Microsoft NNTP Service

Creating newsgroups with Microsoft NNTP Service makes it easy for users in your organization to engage in discussions on various topics with each other and with users outside the organization.

This documentation contains:

  • For help with specific tasks, see How To....
  • For general background information, see Concepts.
  • For information about maintaining Microsoft NNTP Service, see Maintenance.
  • For problem-solving instructions, see Troubleshooting.

    • © 2003 Microsoft Corporation. All rights reserved.


How To...

This section explains how to operate Microsoft NNTP Service. It also describes the two administration tools for operating Microsoft NNTP Service.

This section contains:

  • Install Microsoft NNTP Service
  • Use Administration Tools
  • Start, Stop, and Pause NNTP Virtual Servers
  • Start, Stop, and Pause Microsoft NNTP Service
  • Use Virtual Directories to Store Articles on Multiple Disk Drives
  • Manage Newsgroups
  • Configure Security
  • Process Control Messages
  • Index Newsgroups with Microsoft Indexing Services
  • Create Additional NNTP Virtual Servers


Install Microsoft NNTP Service

Microsoft NNTP Service is not installed by default on computers running Windows Server 2003. First, you must use the administrative tool Manage Your Server to install Microsoft Internet Information Services (IIS). Once IIS is installed, you must then install NNTP.

Note This procedure is not necessary if you are upgrading from Windows 2000 Server or Advanced Server. This procedure is required for new installations of computers running Windows Server 2003.

To install IIS and NNTP on your computers running Windows Server 2003

  1. Upon installation of Windows Server 2003, Standard Edition or Windows Server 2003, Enterprise Edition, the Manage Your Server window will appear. To manually open Manage Your Server, on the Start menu, point to Control Panel, point to Administrative Tools, and then click Manage Your Server.
  2. In Manage Your Server, click Add a role to open the Configure Your Server Wizard.
  3. In the Wizard, choose to add the role Web server (IIS). Click Next and Windows Components Wizard will install IIS.
  4. After IIS is installed, on the Start menu, point to Control Panel, and then click Add or Remove Programs.
  5. In Add or Remove Programs, click Add/Remove Windows Components.
  6. In Windows Components Wizard, under Components, scroll down and select Web Application Server, and then click Details.
  7. In Web Application Server, select Internet Information Services (IIS), and then click Details.
  8. In Internet Information Services (IIS), click to select the check box beside NNTP Service, and then click OK.
  9. In Web Application Server, click OK.
  10. In Windows Components Wizard, click Next. Click Finish when the Wizard completes the installation of NNTP.

Note You may have to close and reopen the Internet Information Services MMC snap-in in order to see your new Default NNTP Virtual Server.


Use Administration Tools

The administrative tool for Microsoft NNTP Service is called Microsoft Management Console (MMC). It can perform all operation tasks and requires a local area network (LAN) connection.

This administration tool is installed by default on the computer running Microsoft NNTP Service.

To operate the service using Microsoft Management Console from a remote computer, you must be using a computer running Microsoft Windows Server 2003 operating systems, and the remote computer must have the Windows Server 2003 Administration Tools installed.

Note You must grant operators the appropriate permissions to operate Microsoft NNTP Service. For more information, see Configure Security.


Using Microsoft Management Console

You can operate Microsoft NNTP Service using Microsoft Management Console (MMC) from the computer on which the service is running.

Important Microsoft NNTP Service is not installed by default on computers running Windows Server 2003. For instructions on how to install NNTP, see Install Microsoft NNTP Service.

Note You can also use Microsoft Management Console to administer your Network News Transfer Protocol (NNTP) virtual server from a remote computer, provided it's on the same LAN as the Microsoft NNTP Service. However, the remote computer must be running Microsoft Windows Server 2003 operating systems and have the Windows Server 2003 Administration Tools installed. If you choose to administer NNTP remotely, be sure your connection to the server running NNTP is secure and cannot be compromised.

To run Microsoft Management Console on the computer on which Microsoft NNTP Service is running

  1. On the Start menu, point to Control Panel, point to Administrative Tools, and then click Computer Management.
  2. In the console tree, expand Services and Applications, and then expand Internet Information Services. The virtual server that is provided upon installation of the service is Default NNTP Virtual Server. Microsoft NNTP Service can consist of one or more NNTP virtual servers.

To view or modify the properties of an NNTP virtual server

  1. Click to select the NNTP virtual server you want to modify.
  2. On the Action menu, click Properties.
  3. Click the tab that you want to view or modify.
  4. Change any options as needed. (For more information about tab options, see Tab Reference.)

To view or modify newsgroup, expiration policy, or virtual directory properties

  1. Expand Microsoft NNTP Service, and then expand the NNTP virtual server you want to view or modify.
  2. Click either Newsgroups, Expiration Policies, or Virtual Directories.
  3. In the details pane, select the newsgroup, expiration policy, or virtual directory that you want to view or modify.
  4. On the Action menu, click Properties.
  5. Change any options as needed. (For more information about tab options, see Tab Reference.)


Start, Stop, and Pause NNTP Virtual Servers

You can start, stop, and pause the default Network News Transfer Protocol (NNTP) virtual server, and any other virtual servers you have created, using Microsoft Management Console.

Note You can also start, stop, and pause the Microsoft NNTP Service. However, stopping the service stops all of the NNTP virtual servers running on your computer. When Microsoft NNTP Service is stopped, you cannot use Microsoft Management Console to perform administrative functions on any NNTP virtual server.

Important Make sure only trusted and qualified administrators in your organization have the necessary permissions to start or stop an NNTP virtual server. See Restricting Operator Access for more information.

When an NNTP virtual server is started, it accepts new connections from users. When you stop an NNTP virtual server, it disconnects current users and does not accept new connections. When you pause an NNTP virtual server, it does not accept new connections but continues to service existing connections. If you want to stop an NNTP virtual server but not disconnect users currently connected to the virtual server, you can also choose to shut down gracefully.

To start, stop, or pause an NNTP virtual server using Microsoft Management Console

  1. Start Microsoft Management Console.
  2. Click to select the desired NNTP virtual server.
  3. On the Action menu, click Start, Stop, or Pause.

To shut down an NNTP virtual server gracefully

  1. Pause the virtual server to prevent new connections.
  2. To check for current users, use Microsoft Management Console. Select Current Sessions. All current users are listed.
  3. If you want to block current users from posting new articles, click the NNTP Settings tab, and then clear the Allow client posting check box.
  4. Stop the NNTP virtual server after all current users have disconnected.


Start, Stop, and Pause Microsoft NNTP Service

Microsoft NNTP Service runs as a service on computers running Microsoft Windows Server 2003. There can be multiple Network News Transfer Protocol (NNTP) virtual servers on a computer but only one instance of Microsoft NNTP Service.

Important Make sure only trusted and qualified administrators in your organization have the necessary permissions to start or stop the NNTP service. See Restricting Operator Access for more information.

You can start, stop, or pause each virtual server independently of one another while the Microsoft NNTP Service is running. It is important to remember, however, that pausing or stopping the entire Microsoft NNTP Service will affect all of the NNTP virtual servers. When the service is stopped, you cannot use Microsoft Management Console to perform administrative functions on any NNTP virtual server.

Note The one exception is that, in Microsoft Management Console only, you can start a virtual server while Microsoft NNTP Service is stopped. Starting an NNTP virtual server will also restart the entire Microsoft NNTP Service. This in turn will start all other NNTP virtual servers that had been running when Microsoft NNTP Service was originally stopped.

When you start Microsoft NNTP Service, it accepts new connections from users. When you stop Microsoft NNTP Service, it disconnects current users and does not accept new connections. When you pause Microsoft NNTP Service, every running NNTP virtual server will cease accepting new connections but will continue to service existing connections. If you want to stop Microsoft NNTP Service but not disconnect users currently connected to each of the virtual servers, you can also choose to shut down gracefully.

To start, stop, or pause Microsoft NNTP Service using Administrative Tools

  1. On the Start menu, click Programs, and then click Administrative Tools.
  2. Select Component Services.
  3. In the Component Services window, select Services (local).
  4. Scroll down the listing of services (in the right-hand panel) if necessary, until you find Microsoft NNTP Service. Right-click it, and then click Start, Stop, or Pause.
Note When you restart Microsoft NNTP Service, all NNTP virtual servers that had been running when you shut down the service will automatically restart. However, an NNTP virtual server that was already stopped when the service was shut down will remain stopped, even after Microsoft NNTP Service is restarted.

To shut down Microsoft NNTP Service gracefully

  1. Using the previous procedure, pause Microsoft NNTP Service. This will prevent new connections.
  2. To check for current users on each of your NNTP virtual servers, use Microsoft Management Console. Under each NNTP virtual server, select Current Sessions. All current users are listed.
  3. If you want to block current users from posting new articles, click the Settings tab, and then clear the Allow client posting check box.
  4. Stop each NNTP virtual server after all current users have disconnected.
  5. After all current users have disconnected from all virtual servers, stop Microsoft NNTP Service.


Change the default startup setting

You can use Administrative Tools to configure the default state of Microsoft NNTP Service at startup.

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Component Services.
  2. In the console tree, select Services (local).
  3. Right-click Network News Transfer Protocol (NNTP), and then click Properties on the shortcut menu.
  4. On the General tab, under Startup, select Automatic, Manual, or Disabled.


Manage Newsgroups

As soon as you create your newsgroups, users can begin posting articles to them. If you want a moderator to review new articles before they are posted, define a moderated newsgroup.

You can change the properties of an existing newsgroup, or delete the newsgroup if you no longer need it. You can also select options that enable Microsoft NNTP Service to delete articles after a specified number of hours or when the amount of disk space used by newsgroups reaches specified limits. Finally, you can filter which newsgroups are visible to users and the number that will display whenever the Newsgroups node is selected under the Network News Transfer Protocol (NNTP) virtual server.

This section describes:

  • Creating Newsgroups
  • Moderating Newsgroups
  • Editing and Deleting Newsgroups
  • Defining Newsgroup Limits and Expirations
  • Limiting Newsgroup Enumeration


Creating Newsgroups

Use the New Newsgroup Wizard to create a newsgroup. When you create a new newsgroup, Microsoft NNTP Service creates the directory for the newsgroup automatically. If you want a moderator to review new articles before they are posted, you can create a moderated newsgroup.

To create a newsgroup

  1. In Microsoft Management Console, expand the desired Network News Transfer Protocol (NNTP) virtual server to display the Newsgroups node.
  2. Right-click Newsgroups, point to New, and then click Newsgroup.
  3. Follow the New Newsgroup Wizard. In Name, type the name of the newsgroup you want to create.
  4. In Description, type a brief description of the newsgroup function.
  5. If you want, in Pretty name type in another name for the newsgroup, which will be returned by the List Prettynames NNTP command. The pretty name is another alias for the newsgroup that can be displayed by clients.
  6. Click Finish.


Moderating Newsgroups

If you want to control what articles are posted to a newsgroup, you should create a moderated newsgroup. Articles submitted to a moderated newsgroup are not posted until they are approved by the moderator you have chosen for that newsgroup.

Important Microsoft recommends having a moderator for every newsgroup, especially if users outside your organization are allowed to make postings on your server. A moderator can filter inappropriate material, and can detect if someone is trying to compromise information on the server, or the server itself.

When a user submits an article to a moderated newsgroup, Microsoft NNTP Service sends the article to the newsgroup moderator. The moderator can either approve the article and send it back to Microsoft NNTP Service to be posted or discard the article. For discarded articles, the moderator can send a message to the article's author to explain why the article was rejected.

Any Network News Transfer Protocol (NNTP) client can be used to post messages to a moderated newsgroup. However, the moderator needs to use an NNTP client that supports moderating functions.

To use moderated newsgroups, you have to specify either a Simple Mail Transfer Protocol (SMTP) mail server for sending articles directly to the moderators or a directory where the articles are stored for the moderators.

You can also specify a default moderator domain. If you choose to use the default moderator for a newsgroup, articles are sent to newsgroup_name@default_domain, where newsgroup_name is the name of the newsgroup (the periods have been replaced by underscores). For example, articles posted to the newsgroup rec.sports.tennis, with a default domain of contoso.com, are sent to rec-sports-tennis@contoso.com.

To enable moderated newsgroups

  1. Click the Settings tab.
  2. In SMTP server for moderated groups, either enter the DNS name or the IP address of the SMTP server, or enter the path to the directory where articles are stored for the moderators. The directory path must be a local directory. You should normally set this value to the pickup directory of the SMTP server. By default, this directory is \Inetpub\Mailroot\Pickup.
  3. In Default moderator domain, type the e-mail domain for default moderators.
  4. Click OK.
  5. If you specified an SMTP server, be sure that the user ID under which Microsoft NNTP Service is running (by default the System Account) is defined as an account on the SMTP server.

To create a moderated newsgroup

  1. If necessary, create the newsgroup. After you finish the New Newsgroup Wizard, the procedure is the same for both new and existing newsgroups.
  2. In Microsoft Management Console, expand the desired NNTP virtual server to display the Newsgroups node.
  3. Click Newsgroups to display all of the NNTP virtual server's newsgroups in the details pane.
  4. Right-click the newsgroup you want, and select Properties.
  5. Select the Moderated check box.
  6. In Moderator, type in the e-mail address of the moderator, or click Set Default to use the default moderator.
  7. Click OK.


Editing and Deleting Newsgroups

You can edit the properties of an existing Microsoft NNTP Service newsgroup or delete a newsgroup that you no longer need.

To edit or delete a newsgroup

  1. In Microsoft Management Console, expand the desired Network News Transfer Protocol (NNTP) virtual server to display the Newsgroups node.
  2. Click Newsgroups to display all of the NNTP virtual server's newsgroups in the details pane.
  3. Right-click the newsgroup you want, and select Properties to edit the newsgroup properties, select Rename to rename the newsgroup, or select Delete to remove the newsgroup.


Defining Newsgroup Limits and Expirations

You can limit how long articles are kept in a Microsoft NNTP Service newsgroup by defining expiration policies for newsgroups. An expiration policy can apply to a single newsgroup or to any number of newsgroups. You can define as many policies as you need. In each case, the oldest articles are deleted first.

If you do not specify an expiration policy for a newsgroup, you should delete articles manually when they are no longer needed.

To create an expiration policy

  1. In Microsoft Management Console, expand the desired Network News Transfer Protocol (NNTP) virtual server to display the Expiration Policies node.
  2. Right-click Expiration Policies, point to New, and then click Expiration Policy.
  3. Follow the New NNTP Expiration Policy Wizard. See the Expiration Policy dialog box for information on expiration policy parameters.

You can modify an existing expiration policy, including changing the newsgroups to which the policy applies, with the Expiration Policy dialog box.

To modify an expiration policy

  1. In Microsoft Management Console, click the Expiration Policies node under the NNTP virtual server.
  2. In the details pane, select the expiration policy you want to modify.
  3. On the Action menu, click Properties.
  4. Change the options in the Expiration Policy dialog box as needed.

Note Use the Move Up and Move Down buttons to specify which newsgroups the expiration policy should apply to, and in what order. For example, if you want to include all of the alt.tv newsgroups (alt.tv.*) in the policy, but exclude the alt.tv.cable newsgroup from the policy, meaning that you want to apply an expiration policy to all of the alt.tv newsgroups except the alt.tv.cable newsgroup, use the Move Up and Move Down buttons to include alt.tv.* first, and exclude alt.tv.cable second.


Limiting Newsgroup Enumeration

Use the Find Newsgroups dialog box to limit the number of newsgroups that will be displayed when the user selects the Newsgroups node, which is beneath the Network News Transfer Protocol (NNTP) virtual server node in Microsoft Management Console (MMC).

Potentially, a server can store thousands of newsgroups; in some cases it might not be possible to enumerate them all. Administrators may want to filter the newsgroups that will be enumerated. You can filter newsgroups by type, by number, or both.

To limit the number of enumerated newsgroups

  1. In Microsoft Management Console, expand the desired NNTP virtual server to display the Newsgroups node.
  2. Right-click on Newsgroups and click Limit groups enumeration. The Find Newsgroups dialog box will open.
  3. In the Newsgroups field, type the kind of the newsgroup you want to display in the MMC when the Newsgroup node is selected. All other types will be filtered out. Use wildcards, such as alt.*. In this example, only newsgroups under the alt hierarchy would be visible to users. By default, every kind of newsgroup is enumerated.
    Note
    You can also type the name of a specific newsgroup in this space, but then only that newsgroup will be visible. Only one wildcard or one newsgroup can be entered at a time.
  4. If you don't want to have a limit on the number of enumerated newsgroups, clear the Limit number of items on the result pane check box. This check box is selected by default.
  5. In Maximum number of items, type in the maximum number of newsgroups you want to enumerate on this virtual server. This limit will only apply when the Limit number of items on the result pane check box is selected. The default is 100 newsgroups.


Use Virtual Directories to Store Articles on Multiple Disk Drives

A virtual directory is a directory on a local or remote disk drive that acts as the root of a portion of the newsgroup hierarchy. Virtual directories enable you to store newsgroup files on multiple disk drives. Using more than one disk drive can improve the performance of a heavily used drive and can provide more storage. Virtual directories also enable you to change the physical location of the directory without changing the name of the newsgroup.

Virtual directories contain a portion of the newsgroup hierarchy. For example, a virtual directory named Research could contain all of the newsgroups named research.*.

Virtual directories can be located on a local disk drive or on a network drive. There is no advantage to creating a virtual directory on the same physical drive as the home directory.


Creating a Virtual Directory

You can create as many virtual directories as you want. Create virtual directories that match the structure of your newsgroup hierarchy.

To create a virtual directory

  1. In Microsoft Management Console, expand the desired Network News Transfer Protocol (NNTP) virtual server to display the Virtual Directories node.
  2. Right-click Virtual Directories, point to New, and then click Virtual Directory.
  3. Follow the New NNTP Virtual Directory Wizard. Create a newsgroup subtree for this virtual directory.
  4. Select either File System (a local location) or Remote as a storage location for the news content. This location can be configured later if necessary by clicking Contents in the Virtual Directory dialog box.
  5. If you selected File System, type a path to the local folder, or click Browse to select a folder. If you selected Remote, type a path to the remote location, or click Browse to select a remote folder. For a remote location, you must also provide a user name and password that Microsoft NNTP Service can use to log on to that remote computer. Type a name or click Browse to search for one. Click Check to ensure the user name/password combination you plan to use is valid.

    Note If you store content in a remote location, the remote computer must be configured with at least read/write permissions for the user name you provide. Make sure the remote location is secure and maintained by trusted administrators.

To modify a virtual directory

  1. In Microsoft Management Console, click the Virtual Directories node under the NNTP virtual server.
  2. In the details pane, select the virtual directory you want to modify.
  3. On the Action menu, click Properties.
  4. Change the options in the Virtual Directory dialog box as needed.


Configure Security

By default, any user who can connect to Microsoft NNTP Service can view all newsgroups. These users connect anonymously, which means they do not have to supply a user name or password. The Setup program creates a different Windows user account that is used by all anonymous users.

You can configure security to control who has access to specific newsgroups and who can operate Microsoft NNTP Service. You can also restrict access on the basis of the client computer IP address. If users connect to Microsoft NNTP Service over a public network, you can encrypt that connection using the SSL protocol so that others cannot intercept the articles being sent and received.

Security is based on Windows user accounts and directory permissions. User access to newsgroups is restricted on the basis of user name and password.

This section describes:

  • Restricting Access to Newsgroups
  • Limiting Access by IP Address
  • Restricting Operator Access
  • Securing Connections with SSL


Restricting Access to Newsgroups

You can control access to individual newsgroups or sets of newsgroups by setting permissions for the directories that contain those newsgroups. You can set permissions for an individual directory or for a set of directories. You can also limit access to all newsgroups according to the IP address of the client computer.

If you do not want to restrict access to a newsgroup, enable anonymous access and do not set any permissions for the directory that contains the newsgroup. To enable anonymous access, on the Access tab, click the Authentication button under Access control, and then select the Allow anonymous check box. Be aware, however, that anonymous access will not prevent malicious or unauthorized users from attempting to access your server.

To restrict access to a newsgroup

  1. Create Windows user accounts for users.
  2. Define permissions for the directory that contains the newsgroup. Be sure to give the local system account full access to all newsgroup directories so that Microsoft NNTP Service has access to its files.
  3. Set the authentication method used by Microsoft NNTP Service.

Create Windows user accounts. It is recommended that you organize users into groups and then grant permissions by group to simplify administration. If possible, use accounts and groups that are already established in your organization.

Microsoft NNTP Service supports two methods for authentication of users:

  • Basic authentication
  • Integrated Windows Authentication

To set the authentication method

  1. Select the Network News Transfer Protocol (NNTP) virtual server, and then click Properties on the Action menu.
  2. On the Access tab, under Access control, click the Authentication button.
  3. Select one or more of the following: the Allow anonymous check box, the Basic authentication check box, the Integrated Windows Authentication check box, and the Enable SSL client authentication check box. If you are only going to require Basic authentication, it is highly recommended that you also enable SSL to prevent user names and passwords from being compromised during transmission.
  4. To require SSL authentication, select the Require SSL client authentication check box. To associate client certificates with Windows user accounts, select the Enable client certificate mapping to Windows user accounts check box, and then click Client Mappings.


Limiting Access by IP Address

You can limit access to Microsoft NNTP Service by the IP address of the client computer. By default, all IP addresses have access to Microsoft NNTP Service.

You can either allow or deny access to a specific list of IP addresses. IP addresses can be specified individually or as a group using a subnet mask. You can also specify IP addresses using a domain name, but doing so adds the overhead of a DNS lookup for each connection.

To limit access by IP address

  1. In Microsoft Management Console, select the Network News Transfer Protocol (NNTP) virtual server, and then click Properties on the Action menu.
  2. On the Access tab, under Connection control, click the Connection button.
  3. Select All except the list below to deny access to a list of IP addresses, or click Only the list below to allow access to a list of IP addresses.
  4. Click Add for each IP address you want to grant or deny access to the NNTP virtual server.
  5. In the Computer dialog box, click one of these options: Single Computer, Group of computers, or Domain. Then proceed as follows:
    • The Single Computer option: In IP address, type the IP address of the computer. (If you don't know the IP address, click DNS Lookup.)
    • The Group of computers option: In Subnet address, type the IP address. Then, in Subnet mask, type the subnet mask for the group of computers.
    • The Domain option: In Name, type the domain name of the computer.
  6. Click OK.


Restricting Operator Access

Operators of Microsoft NNTP Service must be granted operator privileges. By default, everyone in the Administrators group is granted operator privileges.

To add an operator

  1. In Microsoft Management Console, select the Network News Transfer Protocol (NNTP) virtual server, and then click Properties on the Action menu.
  2. On the Security tab, click Add. The Select Users or Groups dialog box opens.
  3. In the Look in drop-down menu, select the domain of the operator you want to add.
  4. Under Name, click the operator or group, and then click Add.
  5. After you've made all of your selections, click OK.

To remove an operator

  1. In Microsoft Management Console, select the NNTP virtual server, and then click Properties on the Action menu.
  2. On the Security tab, in Operators, click the operator.
  3. Click Remove.
  4. Click OK.


Securing Connections with SSL

Secure Sockets Layer (SSL) provides a secure, encrypted connection between Microsoft NNTP Service and the client computer. SSL can protect your private information when users connect across a public network such as the Internet.

SSL support requires an SSL certificate, and this certificate has to be installed on the computer that is running Windows Server 2003. SSL must also be supported by the client software. Microsoft Outlook Express supports SSL.

If a server certificate is installed, Microsoft NNTP Service uses SSL whenever a client requests it. You can optionally require SSL for all newsgroups or for newsgroups located in a virtual directory. You can also use SSL authentication of clients.

To enable SSL

  • Obtain and install an SSL server certificate.

To require an SSL connection for access to newsgroups

  1. In Microsoft Management Console, click the Virtual Directories node under the NNTP virtual server.
  2. In the details pane, select the virtual directory you want to modify.
  3. On the Action menu, click Properties.
  4. In the Virtual Directory dialog box, under Secure Communications, click Secure.
  5. In the Security dialog box, select the Require Secure Channel check box.

To enable SSL authentication for clients

  1. In Microsoft Management Console, select the NNTP virtual server, and then click Properties on the Action menu.
  2. On the Access tab, under Access control, click Authentication, and then select the Enable SSL client authentication check box.


Process Control Messages

Control messages are specially formatted messages that direct Microsoft NNTP Service to delete a specific article from a newsgroup or to add or delete an entire newsgroup. For example, if you post an article to a newsgroup and later decide to remove it using the Cancel command in Microsoft Outlook Express, the client sends a control message to Microsoft NNTP Service directing it to delete the article.

You should restrict control messages to prevent unwanted changes to articles and newsgroups. You also might want to restrict other Network News Transfer Protocol (NNTP) servers from pulling articles from Microsoft NNTP Service.

Important Because process control messages can pose a threat to your newsgroups when not used appropriately, they are not enabled by default on NNTP virtual servers. Having a moderator for all newsgroups can help prevent unauthorized use of process control messages, as a moderator must approve each message before it is enacted.

This section explains how to create control messages and how to restrict control messages to prevent tampering with Microsoft NNTP Service.


Generating Control Messages

Control messages are generated automatically by Network News Transfer Protocol (NNTP) client software, NNTP servers, and special utility programs.

Microsoft NNTP Service accepts the following basic control messages:

  • Cancel (deletes a specified article)
  • Newgroup (creates a newsgroup)
  • Rmgroup (deletes an existing newsgroup)

The Cancel control message is generated by client programs. The Newgroup and Rmgroup messages are typically generated by NNTP servers.


Restricting Control Messages

The Cancel, Newgroup, and Rmgroup control messages are received by Microsoft NNTP Service and posted to these special newsgroups: control.cancel, control.newgroup, and control.rmgroup. Restrict control messages by restricting access to these newsgroups.

You can define the special control.* newsgroups as moderated newsgroups, or you can restrict access to these newsgroups to a limited group of users. If you define them as moderated newsgroups, the moderator must approve each control message before it takes effect.

To define control newsgroups as moderated

  1. In Microsoft Management Console, expand the desired Network News Transfer Protocol (NNTP) virtual server to display the Newsgroups node.
  2. Click Newsgroups to display all of the NNTP virtual server's newsgroups in the details pane.
  3. Right-click the desired control newsgroup, and select Properties.
  4. Select the Moderated check box.
  5. In Moderator, type in the e-mail address of the moderator, or click Set Default to use the default moderator.
  6. Click OK.
  7. Repeat this process for each control.* newsgroup.

To restrict access to control newsgroups

Follow the directions in Restricting Access to Newsgroups. Grant access permissions to the appropriate group of users, such as Administrators.


Index Newsgroups with Microsoft Indexing Services

Users can use Microsoft Indexing Services to search for newsgroup articles that contain specified text strings. Indexing Services periodically updates the catalog that users search using a custom Web page.

To enable indexing in Microsoft NNTP Service

  1. In Microsoft Management Console, click the Virtual Directories node under the Network News Transfer Protocol (NNTP) virtual server.
  2. In the details pane, select the virtual directory that contains the newsgroup you want to index.
  3. On the Action menu, click Properties.
  4. In the Virtual Directory dialog box, select the Index news content check box.
  5. If you have newsgroups located in one or more virtual directories, repeat this process for each virtual directory.


Create Additional NNTP Virtual Servers

You can create more than one Network News Transfer Protocol (NNTP) virtual server on a single computer running Windows Server 2003. To an end user, each one appears as a separate server with a unique address and set of newsgroups. An Internet service provider (ISP) can host separate NNTP virtual servers for multiple customers without the expense of a separate computer for each.

This section contains:

  • Creating an NNTP Virtual Server

  • Configuring an NNTP Virtual Server


Creating an NNTP Virtual Server

You can create as many Network News Transfer Protocol (NNTP) virtual servers as you need. Each virtual server should have a unique IP address/TCP port combination. Although it is possible to have multiple NNTP virtual servers on a single IP address by using a different TCP port for each one, this is not recommended because the client software must then be specially configured to use the non-standard TCP port.

When you create an NNTP virtual server, you are prompted to enter two directory paths: a path for internal files and a path for newsgroup files. If possible, put these two paths on different disk partitions, as the internal files can be corrupted if the disk partition runs out of disk space. Keeping them on a separate disk partition reduces the chance that the disk partition can run out of disk space.

To create a new NNTP virtual server using Microsoft Management Console

  1. Configure the IP address for the NNTP virtual server by selecting Settings on the Start menu, and then click Network and Dial-Up Connections.
  2. Using Microsoft Management Console, select an existing NNTP virtual server. On the Action menu, point to New, and then click Virtual Server.
  3. Follow the instructions of the New NNTP Virtual Server Wizard. Be sure to select an IP address that is not being used by another NNTP virtual server.
  4. The new NNTP virtual server will start automatically. However, if you have assigned it an IP address/TCP port combination that is already in use, it won't start. You will have to reconfigure the IP address/TCP port combination to one that is unique.
  5. Configure the new NNTP virtual server.


Configuring an NNTP Virtual Server

The configuration process for the new Network News Transfer Protocol (NNTP) virtual server is the same as for the existing ones. You can configure security, create newsgroups, set newsgroup limits, and so on. Most configuration options are assigned default values when a new NNTP virtual server is created.

Each NNTP virtual server is listed separately in Internet Service Manager. Each has its own properties, expiration policies, and virtual directories. Be sure to select the correct NNTP virtual server before changing properties.

You need to create the newsgroups for the new NNTP virtual server and verify or change the following options. There are other options you might want to change as well, but the following are required:

  • IP address on the General property tab
  • Password Authentication Method on the Access tab
  • Log access and Index news content in the Virtual Directory dialog box

For more information on configuring an NNTP virtual server, see Operating Microsoft NNTP Service.


Concepts

This section provides general background information about Microsoft NNTP Service:

  • Quick Tour of Microsoft NNTP Service Features
  • Tab Reference
  • How Microsoft NNTP Service Works
  • Command Scripts for Microsoft NNTP Service

It also contains the following two scenarios:

  • Private News Virtual Server
  • Public News Virtual Server


Quick Tour of Microsoft NNTP Service Features

This section outlines the following key features of Microsoft NNTP Service:

  • Standards Support
  • Easy Administration
  • Microsoft Windows Server 2003 Family Integration
  • Microsoft Internet System Integration with IIS
  • Advanced Security


Standards Support

Microsoft NNTP Service supports the Network News Transfer Protocol (NNTP), which is used for both client-to-server and server-to-server communications. Microsoft NNTP Service supports popular NNTP extensions and is fully compatible with other NNTP clients and servers.

In addition, Microsoft NNTP Service supports numerous content formats, including:

  • Multipurpose Internet Mail Extensions (MIME)
  • Hypertext Markup Language (HTML)
  • Graphics Interchange Format (GIF)
  • Joint Photographic Experts Group (JPEG)


Easy Administration

Microsoft NNTP Service offers you Microsoft Management Console (MMC) as an administrative tool, for managing Microsoft NNTP Service from a computer on the same local area network. You can also manage all Microsoft Internet Information Services (IIS) components using a single interface.


Microsoft Internet System Integration with IIS

Microsoft NNTP Service supports full-text and property indexing of newsgroup content using Microsoft Indexing Services, which is included with Internet Information Services (IIS). You can index your news store, allowing you to search for a particular message.

The optional Microsoft Content Replication System updates the access control lists for Microsoft NNTP Service automatically across multiple servers. This saves time and simplifies security administration.


Advanced Security

Microsoft NNTP Service supports three security options that verify the identity of newsgroup users and protect your organization's private information:

  • Anonymous access. Allows anyone access to a newsgroup without providing a user name or a password.
  • Standard NNTP security extension (AUTHINFO USER/PASS). Requires the user to provide a user name and a password, which are sent as clear text across the network. To avoid unauthorized detection of user names and passwords, use Secure Sockets Layer (SSL) channel encryption with this authentication method.
  • Integrated Windows Authentication (AUTHINFO GENERIC). Requires the user to provide a user name and a password, which are encrypted for secure transmission across the network. This protocol uses the GENERIC extension to the standard Network News Transfer Protocol (NNTP) security protocol.

To protect the information from being sent across a public network, Microsoft NNTP Service supports SSL channel encryption, which includes certificate support to validate the identity of clients and servers.


Tab Reference

You can use the options on the Network News Transfer Protocol (NNTP) virtual server property tabs and dialog boxes to configure the service.

Note Newsgroup, expiration policy, and virtual directory properties are accessible by expanding the NNTP virtual server node in Microsoft Management Console and right-clicking the virtual server component you want. Selecting Properties will open the dialog box for that component, which, in all cases, consists of a General tab.

  • Access Tab
  • Expiration Policy Dialog Box
  • General Tab
  • Newsgroup Dialog Box
  • Security Tab
  • Settings Tab
  • Virtual Directory Dialog Box


Microsoft Windows Server 2003 Family Integration

Microsoft NNTP Service takes full advantage of standard Windows Server 2003 family administration tools for performance monitoring and event reporting. When you install Microsoft NNTP Service, the Setup program installs a complete set of System Monitor counters. All Microsoft NNTP Service status and error messages are written to event logs for viewing in Event Viewer. Microsoft NNTP Service also includes support for Simple Network Management Protocol (SNMP) monitors.

Microsoft NNTP Service manages access to newsgroups using access control lists (ACLs). By setting the permissions for the directory that contains a newsgroup, you control who has access to that newsgroup. You can also specify anonymous access to allow anyone access to a newsgroup.


Access Tab

Use the Access tab to restrict access to individual newsgroups or sets of newsgroups on the basis of the user name, or to restrict access to all newsgroups on the basis of the client computer IP address. (For more information on how to control access to newsgroups, see Configure Security.)

The Access tab contains the following options:

Option | Description
Access control | Authentication options. You can choose one or more options. To view the options, click Authentication.
Allow anonymous | Unrestricted user access to newsgroups that do not have permissions set on their directories. User names and passwords are not required.
Anonymous | Opens the Anonymous Account dialog box, which allows you to select a Windows account that will be used when someone logs on anonymously.
Username | The user name of the Windows user account used by all anonymous connections. This account defines the privileges of anonymous users. To select an account already defined on this computer, click Browse.
Password | The password for the anonymous user account.
Enable automatic password synchronization | The automatic update of the password in Microsoft NNTP Service when the password on the computer running Windows Server 2003 is changed.
Basic authentication | Authentication that requires the user to provide a valid Windows user name and password that are authorized for access to that directory. The user name and password are sent as unencrypted clear text across the network. Permissions are set on the directory.
Integrated Windows Authentication | Authentication that encrypts the user name and password and then sends them to Microsoft NNTP Service. The user name and password must be authorized for access to the requested newsgroup directory. Microsoft Outlook Express supports this protocol. Permissions are set on the directory.
Enable SSL client authentication | Enables secure client authentication using Secure Sockets Layer (SSL) encryption and certificates. A server SSL certificate is required.
Require SSL client authentication | Requires clients to provide an encrypted user name and password using SSL.
Enable client certificate mapping to Windows user accounts | Uses the Windows account mapped to the SSL client certificate to authenticate the user. Click Client Mappings to enter certificates and Windows account names.
Secure communication | Click Certificate to start the Web Server Certificate Wizard.
Connection control | The specific IP addresses that are allowed or not allowed access to this Network News Transfer Protocol (NNTP) virtual server. By default, all IP addresses are granted access. To view the options, click the Connection button.
All except the list below | Allows access to this NNTP virtual server to all IP addresses except for those listed.
Only the list below | Denies access to this NNTP virtual server to all IP addresses except for those listed.
Add | Click this button to open the Computer window, where you can add computers or domains to the list.
IP address | The IP address for a single computer that is being added. Click DNS Lookup to find the IP address associated with the DNS name of the computer.
Subnet address | The base IP address for a group of computers that is being added. A subnet mask is required.
Subnet mask | The subnet mask that specifies the range of IP addresses for a group of computers that is being added.
Name | The domain name of a group of IP addresses that is being added.


Expiration Policy Dialog Box

Use the options on the General tab of the Expiration Policy dialog box to set expiration policies for newsgroups. To access this tab, select an expiration policy under a Network News Transfer Protocol (NNTP) virtual server and then click Properties on the Action menu. Expiration policies specify the article age limit for newsgroups; they also specify the newsgroups to which the policy applies. If a newsgroup is assigned to more than one expiration policy, the more restrictive policy applies. (For more information on creating expiration policies, see Defining Newsgroup Limits and Expirations.)

The General tab contains the following options:

Option | Description
Articles older than (Hours) | Removes articles that are older than a specified number of hours. The default is 168 (7 days). To have no age limit, clear the check box.
Affected newsgroups | A list of the newsgroups to which the policy applies. The asterisk (*) wildcard character specifies multiple newsgroups. For example, rec.* denotes and includes all newsgroups starting with "rec.".
Add | Click this button to open the Add Newsgroup dialog box, where you can type in the names of newsgroups to add to this expiration policy. Use the asterisk (*) wildcard character to specify multiple newsgroups.
Remove | To remove a newsgroup from an expiration policy, select the newsgroup in the list of Affected newsgroups and click Remove.
Move Up | To move up a newsgroup in an expiration policy, select the newsgroup in the list of Affected newsgroups and click Move Up.
Move Down | To move down a newsgroup in an expiration policy, select the newsgroup in the list of Affected newsgroups and click Move Down.

Note Use the Move Up and Move Down buttons to specify which newsgroups the expiration policy should apply to, and in what order. For example, if you want to include all of the alt.tv newsgroups (alt.tv.*) in the policy, but exclude the alt.tv.cable newsgroup from the policy, meaning that you want to apply an expiration policy to all of the alt.tv newsgroups except the alt.tv.cable newsgroup, use the Move Up and Move Down buttons to include alt.tv.* first, and exclude alt.tv.cable second.


General Tab

Use the General tab to specify how clients connect to Microsoft NNTP Service.

The General tab contains the following options:

Option | Description
IP address | The IP address of the Network News Transfer Protocol (NNTP) virtual server.
Advanced | Opens the Advanced dialog box, where you can enable multiple IP addresses for the NNTP virtual server and configure TCP and SSL port numbers.
TCP port | The TCP port used by clients to connect to Microsoft NNTP Service. You can enter any unique TCP port number. The default is port 119.
SSL port | The TCP port used by clients to connect to Microsoft NNTP Service using SSL. You can enter any unique TCP port number. The default is port 563.
Limit number of connections to | When the check box is selected, this limits the number of simultaneous client connections to the NNTP virtual server. The default is 5,000 connections.
Connection time-out (minutes) | The number of minutes before an inactive client is disconnected. The default is 10 minutes.
Path header | The string used for the Path line in each news posting. The Path header displays the path a news message takes to reach its destination. When a message is forwarded from a news server, a descriptive string is added to the message in the Path line. Any punctuation character except the period (.) can separate the Path header. For information on how NNTP Path statements are generated, see Request for Comments (RFC) 1036. The default value is the Domain Name System (DNS) name of the NNTP virtual server. You do not need to change the default value.
Enable logging | Enables logging to track users of the NNTP virtual server. The default log file directory is C:\Winnt\System32\LogFiles\Nntpsvc1. To enable logging, you must also select the Log access check box in the Virtual Directory dialog box. Important Auditing server activity with log files is a good way to detect if unauthorized external users are attempting to access your virtual server, or if internal users are trying to access resources they do not have permission to access. For more information about auditing and using Event Viewer, see Help and Support Center.
Active log format | The transaction log format. To specify log properties, click Properties.


Newsgroup Dialog Box

Use the options on the General tab of the Newsgroup dialog box to modify newsgroups. You can configure newsgroups with a moderator who must approve articles before they are posted. You can also restrict write access for the newsgroup to the moderator. See also Creating Newsgroups.

The General tab contains the following options:

Option | Description
Description | A description of the newsgroup that can be displayed by clients.
Pretty name | Another name for the newsgroup returned by the List Prettynames Network News Transfer Protocol (NNTP) command that can be displayed by clients. This option accepts Unicode characters so that you can specify a newsgroup name using the character set of another language.
Read only | Restricts write access to the newsgroup moderator.
Moderated | Checking this option means all articles will be sent to a moderator for approval before posting.
Moderator | The e-mail address of the newsgroup moderator. The default is newsgroup@default_domain where newsgroup is the name of the newsgroup and default_domain is the domain specified in Default moderator domain on the Settings tab.


Security Tab

Use the Security tab to specify the operators who are allowed access to the NNTP virtual server.

The Security tab contains the following options:

Option | Description
Operators | The operators or groups of operators authorized access to this Network News Transfer Protocol (NNTP) virtual server. The default value is the Administrators group for this computer.
Add | Opens the Select Users or Groups dialog box, where you can select operators.
Remove | Removes the selected operator.
Look in (in Select Users or Groups dialog box) | The domain from which to select operators.
Name (in Select Users or Groups dialog box) | The available user and group names in the selected domain.
Add (in Select Users or Groups dialog box) | Adds the selected operators or groups to the selection box. Click OK to return to the Security tab. The names you added will appear in the Operators field.


Settings Tab

Use the Settings tab to set limits on posting articles, to enable control messages, and to enable moderated newsgroups.

The Settings tab contains the following options:

Option | Description
Allow client posting | When the check box is selected, this allows clients to post articles to newsgroups on this Network News Transfer Protocol (NNTP) virtual server.
Limit post size (KB) | Specifies, in kilobytes, the largest single article that a user can post. To have no limit, clear the check box.
Limit connection size (MB) | Specifies, in megabytes, the maximum amount of data that a user can post to a newsgroup during a connection. To have no limit, clear the check box.
Allow feed posting | When selected, this allows clients to post articles to newsfeeds on this NNTP virtual server.
Limit post size (KB) | Specifies, in kilobytes, the largest single article that a user can post to a newsfeed. To have no limit, clear the check box.
Limit connection size (MB) | Specifies, in megabytes, the maximum amount of data that a user can post to a newsfeed during a connection. To have no limit, clear the check box.
Allow servers to pull news articles from this server | Allows other NNTP servers to use pull feeds to get more than one article at a time from this server.
Allow control messages | Allows clients and servers to send control messages that create and remove newsgroups and delete individual articles. (For more information, see Process Control Messages.)
SMTP server for moderated groups | The DNS name of the Simple Mail Transfer Protocol (SMTP) mail server that sends articles to the moderators of newsgroups or specifies the directory path where these articles are placed. The directory must be a local directory.
Default moderator domain | The default domain for moderated newsgroups. The domain must be a qualified domain name. Articles posted to moderated newsgroups that have no specified moderator are sent to: news_group_name@default_moderator_domain where news_group_name is the name of the newsgroup to which the article is sent and default_moderator_domain is the value you specify for this option.
Administrator e-mail account | An e-mail address for receiving the non-delivery reports (NDRs) of moderated newsgroup articles that cannot be delivered to the specified moderator. To enable sending NDRs, create a new DWORD value named MailFromHeader with a value of 1 in the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\NntpSvc\Parameters\


Virtual Directory Dialog Box

Use the General tab in the Virtual Directory dialog box to specify the location and properties of a virtual directory. (For more information on creating virtual directories, see Use Virtual Directories to Store Articles on Multiple Disk Drives.)

The General tab contains the following options:

Option | Description
Directory contents | Click Contents to open the Directory Contents dialog box, where you determine the storage location of the virtual directory's resources.
Directory located on this computer | A local directory on this computer that contains the virtual directory.
Share located on another computer | A network directory on another computer that contains the virtual directory.
Local path | The path specifying where the virtual directory is located. For example, E:\Nntp\Rec\Sports.
Network directory | The Uniform Naming Convention (UNC) name of the share directory on another computer on which the virtual directory is located. For example, \\server_name\Rec\Sports.
Username | Specify a valid user name to be used when connecting to the remote computer. Click Browse to select a user name.
Password | The password that will be used in conjunction with the username you provide. Click Check to see if the username/password pair is a valid one.
Secure Communications | Restricts access to newsgroups in this directory hierarchy to clients using Secure Sockets Layer (SSL). To require SSL security, click Secure to open the Security dialog box.
Require Secure Channel | Restricts access to newsgroups in this directory hierarchy to clients using SSL to connect.
Require 128-bit Encryption | Restricts access to newsgroups in this directory hierarchy to clients using 128-bit, high-strength SSL encryption.
Allow posting | Allows news clients to post articles to newsgroups in this directory hierarchy.
Restrict newsgroup visibility | Restricts visibility of newsgroups in this directory to users who have access permission. This option adds processing overhead and should not be used for newsgroups that allow anonymous access.
Log access | Enables the writing of log records to the Internet Information Services (IIS) access log that show news client access to the newsgroups located in this directory hierarchy. To enable logging, you must also select the Enable logging check box on the General tab.
Index news content | Indexes newsgroups in this directory to enable searching for specific text. (For more information, see Index Newsgroups with Microsoft Indexing Services.)


How Microsoft NNTP Service Works

This section explains how Microsoft NNTP Service works. It describes:

  • Posting Articles
  • Viewing Articles
  • Microsoft NNTP Service Data Structures

Microsoft NNTP Service implements Network News Transfer Protocol (NNTP), which is a client/server protocol. Microsoft NNTP Service functions as the server; Microsoft Outlook Express is an example of a typical client.

Clients connect to Microsoft NNTP Service through a TCP/IP network. For normal connections, the default TCP port is 119; for optional encrypted SSL connections, the default TCP port is 563.

Microsoft NNTP Service runs as a service on computers running Windows Server 2003 and is configured to start automatically. The service name in the Services application in Control Panel is Microsoft NNTP Service.


Posting Articles

You post newsgroup articles to Microsoft NNTP Service using a news client such as Microsoft Outlook Express. The client connects to Microsoft NNTP Service and requests that an article be posted to one or more newsgroups. Microsoft NNTP Service receives the connection request and verifies the user's authorization to post to the specified newsgroups. Microsoft NNTP Service then adds the article to the newsgroups and updates the newsgroup index. The figure below illustrates this process.

Picture of article posting


Viewing Articles

You view newsgroup articles on Microsoft NNTP Service using a news client such as Microsoft Outlook Express. The first step in viewing newsgroup articles is getting a list of available newsgroups. The client connects to Microsoft NNTP Service and requests the list of available newsgroups. Microsoft NNTP Service receives the connection request, verifies that user access to newsgroups is authorized, and then sends the client a list of all available newsgroups.

The second step is selecting the newsgroup the user wants to view. The client requests the list of articles for the selected newsgroup. Microsoft NNTP Service verifies that user access to the specified newsgroup is authorized and sends the client a list of all articles in that newsgroup. Then, as the user selects articles, the client requests the articles from Microsoft NNTP Service, and Microsoft NNTP Service returns the contents of the articles. The figure below illustrates the steps in this process.

Picture of article viewing


Microsoft NNTP Service Data Structures

Microsoft NNTP Service stores newsgroup articles in one or more directory hierarchies. Each newsgroup has its own directory, and each article is stored as a file in that directory.

The main directory is C:\Inetpub\nntpfile\root by default, which can be changed by clicking Contents on the Virtual Directory dialog box of your Network News Transfer Protocol (NNTP) virtual server's Default virtual directory. You can create additional directory hierarchies on other disk drives or other computers by creating virtual directories.

The newsgroup directory has the same name as the newsgroup. Microsoft NNTP Service automatically creates the required directories when you create new newsgroups. For example, the newsgroup named entertainment.news is stored in the directory \Entertainment\News under the root directory C:\Inetpub\Nntpfile\root\Entertainment\News by default. All newsgroup article files have an .nws extension.

Microsoft NNTP Service also creates files that list the subjects of the stored articles; these files have an .xix extension. Microsoft NNTP Service creates one of these subject files for every 128 articles in a newsgroup.

Microsoft NNTP Service also maintains a number of internal data structure files with .hsh, .hdr, .lst, and .txt extensions. The default location of these files is C:\Inetpub\Nntpfile. Do not modify or delete these files. Rebuilding Microsoft NNTP Service restores these files if they are accidentally deleted or damaged.


Private News Virtual Server: A Departmental Newsgroup

Communication is critical for any group of people working together. In many organizations, it is difficult to get all of the members of a team together to share information regularly.

A newsgroup can solve many communication problems. It enables anyone in the group to read or post information at any time. It is easy for someone to find all of the information about a particular topic because articles are organized into topic threads. And, unlike e-mail, newsgroups provide a mechanism for easily archiving information for future reference.

Goal: To improve communication between department members working on a project and to organize and archive project information.

Software Components: Microsoft Windows Server 2003, Standard Edition or Windows Server 2003, Enterprise Edition; Microsoft Internet Information Services (IIS); Microsoft Outlook Express.

Environment: A Microsoft Windows Server 2003 family network.

Setup Considerations: Install Microsoft NNTP Service.

Other: To use a newsgroup as an information archive, do not set an expiration time for articles and be sure to back up the newsgroup directory frequently.

Basic Process

Hosting a few private newsgroups within your organization typically requires few server resources. You can usually use any computer running Windows Server 2003. Because Microsoft NNTP Service uses standard Network News Transfer Protocol (NNTP), department members can have access to newsgroups using any NNTP client software, although Microsoft Outlook Express does provide additional security options if you need them. The server and clients must be set up to use the TCP/IP networking protocol.

Start off with just a few newsgroups for a project. If your project is to design and build a better mousetrap, you might call your newsgroups mousetrap.design, mousetrap.test, and mousetrap.manufacturing. Because articles within each newsgroup are organized by subject, you do not need a separate newsgroup for each specific subject.

The URLs for your newsgroups have the following formats:

news://server/newsgroup

news://server/newsgroup/article

where server is the name or IP address of Microsoft NNTP Service, newsgroup is the name of the newsgroup, and article is an optional identifier of a specific article.

Depending on how confidential the articles will be, you might need to define security for the newsgroups. If the information is available to anyone in your organization and if your network is protected by a firewall, you should be able to allow anonymous logon. But if you need more security, create Windows user accounts for each newsgroup user, and then restrict access to the newsgroup directories to those accounts. Microsoft NNTP Service manages security using Windows user accounts and permissions.

Result

Members of your department can read and post articles about their project on a timely basis, keeping each other informed without having to schedule frequent meetings.


Public News Virtual Server: Customer Support Newsgroups

The quality and availability of customer support can make the difference between satisfied customers who will buy your products or services again and unsatisfied customers who will return products and take their business to a competitor. But providing appropriate support to customers can be a very expensive activity.

Goal: To reduce support costs and improve customer service by giving customers quick and easy access to technical support information.

Software Components: Microsoft Windows Server 2003, Standard Edition or Windows Server 2003, Enterprise Edition; Microsoft Internet Information Services (IIS); any Network News Transfer Protocol (NNTP) client software for anonymous access or Microsoft Outlook Express for advanced security.

Environment: The Internet.

Setup Considerations: Enable anonymous access; use the Domain Name System (DNS) or Windows Internet Name Service (WINS) for name resolution; provide access through the firewall if one is present.

Other: Consider using moderated newsgroups to prevent customers from posting unwanted or technically incorrect articles, but be aware that this can limit customers' ability to help each other if your support staff is not immediately available.

Basic Process

If you are already using IIS to provide public Web pages to customers, you can add customer support newsgroups to the same computer initially. If newsgroup activity increases, you can then move Microsoft NNTP Service to its own computer.

You can create a single newsgroup for each product you are supporting, or you can create several newsgroups for each product, one for each support topic. For example, if your product is a mousetrap, you can create the newsgroup support.mousetrap. If you expect a high volume of articles, you can create support.mousetrap.installation, support.mousetrap.operation, support.mousetrap.maintenance, and so on.

The URLs for your newsgroups have the following formats:

news://server/newsgroup

news://server/newsgroup/article

where server is the name or IP address of Microsoft NNTP Service, newsgroup is the name of the newsgroup, and article is an optional identifier of a specific article.

To ensure customer acceptance of newsgroups, your customer support personnel should read the newsgroup articles frequently and respond to questions promptly. It is also a good idea to post those frequently asked questions (FAQs) that address the most common support questions on a regular basis.

Result

Your customers are happier because they have immediate access to the latest questions and answers about your product. They can post their own questions and then check back later for a response from your support personnel or from another customer.

Your support personnel are more productive because they do not have to answer the same questions over and over. Your product teams can improve quality by monitoring the newsgroups to get customer feedback. By analyzing the access logs, you can track how support activity changes over time.


Command Scripts for Microsoft NNTP Service

This section contains information on command scripts and return codes that are used when you run scripts. Microsoft NNTP Service supports VBScript for most commands, and you can run them from local or remote servers. The -s option points commands to the server running Microsoft NNTP Service.

VBScripts have the same functionality as the command-line utilities from earlier versions of Microsoft NNTP Service. Windows Script Host, installed on computers running Windows Server 2003 operating systems, allows you to use VBScripts by clicking a script file on the Windows desktop or by typing the name of a script file at the command prompt.

Although you can run Windows Script Host either from the Windows-based host (Wscript.exe) or from the command shell-based host (Cscript.exe), Cscript.exe is easier to use. The VBScripts for Microsoft NNTP Service require options to be entered, which is easier to do from the command line. Type cscript.exe at the command prompt.

Note You must specify the full file name (including the .vbs extension) when you run the scripts.

The following VBScripts are available:

  • Rcancel.vbs
  • Rexpire.vbs
  • Rfeed.vbs
  • Rgroup.vbs
  • Rsess.vbs


Rcancel.vbs

Use this command to cancel messages on NNTP virtual servers. The following table lists the parameters you can use with Rcancel.

Parameter | Description
-t operation, where operation is one of the following arguments: |
-m "message-id" | The message to be cancelled.
-s server | The name of the server computer to be configured.
-i virtual server ID | The Network News Transfer Protocol (NNTP) virtual server ID (an integer).

The following example shows how command scripts are used. When Windows Script Host is running, you can enter any of the command scripts shown here on the command line.

Command script Function
Rcancel.vbs -m "uqjWStxCBHA.1240@nntpserver.example.com"
 Cancels the identified message.


Rexpire.vbs

Use this command to add, delete, and modify expiration policies. The following table lists the parameters you can use with Rexpire.

Parameter | Description
-t operation, where operation is one of the following arguments: |
a | Adds the expiration policy.
d | Deletes the expiration policy.
g | Gets the expiration policy.
s | Sets the expiration policy.
e | Enumerates the expiration policies.
-s server | The name of the server computer to be configured.
-v virtual server id | The Network News Transfer Protocol (NNTP) virtual server (an integer).
-i expire id | The ID of the expiration policy.
-h expire hours | The number of hours until articles are discarded.
-n newsgroups | The newsgroups to which the command is to be applied. (Strings containing the wildcard character (*) can be used.)
-p policy name | The name of the expire policy.

The following examples show how command scripts are used. When Windows Script Host is running, you can enter any of the command scripts shown here on the command line.

Command script Function
Rexpire.vbs -t e -v 1
 Enumerates the expiration policies for NNTP virtual server 1.
Rexpire.vbs -t d -i 1
 Deletes expiration 1.


Rfeed.vbs

Use this command for feed management. The following table lists the parameters you can use with Rfeed.

Parameter | Description
-t operation, where operation is one of the following arguments: |
a | Adds a feed.
d | Deleted a feed.
g | Gets information about a feed.
s | Sets information on a feed.
e | Enumerates feeds.
-s server | The name of the server computer to be configured.
-v virtual server id | The Network News Transfer Protocol (NNTP) virtual server ID (an integer).
-r | The server computer against which the feed operates.
-f [peer | master | slave] | The type of feed.
-u | The uucp name.
-a | Authinfo account.
-b | Authinfo password.
-i feed id | The feed ID (an integer).

Switches for inbound feed settings:

Parameter | Description
-ia [Pull | Accept | None] | The action the feed is to take.
-in | Newsgroup patterns.
-ix # minutes | Specifies how many minutes to wait between feed runs.
-iz [True | False] | Whether or not process control messages are used.
-im | The maximum number of connection attempts.
-io date | Get articles after this date (pull feeds only).
-ic [True | False] | Whether or not to create newsgroups automatically (pull feeds only).
-ip | The outbound Internet Protocol (IP) port.
-it | The location of the temporary files directory.

Switches for outbound feed settings:

Parameter | Description
-oa [Push | None] | The action the feed is to take.
-on | Newsgroup patterns.
-ox # minutes | Specifies how many minutes to wait between feed runs.
-oz [True | False] | Whether or not process control messages are used.
-om | The maximum number of connection attempts.
-op | The outbound Internet Protocol (IP) port.
-ot | The location of the temporary files directory.

The following examples show how command scripts are used. When Windows Script Host is running, you can enter any of the command scripts shown here on the command line.

Command script Function
Rfeed.vbs -t e
 Enumerates all feeds.
Rfeed.vbs -t d -i 1
 Deletes feed number 1.
Rfeed.vbs -t s -i 1 -ix 120
 Sets feed number 1 to wait 120 minutes between feed runs on inbound feeds.


Rgroup.vbs

Use this command to add, delete, and modify newsgroups. The following table lists the parameters you can use with Rgroup.

Parameter | Description
-t operation, where operation is one of the following arguments: |
f | Finds a group.
a | Adds a group.
d | Deletes a group.
g | Gets information about a group.
s | Sets information about a group.
-s server | The server affected by this change.
-v virtual server id | The Network News Transfer Protocol (NNTP) virtual server ID.
-c creation date | The date the group was created.
-g group | The name of the group. The wildcard character (*) can be used during searches (Rgroup.vbs –t f).
-n number of results | The maximum number of newsgroups to return for a search (Rgroup.vbs –t f).
-m moderator | The moderator's full e-mail address.
-d description | The description of the group.
-p description | Provides the response to the List PrettyNames command.
-r true | false | Read-only.
-u true | false | Indicates whether to moderate by default moderator.

The following examples show how command scripts are used. When Windows Script Host is running, you can enter any of the command scripts shown here on the command line.

Command script Function
Rgroup.vbs -t f -g alt.*
 Returns all newsgroups beginning with alt.
Rgroup.vbs -t d -g my.old.group
 Deletes the newsgroup my.old.group.
Rgroup.vbs -t a -g my.new.group
 Adds the newsgroup my.new.group.
Rgroup.vbs -t s -g my.old.group -p GreatGroup
       -m someone@example.com
 Sets the newsgroup pretty name description for my.old.group to GreatGroup and sets the moderator's address to someone@example.com.


Rsess.vbs

Use this command for session management. The following table lists the parameters you can use with Rsess.

Parameter | Description
-t operation, where operation is one of the following arguments: |
e | Enumerates users.
d | Terminates a session. (You must specify -u or -i.)
a | Terminates all sessions; terminates a client connection.
-u username | The user name to be terminated.
-i ipaddress | The IP or host name to be terminated.
-s server | The name of the server computer to be configured.
-v virtual server id | The Network News Transfer Protocol (NNTP) virtual server ID (an integer).

The following examples show how command scripts are used. When Windows Script Host is running, you can enter any of the command scripts shown here on the command line.

Command script Function
Rsess.vbs -t e -v 1
 Lists the current sessions for NNTP virtual server 1.
Rsess.vbs -t d -u bad_user
Terminates the session for the user bad_user.
Rsess.vbs -t a
 Terminates all sessions.


Maintenance

This section explains how to maintain Microsoft NNTP Service to ensure high performance and availability. Busier sites require more maintenance, so the amount of maintenance your Network News Transfer Protocol (NNTP) virtual news server requires depends primarily on its level of activity.

This section contains:

  • Maintenance Overview
  • Monitoring Microsoft NNTP Service with System Monitor
  • Viewing Messages with Event Viewer
  • Logging Microsoft NNTP Service Transactions
  • Rebuilding Microsoft NNTP Service


Maintenance Overview

Set up and follow a regular maintenance program to ensure maximum performance and availability from Microsoft NNTP Service. The goal of regular maintenance is to identify and correct potential problems before they become real problems and affect your users.

Four types of maintenance functions make up the Microsoft NNTP Service maintenance program:

  • Monitoring critical performance data
  • Reviewing messages written to Event Viewer
  • Monitoring transaction data
  • Updating indexes and hash tables

Performance counters enable you to monitor critical performance data for unusual values.

Microsoft Internet Information Services (IIS) logs enable you to see who is using your Network News Transfer Protocol (NNTP) virtual server and how he or she is using it.

The Microsoft NNTP Service rebuild capability enables you to update the indexes and the hash tables that keep track of articles posted to newsgroups.


Monitoring Microsoft NNTP Service with System Monitor

You can use System Monitor in the Control Panel to monitor Microsoft NNTP Service. The performance counters included with Microsoft NNTP Service enable you to build charts and reports that show critical performance data:

  • Service activity
  • Security
  • Overall performance
  • Performance trends

Important Auditing server activity is a good way to detect if unauthorized external users are attempting to access your virtual server, or if internal users are trying to access resources they do not have permission to access. For more information about auditing and using Event Viewer, see Help and Support Center.

Microsoft NNTP Service includes two objects in System Monitor. The first, NNTP Commands object, contains counters for client commands. The second, NNTP Server object, contains counters for service performance. This section describes the performance counters that are used most frequently.

In addition to charts and reports, you can define alerts to notify you when monitored values exceed thresholds that you specify.

To start monitoring Microsoft NNTP Service

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Performance.
  2. In the Performance window, right-click the graph window and select Add Counters.
  3. In the Performance Object drop-down menu, select either NNTP Commands or NNTP Server.
  4. In the Performance Counter drop-down menu, click the performance counter you want. To see a description of the selected counter, click Explain.
  5. Click Add.


Monitoring Service Activity

Monitor service activity to ensure that Microsoft NNTP Service is accepting new connections and servicing existing connections. The following performance counters provide a good indication of service activity:

  • Bytes Total/Sec in the NNTP Server object; this value should be greater than zero when active users are connected.
  • Current Connections in the NNTP Server object; this value should be greater than zero when users are connected.
  • Logon Attempts and Logon Failures in the NNTP Commands object; the value of Logon Failures should be a small fraction of the value of Logon Attempts.
  • Logon Failures/Sec in the NNTP Commands object; this value should be zero when users are successfully connecting.
  • Maximum Connections in the NNTP Server object; this value should be significantly less than the Limited to value in the General tab.


Monitoring Security

If your Network News Transfer Protocol (NNTP) virtual server is not available to the public, monitor the Logon Failures/Sec counter in the NNTP Commands object. A high number of logon failures might mean that unauthorized users are trying to gain access.


Monitoring Overall Performance

To monitor the overall performance of your Network News Transfer Protocol (NNTP) virtual server, monitor processor and disk performance counters in addition to Microsoft NNTP Service performance counters. The following performance counters provide advance warning of performance problems:

  • % Processor Time in the Processor object; this value should be less than 75.
  • Available Bytes in the Memory object; this value should be more than 4,200,000.
  • % Free Space in the LogicalDisk object; this value should always be greater than 0. Set an alert at 10 for advance warning that you are running out of disk space. If you have Microsoft NNTP Service files located on more than one drive letter, create an instance of this counter for each drive letter.
  • Avg. Disk Queue Length in the LogicalDisk object; this value should be less than the number of disks in the computer's disk array. If you have newsgroup articles located on more than one drive letter, create an instance of this counter for each drive letter.

    Before adding counters in the LogicalDisk object, enable disk data collection by typing the following command and then restarting the computer:

    diskperf -y

    For disks configured as Microsoft Windows stripe sets, type the following command instead:

    diskperf -yE

    To prevent performance problems, disable disk data collection by typing the following command when you are not actively monitoring disk performance:

    diskperf -n


Monitoring Performance Trends

The chart display of System Monitor is best used for monitoring current performance data. To monitor performance trends, you should use the log function of System Monitor. The log function uses the same performance counters as the chart display, but it collects the data at specified intervals.

To create a System Monitor log to monitor trends

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Performance.
  2. Double-click Performance Logs and Alerts, and then click Counter Logs.

    Any existing logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that a log has been stopped.
  3. Right-click a blank area of the details pane, and then click New Log Settings.
  4. In Name, type the name of the log, and then click OK.
  5. On the General tab, click Add Objects and select NNTP Commands and NNTP Server.
  6. On the General tab, set Interval to 15 and Units to minutes. An interval of 15 minutes is good for monitoring trends.
  7. If you want to change the default file and schedule information, make the changes on the Logs tab and the Schedule tab.


Logging Microsoft NNTP Service Transactions

Microsoft NNTP Service logs transaction data to the Internet Information Services (IIS) logs. Examine the transaction logs to understand who is using your Network News Transfer Protocol (NNTP) virtual server and how he or she is using it, and then extract the information you need from the logs. Then archive or delete the logs so they do not use too much disk space.

Microsoft NNTP Service writes a log record each time a user connects, retrieves an article, posts an article, or disconnects. Although you can read a log file written as text, log files are usually analyzed using software that creates summaries of the data. You can write log records in one of four formats:

  • Comma-separated value (CSV) text file in IIS log format.
  • CSV text file in National Center for Supercomputing Applications (NCSA) common log format.
  • CSV text file in World Wide Web Consortium (W3C) extended log format.
  • Open Database Connectivity (ODBC) database format. Writing to an ODBC database creates additional processing overhead that can reduce performance.

To enable logging

  1. Click the General tab.
  2. Select the Enable logging check box.
  3. In Active log format, click the format for writing the transaction log records.
  4. Click Properties, and then enter the required properties for the selected log format. (For information on specific properties, click Help.)
  5. Select each virtual directory and, on the Action menu, click Properties.
  6. In the Virtual Directory dialog box, select the Log access check box to log transactions for newsgroups in the virtual directory hierarchy.


Viewing Messages with Event Viewer

Check Event Viewer regularly for messages that might indicate developing problems. Microsoft NNTP Service writes a message to the System log in Event Viewer each time the service starts and stops, an operator command is processed, or an error is detected.

To view messages with Event Viewer

  1. On the Start menu, point to Programs, point to Administrative Tools (Common), and then click Event Viewer.
  2. In the console tree, click System. The messages written by Microsoft NNTP Service display NNTPSVC in the Source column.

You can make it easier to find Microsoft NNTP Service messages by filtering the messages in Event Viewer.

To view only Microsoft NNTP Service messages

  1. On the View menu in Event Viewer, click Filter.
  2. In the Source drop-down menu, click NNTPSVC.


Rebuilding an NNTP Virtual Server

Rebuilding a Network News Transfer Protocol (NNTP) virtual server with Microsoft NNTP Service will update the index and hash table files, which are what the virtual server uses to keep track of articles. You should rebuild an NNTP virtual server after you have manually deleted files, when you are recovering the system from a disk failure, and when you have problems gaining access to articles. In addition, some of the error messages written to the Event Viewer system log tell you to rebuild the virtual server.

Note Before you can rebuild the Microsoft News Service on an NNTP virtual server, you must stop that virtual server.

You can choose one of two levels of rebuilding:

  • Standard: Does not rebuild all of the files, but it is the faster option.
  • Thorough: Rebuilds all of the files, but it a slower option.
Note If you have deleted the nntpfile\root directory, you must use the Thorough level to rebuild.

To rebuild an NNTP virtual server

  1. Using Microsoft Management Console, stop the NNTP virtual server.
  2. Make sure the NNTP virtual server is selected and then, on the Action menu, click All Tasks.
  3. Click Rebuild Server.
  4. Under Rebuild type, click Standard or Thorough, and then click Start.


Troubleshooting

This section explains how to identify and correct problems with Microsoft NNTP Service. You can use the procedures in this section when users report problems or when you receive error messages.

This section contains:

  • Troubleshooting Overview
  • Viewing Messages with Event Viewer
  • Verifying Network Connectivity with Ping
  • Verifying Microsoft NNTP Service Availability with Telnet


Troubleshooting Overview

When you or your users have problems with Microsoft NNTP Service, follow the procedures in this section. There are three basic troubleshooting procedures:

  • Using Event Viewer to check for messages written by Microsoft NNTP Service. If the service detects a problem or fails to start, it writes error messages to the System log in Event Viewer.
  • Using the Ping program to verify network connectivity with Microsoft NNTP Service. If the client cannot establish a network connection to the computer on which the service is running, the client cannot read or post to newsgroups.
  • Using the Telnet program to verify that Microsoft NNTP Service is available. Telnet enables you to determine whether the problem is with the client or with the service.


Viewing Messages with Event Viewer

If you are having problems with Microsoft NNTP Service, check Event Viewer for error messages. Microsoft NNTP Service writes a message to the System log in Event Viewer each time the service starts and stops, an operator command is processed, or an error is detected.

Even if you are not currently having problems with the service, you should check Event Viewer periodically for error messages about potentially troublesome conditions you have not yet identified.

To view messages with Event Viewer

  1. On the Start menu, point to Programs, point to Administrative Tools (Common), and then click Event Viewer.
  2. In the console tree, click System. The messages written by Microsoft NNTP Service display NNTPSVC in the Source column.

You can make it easier to find Microsoft NNTP Service messages by filtering the messages in Event Viewer.

To view only Microsoft NNTP Service messages

  1. On the View menu in Event Viewer, click Filter.
  2. In Source, click NNTPSVC.


Verifying Network Connectivity with Ping

You can use the Ping program to verify network connectivity to Microsoft NNTP Service. You can verify whether the Domain Name System (DNS) is correctly resolving the computer name to the Internet Protocol (IP) address.

Because a network problem can occur at many places in the network, it is preferable to verify connectivity on the computer from which the client cannot connect to Microsoft NNTP Service. However, if necessary, you can verify connectivity from any computer on the network.

Note Some network routers always block Ping messages. Even if Ping fails to connect, try connecting with Telnet.

To verify network connectivity

  1. On the Start menu, point to All Programs, point to Accessories, and then click Command Prompt.
  2. At the command prompt, enter the following command:

    ping server_name

    where server_name is the DNS name of the computer on which Microsoft NNTP Server is running.

  3. If the two computers can establish a network connection, you receive a response similar to the following:

    Pinging news.dns.microsoft.com [10.0.0.0] with 32 bytes of data:

    Reply from 10.0.0.1: bytes=32 time=15ms TTL=128
    Reply from 10.0.0.1: bytes=32 time<10ms TTL=128
    Reply from 10.0.0.1: bytes=32 time<10ms TTL=128

    If the two computers cannot establish a network connection, you receive an error message similar to the following:

    Bad IP address news.microsoft.com

    When you receive the latter error message, at the command prompt, enter the following command:

    ping IP_address

    where IP_address is the IP address of the computer on which Microsoft NNTP Service is running.

    If you get a successful response by IP address but not by DNS name, you have a problem with the DNS. Verify that the IP address of Microsoft NNTP Service is correctly registered in your DNS and that the client is configured to use the correct DNS.

    If you do not get a successful response by IP address, you have a network connectivity problem. Work with your network administrator to identify and correct the network problem.

For help with Ping command syntax, type ping -? at the command prompt.

Note If the response from the Ping command shows a time value greater than 10 milliseconds, ask your network administrator to check for network congestion problems.


Verifying Microsoft NNTP Service Availability with Telnet

You can use the Telnet program to verify that Microsoft NNTP Service is accepting connections and responding correctly to Network News Transfer Protocol (NNTP) commands. This enables you to determine whether a problem is being caused by the service or by the client.

Before using Telnet, you should verify network connectivity using Ping.

To connect to Microsoft NNTP Service using Telnet

  1. On the Start menu, point to Programs, point to Accessories, and then click Telnet.
  2. On the Terminal menu, click Preferences, and then select the Local Echo check box.
  3. On the Connect menu, click Remote System.
  4. In Host Name, type the DNS name or IP address of Microsoft NNTP Service. In the Port box, type the IP port number being used by Microsoft NNTP Service. (The default is port 119.)

    If the service is accepting connections, you receive a message similar to the following:

    200 NNTP Service Microsoft Internet Services 5.5 Version: 5.5.1717.0 Posting Allowed

    If you receive a Connect Failed message from Telnet, the service is either not running or not accepting connections. If you receive a 502 Connection Refused message from Microsoft NNTP Service, the service has either paused or reached its connection limit.

  5. If the service accepts your connection, type list, and then press ENTER.

    If the service is responding to NNTP commands, it lists the available newsgroups.

    If you receive a 480 Logon Required message, the service is not allowing anonymous access.

  6. To end your Telnet session, type quit, and then press ENTER.

If you can connect and run the List command successfully using Telnet, the problem is probably with the client.

If you cannot connect, the problem is probably with the service. Verify the port number and other Microsoft NNTP Service configuration settings.


Legal Information

Microsoft Documentation

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people and events depicted herein are fictitious and no association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2003 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, MS-DOS, Outlook, Win32, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.