the Add New Connection dialog box.

To manage servers remotely by using Active Directory Users and Computers

  1. Open Active Directory Users and Computers.
  2. In the console tree, click Computers.

    Where?

    • Active Directory Users and Computers
    • domain node
    • Computers

    Or, click the container that contains the computer you want to manage.

  3. In the details pane, right-click the computer, and then click Manage.

Notes

  • XOX
  • XOX
  • Clicking Manage starts Computer Management from which you can administer remote computers. You must have administrative credentials on the local computer to view certain information or to modify computer properties using Computer Management.


Managing services

A service is an application type that runs in the background and is similar to a UNIX daemon application. Services typically provide access to key features such as file servers, Web servers, database servers, and other server-based applications to users, both locally and across the network.

Some of the most common tasks associated with managing services are starting and stopping a service, disabling a service for a hardware profile, and changing the startup method for a service. For more information about other tasks for managing services, see How To.

To improve performance and security in the Windows Server 2003 family, several services have been disabled by default that were previously enabled. You should not change the startup method of a service unless you are sure you are choosing the appropriate startup method. For a table that lists the default settings and provides information about how to enable these services, see Default settings for services.

To start, stop, pause, resume, or restart a service

  1. Open Services.
  2. In the details panel, do one of the following:
    • Click the service, and then, on the Action menu, click Start, Stop, Pause, Resume, or Restart.
    • Right-click the service, and then click Start, Stop, Pause, Resume, or Restart.

Caution

  • If you stop, start, or restart a service, any dependent services are also affected. Starting a service does not automatically restart its dependent services. For more information, see To view service dependencies.
  • Changing the default service settings might prevent key services from running correctly. It is especially important to use caution when changing the Startup type and Log on as settings of services that are configured to start automatically. In most cases, it is recommended that you not change the Allow service to interact with desktop setting.

Notes

  • XOX
  • XOX
  • To start a service with startup parameters, right-click the service, click Properties, and then type the parameters in Start parameters before you click Start. These settings are not persistent; they are are used only once, and then the default settings are restored. (A backslash (\) is treated as an escape character; type two backslashes for each backslash in a parameter.)

To enable or disable a service for a hardware profile

  1. Open Services.
  2. In the details pane, right-click the service that you want to enable or disable, and then click Properties.
  3. On the Log On tab, click the hardware profile that you want to configure.
  4. Click Enable or Disable, and then click OK.

Caution

  • Changing the default service settings might prevent key services from running correctly. It is especially important to use caution when changing the Startup type and Log on as settings of services that are configured to start automatically. In most cases, you should not change the Allow service to interact with desktop setting.

Notes

  • XOX
  • XOX
  • You may want to set up a hardware profile to test any newly installed services. For example, you can create two hardware profiles for a newly installed service: one profile in which the service is enabled and a second profile in which the service is disabled. This way, you can troubleshoot any problems that may occur, such as a driver not loading properly.
  • Use caution when disabling services by using this method. If you disable a service for a certain hardware profile, the Hardware Profile settings override the Startup type setting for that service.
  • Use the options in the System Properties dialog box to create and manage hardware profiles.
  • If you receive a Configuration Manager error message when you open the Properties dialog box, verify that the Remote Registry service is running on the target computer. If the Remote Registry service is not running, or if the target computer is running Windows NT 4.0, you cannot view or modify hardware profile settings, but you can perform any other actions. For more information about troubleshooting services, see Troubleshooting. Also, see "Managing System Services" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)

To start, stop, or change the startup method for a service

  1. Open Services.
  2. In the details pane, right-click the service that you want to configure, and then click Properties.
  3. On the General tab, in Startup type, click Automatic, Manual, or Disabled.
  4. To specify the user account that the service can use to log on, click the Log On tab, and then do one of the following:
    • To specify that the service uses the LocalSystem account, click Local System account.
    • To specify that the service uses the LocalService account, click This account, and then type NT AUTHORITY\LocalService.
    • To specify that the service uses the NetworkService account, click This account, and then type NT AUTHORITY\NetworkService.
    • To specify another account, click This account, click Browse, and then specify a user account in the Select User dialog box. When you are finished, click OK.
  5. Type the password for the user account in the Password box and in the Confirm password box, and then click OK. If you select the Local Service account or Network Service account, the password must be blank.

Caution

  • Most services are not designed to have the default account changed. Changing the default account of a service could result in the service failing to start.
  • Changing the default service settings may prevent key services from running correctly. It is especially important to use caution when changing the Startup type and Log on as settings of services that are configured to start automatically.
  • In most cases, it is recommended that you not change the Allow service to interact with desktop setting. If you allow the service to interact with the desktop, any information that the service displays on the desktop will also be displayed on the interactive user's desktop. A malicious user could then take control of the service or attack it from the interactive desktop.

Notes

  • XOX
  • The Local Service account and Network Service account are configured with a null password. Whatever password information you supply is ignored. For more information about service accounts, see Services permissions.
  • It is recommended that user accounts that are used to log on as a service have the Password never expires check box selected in their properties dialog box and that they have strong passwords.
  • If account lockout policy is enabled and the account is locked out, the service will not start.
  • If you enable or disable a service and you encounter a problem starting the computer, you can start the computer in Safe Mode. In Safe Mode, core services that are required to start the operating system are started in a default scheme, regardless of any changes that are made to the service settings. After the computer is in Safe Mode, you can change the service configuration or restore the default configuration.
  • If you specify an account that does not have permission to log on as a service, the Services snap-in automatically grants the appropriate permissions to that account on the computer that you are managing.
  • For more information about the user accounts that a service uses to log on, see "Managing System Services" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


Monitoring network traffic

As an administrator, you need to monitor and detect problems with traffic on your network. With Network Monitor, you can gather information about the network traffic that flows to and from the network adapter of the computer on which it is installed. Once you capture the information, you can use Network Monitor to analyze the information, diagnose problem traffic patterns, and devise strategies to prevent future network traffic problems.

Some of the most common tasks are installing Network Monitor, specifying data frame patterns to capture, capturing network frames, and viewing a specific frame. You can also monitor network traffic from the command line. For more information about other tasks for monitoring network traffic, see How To.

To install Network Monitor

  1. Open Windows Components wizard.
  2. In the Windows Components wizard, click Management and Monitoring Tools, and then click Details.
  3. In Subcomponents of Management and Monitoring Tools, select the Network Monitor Tools check box, and then click OK.
  4. If you are prompted for additional files, insert the installation CD for your operating system, or type a path to the location of the files on the network.

Notes

  • XOX
  • XOX
  • XOX
  • This procedure automatically installs the Network Monitor driver.

To specify frame data patterns to capture

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Filter.
  4. In the capture filter decision tree, double-click the AND (Pattern Matches) line.
  5. Complete the Pattern Match dialog box, and then click OK.

Notes

  • XOX
  • XOX
  • You can define up to four data patterns in a capture filter.
  • To capture frames that match any of multiple patterns, create a logical branch by selecting one of the patterns in the decision tree and clicking OR.
  • To exclude frames that match a pattern, select the pattern in the decision tree and then click NOT.
  • If you specify more than one pattern in the capture filter decision tree, by default, Network Monitor treats each as a logical OR branch.

To capture network frames

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. On the Capture menu, click Buffer Settings, and then set the buffer and frame size as appropriate.
  4. On the Capture menu, click Start.

Notes

  • XOX
  • XOX
  • To pause, stop, or display the data capture, on the Capture menu, click Pause, Stop, or Display Captured Data. You can also stop and display the capture by clicking Stop and View.
  • Network Monitor displays session statistics of the first 100 unique network sessions that it detects. To reset statistics and view information about the next 100 detected network sessions, click the Capture menu, and then click Clear Statistics
    • .
  • If you want to capture data from multiple local networks at the same time, install an adapter and start an instance of Network Monitor for each network. In each instance, specify the network from which you want to capture data by, on the Capture menu, clicking Networks and selecting a network.
  • If prompted for additional files, insert the installation CD for your operating system, or type a path to the location of the files on the network.

To view a specific frame

  1. Open Network Monitor.
  2. If prompted, select the local network from which you want to capture data by default.
  3. Do one of the following:
    • On the File menu, click Open, and then double-click a saved capture file to open it.
    • On the Capture menu, click Start, and then click Stop and View when you are done capturing frames.
  4. On the Display menu, click Go To Frame.
  5. In the Go To dialog box, type the number of the frame that you want to view, and then click OK.

Notes

  • XOX
  • XOX
  • Network Monitor runs with reduced access in which administrative privileges have been removed. If you receive an Access Denied message when you follow this procedure, add your user name to the permissions list of the file or folder that you want to access. For more information, see To set, view, change, or remove permissions on files and folders.
  • The frame number is listed in the Frame column.
  • Frames are numbered in the order that Network Monitor captures them.


Monitoring security-related events

It is important to monitor security related events so that you can find out if changes are made to security policies or other objects, who made the changes, and when they were made. You can monitor security-related events by setting up an auditing policy. An auditing policy is made up of all of the auditing settings that you configure for individual security event categories.

Some of the most common tasks for monitoring security-related events are defining or modifying auditing policy settings for an event category on your local computer, defining or modifying auditing policy settings for an event category across your organization, and viewing the security log. For more information about other tasks for auditing security-related events, see How To.

To define or modify auditing policy settings for an event category on your local computer

  1. Open Local Security Policy.
  2. In the console tree, click Audit Policy.

    3. Where?

    • Security Settings
    • Local Policies
    • Audit Policy
  3. In the details pane, double-click an event category that you want to change the auditing policy settings for.
  4. Do one or both of the following, and then click OK.
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX
  • To audit object accesses, enable auditing of the object access event category by following the steps above. Then, enable auditing on the specific object. For information about how to enable auditing on an object, see To apply or modify auditing policy settings for a local object or To apply or modify auditing policy settings for an object using Group Policy .

To define or modify auditing policy settings for an event category across your organization

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit that you want to set Group Policy for.
  3. Click Properties, and then click the Group Policy tab.
  4. Click Edit to open the Group Policy object (GPO) that you want to edit. You can also click New to create a new GPO, and then click Edit.
  5. In the console tree, click Audit Policy.

    6. Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  6. In the details pane, double-click an event category that you want to change the auditing policy settings for.
  7. If you are defining auditing policy settings for this event category for the first time, select the Define these policy settings check box.
  8. Do one or both of the following, and then click OK.
    • To audit successful attempts, select the Success check box.
    • To audit unsuccessful attempts, select the Failure check box.

Notes

  • XOX
  • XOX
  • If you are on a server or workstation joined to the domain, you can open Active Directory Users and Computers if you click Start, click Run, type mmc, and then click OK. On the File menu, click Add/Remove Snap-in, click Add, double-click Active Directory Users and Computers, click Close, and then click OK.
  • To audit object accesses, enable auditing of the object access event category by following the steps above. Then, enable auditing on the specific object. For information about how to enable auditing on an object, see To apply or modify auditing policy settings for a local object or To apply or modify auditing policy settings for an object using Group Policy .

To view the security log

  1. Open Event Viewer.
  2. In the console tree, click Security. The details pane lists individual security events.
  3. In the details pane, double-click an event to view more details.

Notes

  • You must be logged on as a member of the Administrators group or you must have been granted the Manage auditing and security log right in Group Policy to perform this procedure.
  • XOX
  • For more information about security events, see "Security Events" on the Microsoft Windows Resource Kits Web site . (http://www.microsoft.com/)


Monitoring server performance

In today’s business environment, administrators need to ensure their computer systems are efficient and reliable. To optimize the performance of your servers, you need the data supplied by performance monitoring. This topic describes the most common tasks associated with monitoring the performance of a simple server configuration, one that has a few client workstations connected to a single facility that contains one or more servers.

To monitor the performance of a simple server configuration, you need to collect three different types of performance data over a period of time:

  • General performance data: Information that can help you identify short-term trends such as memory leaks. After a month or two of data collection, you can average the results and save them in a more compact format. This archived data can assist you in capacity planning as your business grows, and later help you to evaluate the effectiveness of your plan.
  • Baseline performance data: Information that can help you discover changes that occur slowly, over time. By comparing the current state of your system with historical data, you can troubleshoot and tune your system. Because this information is collected only periodically, there is no need to compress it for storage.
  • Data for service level reports: Information that can help you ensure that your system meets a certain service or performance level, and which you will likely present to decision makers who are not performance analysts. How often you collect and maintain this data depends on your specific business needs.

To collect all three types of data, you can use Performance Logs and Alerts to create a counter log. You can also collect this information from the command line. You can then run the log over time, either manually or with automated scheduling. You can customize a counter log by adding objects and adding counters. For more information about monitoring server performance, including how to further modify counter logs, create reports in various formats, and use the collected data, see How To.

To create a counter log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.

    3. Any existing counter logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that a log has stopped.

  3. Right-click a blank area of the details pane, and click New Log Settings.
  4. In Name, type the name of the counter log, and then click OK.
  5. On the General tab, click Add Objects and select the performance objects you want to add, or click Add Counters to select the individual counters you want to log.
    • You must use the Run as text box and Password button to collect counter data from a remotely managed computer. These features enable you to specify the logon account name for the log. You can access them from the General tab.
  6. If you want to change the default file and schedule information, make the changes on the Log Files tab and the Schedule tab.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To save the settings for a counter log, trace log, or alert, right-click the log or alert in the details pane and click Save Settings As. You can then specify an .htm file in which to save the settings. To reuse the saved settings for a new log or alert, right-click the details pane, and then click New Log Settings From or New Alert Settings From. This is an easy way to generate new settings from a log or alert configuration. You can also open the HTML file in Internet Explorer to display a System Monitor graph.
  • Although the extension for a log file is .blg, the file format is changed in the Windows Server 2003 family and therefore cannot be read on an earlier version of the operating system. For example, if you copy a binary file from XOX, to Windows 2000, you will be unable to read it on the latter system.

To add objects to a log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then double-click Counter Logs or Alerts.
  3. In the details pane, double-click the log or alert you want to modify.
  4. On the General tab, click Add Objects. For each object that you want to add to the log, perform the following steps:
    • To log objects from the computer on which the Performance Logs and Alerts service will run, click Use local computer counter objects.

      Or, to log objects from a specific computer regardless of where the service is run, click Select counter objects from computer: and specify the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor.

    • In Performance object, click an object to monitor, and then click Add.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When creating counter log settings for export, make sure to select Use local computer counter objects. Otherwise, counter logs will obtain data from the computer named in the text box.
  • For a description of an object, click the object in Performance counters and then click Explain.
  • When you specify the name of a remote computer using Select counter objects from computer, only the name of the local computer and those computer names entered during the current Performance session are listed. Computer names entered in previous sessions will not be listed.
  • The Run as feature enables you to run log collections under different accounts. For example, if you need to log data from a remote computer that requires administrative credentials, you can use the feature to specify an account with the necessary permissions.

To add counters to a log

  1. Open Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.
  3. In the details pane, double-click the log you want to modify.
  4. On the General tab, click Add Counters. For each counter or group of counters that you want to add to the log, perform the following steps:
    • To log counters from the computer on which the Performance Logs and Alerts service will run, click Use local computer counters.

      Or, to log counters from a specific computer regardless of where the service is run, click Select counters from computer and specify the Universal Naming Convention (UNC) name, such as \\MyLogServer, of the computer you want to monitor.

    • In Performance object, select an object to monitor.
    • In Select counters from list, click one or more counters to monitor.
    • To monitor all instances of the selected counters, click All Instances. (Binary logs can include instances that are not available at log startup but subsequently become available.)

      Or, to monitor particular instances of the selected counters, click Select Instances From List, and then click an instance or instances to monitor.

    • Click Add.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or the Performance Log Users group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, counter logs will obtain data from the computer named in the text box, regardless of where the console file is installed.
  • For a description of a counter, click the counter in Performance counters and then click Explain.
  • Some object types have several instances. For example, if a system has multiple processors, the Processor object type will have multiple instances. The PhysicalDisk object type has two instances if a system has two disks. Some object types, such as Memory and Server, have only a single instance. If an object type has multiple instances, you can add counters to track statistics for each instance, or in many cases, for all instances at once. By default, counters are shown with both the instance name and an instance index. To turn off this feature, right-click the System Monitor graph, click Properties, and click the General tab.
  • When you specify the name of a remote computer using Select counters from computer, only the name of the local computer and those computer names entered during the current Performance session are listed. Computer names entered in previous sessions will not be listed.


Resetting user passwords

Users occasionally forget their passwords to their local user accounts. You can manually reset a user’s password. However, by doing so, the following information is lost:

  • E-mail that is encrypted with the user's public key
  • Internet passwords that are saved on the computer
  • Files that the user has encrypted

To prevent information loss when you reset a local user account password, you can create and use a password reset disk.

Some of the most common tasks when administering local user accounts are resetting a local user account password, resetting a domain user account password, and creating a password reset disk. You can also reset a user password from the command line. For more information about other tasks for using passwords, see How To.

To reset a local user account password

  1. Open Computer Management.
  2. In the console tree, double-click Local Users and Groups.

    Where?

    • Computer Management (Local)
    • System Tools
    • Local Users and Groups
  3. In the console tree, click Users.
  4. In the details pane, right-click the user name, and then click Set Password.
  5. Read the warning message, and then, if you want to continue, click Proceed.
  6. In New password and in Confirm password, type a new password, and then click OK.

Notes

  • XOX
  • XOX

To reset a domain user account password

  1. Open Active Directory Users and Computers.
  2. In the console tree, click Users.

    Where?

    • Active Directory Users and Computers
    • Domain name
    • Users
  3. In the details pane, right-click the user name, and then click Reset Password.
  4. Type a new password in New Password and in Confirm New Password, and then click OK.

Notes

  • XOX
  • XOX
  • If you are on a server or workstation joined to the domain, you can open Active Directory Users and Computers if you click Start, click Run, type mmc, and then click OK. On the File menu, click Add/Remove Snap-in, click Add, double-click Active Directory Users and Computers, click Close, and then click OK.

To create a password reset disk

  1. Press CTRL+ALT+DEL, and then click Change Password.
  2. In User name, type the user name of the account that you want to create a password reset disk for.
  3. In Log on to, click your LocalComputerName.
  4. Click Backup.
  5. Follow the steps in the Forgotten Password Wizard until the procedure is complete. Store the password reset disk in a safe and secure place.

Notes

  • Password reset disks can only be used for local computer accounts, not for domain accounts.
  • You cannot change your password and create a password reset disk at the same time. If you type a new password in New Password and in Confirm New Password before you click Backup, the new password information is not saved. When the wizard prompts you for your current user account password, you must type the old password. You can change your password after you create the password reset disk.
  • You can change your password any time after you create a password reset disk. You do not have to create a new password reset disk if you change your password or if the password is reset manually.


Safeguarding your system

To safeguard your system against a serious failure, you can use the Backup tool to create an Automated System Recovery (ASR) set on a regular basis. The Automated System Recovery Wizard creates a two-part backup that you can use to recover your system after all other recovery attempts have failed, or after you have replaced the hard disk. ASR backs up the system state, system services, and all disks associated with the operating system components. It also creates a startup disk that contains information about the backup, the disk configurations (including basic and dynamic volumes), and how to accomplish a restore. You should create a new ASR set after any major change to the system and also on a regular schedule as part of a comprehensive backup plan.

Some of the most common tasks are creating an Automated System Recovery set using Backup and recovering from a system failure using Automated System Recovery. For more information about other system recovery tools, see Repair overview.

To create an Automated System Recovery set using Backup

  1. XOX

    2. The Backup or Restore Wizard starts by default, unless it is disabled. You can use the Backup or Restore wizard to create an ASR set by answering All information on this computer in the What do you want to backup? section. Otherwise, you can go to the next step to create an ASR set in Advanced Mode.

  2. Click the Advanced Mode link on the Backup or Restore Wizard.
  3. On the Tools menu, click ASR Wizard.
  4. Follow the instructions that appear on your screen.

Important

  • You will need a blank 1.44 MB floppy disk to save your system settings and media to contain the backup files. If your computer does not have a floppy drive, see Troubleshooting.

Notes

  • XOX
  • XOX
  • This procedure will only back up those system files that are necessary for starting your system. You will need to backup your data separately.
  • After creating the ASR set, label this floppy disk and backup media carefully, and keep them together. In order to use the backup media, you must have the floppy disk that you created with that set of media. You cannot use a floppy disk created at a different time or with a different set of media. You must also have your Setup CD available at the time you perform Automated System Recovery.
  • Keep the ASR set in a secure location. The ASR set contains information about your systems configuration that could be used to do harm to your system.
  • If you are backing up a server cluster, run the Automated System Recovery Preparation Wizard on all nodes of the cluster and make sure that the Cluster service is running when you start each Automated System Recovery backup. Make sure that one of the nodes on which you run the Automated System Recovery Preparation Wizard is listed as the owner of the quorum resource while the wizard is running.

To recover from a system failure using Automated System Recovery

  1. Make sure you have the following on hand before you begin the recovery procedure:
    • Your previously created Automated System Recovery (ASR) floppy disk.
    • Your previously created backup media.
    • The original operating system installation CD.
    • If you have a mass storage controller and you are aware that the manufacturer has supplied a separate driver file for it (different from driver files available on the Setup CD), obtain the file (on a floppy disk) before you begin this procedure.
  2. Insert the original operating system installation CD into your CD drive.
  3. Restart your computer. If prompted to press a key in order to start the computer from CD, press the appropriate key.
  4. If you have a separate driver file as described in step 1, use the driver as part of Setup by pressing F6 when prompted.
  5. Press F2 when prompted at the beginning of the text-only mode section of Setup. You will be prompted to insert the ASR floppy disk you have previously created.
  6. Follow the directions on the screen.
  7. If you have a separate driver file as described in step 1, press F6 (a second time) when prompted after the system reboots.
  8. Follow the directions on the screen.

Notes

  • XOX
  • ASR will not restore your data files.
  • If you are restoring a server cluster in which all nodes failed and the quorum disk cannot be restored from backup, use Automated System Recovery on each node in the original cluster to restore the disk signatures and the partition layout of the cluster disks (quorum and nonquorum).


Scheduling tasks

By using Task Scheduler, you can schedule commands, programs, or scripts to run at specific times. For example, if you create a script to install updates on employee workstations, you can schedule the script to run in the evening, when most employees are not at work.

Some of the most common tasks are scheduling a new task and scheduling a task on a remote computer. You can also schedule tasks from the command line. For more information about other tasks you can perform by using Task Scheduler, see How To.

To schedule a new task

  1. Open Task Scheduler.
  2. Double-click Add Scheduled Task.
  3. Follow the instructions in the Scheduled Task Wizard.

Notes

  • To perform this procedure, you must be a member of the Administrators, Backup Operators, or Server Operators group, or have been delegated the appropriate authority, on the local computer. As a security best practice, consider using Run as to perform this procedure.
  • When creating a scheduled task, you must enter a user name and password, either in the Add Scheduled Task Wizard or in the Run as box on the Task tab of the properties dialog box for the scheduled task. When the scheduled task runs, the program runs as if it were started by the user you specified, with that user's security context.
  • XOX
  • Confirm that the system date and time on your computer are accurate, as Task Scheduler relies on this information to run scheduled tasks. To verify or change this information, double-click the time indicator on the taskbar.
  • If you want to configure advanced settings for the task, select the Open advanced properties for this task when I click Finish check box in the final page of the wizard. This opens the properties dialog box for the task. You can then change the program being run on the Task tab, fine-tune the schedule on the Schedule tab, customize settings on the Settings tab, or set user and group permissions on the Security tab.

To schedule a task on a remote computer

  1. Open My Network Places.
  2. Click Search for Computers.
  3. In the Computer name box, enter the computer name, and then click Search.
  4. In the details pane, double-click the remote computer on which you want to view scheduled tasks.
  5. Double-click Scheduled Tasks.
  6. From the File menu, point to New, and then click Scheduled Task.
  7. Type a name for the new task, and then press ENTER.
  8. Right-click the new task, and then click Properties.
  9. Do the following:
    • To specify the program being run, in Run, type the path for the new program.
    • To set the user account name and password that the scheduled task will run as, edit or enter a new name in the Run as box, and then click Set password.
    • To set the schedule for the task, click the Schedule tab.
    • To customize the settings for the task, click the Settings tab.
    • To set user and group permissions for the task, click the Security tab.

Notes

  • To perform this procedure, you must be a member of the Administrators group, or have been delegated the appropriate authority, on the remote computer. As a security best practice, consider using Run as to perform this procedure.
  • XOX


Setting up DNS

Domain Name System (DNS) is used in Transmission Control Protocol/Internet Protocol (TCP/IP) networks, such as the Internet, to locate computers and services through user-friendly names. When a user enters a DNS name in an application, DNS can resolve the name to other information associated with the name, such as an IP address. If your network is homogeneous (all hosts use the same operating system), and it uses a name resolution method other than DNS, you can continue to use that method without needing DNS. If your network is heterogeneous (the hosts use different operating systems), or it connects to the Internet, you will want to deploy DNS as the Internet consists of protocols that require DNS.

Setting up DNS in your network does not necessarily require that you administer a large DNS infrastructure or become an expert DNS administrator. If you have a very small network in which information is maintained dependably, you may choose to have your DNS namespace administered by a different organization that specializes in DNS administration, such as your government or an Internet Service Provider (ISP). In this case, the other organization will host and administer your DNS zone data for you or integrate your hosts with an existing DNS zone hosted in their network. Once your network expands beyond a small number of hosts, you will want to begin administering DNS yourself in order to better serve the name resolution needs of your expanding network.

Setting up a DNS server typically involves configuring the DNS server with DNS zones to administer the DNS domain names in your network, adding DNS resource records for the hosts in your network to your DNS zones, and delegating administration for these zones by creating a delegation from the parent DNS server previously authoritative for a domain name to the child DNS server that is accepting responsibility for a domain name. Lastly, a DNS server administrator should maintain the integrity of DNS zone data by securing the DNS servers in the network. You can also set up a DNS server from the command line. For more information, see DNS tools. For more information about setting up DNS, see How to.

To configure a DNS server

  1. Open DNS.
  2. If needed, add and connect to the applicable server in the console.
  3. In the console tree, click the applicable DNS server.

    Where?

    • DNS
    • Applicable DNS server
  4. On the Action menu, click Configure a DNS server.
  5. Follow the instructions in the Configure a DNS Server Wizard.

Notes

  • XOX
  • XOX
  • If the DNS server is running locally, you do not need to perform step 2.
  • The Configure a DNS Server Wizard allows you to specify zones, root hints, and forwarders.
  • If you are setting up DNS for your intranet and you want your computers to connect to the Internet also, configure the root hints with the IP addresses of the DNS servers located at your ISP.
  • When you finish configuring the server, you will need to complete additional tasks, such as configuring your network hosts to use this DNS server as their preferred DNS server, enabling dynamic update for the zones on this DNS server, or adding resource records to its zones.

To add a resource record to a zone

  1. Open DNS.
  2. In the console tree, right-click the applicable zone and click Other New Records.
  3. In Select a resource record type list box, select the type of resource record you want to add.
  4. Click Create Record.
  5. In New Resource Record, enter the information needed to complete the resource record.
  6. After you specify all of the necessary information for the resource record, click OK to add the new record to the zone.

Notes

  • XOX
  • XOX
  • Add a resource record for every host in your network that will use DNS. If you have configured your DNS zones to accept dynamic updates, and your network hosts support dynamic update and are configured to use this DNS server as their preferred DNS server, then your network hosts will add their resource records automatically.
  • For more information about the different types of resource records you can add, see Resource records reference.

To create a zone delegation

  1. Open DNS.
  2. In the console tree, right-click the applicable subdomain, and then click New Delegation.
  3. Follow the instructions provided in the New Delegation Wizard to finish creating the new delegated domain.

Notes

  • XOX
  • XOX
  • All domains (or subdomains) that appear as part of the applicable zone delegation must be created in the current zone prior to performing delegation as described here. As necessary, use the DNS console to first add domains to the zone before completing this procedure. For more information, see Delegating zones.

To secure a DNS server

  1. Open DNS.
  2. In the console tree, right-click the applicable DNS server, and then click Properties.
  3. On the Interfaces tab, ensure that the DNS server is listening to the correct interfaces.
  4. On the Advanced tab, select the Secure cache against pollution check box.
  5. If this DNS server will not perform recursive resolution, then select the Disable recursion check box.

Notes

  • XOX
  • XOX
  • If a DNS zone is stored in Active Directory, you can also secure that DNS zone and its resource records by using the security features of Active Directory.
  • By default, a DNS zone is only permitted to allow zone transfers from the DNS servers that are listed in the DNS zone properties.
  • By default, the DNS service listens for DNS message communications on all IP addresses that are configured for the server computer.
  • Server IP addresses that are added here need to be statically managed. If you later change or remove addresses specified here from the TCP/IP configurations maintained at this server, update this list accordingly.
  • The Secure cache against pollution check box is selected by default.
  • If you disable recursion on this DNS server, you cannot use this DNS server to answer recursive queries from DNS clients or to list this DNS server as a DNS forwarder. Disable recursion on DNS servers that only perform iteration with other DNS servers.
  • By disabling recursive resolution on this DNS server, you can prevent a Denial of Service (DoS) attack in which a malicious user attempts to have this DNS server respond to recursive queries for a domain in a DNS zone under the malicious user's control.


Setting up TCP/IP

By default, computers running Windows Server 2003 operating systems are configured as Dynamic Host Configuration Protocol (DHCP) clients, which means they can accept leases from any available DHCP server. TCP/IP computers (hosts) on a DHCP network automatically obtain TCP/IP configurations from DHCP servers that are located elsewhere on that network. This is the most common scenario for mid-sized and large TCP/IP networks. For more information about DHCP, see DHCP.

In certain cases, you will need to configure TCP/IP for static addressing. Configuring TCP/IP for static addressing is the process of manually assigning unique, permanent addresses to network devices, and providing static address information about other network resources (for example, DHCP servers, routers, and default gateways). If you are setting up a computer to run on a network that does not have a DHCP server, but that does provide Windows Internet Name Service (WINS), you will need to configure TCP/IP to use WINS. For more information about WINS, see WINS.

Some of the most common tasks for setting up TCP/IP are configuring TCP/IP for static addressing, and configuring TCP/IP to use WINS. You can also set up TCP/IP from the command line. For more information about other tasks for setting up TCP/IP, see How To.

To configure TCP/IP for static addressing

  1. Open Network Connections.
  2. Right-click the network connection you want to configure, and then click Properties.
  3. On the General tab (for a local area connection) or the Networking tab (for all other connections), click Internet Protocol (TCP/IP), and then click Properties.
  4. Click Use the following IP address, and do one of the following:
    • For a local area connection, in IP address, Subnet mask, and Default gateway, type the IP address, subnet mask, and default gateway addresses.
    • For all other connections, in IP address, type the IP address.
  5. Click Use the following DNS server addresses.
  6. In Preferred DNS server and Alternate DNS server, type the primary and secondary DNS server addresses.

Notes

  • XOX
  • XOX
  • If your network does not have a DNS server, you can skip steps 5 and 6.

To configure TCP/IP to use WINS

  1. Open Network Connections.
  2. Right-click the network connection you want to configure, and then click Properties.
  3. On the General tab (for a local area connection) or the Networking tab (for all other connections), click Internet Protocol (TCP/IP), and then click Properties.
  4. Click Advanced, click the WINS tab, and then click Add.
  5. In TCP/IP WINS server, type the IP address of the WINS server, and then click Add.
  6. Repeat steps 4 and 5 for each WINS server IP address you want to add, and then click OK.
  7. To enable the use of the Lmhosts file to resolve remote NetBIOS names, select the Enable LMHOSTS lookup check box. This option is enabled by default.
  8. To specify the location of the file that you want to import into the Lmhosts file, click Import LMHOSTS, and then select the file in the Open dialog box.
  9. To enable or disable NetBIOS over TCP/IP, do the following:
    • To enable the use of NetBIOS over TCP/IP, click Enable NetBIOS over TCP/IP.
    • To disable the use of NetBIOS over TCP/IP, click Disable NetBIOS over TCP/IP.
    • To have the DHCP server determine whether NetBIOS over TCP/IP is enabled or disabled, click Default. For more information, see Notes.

Notes

  • XOX
  • XOX
  • If you are using a DHCP server to allocate WINS server IP addresses, you do not need to add WINS server addresses.
  • You can no longer configure the NetBIOS scope ID on the WINS tab (previously available in Windows NT 4.0). To configure the NetBIOS scope ID, set the following registry value to the name of the scope ID that you want to use:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\ScopeID

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.


Setting user and group security

In order to secure a computer and its resources, you must decide what tasks and actions users or groups of users can perform. The tasks and actions that a user or group of users can perform are determined by the user rights that you assign to them. For example, if a trusted member of the Users group needed to monitor the security log, you could grant the user the "Manage auditing and security log" user right instead of adding the user to a more privileged group, such as the Administrators group. Similarly, you can secure an object, such as a file or folder, by assigning permissions.

Some of the most common tasks are assigning user rights on your local computer, assigning user rights throughout your organization, and setting file and folder permissions. For more information about other tasks for setting user and group security, see How To.

To assign user rights on your local computer

  1. Open Local Security Settings.
  2. In the console tree, click User Rights Assignment.

    3. Where?

    • Security Settings
    • Local Policies
    • User Rights Assignment
  3. In the details pane, double-click the user right that you want to modify.
  4. Do one of the following, and then click OK.
    • To add a user or group, click Add a User or Group. In Select Users or Groups, type the user name or group name that you want to add, and then click OK.
    • To remove a user or group, select the user or group in the list, and then click Remove.

Notes

  • XOX
  • XOX

To assign user rights throughout your organization

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the Group Policy object for which you want to edit security settings.
  3. Click Properties, and then click the Group Policy tab.
  4. Click Edit to open the Group Policy object you want to edit. Or, click New to create a new Group Policy object, and then click Edit.
  5. In the console tree, click User Rights Assignment.

    6. Where?

    • GroupPolicyObject [ComputerName] Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • User Rights Assignment
  6. In the details pane, double-click the user right that you want to modify.
  7. If this security setting has not yet been defined, select the Define these policy settings check box.
  8. Do one of the following, and then click OK.
    • To add a user or group, click Add a User or Group. In Select Users or Groups, type the user name or group name that you want to add, and then click OK.
    • To remove a user or group, select the user or group in the list, and then click Remove.

Notes

  • XOX
  • XOX
  • If you are on a server or workstation joined to the domain, you can open Active Directory Users and Computers if you click Start, click Run, type mmc, and then click OK. On the File menu, click Add/Remove Snap-in, click Add, double-click Active Directory Users and Computers, click Close, and then click OK.
  • Always test a newly created policy on a test organizational unit before applying it to your network.
  • When you change a security setting and click OK, that setting will take effect in the next refresh of settings.
  • XOX

To set, view, change, or remove permissions on files and folders

  1. Open Windows Explorer.
  2. Right-click the file or folder for which you want to set permissions, click Properties, and then click the Security tab.
  3. Do one of the following:
    • To set permissions for a group or user that does not appear in the Group or user names box, click Add. Type the name of the group or user for which you want to set permissions, and then click OK.
    • To change or remove permissions from an existing group or user, click the name of the group or user.
  4. Do one of the following:
    • To allow or deny a permission, in the Permissions for User or Group box, select the Allow or Deny check box.
    • To remove the group or user from the Group or user names box, click Remove.

Notes

  • XOX
  • In the Windows Server 2003 family, the Everyone group no longer includes Anonymous Logon.
  • You can set file and folder permissions only on drives formatted to use NTFS.
  • If the check boxes under Permissions for User or Group are shaded or if the Remove button is unavailable, then the file or folder has inherited permissions from the parent folder. For more information, see How inheritance affects file and folder permissions.
  • When adding a new user or group, by default, this user or group will have Read & Execute, List Folder Contents, and Read permissions.