Attachment 4 v10_1_SAG.pdf

FOR OFFICIAL USE ONLY

Tactical Local Area Network (TACLAN) Version 10.1

System Administration Guide

United States Special Operations Command (USSOCOM) TACLAN Program Management Office (PMO)

D04300-R00

April 2011

V10.1 System Administration Guide

D4300-R00 ii

Change Log

Revision Date Paragraphs Changed

Description of Change

00 April 2011 -- Initial Release iii

Table of Contents

1.0 Introduction

1.1 Document Conventions

1.2 What is New in TACLAN Version 10.1

1.2.1 Scripted Installation and Deployment

1.2.2 TACLAN First-In/Last-Out (TACFILO) Laptop Server

1.2.3 TACLAN Configurator Utility

1.2.4 VMware vCenter Server

1.2.5 VMware ESX 3.5

1.2.6 Microsoft Server 2008 R2

1.2.7 Microsoft Exchange 2010

1.2.8 NetApp FAS2040 Storage System

2.0 Windows Server 2008 R2 Management

2.1 Server Manager

2.2 Windows Deployment Services (WDS)

2.3 Managing User Accounts

2.3.1 Create a New Domain User Account

2.3.2 Create a New Local User Account

2.3.3 Disable or Enable Domain User Accounts

2.4 Managing Computer Accounts

2.4.1 Create New Computer Accounts

2.4.2 Add a Computer Account to a Group

2.4.3 Delete a Computer Account

2.4.4 Manage a Remote Computer

2.4.5 Move a Computer Account

2.4.6 Reset a Computer Account

2.5 Enable and Unlock User and Computer Accounts

2.6 Locate Active Directory Objects

2.7 Filter Active Directory Data

3.0 Managing Groups

3.1 Understanding Group Accounts

3.2 Create a New Group

3.3 Add a Member to a Group

3.4 Convert a Group to Another Group Type

3.5 Change Group Scope

3.6 Delete a Group

3.7 Find Groups in Which a User is a Member

3.8 Assign User Rights to a Group in Active Directory Domain Services (AD DS)

4.0 Group Policy Implementation

4.1 Recommended Group Policy Settings

4.2 Group Policy Management Console

4.3 Microsoft Group Policy Planning and Deployment Guide

4.4 Group Policy and Automatic Updates

4.5 Configure Automatic Updates by Using Local Group Policy

iv

5.0 Exchange Server 2010 Administration

5.1 Exchange Management Tools

5.2 Exchange 2010 Administration

5.2.1 Create a Mailbox with Exchange Management Console (EMC)

5.2.2 Enable or Disable Messaging Application Programming Interface (MAPI) for a User’s Mailbox

5.3 Reinstall Exchange After a Failed Install

5.3.1 Exchange Installation Repair Steps

6.0 Windows 2008 R2 Domain Name System (DNS)

6.1 DNS Services and Zones

6.1.1 Start or Stop a DNS Server

6.1.2 Pause or Resume a Zone

6.2 Adding Zones

6.2.1 Add a Forward Lookup Zone

6.2.2 Add a Reverse Lookup Zone

6.2.3 Add a Stub Zone

6.2.4 Configure DNS to Use Conditional Forwarders

6.2.4.1 Using Conditional Forwarders Versus Secondary Zones

6.2.4.2 Conditional Forwarders

6.3 DNS Tools

7.0 TACLAN FILO Laptop Disaster Recovery

7.1 Introduction

7.2 Applicability

7.3 Purpose

7.4 Software Requirements

7.5 Hardware Requirements

7.6 Remove Failed TACFILO Object from Active Directory

7.6.1 Install Virtual Infrastructure Client

7.6.2 Locate and Login to Surviving Domain Controller

7.6.3 Remove Failed TACFILO Object from Active Directory

7.7 Rebuild the TACLAN FILO Laptop Server

7.7.1 Connect Network Cables

7.7.2 Set up a Panasonic CF-52 Laptop to Boot from the External USB Hard Drive ... 44

7.7.3 Load the TACLAN FILO Image Onto the Panasonic CF-52 Laptop

7.7.4 Set Domain Controller Time

7.7.5 Disable FILO Laptop Standby Power Function

7.7.6 Load Hyper-V and WDS Services

7.7.7 Create Build Files and Templates

7.7.8 Deploy vSphere VM on Hyper-V

7.7.9 vSphere Virtual Machine – PXE Boot and Load the Server 2008 R2

7.7.10 Configure vSphere

7.7.11 Install vSphere Software

7.7.12 FILO – Install Outlook 2007 and NetApp SMBR

7.7.13 Configure Disaster Recovery Script

v

8.0 Information Assurance Management Program

8.1 Information Assurance Vulnerabilities

8.2 Security Technical Implementation Guides

8.3 Gold Disk

8.4 McAfee Antivirus Virus Definition Download and Install

8.5 Password Policy

8.5.1 Scope

8.5.2 Policy

8.5.3 Guidelines

8.5.4 TACLAN Password Management

8.6 Host Based Security System (HBSS)

9.0 Remote Desktop Configuration

9.1 Remote Desktop

9.2 Enable Remote Desktop

9.3 Create a Remote Desktop Session

10.0 NetApp FAS2040 Storage System Administration

10.1 NetApp FAS2040 Overview

10.2 NetApp FAS2040 Configuration

10.2.1 Change the NetApp FAS2040 IP Address Through FilerView

10.2.2 Change the NetApp FAS2040 Password

10.2.3 Map Network Drives to the NetApp FAS2040 Storage

10.2.4 Join the NetApp FAS2040 to a Domain

10.2.5 Create a Local NetApp FAS2040 User Account to Mirror a Local Account on the TACLAN Client (if Required)

10.3 Zeroize the FAS2040 Hard Drives and Prepare for Operating System Software Reload

10.3.1 Zeroize the Drives and Prepare for Software Reload

10.4 Reload Data ONTAP Through a Console Session and Windows

10.4.1 Configure the FAS2040 for Data ONTAP OS Software Installation

10.5 Map a Network Drive from the Administrator Laptop to the FAS2040

10.6 Cluster Failover (CF) Giveback Correction

10.7 Troubleshooting NetApp Exchange Server Build

10.7.1 Restart SnapDrive Service (if Required)

10.7.2 Reconnect the Exchange DB and Log File LUNS if They Exist

10.7.3 Create New Exchange DB and Log File LUNS if They do not Exist

10.7.4 Create New Exchange Database

11.0 Reset NetApp Configuration to Factory Default

11.1 Reset the NetApp Data to Factory Default

11.1.1 Quick Reset the Storage Configuration for a Quick Rebuild

11.1.2 Graceful Storage Shutdown

11.1.3 NVRAM (Cache) Battery Charging Bypass

11.1.4 Configure the NetApp FAS2040 Hard Disk Assignment

11.1.5 Reconfigure Replacement Secondary Storage

11.2 Restore Files, Folders, Virtual Machines, and Exchange

11.2.1 SnapManager for Virtual Infrastructure (SMVI)

vi

11.2.2 Install SMVI

11.2.3 Configure SMVI

11.2.4 Schedule SMVI Virtual Machine Backup Jobs

11.2.5 Restore a Virtual Machine Using SMVI

11.2.6 SnapManager for Exchange

11.2.7 Install SnapManager for Exchange (SME)

11.2.8 Starting SME the First Time

11.2.9 Configure an SME Backup Job

11.2.10 Create an SME Exchange Backup Schedule

11.2.11 Restore the Exchange Database Using a Point-in Time Restore from SME

11.2.12 Initialize CIFS SnapMirrors

11.2.13 Single Mailbox Recovery (SMBR)

11.2.14 Restore an Exchange Mailbox, Email, or Object from a Snapshot Using

SMBR

11.2.14.1 Single Mailbox Recovery –– Enable iSCSI on FILO

11.2.14.2 Configure SnapDrive

11.2.14.3 Configure and Run SMBR

11.2.15 TACLAN 10.1 NetApp Snapshots

11.2.16 Restore User Data from a Snapshot

11.2.17 Change the NetApp FAS2040 Snapshot Schedule

11.2.18 TACLAN 10.1 NetApp SnapMirror

11.2.19 Restore User Data from a SnapMirror

11.2.20 Change the NetApp FAS2040 SnapMirror Schedule

11.2.21 TACLAN 10.1 NetApp SnapVault

11.2.22 Restore User Data from a SnapVault Using a CIFS Connection

11.2.23 Restore Volumes from a SnapVault

11.2.24 Change the NetApp FAS2040 SnapVault Schedule

11.2.25 TACLAN 10.1 NetApp SnapRestore

11.2.26 Restore User Data using SnapRestore

12.0 NetApp FAS2040 Storage System Disaster Recovery

12.1 Introduction

12.2 Applicability

12.3 Purpose

12.4 Software Requirements

12.5 Hardware Requirements

12.6 Operating Modes

12.6.1 Normal Mode

12.6.2 Emergency Mode

12.7 Restoration Process

12.8 Normal Mode Operation (Preparation)

12.9 Emergency Mode Operations

12.9.1 Continuity of Operations on Secondary Storage

12.9.2 Assumptions

12.9.3 Configure the System to Run on the Secondary FAS2040

12.9.3.1 Power Cycle ESX Servers

vii

12.9.3.2 Login to the FILO Server

12.9.3.3 Modify the MOSS, SQL, and Member Server VMware VMX Files (if Necessary)

12.9.3.4 Reconnect the Exchange DB and Log File

12.9.3.5 Reconfigure SMVI for Operation on the Secondary SAN (Emergency Operations)

12.9.3.6 Reconfigure SME for Operation on the Secondary SAN (Emergency Operations)

12.9.3.7 Create an SME Exchange Backup Schedule

12.9.3.8 Reconfigure Snap Vault for Operation on the Secondary SAN (Emergency Operations)

12.9.4 Restore to Normal Mode (Failback)

12.9.4.1 Restore to Normal Mode Using SnapMirror to Recover Data

12.9.4.2 Recover Virtual Machines

12.9.4.3 Reconnect the Exchange DB and Log File

12.9.4.4 Re-establish SnapMirror Relationships from Primary to Secondary

12.9.4.5 Reconfigure SME for Operation on the Primary SAN (Failback Operations)

12.9.4.6 Create an SME Exchange Backup Schedule

12.9.4.7 Reconfigure SMVI

12.9.4.8 Re-establish SnapVault Relationships

13.0 EMC Storage System Disaster Recovery Procedures

13.1 Introduction

13.2 Applicability

13.3 Purpose

13.4 Software Requirements

13.5 Hardware Requirements

13.6 Operating Modes

13.6.1 Normal Mode

13.6.2 Emergency Mode

13.7 Restoration Process

13.8 Disclaimers

13.9 Normal Operation

13.9.1 Preparation

13.9.2 Prepare Segment for Emergency Operation Mode

13.9.3 Run backup_vms Script on ESX1

13.9.4 Run backup_vms Script on ESX2

13.10 Emergency Mode Operation

13.10.1 Continuity of Operations on Secondary Storage

13.10.2 Assumptions

13.10.3 Remove Inaccessible or Orphaned Virtual Machines

13.10.4 Remove Secondary Domain Controller from Active Directory

13.10.5 Point Virtual Machines to Secondary SAN

13.11 Normal Operation – Replace Primary SAN

13.11.1 Preparation

viii

13.11.2 Recreate DataStores on Primary SAN

13.11.3 Run restore_vms Script on ESX1

13.11.4 Run restore_vms Script on ESX2

13.11.5 Point Virtual Machines to Primary SAN

13.11.6 Install and Configure Domain Controller Virtual Server

13.11.7 Install NAS Virtual Server

13.11.8 Copy and Destroy Existing NAS Mirrors (Update Mirror Steps)

13.11.9 Copy Data Back to SAN Mirror

13.11.10 Install and Configure BackupExec 2010 R2

14.0 Removing Buffalo Drives

14.1 Applicability

14.2 Purpose

14.3 Buffalo TeraStation III NAS Disconnect Procedures

14.3.1 Cancel Archive Scheduled Task and Unmap Network Drives to the Buffalo TeraStations

15.0 Create Additional Hyper-V Virtual Machines as Needed

15.1 PXE Boot and Load the Server 2008 R2 on the Virtual Machine

15.2 Install Software on the Server Virtual Machine (15.2)

16.0 Disable Internet Explorer (IE) Security Enhancement Configuration (ESC) Feature

17.0 BackupExec 2010 R2 Restore Procedures

17.1 E-mail

17.2 Files and Folders

17.3 System State

18.0 Frequently Asked Questions (FAQs)

Appendix A: TACLAN – NetApp Solutions A1.0 TACLAN\NetApp Solution Overview A2.0 TACLAN – NetApp Scripted Solution (FAS Setup)

A2.1 System Setup A2.2 Configure Common Internet File System (CIFS) Setup

A2.3 Volume Creation and Configuration A2.4 Account Permissions A3.0 TACLAN – NetApp Scripted Solution (Exchange Setup)

A3.1 Account Permissions A3.2 Start iSCSI

A3.3 NetApp Host Utilities A3.4 NetApp SnapDrive A3.5 NetApp SnapManager for Exchange A4.0 TACLAN – NetApp Semi-Automated Solution (Single Mailbox Recovery)

A5.0 TACLAN – NetApp Manual Solution (SMVI)

A6.0 TACLAN – NetApp\TACLAN Solution (Primary SAN Failure)

A7.0 TACLAN – NetApp Automated Solution (System Reset)

A8.0 TACLAN – SharePoint Backup and Restore TACMOSS Data

A8.1 Create a TACMOSS Backup A8.2 Restore TACMOSS Data from Backup ix

A9.0 SolarWinds Database Backup A9.1 Back up the Orion NPM Database A9.2 Back up the Orion NCM Database A9.3 Restore the SolarWinds Databases

A9.3.1 Restore the Orion NPM Database

A9.3.2 Restore the Orion NCM Database

List of Figures

Figure 4-1 Group Policy Objects – WSUS Example (Enabled) Figure 4-2 GPEDIT.MSC – Local Computer Policy View Figure 4-3 GPEDIT.MSC – Windows Update – Edit Policy Settings View

Figure 4-4 GPEDIT.MSC – Windows Update – Enable and Configure Options

Figure 4-5 GPEDIT.MSC – Windows Update – Apply Policy Settings

Figure 5-1 Run the Remove Exchange PowerShell Script Figure 5-2 Force the VM into BIOS Setup After Boot Up Figure 5-3 Change the Boot Order in the PhoenixBIOS Setup Utility Figure 5-4 Save the Changes in the PhoenixBIOS Setup Utility Figure A-1.1 NetApp CONOPS

1.0 Introduction

The information in this System Administration Guide (SAG) is provided to assist Tactical Local Area Network (TACLAN) system administrators (SAs) with a ready source of useful information. If you are already an experienced TACLAN SA, this Guide will provide a useful reference. However, if you are not a certified SA, or are new to TACLAN Version 10.1, this Guide provides essential SA information required to operate the TACLAN system. Portions of the information contained in this Guide were derived from Microsoft sources because TACLAN

10.1 uses Microsoft Windows Server 2008 R2 and Windows XP to provide core server services and client operating systems, respectively. References to the Microsoft sources are provided as applicable. Other sources include Cisco, NetApp, Dell, and Panasonic.

1.1 Document Conventions

The following conventions are used throughout this document:

Italics Text Text displayed on the computer screen is in italics.

Bold Italics Text Options that the user is to select are in bold italics .

Bolded Text Text that the user must type is printed in bold lettering that resembles the output from a typewriter .

<Ctrl-L> This key combination indicates a command that is entered. This command, for example, indicates that the user should hold down the Control key and press the L key simultaneously.

[IP Address] Text contained within brackets such as [192.168.1.10] or [Domain Administrator Password] indicates that a substitution can be made. This information is unique and is not necessarily the same for every system.

� This symbol is used between steps that follow each other. Select Start ���� Shutdown ���� Restart means that you should select the Start button, select Shutdown, and then select Restart.

<Enter> Press the key within the arrows.

IMPORTANT: The Information icon calls particular attention to information or steps that should be strictly adhered to.

STOP: The Stop icon calls particular attention to information or procedures that, if not strictly followed, could result in loss of data or equipment malfunction.

NOTE: The Note icon calls particular attention to technical tips or helpful information that goes a step beyond the basic build process.

1.2 What is New in TACLAN Version 10.1

1.2.1 Scripted Installation and Deployment

The engineering approach for TACLAN Version 10.1 had specific goals. Among these goals were to simplify the deployment process and automate as many processes as possible. Another major goal was to increase scalability even more than in previous TACLAN versions. TACLAN Version 10.1 implements heavy use of Microsoft PowerShell to streamline installation of many applications and services. Most of the tedious processes in previous TACLAN versions requiring manual input have been eliminated in TACLAN Version 10.1 because of the PowerShell implementation. Two key benefits to the war-fighter are the reduction in build time and extreme scalability.

1.2.2 TACLAN First-In/Last-Out (TACFILO) Laptop Ser ver

The TACLAN FILO Server is a dual-role laptop running Windows Server 2008 R2 and fulfilling a domain controller role. The TACFILO laptop server configuration initially was created in response to requests for a small, rugged, deployable, server platform by System Administrators (SAs) in the field. The TACFILO is capable of being the first deployed laptop server and supporting a small contingent of war fighters. It is also capable of scaling up to a full TACLAN suite and scaling back down again to support redeployment back to garrison.

Another role of the TACLFILO is to provide a deployment platform for the TACLAN virtual suites. With the use of TACLAN Configurator, the TACLFILO is easily configured to support complete deployment of the TACLAN 10.1 suites running VMware virtual servers. During the build process the TACFILO acts as a Preboot Execution Environment (PXE) platform for all builds. After the virtual suite is built, the TACFILO remains as a (first) domain controller for the suite. During the build process a virtual machine becomes the second domain controller. This is the first ever TACLAN release to provide domain controller redundancy.

1.2.3 TACLAN Configurator Utility

The TACLAN Configurator is a Graphical User Interface (GUI) utility created to help automate the TACLAN build process. This utility is on the TACFILO and all the Windows Server 2008 R2 virtual machines. The Configurator’s main purpose is to provide a central data entry point for building the TACLAN suite. Data (such as server, names, IP addresses, Dynamic Host Configuration Protocol (DHCP) scope, VLANS, gateway, etc.) is entered only once within the Configurator as opposed to being entered in each server after it is built. The data is automatically populated throughout the suite as needed during the build process. The

Configurator is a great deployment aid that helps to eliminate configuration errors that have been prominent in previous TACLAN versions.

1.2.4 VMware vCenter Server

VMware vCenter Server provides a scalable and extensible platform that forms the foundation for virtualization management. VMware vCenter Server, formerly VMware VirtualCenter, centrally manages VMware vSphere environments, allowing information technology (IT) administrators to dramatically improve control over the virtual environment as compared to other management platforms.

VMware vCenter Server:

• Provides centralized control and visibility at every level of virtual infrastructure:

o An improved user interface allows for easier navigation and access to different parts of the vSphere Client from a vCenter Home Page, featuring a new dashboard and navigation bar.

o Inventory search puts the entire vCenter inventory, including virtual machines, hosts, datastores, and networks, at your fingertips from anywhere within vCenter.

o New hardware monitoring with Common Information Model (CIM) Systems Management Architecture for Server Hardware (SMASH) enable alarms when hardware failures of key components such as fans, system board and power supply occur, providing an integrated view of physical and virtual server health.

o New storage maps and reports convey storage usage, connectivity, and configuration. Customizable topology views give visibility into storage infrastructure and assist in diagnosis and troubleshooting of storage issues.

o Improved alerts and notifications support new entities, metrics, and events such as datastore – and VM-specific alarms. These alarms can trigger new automated workflows to remedy and preempt problems.

o Improved performance graphs monitor virtual machines, resource pools, and server utilization and availability with more detailed statistics and graphs that can be viewed in real time or across a specified time interval.

• Provides a scalable and extensible management platform with a broad partner ecosystem:

o Improved large-scale management with vCenter Server, since it is designed from the ground up to handle the largest IT environments. A single instance of vCenter Server 4.0 manages up to 300 hosts and 3000 virtual machines and with Linked Mode you can manage up to 1,000 hosts and 10,000 virtual machines across 10 vCenter Server instances. VMware Hardware (HA) and Distributed Resource Scheduling (DRS) clusters can support up to 32 hosts.

o Linked Mode provides a scalable architecture and visibility across multiple vCenter Server instances, with roles, permissions, and licenses replicated across the infrastructure so you can simultaneously log in, view, and search the inventories of all vCenter Servers.

o Integration with systems management products web services Automated Program Interfaces (APIs) protect your investments and give you freedom of choice in how you manage your environment.

For more information, reference the VMware website at:

http://www.vmware.com/resources/techresources/10044 http://www.vmware.com/products/vcenter-server/

1.2.5 VMware ESX 3.5

Team TACLAN introduced ESX 3.5 in TACLAN Version 9.0. TACLAN Version 10.1 virtualization platform is also based on ESX 3.5 and provides all security and performance enhancements required. Below are some of the capabilities introduced by utilizing ESX3.5 in the TACLAN virtual environment.

Enablement of Intel Xeon Processor 3400 Series. Support for the Intel Xeon processor 3400 series has been added. Support includes Enhanced VMotion capabilities. For additional information on previous processor families supported by Enhanced VMotion, see Enhanced VMotion Compatibility (EVC) processor support (Knowledge Base (KB) 1003212).

Driver Update for Broadcom Network Controller . The driver for Broadcom controllers has been upgraded. This driver supports bootcode upgrade on bnx2 chipsets and requires bmapilnx and lnxfwnx2 tools upgrade from Broadcom. This driver also adds support for Network Controller – Sideband Interface (NC-SI) for serial over LAN (SOL) applicable to Broadcom NetXtreme 5709 and 5716 chipsets.

Driver Update for LSI SCSI and Serial Attached (SAS) Small Computer System Interface (SCSI) Controllers. The driver for LSI SCSI and SAS controllers is updated to version 2.06.74.

This version of the driver is required to provide a better support for shared SAS environments.

Newly Supported Guest Operating Systems. Support for the following guest operating systems has been added specifically for this release:

Windows 2008 R2 Enterprise Edition (64-bit) (TACLAN 10.1)

For more complete information about supported guests included in this release, see the VMware Compatibility Guide at http://www.vmware.com/resources/compatibility/ search.php?deviceCategory=software.

Newly Supported Management Agents. See VMware ESX Server Supported Hardware Lifecycle Management Agents for current information on supported management agents.

Newly Supported Network Cards. This release of ESX Server supports HP NC375T (NetXen) PCI Express Quad Port Gigabit Server Adapter.

Newly Supported Serial Advanced Technology Attachment (SATA) Controllers. This release of ESX Server supports the Intel Ibex.

For more information, reference the VMware website at http://www.vmware.com/support/vi3/ doc/vi3_esx35u5_rel_notes.html#whatsnew.

1.2.6 Microsoft Server 2008 R2

Windows Server 2008 R2 delivers valuable new functionality and powerful improvements to the core Windows Server Operating System to help organizations of all sizes increase control, availability, and flexibility for their changing mission requirements. New Web tools, virtualization technologies, scalability enhancements, and management utilities help save time, reduce costs, and provide a solid foundation for TACLAN IT infrastructures. TACLAN leverages these technologies to provide a fully capable, yet tactically deployable IT infrastructure.

Web Application Platform . Windows Server 2008 R2 includes many enhancements that make this release the most robust Windows Server Web application platform yet. It offers an updated Web server role, Internet Information Services (IIS) 7.5, and greater support for .NET on Server Core.

Virtualization. Windows Server 2008 R2 provides client and server virtualization via Hyper-V and Presentation virtualization with Remote Desktop Services.

Scalability and Reliability. Windows Server 2008 R2 is capable of unprecedented workload size, dynamic scalability, and across-the-board availability and reliability. A host of new and updated features include leveraged sophisticated CPU architectures, increased operating system componentization, and improved performance and scalability for applications and services.

Management. The ongoing management of servers in the data center is one of the most time-consuming tasks facing IT professionals today. Any management strategy you deploy must support the management of both your physical and virtual environments. To help with this problem, Windows Server 2008 R2 has new features to reduce the ongoing management of Windows Server 2008 R2 and to reduce the administrative effort for common day-to-day operational tasks.

For more information reference the Microsoft website at http://www.microsoft.com/ windowsserver2008/en/us/whats-new.aspx.

1.2.7 Microsoft Exchange 2010

Microsoft Exchange Server 2010 brings a new and rich set of technologies, features, and services to the Exchange Server product line. New features and functionality in Exchange 2010 support several key concepts:

Flexible and reliable. The pressure to optimize your IT infrastructure to respond to changing business conditions demands agility. Exchange 2010 gives you the flexibility to tailor based on your unique needs and a simplified way to help keep e-mail continuously available for your users.

Anywhere access. Enhancements in Exchange 2010 helps users get more done by helping them to access all of their communications—e-mail, voice mail, instant messaging—from virtually

NOTE: Portions of the information contained in this section were derived from Microsoft. For more information, consult the appropriate manufacturer’s website or guides.

any platform, Web-browser, or device through industry-standard protocols. Managing the flow of information into and out of an individual’s inbox daily can create overload and affect productivity and profitability. In response to this challenge, Exchange 2010 adds new productivity features that can help users more easily organize and effectively prioritize their communications.

Protection and compliance. Exchange 2010 delivers new, integrated e-mail archiving and retention functionality, including granular multi-mailbox search and immediate legal hold.

Exchange 2010 also helps you to better protect your communications and e-mail through central managed information control capabilities. This includes the ability to more effectively intercept, moderate, encrypt, and block e-mail messages. Together, this functionality provides you with a flexible range of protection and control options, whether you want to automatically enforce controls or empower users to implement their own data protection.

For more information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/dd298136.aspx.

1.2.8 NetApp FAS2040 Storage System

NetApp’s common end-to-end Unified Storage architecture makes it possible to expand capacity and add functionality to future TACLAN systems quickly and easily. NetApp FAS2040 systems provide the following:

• Integrated block- and file-level data access over Fibre Channel and Ethernet networks delivers capacity where you need it, when you need it, regardless of user or application

• Primary and/or secondary storage

• Intelligent management software

• Data-protection capabilities of high-end systems with NetApp ease of use

• Internal SATA drives

• Built-in remote management that increases efficiency

NetApp FAS2000 systems provide a powerful range of technologies and features based on Data ONTAP® to help increase storage utilization and the efficiency of your system and storage administrators. These features include the following:

• NetApp Snapshot ™ provides point-in-time images, enabling you to perform near-instantaneous file-level or full data set recovery, and its minimal performance overhead makes it uniquely suited for protecting your production data.

• Thin provisioning helps avoid the costly over provisioning and time-consuming reconfiguration that is typical with other storage solutions.

NOTE: Portions of the information contained in this section was derived from NetApp. For more information, consult the appropriate manufacturer’s website or guide.

• Deduplication enables you to store only one copy of each unique data object, substantially reducing capacity requirements.

• Highly efficient RAID-DP ® protects against multiple failures in a RAID group.

For more information, reference the NetApp website at: http://media.netapp.com/documents/ fas2000.pdf.

2.0 Windows Server 2008 R2 Management

Windows Server 2008 R2 provides a comprehensive set of features that make deploying and managing servers easier. For administration of a single server, Server Manager is an integrated Microsoft Management Console (MMC) that offers a seamless, integrated management experience. In larger enterprises, management of multiple servers can be automated using Windows PowerShell, which consists of a command-line shell and scripting language designed specifically to automate administration tasks for server roles, such as Internet Information Services (IIS) and Active Directory.

For more information, reference http://www.microsoft.com/windowsserver2008/en/us/ server-management.aspx.

2.1 Server Manager

The Server Manager console in Windows Server 2008 R2 eases the task of managing and securing multiple server roles in an enterprise. Server Manager guides administrators through the process of installing, configuring, and managing server roles and features that are part of Windows Server 2008 R2. In Windows Server 2008 R2, a server role describes the primary function of the server. Many of the management consoles used to manage Windows Server 2008 R2 have been updated or completely redesigned to help reduce your administrative effort.

Server Manager replaces several features provided in previous versions of Windows Server, including Manage Your Server, Configure Your Server, and Add or Remove Windows Components. Server Manager also eliminates the requirement that administrators run the Security Configuration Wizard before deploying servers—server roles are configured with recommended security settings by default and are ready to deploy as soon as they are installed and properly configured.

For more information, reference http://technet.microsoft.com/en-us/library/ cc732131(WS.10).aspx.

2.2 Windows Deployment Services (WDS)

Windows Deployment Services, the updated and redesigned version of Remote Installation Services (RIS), is a suite of components that work together on Windows Server 2008 R2 to enable the deployment of Windows operating systems. Windows Deployment Services assists with the rapid adoption and deployment of Windows operating systems. You can use it to set up new computers by using a network-based installation. This means that you do not have to be physically present at each computer, and you do not have to install directly from a CD or DVD.

You can also use Windows Deployment Services to repurpose existing computers.

NOTE: Portions of the information contained in this section was derived from Microsoft. For more information, consult the appropriate manufacturer’s website or guide.

For more information, reference WDS Technology Center at:

http://technet.microsoft.com/en-us/library/cc772106(WS.10).aspx http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=3cb929 bc-af77-48d2-9b51-48268cd235fe

2.3 Managing User Accounts

2.3.1 Create a New Domain User Account

� 1. Open Active Directory Users and Computers, by clicking Start . Click Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, <right-click> the folder in which you want to add a user account.

� 3. Point to New, and then click User .

� 4. In the First name field, type the user’s first name.

� 5. In the Initials field, type the user’s initials.

� 6. In the Last name field, type the user’s last name.

� 7. Modify the Full name field to add initials or reverse the order of first and last names.

� 8. In the User logon name field, type the user logon name, click the user principal name (UPN) suffix in the drop-down list, and then click Next .

� 9. If the user will use a different name to log on to computers running Microsoft® Windows® 95, Windows 98, or Windows NT® operating systems, you can change the user logon name as it appears in User logon name (pre-Windows 2000) to the different name.

� 10. In the Password and Confirm password field, type the user’s password, and then select the appropriate password options.

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc732336.aspx.

2.3.2 Create a New Local User Account

� 1. Open Computer Management.

� 2. In the console tree, click Users .

� 3. On the Action menu, click New User .

� 4. Type the appropriate information in the dialog box.

� 5. Select or clear the check boxes for:

• User must change password at next logon

• User cannot change password

• Password never expires

• Account is disabled

� 6. Click Create , and then click Close .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc770642.aspx.

2.3.3 Disable or Enable Domain User Accounts

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then double-click Active Directory Users and Computers .

� 2. In the console tree, click Users .

� 3. In the Details pane, <right-click> the user .

� 4. Depending on the status of the account, do one of the following:

• To disable the account, click Disable Account .

• To enable the account, click Enable Account .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc753390.aspx.

2.4 Managing Computer Accounts

2.4.1 Create New Computer Accounts

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, <right-click> Computers .

� 3. Point to New, and then click Computer .

� 4. Type the computer name .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc754478.aspx.

2.4.2 Add a Computer Account to a Group

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click Computers .

� 3. In the details pane, <right-click> the computer , and then click Properties .

� 4. On the Member Of tab, click Add .

� 5. In the Enter the object names to select field, type the name of a group that you want this computer to be a member of, and then click OK.

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc733097.aspx.

2.4.3 Delete a Computer Account

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click Computers .

� 3. In the details pane, <right-click> the computer , and then click Delete .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc754624.aspx.

2.4.4 Manage a Remote Computer

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click Computers .

� 3. In the details pane, <right-click> the computer , and then click Manage .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc753432.aspx.

2.4.5 Move a Computer Account

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click Computers .

� 3. In the Details pane, <right-click> the computer , and then click Move .

� 4. In the Move dialog box, <right-click> the domain node .

� 5. Click the folder to which you want to move the computer, and then click OK.

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc731825.aspx.

2.4.6 Reset a Computer Account

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click Computers .

� 3. In the Details pane, <right-click> the computer , and then click Reset Account .

For more detailed information, reference the Microsoft website at:

http://technet.microsoft.com/en-us/library/cc753596.aspx http://go.microsoft.com/fwlink/?LinkId=138388

2.5 Enable and Unlock User and Computer Accounts

� 1. To open Active Directory Administrative Center, click Start ���� Administrative Tools , and then click Active Directory Administrative Center .

� 2. In the navigation pane, select the node that contains the computer account whose status you want to change.

� 3. In the management list, <right-click> the computer whose status you want to change.

� 4. Depending on the status of the computer account, do one of the following:

• To disable the computer account, click Disable .

• To enable the computer account, click Enable .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/dd861339.aspx.

2.6 Locate Active Directory Objects

� 1. To open Active Directory Administrative Center, click Start ���� Administrative Tools , and then click Active Directory Administrative Center .

� 2. In the Active Directory Administrative Center navigation pane, click Global Search .

� 3. You can build a Global Search query using keywords and the available search criteria or by using the Lightweight Directory Access Protocol (LDAP) query mode.

• To build a query using keywords and search criteria, click Normal .

• To search for Active Directory Data by using the LDAP query mode, click Convert to LDAP .

� 4. To adjust the scope of your search query, click Scope .

� 5. To run your query, click Search .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/dd861328.aspx.

2.7 Filter Active Directory Data

� 1. To open Active Directory Administrative Center, click Start ���� Administrative Tools , and then click Active Directory Administrative Center .

� 2. Navigate to the desired organizational unit (OU) by using either the Active Directory Administrative Center navigation pane or management list.

� 3. In Filter field, type keywords for your query, or to add criteria, click Add criteria .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/dd861328.aspx.

3.0 Managing Groups

3.1 Understanding Group Accounts

A group is a collection of user and computer accounts, contacts, and other groups that can be managed as a single unit. Users and computers that belong to a particular group are referred to as group members.

Groups in Active Directory (AD) Domain Services (DS) are directory objects that reside in a domain and in organizational unit (OU) container objects. AD DS provides a set of default groups at installation. It also provides an option to create groups.

You can use groups in AD DS to:

• Simplify administration by assigning permissions on a shared resource to a group, rather than to individual users. Assigning permissions to a group assigns the same access to the resource to all members of that group.

• Delegate administration by assigning user rights once to a group through Group Policy.

You can then add members to the group that you want to have the same rights as the group.

• Create e-mail distribution lists.

Groups are characterized by their scope and their type. The scope of a group determines the extent to which the group is applied within a domain or forest. The group type determines whether you can use a group to assign permissions from a shared resource (for security groups) or use a group for e-mail distribution lists only (for distribution groups).

There are also groups for which you cannot modify or view the memberships. These groups are referred to as special identities. They represent different users at different times, depending on the circumstances. For example, the Everyone group is a special identity that represents all current network users, including guests and users from other domains.

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc733001.aspx.

3.2 Create a New Group

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, <right-click> the folder under which you want to create a new group.

� 3. Point to New, and then click Group .

� 4. Type the name of the new group in the Group Name: field. By default, the name that you type is also entered as the pre–Windows 2000 name of the new group.

� 5. In the Group Scope: field, click one of the options.

� 6. For more information, reference the section Understanding group scope in Understanding Group Accounts.

� 7. In the Group type: field, click one of the options.

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc733146.aspx.

3.3 Add a Member to a Group

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click the folder that contains the group to which you want to add a member.

� 3. In the Details pane, <right-click> the group, and then click Properties .

� 4. On the Members tab, click Add.

� 5. In Enter the object names to select, type the name of the user, group, or computer that you want to add to the group, and then click OK.

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc753515.aspx.

3.4 Convert a Group to Another Group Type

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click the folder that contains the group to which you want to add a member.

� 3. On the General tab, under Group type, click the group type .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc753515.aspx.

3.5 Change Group Scope

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click the folder that contains the group to which you want to change the group scope.

� 3. In the Details pane, <right-click> the group and then click Properties .

� 4. On the General tab, under Group scope, click the group type .

For more detailed information, reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc770766.aspx.

3.6 Delete a Group

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then <double-click> Active Directory Users and Computers .

� 2. In the console tree, click the folder that contains the group to which you want to delete a member.

� 3. On the Details pane, <right-click> the group , and then click Delete .

For more detailed information reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc725992.aspx.

3.7 Find Groups in Which a User is a Member

� 1. To open Active Directory Users and Computers, click Start ���� Control Panel , <double-click> Administrative Tools , and then double-click Active Directory Users and Computers .

� 2. In the console tree, click Users or, click the folder that contains the user account whose group membership you want to view.

� 3. In the Details pane, <right-click> a user account, and then click Properties .

� 4. Click the Member Of tab.

For more detailed information reference the Microsoft website at http://technet.microsoft.com/ en-us/library/cc725681.aspx.

3.8 Assign User Rights to a Group in Active Directo ry Domain Services (AD DS) � 1. To open Group Policy Management, click Start ���� Run , type gpmc.msc , and then click

OK.

� 2. In the console tree, <right-click> Default Domain Controllers Policy , and then click Edit .

� 3. In the console tree, click User Rights Assignment .

� 4. In the Details pane, <double-click> the user right that you want to assign.

� 5. Click Add User or Group .

� 6. If the button appears dimmed, select the Define these policy settings check box.

� 7. Type the name of the group to which you want to assign this right.

For more detailed information, reference the Microsoft website at:

http://technet.microsoft.com/en-us/library/cc754142.aspx http://technet.microsoft.com/en-us/library/cc754217.aspx http://technet.microsoft.com/en-us/library/cc771069.aspx

4.0 Group Policy Implementation

During the TACLAN build, group policy objects are created and implemented automatically.

These pre-defined Group Policy Objects (GPOs) come directly from the Defense Information Systems Agency (DISA) and the United States Special Operations Command (USSOCOM).

Group policy was designed to allow you to easily control the settings and configuration of many machines, reducing your total cost of ownership. It is a very powerful part of the Active Directory that can save you a lot of administrative overhead time. If it is not implemented correctly, it can cost your organization time and resources – fixing what can be huge mistakes!

Group Policy allows you to define user-related policies, as well as network settings, security settings, and machine policies. In addition, you can use Group Policy to manage settings on your servers.

Group Policy was improved with the release of Windows Server 2008 R2. There were hundreds of new policies added, as well as a new Group Policy Management Console. Group Policy is much more powerful, allows for more flexibility, and is easier to administer than previous Microsoft operating systems.

Changing Group Policy is not a simple task, so you should plan your changes very carefully. If you turn on the wrong policy, you can mistakenly prevent your users from accessing the network or prevent an entire unit from opening Microsoft Outlook. Group Policy is very powerful and should be configured with a great level of planning and discussion.

If you plan to change the default Group Policy settings, we recommend reviewing all of the Group Policy settings as a group with your network administrators, help desk, and PC support groups. This is a long process and can drag out, but we will highlight some of the Group Policy settings you may want to make and the reason they are suggested.

4.1 Recommended Group Policy Settings

This is by no means a definitive list. We have made some settings for you to comply with DISA and USSOCOM security standards. Changing these could be considered a breach of security, so you should consult your local Information Assurance office before making any changes. You should review all of the Group Policy settings to see how they fit in your requirements.

There are three categories of group policy settings underneath two broad groups: Computer Configuration and User Configuration. Inside those are Software Settings, Windows Settings, and Administrative Templates.

Policies you apply within Computer Configuration apply to the whole computer (and all of its users) while settings you apply within User Configuration apply to a specific user.

4.2 Group Policy Management Console

Group Policy Management Console (GPMC) is a scriptable MMC snap-in, providing a single administrative tool for managing Group Policy across the enterprise. GPMC is the standard tool for managing Group Policy.

To manage domain Group Policy across an enterprise, you must first install the GPMC. The GPMC consists of an MMC snap-in and a set of scriptable interfaces for managing Group Policy.

The GPMC is included with Remote Server Administration Tools (RSAT), which is available for download at http://go.microsoft.com/fwlink/?LinkId=130862.

RSAT enables IT administrators to remotely manage roles and features in Windows Server 2008 R2. RSAT includes support for the remote management of computers that are running either a Server Core installation or the full installation option of Windows Server 2008 R2.

For help on how to use the console, refer to the Group Policy Management Console article on Microsoft Technet at the following websites:

http://technet.microsoft.com/en-us/library/cc753298.aspx http://windows.microsoft.com/en-US/windows7/Group-Policy-management-for-IT-pros

4.3 Microsoft Group Policy Planning and Deployment Guide

You can use Windows Server 2008 Group Policy to manage configurations for groups of computers and users, including options for registry-based policy settings, security settings, software deployment, scripts, folder redirection, and preferences. Group Policy preferences, new in Windows Server 2008, are more than 20 Group Policy extensions that expand the range of configurable policy settings within a GPO. In contrast to Group Policy settings, preferences are not enforced. Users can change preferences after initial deployment.

Using Group Policy, you can significantly reduce an organization’s total cost of ownership.

Various factors, such as the large number of policy settings available, the interaction between multiple policies, and inheritance options, can make Group Policy design complex. By carefully planning, designing, testing, and deploying a solution based on your organization’s business requirements, you can provide the standardized functionality, security, and management control that your organization needs.

Group Policy enables Active Directory–based change and configuration management of user and computer settings on computers running Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP. In addition to using Group Policy to define configurations for groups of users and computers, you can also use Group Policy to help manage server computers, by configuring many server-specific operational and security settings.

The Group Policy settings you create are contained in a GPO. To create and edit a GPO, use the GPMC. By using the GPMC to link a GPO to selected Active Directory sites, domains, and OUs, you apply the policy settings in the GPO to the users and computers in those Active Directory objects. An OU is the lowest-level Active Directory container to which you can assign Group Policy settings.

To guide your Group Policy design decisions, you need a clear understanding of your organization’s business needs, service level agreements, and requirements for security, network, and IT.