http___microsoftguru.com.au_hr_tag_hyper-v__1.xml
1.1 2.1 2.2 2.3 2.4 2.5 3.1 4.1 4.2 4.3 4.4 4.5 4.6 5.1 6.1 6.2 6.3 7.1 8.1 8.2 8.3 8.4 8.5 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 28.2 28.3 28.4 29.1 30.1 30.2 30.3 31.1 31.2 31.3 32.1 33.1 33.2 33.3 33.4 34.1 34.2 34.3 34.4 35.1 36.1 36.2 36.3 36.4 36.5 36.6 36.7 37.1 37.2 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 54.2 55.1 55.2 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 63.2 63.3 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1
Hardening Security of Server- The Bottom Line Securing Servers from internal and external threat is the key aspect of managing and administering Windows Servers. If you carefully design, implement and maintain IT Infrastructure you will have a better night sleep knowing you are safe. There will not be music in the ears of oncall Engineer facing nightmare. So how you accomplish a tight security and control on IT infrastructure without compromising work environment. Here are some tips for you. Infrastructure Firewalls You must have an isolated Head Office network from branch office. You can purchase MPLS or IP WAN service from your ISP. Alternatively you can create site to site VPN using security appliance or application like Forefront TMG 2010. A better design approach would be a multi-tier firewall so that your internal server, DMZ servers and branch servers stay securely connected. You can have specific VLANs for specific servers/services/applications with correct Access Control List (ACL) in Cisco switches and routers. This will add another layer of firewall to the network. Computer based Firewalls In Windows Server 2008 and Windows Server 2012, there is built in firewall. You can configure that built-in firewall for a group of servers or individual server to provide host based firewall. Both Server 2008 and Server 2012 shipped with advanced Firewall and security configuration tools which you can administer through Group Policy object. Intrusion Detection System Another key aspect of firewall is security appliance that provide you to harden security using Intrusion Detection System (IDS) /Intrusion Protection System (IPS). These are third-party Devices or appliance. The IDS helps you monitor network traffic, logs data about the traffic, analyses the traffic based on signatures and anomalies, recognizes potential attacks, and alerts the IT staff to the perceived attack. The IPS does all that, but it also has the capability to react to the perceived attack. IPS is also capable of reacting to an attack based on your configured rules. Server Hardening- The bottom line You execute the following action to stop being hacked or take these actions to prevent hacking - Isolate Administrator Role for individual tasks similar to their job description. - Stopping and disabling all unnecessary services and applications - Renaming the Administrator account - Implement password policy using Default Domain Policy in Group Policy Object - Implement GPO to secure servers and clients - Deleting or disabling all unnecessary user accounts - Use of Service Account to run services and application instead of running services using IT Admin’s generic account and store password to safe location - Create Role Based User Account instead of using user account by user name - Requiring strong authentication and certificates to access applications - Performing regular firmware, operating system and application updates using WSUS or SCCM - Installing renowned Antivirus and Anti-Spyware program and manage them centrally - Document all system configurations and store these documents in safe location - Audit and monitor IT infrastructure regularly to prevent any misconfiguration - Use Read only Domain Controller (RODC) for branch office - Utilize great benefit of Server Core Technology reducing surface attack further - Utilize NPS, NAP and Certificate Servers to secure access to applications and services. FF TMG 2010—Can future be altered? I read the following articles about Microsoft Forefront TMG 2010. I was shocked by the news. TMG 2010 is one of the beautiful product Wintel Engineers and Security Administer can be proud off. I believe I am one of the biggest admirer of Forefront Product lines. The demise of Threat Management Gateway: Is Microsoft backing away from the edge? I would like to voice my own opinion on this matter. I am sure I will find lots of similar minded techie out there who would love to share same opinion as me. I would like to send an open request to Microsoft Corp and MVPs to pursue for an advanced version of TMG that incorporate cloud security and address modern day security challenges. I decided to write on a different perspective of TMG 2010 what I would like to see next service pack of Forefront Threat Management Gateway or in a future version if there is one. This is not an official account of Microsoft Corp. This is just my wish list. I hope and cross my finger that Microsoft will listen to those who are on the field working for a better and even bigger Microsoft community. FF TMG 2010: Here is details of evolution of today’s TMG TMG 2010 can be more advanced in terms Firewall Policy, Publishing Rules and Cloud Security. TMG 2010 may be available in Downloadable virtual Appliance build on Windows Server “Code name 8” and physical appliance through the Microsoft partners program. Microsoft declared TMG 2010 is in sustainable mode and will not invest on TMG for further development so my dream to administer TMG administration console via internet explorer and Silverlight will be just a dream. I would like to see TMG service pack as separate installed and TMG 2010+SP3 integrated together in a installer for those who wants to refresh TMG and adopt as a new customer. Topology and Installation Changes: I would like to see a Hyper-V network incorporated into TMG. As you all know when installing TMG, TMG installer prompt you for subnets of Local area network. The new version will prompt you to add your cloud networks in an installation window. The installer will secure the local area network and private cloud network using default configuration which you will be able to modify and align later on with your desired topology and network layout. Incorporating Cloud Security: clients and partners have serious concern over the years about Service provides who sells cloud solutions. For example, service provider selling Exchange cloud, SharePoint cloud, Anti-Spam and Security Cloud Solution. There are questions to be asked when you buying public cloud solutions. This is not just having a hypervisor and virtual center. what about application security, identity and governance. How would to address your client’s concern of internal threat and external threat. How client will trust a provider when they place their data in somewhere service provider’s cloud. Microsoft can/should/must address these issues by providing Security as a service. Forefront TMG can play a key role if Microsoft is willing take a step ahead to the bottom line. - Application security - Privacy - Legal issues - Availability - Identity management - Compliance - Business Continuity and data recovery - Data Security Firewall Rules: New Publishing Tools in Tasks pan should include - Publish FTP Servers - Publish Lync Server - Publish Streaming Media Server - Secure Cloud Network Configure IM and Social media policy: Web Access Policy Tasks Pan should include - Configure IM Access (Allow/Deny Skype/Lync/MSN/Yahoo Messenger) - Configure Social Media Access (Allow/Deny Social Media such as Twitter/FaceBook/Google+/Youtube) Networks: Network rules incorporate a build-in cloud network and network rules establishing communication from LAN to Cloud network and External to Cloud network. During installation of TMG; allow rules to be configured automatically when selecting Hyper-V Server in DMZ. Multicast NLB Configuration: NLB Properties should be added another check box to create firewall rule for Multicast NLB in a virtualized environment. That means Multicast NLB mac address can communicate within array members in a virtualized environment if there is strict security policy deployed through out the infrastructure. List of New Protocol available: New Protocols includes following protocols and many more: - Cloud Protocols - Lync Protocol - Hyper-v Protocols Generate offline Certificate request: There should be an option to generate offline certificate request in Systems>Tasks pan. Integrating Bing Search with TMG 2014 Cache: Search result cached in TMG from Bing Search Engine and presented to client. Bandwidth Management: TMG should be able to manage bandwidth by single user, multiple users, AD Security groups, IP address, Computer Name, Department, Site, Branch. Configure Branch or Site TMG Server: Option can be selected during installation of TMG 2010+SP3 (integrated installer) whether TMG is a primary site or branch site. Selecting Branch Site will auto configure site server with site to site VPN (if selected) and even replicate with primary sites firewall rules and policies (depending on topology). when installing a branch TMG branch TMG will automatically create branch cache depending on selection of topology . Reporting: Following are the examples of the reports will be available in TMG 2010 SP3. there will be many more. - User based report - AD Security Group Based report - Web Site Visited - IP Address visited - Web/Content Uses report - Download reports by users/Group/Department - Bandwidth Uses report - Caching report - Search Engine Visitor by Search Engine report - Real Time/Custom Traffic report - Traffic Trending report - Top 20 Net users - Top 20 Site Visited - Default Monthly report - Default Yearly report - TMG Health report Audit and Change Management: TMG will include complete change manage and recording of Tasks/Events generated by role based user and systems itself. Role based TMG management: TMG Workgroup Deployment and Domain Member deployment should include RBAC management. - Administrator - Organization Administrator (member of this group manages cluster of Arrays ) - Backup operator (Commvault/Symantec Client/SCDPM client integrated) - Auditor/User (view permission) - Firewall Rules and Web Access Policy Operator - Single or Multiple array administrator Tool Box: Pre-installed BPA, Troubleshooting, Monitoring & Capturing Real Time Traffic. Learn more about TMG here .
1.1 2.1 2.2 2.3 2.4 2.5 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 12.2 13.1 14.1 15.1 16.1 17.1 18.1 18.2 18.3 18.4 19.1 20.1 20.2 20.3 20.4 21.1 22.1 22.2 22.3 23.1 23.2 23.3 24.1 25.1 25.2 25.3 25.4 26.1 26.2 26.3 26.4 27.1 28.1 28.2 28.3 28.4 28.5 28.6 29.1 29.2 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 46.2 47.1 47.2 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 55.2 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1
Klijent Hyper-V u sustavu Windows 8 Klijent Hyper-V u sustavu Windows 8 pruža bogat virtualnu platformu za programere i IT profesionalcima. Možete stvoriti i upravljati virtualnim strojevima pomoću klijenta Hyper-V utjecati na sigurnost, ljestvica, i upravljivost sustava Windows 8 i Server Hyper-V platforme. To je zgodan laboratorij i test okruženje za Wintel inženjera, developera i cloud inženjer. Klijent Hyper-V koristi isti VHD format kao Hyper-V na poslužitelju. Međutim nisu sve značajke dostupne u goli-metal Hyper-V su dostupni u klijent Hyper-V. Podržano Konfiguracija: - Windows 8 32-bitni i 64-bitni operacijski sustavi - Podrška do 32 virtualnih procesora i 512GB memorije - Podrška IDE, iSCSI, Sambu, i USB flash pogoni. - BitLocker šifriranje pogona i Secure Boot - Podrška Drugi prijevod razine (letva) Adresa na x64 računalu - Višestruki ožičen i bežične mreže podrške - 3D, audio, multi-touch, spavanje i hibernacija države - Podrška isti VHD virtualni disk kao goli-metal Hyper-V Možete izgraditi, domaćin, i testirati cijelu infrastrukturu na vašem računalu Admin, a zatim izvoz virtualnih strojeva izravno u proizvodnom okruženju u sustavu Windows Server 2012. Za uključivanje Windows 8 Hyper-V značajka također instalira VM alat za upravljanje zove Hyper-V Manager. - Zadržite miš na desnoj strani gornjem kutu, kliknite Traži, ploča Vid Upravljačka zatim Upravljačka ploča Programi kliknite, a zatim odaberite Programi i značajke. - Odaberite Uključiti značajki sustava Windows ili isključiti. - Kliknite Hyper-V, onda u redu, a zatim Zatvori. Da biste omogućili klijenta Hyper-V u sustavu Windows PowerShell, Otvoreno povišen PowerShell naredbe, upišite sljedeće: Omogućiti-WindowsOptionalFeature-Online-FeatureName Microsoft-Hyper-V Nakon Hyper-V je omogućena, morate isključiti računalo i pokrenite računalo da biste dovršili instalaciju. Vi ćete biti u stanju stvoriti i upravljati VMS kroz Hyper-V Manager ili Hyper-V modul za Windows PowerShell. Također možete koristiti Virtual Connection Machine za udaljeno povezivanje VM. Možete koristiti Sysinternals Disk2vhd VHD konverter za stvaranje i uvesti velike virtualnih strojeva u klijentu Hyper-V za testiranje i eksperimentirati svoju infrastrukturu. FF TMG 2010-Može budućnosti biti promijenjen? Pročitao sam sljedeće članke o Microsoft Forefront TMG 2010. Bio sam šokiran viješću. TMG 2010 je jedan od najljepših proizvoda Wintel inženjera i sigurnost Primijeniti mogu biti ponosni off. Vjerujem da sam jedan od najvećih ljubitelj čelu proizvodnih linija. Gašenje Threat Management Gateway: Je li Microsoft odustaje od ruba? Želio bih izraziti svoje mišljenje o tom pitanju. Siguran sam da ću naći puno sličnog istomišljenika techie vani koji bi rado podijeliti isto mišljenje kao ja. Htio bih poslati otvorenu zahtjev za Microsoft Corp i MVP nastaviti za napredne verzije TMG da se uključi oblak sigurnost i adrese moderne dan sigurnosne izazove. Odlučio sam napisati na drugom perspektive TMG 2010 ono što bih želio vidjeti sljedeći servisni paket Forefront Threat Management Gateway ili u budućoj verziji, ako postoji jedan. Ovo nije službeni račun tvrtke Microsoft Corp Ovo je samo moja želja popis. Nadam se i prijeći moj prst da Microsoft će slušati one koji su na terenu radi za bolju i još veći Microsoft zajednici. FF TMG 2010: Evo detalji evolucije današnjeg TMG TMG 2010 može biti napredniji u smislu Firewall politika, izdavaštvo Pravila i Cloud Security. TMG 2010 možda neće biti dostupne u downloadable virtualnom Appliance graditi na Windows Server "kodnim imenom" 8 i fizičkog uređaja putem programa Microsoft partnerima. Microsoft je proglasio TMG 2010 je u održivom načinu i neće ulagati u TMG za daljnji razvoj tako da je moj san za administraciju TMG upravi konzola putem Internet Explorera i Silverlight će biti samo san. Ja bih volio vidjeti TMG servisni paket kao zasebna instaliran i TMG 2010 + SP3 integriran zajedno u instalater za one koji žele osvježiti TMG i usvojiti kao novog kupca. Topologija i instalacija Promjene: Volio bih vidjeti Hyper-V mrežu uključene u TMG. Kao što svi znamo, kada instalirate TMG, TMG instalater vas pitati za subneta u lokalnoj mreži. Nova verzija će zatražiti da dodate svoje cloud mreže u instalacijski prozor. Instalater će osigurati lokalnu mrežu i privatni oblak mrežu koristeći zadanu konfiguraciju koju će moći mijenjati i uskladiti kasnije sa željenim topologije mreže i izgled. Napravljena Cloud Security: klijenti i partneri imaju ozbiljnu zabrinutost zbog godina o usluga pruža tko prodaje cloud rješenja. Na primjer, pružatelj usluga prodaje Exchange oblak, SharePoint oblak, anti-spam i sigurnosti Cloud rješenje. Postoje pitanja koja se pitao kada kupujete javnih cloud rješenja. To je ne samo da hypervisor i virtualni centar. što je primjena sigurnost, identitet i upravljanje. Kako bi za rješavanje svog klijenta zabrinutost unutarnje prijetnje i vanjske prijetnje. Kako klijent će povjerenje davatelja kad stavite svoje podatke u negdje davatelja usluga oblaka. Microsoft može / treba / mora riješiti ta pitanja pružajući sigurnost kao uslugu. Forefront TMG može igrati ključnu ulogu ako Microsoft je spreman napraviti korak naprijed na dnu liniju. - Primjena sigurnosti - Privatnost - Pravna pitanja - Dostupnost - Upravljanje identitetima - Popustljivost - Kontinuitet poslovanja i oporavak podataka - Sigurnost podataka Firewall Pravila: Novi Publishing Alati u zadacima tavi treba uključivati - Objavi FTP poslužitelje - Objavi Lync Server - Objavi Streaming Media Server - Sigurna Cloud mreža Konfiguracija IM i socijalne medijske politike: Web Access Politika Zadaci Pan bi trebao uključivati - Konfiguracija IM Access (Dopusti / Zabrani Skype / Lync / MSN / Yahoo Messenger) - Konfiguracija Social Media Access (Dopusti / Zabrani Social Media kao što su Twitter / Facebook / Google + / Youtube) Mreže: Mreža pravila ugraditi graditi u oblaku mreže i mrežnih pravila uspostavljaju komunikaciju s LAN Cloud mreže i vanjske Cloud mrežu. Tijekom instalacije TMG; dopuštaju pravila biti konfiguriran automatski kada odaberete Hyper-V Server u DMZ. Multicast NLB Konfiguracija: NLB Nekretnine treba dodati još jedan okvir za stvaranje firewall pravilo za multicast NLB u virtualizirane okoline. To znači Multicast NLB mac adresa može komunicirati unutar polja članova u virtualizirane okoline ako postoji stroga sigurnosna politika raspoređeno kroz iz infrastrukture. Popis novi protokol dostupni: Novi protokolima uključuje sljedeće protokole i mnogo više: - Cloud Protokoli - Lync Protokol - Hyper-V Protokoli Generirajte offline zahtjev certifikata: Tu bi trebao biti opcija za generiranje offline certifikat zahtjev u sustavima> Zadaci tavi. Integriranje Bing pretraživanje s TMG 2014 Cache: Traži rezultat spremljeno u TMG od Bing Search Engine i predstavljen klijenta. Propusnost Uprava: TMG bi trebao biti u mogućnosti upravljati propusnost jednog korisnika, više korisnika, AD sigurnosnih grupa, IP adresa, ime računala, Zavod, lokacija, filijali. Konfiguracija Branch ili web TMG Server: Opcija može biti odabran tijekom instalacije TMG 2010 + SP3 (integrirani instalater) da li TMG je primarni sajt ili grana stranica. Odabir Branch Site će automatski konfigurirati web-poslužitelj s mjesta do mjesta VPN (ako je odabrana), pa čak i ponoviti s osnovnim nalazišta firewall pravila i (ovisno o topologiji). prilikom instaliranja podružnice TMG podružnice TMG automatski će se stvoriti poslovnicu cache memorije, ovisno o izboru topologije. Izvješćivanje: Nakon što su primjeri izvještaja će biti dostupan u TMG 2010 SP3. tu će biti mnogo više. - Upute temeljen izvješće - AD Security Group Based izvješće - Web stranica Posjetio - IP adresa posjetio - Web / Sadržaj Koristi izvješće - Preuzmite izvješća od strane korisnika / grupe / Zavod - Propusnost Koristi izvješće - Caching izvješće - Search Engine Posjetitelj po Search Engine izvješću - Real Time / Custom Izvješće o prometu - Promet Trendovi izvješće - Top 20 Neto korisnici - Top 20 stranica Posjetio - Zadani Mjesečni izvještaj - Zadani Godišnji izvještaj - TMG Zdravlje izvješće Reviziju i upravljanje promjenama: TMG će uključivati kompletnu promjenu upravljanje i evidentiranje Zadaci / događanja generiranih uloga na temelju korisnika i sustava sama. Uloga temelji TMG upravljanje: TMG Workgroup Deployment i Domena Član implementacija bi trebala uključiti rbac upravljanje. - Upravitelj - Organizacija administrator (član ove skupine upravlja grozd Razvrstati) - Backup operater (CommVault / Symantec Client / SCDPM klijent integriran) - Revizor / Korisnik (pogled dozvolu) - Firewall Pravila i Web Access Politika Operator - Jedan ili više polja Administrator Alat Box: Unaprijed instalirana BPA, rješavanje problema, nadgledanje i hvatanje Real Time Traffic. Saznajte više o TMG ovdje .