LIFECYCLE OF IT PROFESSIONAL

LIFECYCLE OF IT PROFESSIONAL

Advanced Settings of TCP/IP in Windows Server 2003. Very Important

In this article I will walk you through the Advanced TCP/IP settings dialog and its relevant tabs, so that you can better understand what each option is used for and how to configure it.

Windows 2003 comes with a number of new features for TCP/IP, including support for IP Version 6, automatically determining the Interface and Gateway metric, and the Alternate configuration tab which allows you to specify an alternate IP Address to use in absence of a DHCP server (before APIPA kicks in).

The Advanced TCP/IP dialog will allow you to configure settings relative to DNS, WINS and specify multiple IP Addresses and Gateways (which can even be used if you only have one network card on the machine).

To bring up the Advanced TCP/IP Settings dialog, simply right click the desired connection from the Network Connections folder, and choose properties to open the Properties dialog of the selected connection. Now select Internet Protocol (TCP/IP) from the list and click the Properties button. This will open the Internet Protocol (TCP/IP) Properties dialog. Next, click the Advanced button and up pops the Advanced TCP/IP Settings dialog with four tabs to choose from:

IP Settings – Allows you to add more IP Addresses or change the routing properties of the network card.

DNS – Allows you to set how the TCP/IP connection uses DNS.

WINS – Allows you to set how the TCP/IP connection uses WINS for computers that can't access Active Directory.

Options – Allows you to set TCP/IP Filtering and specify which ports will be used for TCP/IP communication.

Advanced TCP/IP Settings – The IP Settings Tab

The IP addresses box at the top allows you to assign additional IP Addresses to a single network card. This is useful if you are hosting multiple websites on the same web server and want to give each its own IP Address for example.

Simply click the Add button to add an IP Address and Subnet Mask. Click Edit to modify the currently selected item and Remove to delete the currently selected item from the list.

Figure 1: The IP Settings Tab

The Default gateways box in the middle is used if you want the network connection to use multiple default gateways. Click the Add button to add a Default gateway and assign it a Metric value. A metric value is the cost of a specific route. Cost can reflect speed, reliability and number of hops. The route with the lowest metric value is used, so if you have two Default Gateways set up, one with a metric of 10 and the other with a metric of 20, the one with 10 will be chosen first. Leaving the metric at automatic means that the route metric for this default gateway will be calculated automatically, and the fastest route chosen.

Note: If you fire up the Command Prompt and type "route print" with no quotes, the IP Routing table is displayed with the metric value listed as one of the properties of each IP Address and its associations.

The Edit and Remove buttons in the Default gateways box do exactly the same as for the IP addresses box (explained above).

At the bottom of the IP Settings tab you can set whether you want the Interface to have a specific metric or to be assigned one automatically. By default this option is checked. Uncheck it if you wish to input an Interface metric value of your choice.

Advanced TCP/IP Settings – The DNS Tab

The "DNS server addresses, in order of use box" at the top of the DNS tab is used to list the IP Addresses of the DNS Servers that will be used for name resolution. These servers are ordered and used in priority, meaning if one server does not work then it will move to the next one down the list. To set the order of IP Addresses, select an IP Address and press the up and down button on the right hand side.

It is important to keep in mind that TCP/IP will not move on to the next server if it fails to resolve the request. It will only move to the next server if the first server it tries is unavailable (perhaps down for maintenance or in the middle of a reboot).

Append primary and connection specific DNS suffixes, and Append parent suffixes of the primary DNS suffix are enabled by default. These options are used for resolution of unqualified names.

The first option is used to resolve unqualified names using the parent domain. For example, if you had a computer name of "andrew" and a parent domain called ztabona.com it would resolve to andrew.ztabona. com. The query would fail if andrew.ztabona. com does not exist in the parent domain. The second option is used to resolve unqualified names using the parent-child domain hierarchy. A DNS query will move one step up the domain hierarchy if it fails at the current level. It will do this until it reaches the root of the hierarchy.

If you have an environment which consists of a client machine forming part of multiple domains then you can add a bunch of domains to the Append these DNS suffixes (in order) list so these will be searched as part of the DNS query, instead of using the parent domain.

Figure 2

The textbox on the right of the DNS suffix for this connection is used to explicitly set a DNS suffix that will override any other setting already specified for this connection.

Register this connection's addresses in DNS will register all this connection's IP Addresses in DNS under the computer's FQDN. Using this connection's DNS suffix in DNS registration will register all IP Addresses for this connection in DNS under the parent domain.

Advanced TCP/IP Settings – The WINS Tab

The WINS tab is used to specify WINS related settings such as the list of WINS servers to be used for NETBIOS name to IP resolution, the LMHOSTS file to be used as an alternate means of lookups and the NETBIOS settings for the network connection.

Pre-Windows 2000 machines and applications use NETBIOS to IP name resolution. If you have a Windows 2003 machine that acts as a file or print server and any client machines want to communicate with it, you will have to make use of NETBIOS. It is unlikely that you will have no pre-Windows 2000 machines on your network but if you do, then go ahead and disable NETBIOS over IP; you'll save on memory and CPU consumption and free up resources.

Use the "WINS addresses, in order of use box" at the top to add the WINS servers you want the system to use for IP to name resolution. Press the Add button for a small dialog box to appear waiting for you to enter the IP Address of the WINS server. Use the Edit and Remove buttons to modify or delete a selected item respectively. If you have more than one WINS server in the list, press the up and down arrow buttons to adjust the priority of which servers will be queried first. If one server is not available then the next one down will be used, and so on and so forth.

Figure 3

Check the Enable LMHOSTS lookup checkbox so that if WINS cannot resolve a name then the local LMHOSTS file will be used. The LMHOSTS file can be found in \WINDOWS\system32\ drivers\etc. It goes by the name of lmhosts.sam and can be modified in a text editor. Entries are placed at the bottom of the file and when used, the listed IP Addresses are matched against a specified host name. If you already have an LMHOSTS file defined on another machine on the network, use the Import LMHOSTS button to select this file and import it to the local machine.

The NETBIOS settings at the bottom allow you to explicitly define how NETBIOS will be used on the system. Choose Default if you want the DHCP server to assign the NETBIOS setting, Enable NETBIOS over TCP/IP if you use a static IP Address or the DHCP Server does not give NETBIOS settings, and Disable NETBIOS over TCP/IP if you do not use NETBIOS or WINS on your network.

Advanced TCP/IP Settings – The Options Tab (TCP/IP Filtering)

The Options tab allows you to configure TCP/IP Filtering settings; you can define which ports or protocols are permitted. Select the Permit Only radio button and use the Add button to add TCP/UDP port numbers or a protocol version to the respective list. If you permit traffic only from a defined set of ports, all other traffic will be dropped.

Figure 4

Conclusion

This article has given you an overview of Advanced TCP/IP settings in Windows 2003. Knowing what each option is and how it can be used should definitely be a great plus when configuring network communication.

Configuring Windows Server 2003 to act as a NAT router

More years ago than I care to think about, IP addresses were handed out to companies on an indiscriminant basis. As the popularity of the Internet increased, IP addresses soon grew to be a scarce commodity. Internet service providers began to strictly limit the number of IP addresses that they would lease to companies. This presented an interesting challenge. A PC has to have an IP address in order to communicate with the Internet, but there weren't enough IP addresses left for every PC to be given one. The solution to this problem was a technology called Network Address Translation (NAT). Today, NAT is alive and well, and more popular than ever. In this article, I will explain what NAT is and how you can configure Windows Server 2003 to act as a NAT router.

What is NAT?

So what is NAT? Network Address Translation, or NAT, is a technology that uses a router to share an Internet connection among the PCs on your private network, even though those PCs do not have a valid public IP address. There are both hardware and software NAT routers. In this particular situation, we will be configuring a Windows Server 2003 machine to act as a software based NAT router.

As you probably know, a router's primary purpose is to regulate traffic flow between two networks, and a NAT router is no exception. The server that you will use as a NAT router must have two network interface cards (NICs) installed. One of these NICs will connect to the Internet and the other will connect to the private network. PCs on the private network will then send HTTP requests to the NAT server via the server's private network connection. The server will then retransmit the request over the Internet on behalf of the client. When the requested Web site responds, the response is sent to the NAT server, which in turn forwards it to the client who made the original request. The client never communicates across the Internet directly.

IP Addressing Considerations

As I explained in the section above, a NAT router acts as a gateway between your private network and the Internet. The server that is acting as the NAT router must have two NICs. One of the NICs is connected to the Internet. This NIC must be assigned the IP address that was given to you by your Internet Service Provider.

The other NIC connects to your private network. As I mentioned, NAT does not expect you to have valid IP addresses on your private network. Instead, you are basically free to pick an address range at random. There is the off chance that the range that you pick might already be in use by a popular Web site, but I have only seen someone pick an address range that caused problems once. If you want to use an address range that is guaranteed not to interfere with anything on the Internet, you can use the 192.168.x.x address range.

After you pick an address range, I recommend setting up a DHCP server so that it will assign addresses from your chosen address range (the DHCP term for an address range is a scope) to the workstations on your network. You must however statically assign an address to the NIC on the NAT server that connects to your private network. For example, if you chose to use the address range 192.168.1.0 to 192.168.1.99, then you might consider assigning the address 192.168.1.0 to the NAT server. You could then use the 192.168.1.1 to 192.168.1.99 address block as your DHCP scope.

While you are configuring your DHCP server, there are a couple of other considerations that you need to make. As you may know, DHCP allows you to optionally assign a default gateway and a DNS server to workstations along with an IP address. When doing so, you must set the default gateway address to match the private network address that you assigned to your NAT server.

You have a few different options when choosing which DNS server address the DHCP server should assign to the workstations on your network. If you don't have your own DNS server, then the best thing that you can do is to just use the IP address of your Internet service provider's DNS server. If your network is running Active Directory though, then you already have a DNS server and you should use its address. It doesn't matter if your DNS server is authoritative for your domain or not. Simply point the workstations to it. You can then set up a forwarder on the DNS Server so that any unresolved queries get forwarded to your ISP's DNS server.

The advantage to pointing clients to your own DNS server rather than to your ISP's DNS server is that doing so will provide your users with better performance. Your DNS server is local, so queries reach the server more quickly than they would reach a remote server. Furthermore, your DNS server has a built in cache so that popular Web sites do not have to be resolved each time a user visits them.

Setting Up NAT

Begin by selecting the Routing and Remote Access command from Windows' Administrative Tools menu. When you do, Windows will display the Routing and Remote Access console. Locate your server (just below the Server Status). There should be a big red dot to the left of the server, indicating that the server is currently inactive. Now, right click on the server and select the Configure and Enable Routing and Remote Access command from the resulting shortcut menu. When you do, Windows will launch the Routing and Remote Access Server Setup Wizard.

Click Next to bypass the wizard's Welcome screen. You will now see a screen that's similar to the one that's shown in Figure A. This screen allows you to select various configurations for Routing and Remote Access (RRAS). RRAS can be configured to do just about anything that you want, but Microsoft has included several templates to make the configuration process easier for common deployment types. Select the Network Address Translation (NAT) option and click Next.

Figure A: Select the Network Address Translation (NAT) option and click Next

The next screen that you will see, shown in Figure B, is a rather important one to pay attention to. The screen gives you the choice of selecting a network interface that is connected to the external network (usually the Internet) or to select a demand dial interface. In case you are wondering, demand dial is a feature that allows Windows to establish a dial-up connection when ever external connectivity is needed. For the purpose of this article, I am assuming that you have a broadband connection to the Internet. Additionally, I am assuming that the NIC that the broadband connection comes in through has a static IP address assigned to it. You will have to select that network interface.

Figure B: Select the NIC that connects the server to the outside world

Before you click Next, you should notice that there is a check box that allows you to enable a firewall for the connection. I recommend always selecting this option. The firewall will keep unwanted traffic out of your network. If you need to grant external users access to some service on your network, you have the option of configuring port forwarding to pass packets through the firewall to the desired network resource.

After you enable the RRAS firewall, click Next and you will see a screen asking you to select the network that will have shared Internet access. Although the dialog box uses some weird wording, it is basically just asking you to select the NIC that is attached to your private network. Make your selection, and click Next, followed by Finish to complete the process.

Conclusion

In this article, I have explained how you can use a NAT server as a way of sharing an Internet connection among the users on your network. I then went on to explain how IP addressing should be configured and how to configure RRAS to act as a NAT router.

VPN Implementation over PPTP. Very important MCSE Article

Introduction

Although VPN's are considered as an extension of a private network, in reality they are nothing close to the equivalent of a private network. This is so because you can't compare physically connected devices in a closed environment to a remote connection.

Some advantages of a VPN connection are as follows:

• Expensive long distance leased lines are not required, thus lowering costs
• Compared with alternatives, it is relatively easy to setup on both the client and server side
• Flexibilty; for the simple reason that you can connect to a VPN server from anywhere in the world that has internet access.

However, it does have a couple of disadvantages, namely:

• If a fast and reliable internet connection is not available then the performance of the VPN connection can be negatively effected. Unfortunately, this is something out of the organization' s control
• Due to all the encryption that takes place, although compressed, one may notice a slight decrease in speed.

A VPN is composed of two parts:

VPN Server

The VPN Server is the machine that accepts VPN connections from VPN clients. A VPN server provides remote access connections or router-to-router VPN connections. In Windows 2003, this can be setup from the RRAS (Routing and Remote Access Server) Administrative Tool.

VPN Client

The VPN Client can be the remote user who wishes to connect to the VPN Server to establish a session on the network. The interface required by the VPN Client can be that of a dial-in modem or a dedicated connection to the internet (ADSL for example).

The diagram below illustrates the basic anatomy of a typical VPN connection.

The cloud in the middle signifies the public intranet, which in the case of a dedicated connection to the internet interface, the VPN client uses to connect to the server.

A step-by-step guide

The following is a step-by-step guide of how to setup a client based VPN connection using the Point to Point Tunneling protocol.

The first thing you must do is right click the My Network Places icon and select Properties.

This will bring you to the Network Connections window which displays a list of your current network connections. Double click the New Connection Wizard icon.

You are faced with three options - choose the second one, "Connect to the network at my workplace" and click Next.

Now choose the second option, "Virtual Private Network connection" and click Next.

This will bring you to the window in which you should enter the name of the company or server you will be connecting to. After you have typed the name in, press Next.

This will bring you to the following window in which you must enter the host name or IP address of the VPN server. Tip: Entering the IP address is recommended (the IP address can be obtained from the server administrator) .

And finally, the "Connection Availability" window will allow you to select who is authorized to use the VPN connection. "Anyone's use" will permit anyone who logs onto the system to use the connection, whereas "My use only" will limit it's use to you only.

Once you click Next and Finish, your new connection will be visible in the Network Connections window (as seen below).

Right click the new connection and select properties to open the properties window. Here, you can configure, amongst others, the network settings and general options.

Select the Networking tab and in the "Type of VPN" drop down list, choose PPTP VPN. It is not necessary to configure any other options on this page, unless otherwise specified by the VPN server administrator.

File and Printer Sharing for Microsoft Networks is the service required for you to be able to share files and printers once a connection has been established to the organizational network.

Now move onto the Options tab. You are able to configure dialing and redialing options on this page.

If you are using the same logon at your company network as you are for the VPN server, then select the "Include Windows logon domain" check box.

Go to the security tab and verify that the screen looks like the one below. Only select the first check box if the local computer you are logged on to has the same log on account and password as the account you have on the VPN server.

If you select the General tab you can change the IP or Host Name of the VPN server and select whether or not you want another connection to be established first before initiating the VPN connection. You would do this if, for example, you had an ADSL connection you wanted to connect to first before dialing into the VPN server.

Press OK to close the window and return to the network connections window.

If you double click your VPN connection the logon window will appear.

Enter your username and password and click Connect.

After the authentication process is complete, you will be logged on to the VPN Server and two computers will appear at the bottom right hand corner of your screen (default).

Congratulations! You have now successfully been connected to the VPN server.

This was just one of the ways of utilizing the VPN connectivity service offered by Microsoft Windows 2003.
With it's latest operating system, Microsoft has either introduced or bettered a broad range of services which are intended to make the life of the system's administrator easier. The idea is for it to be more efficient, reliable and scalable while providing good, all round functionality. RRAS, for example, has been improved and provides great possibilities for companies who wish to implement a demand-dial router, a multiprotocol router or a remote access server.

SYSTEM And PERFORMANCE MONITORING IN WINDOWS SERVER 2003

SYSTEM & PERFORMANCE MONITORING IN WINDOWS SERVER 2003

The performance monitor, or system monitor, is a utility used to track a range of processes and give a real time graphical display of the results, on a Windows 2003 system. This tool can be used to assist you with the planning of upgrades, tracking of processes that need to be optimized, monitoring results of tuning and configuration scenarios, and the understanding of a workload and its effect on resource usage to identify bottlenecks.

Bottlenecks can occur on practically any element of the network and may be caused by a malfunctioning resource, the system not having enough resources, a program that dominates a particular resource. In fact, 40% network utilization is considered a bottleneck.

Using perfmon will help to identify these bottlenecks and allow you to take action.

It can be opened by navigating to the performance icon in the administrative tools folder in the control panel, from the start menu or by typing perfmon.msc in the run box.

System Monitor

Adding a counter

Right click anywhere on the graph and choose Add Counter.

The Add Counter box consists of the following options:

• Computer: The source system of the object. You can choose to select the local computer or another computer on your network - type \\computer_name in the appropriate box.
• Object: The subsystem of interest. This refers to the virtual part of the computer that you want to monitor. Memory, Processor or Network Interface, for example.
• Counter: The aspect of performance of interest. This refers to what parts of the object you want to monitor - they differ depending on the object.
• Instance: The specific object to be measured when multiple objects of the same type exist on a single system. For example, if you go to the Process performance object, the instances list will display all the active processes on the specified computer.

The above image shows the Add Counters window.

System monitor properties

Right click anywhere on the graph and choose Properties. This brings up the System Monitor Properties window that will allow you to customize the appearance and settings. You can change the view to graph, report or histogram style, the monitoring time interval and the colour of the counter lines, amongst others.

The above screenshots shows the general tab of the system monitor properties.

Using the monitor for network related performance.

The performance monitor can be a great tool to help with investigating the performance of your network. You are able to monitor things such as the Network Interface, TCP, UDP packet flow, terminal services sessions, and ICMP, amongst others. You can then compare the collected data and keep it as a record or use it for problem analysis.

In my example I have chosen to use the Network Interface as the performance object.
The following counters were added:

Current Bandwidth – to display the amount of bandwidth the network interface has.
Packets/Sec – to display the amount of packets transferred per second.
Bytes Total/Sec – to display the total amount of bytes per second.

The image below displays a graph of network activity that took place within the space of five minutes. The purple line represents the number of packets per second, the yellow line represents the total bytes per second and the light green line shows how much bandwidth is available.

To simulate this activity I navigated to a share on another computer on the network and browsed through the folders.

Performance Logs and Alerts

With the use of logs you are able to capture data that you can analyze later. Logged counter data information can be exported to spreadsheets and databases for future review and reporting. Alerts allow you to set an action that will be performed when specified counters reach a given value. These actions include sending a network message, executing a batch file, recording an item in the application log of the event viewer, and to start logging performance data.

You can use Alerts to send out warnings when disk space is running low or when network or level of CPU utilization poses a risk.

Logs

There are two types of logging features:

• Counter Logs: are used to record the measurements of specific counters
• Trace Logs: are used to record memory and resource events.

The above image displays the counter log window that allows you to specify which counters should be monitored. The schedule permits you to set the start and stop time of logging. Go to the Log Files tab if you want to customize the name, size and location of the log file.

The above displays the trace log window which allows you to change what events will be logged by the system provider. Click `Provider Status' to bring up a window that will show what system trace log providers and available and their current status. If you wish to add non system providers then select that option and press Add. You can run the this process as a different user, type the username in the Run As box and press the Set Password box to enter the password of the user.

Keep in mind that the more events you choose to log the more space will be required, especially if you choose page faults.

Alerts

Right click anywhere on the white screen and choose "New Alert Setting" to bring up the properties window for a new alert. In my example I have set it to monitor the packets received errors and if they exceed three then an alert will be triggered. The schedule tab gives you the option to set the start of stop times of the scan.

The image above shows the alert properties box.

Apart from bottlenecks slowing down the entire system, they do not allow you to take full advantage of your network infrastructure. Using the performance monitor on your Windows Server will help you identify where the problem is coming from. If this tool is used with correct configuration and planning to suit your network environment then the administrator can benefit from being able to tackle problems in less time, therefore making the situation more efficient.

SYSTEM & PERFORMANCE MONITORING IN WINDOWS SERVER 2003

SYSTEM & PERFORMANCE MONITORING IN WINDOWS SERVER 2003

The performance monitor, or system monitor, is a utility used to track a range of processes and give a real time graphical display of the results, on a Windows 2003 system. This tool can be used to assist you with the planning of upgrades, tracking of processes that need to be optimized, monitoring results of tuning and configuration scenarios, and the understanding of a workload and its effect on resource usage to identify bottlenecks.

Bottlenecks can occur on practically any element of the network and may be caused by a malfunctioning resource, the system not having enough resources, a program that dominates a particular resource. In fact, 40% network utilization is considered a bottleneck.

Using perfmon will help to identify these bottlenecks and allow you to take action.

It can be opened by navigating to the performance icon in the administrative tools folder in the control panel, from the start menu or by typing perfmon.msc in the run box.

System Monitor

Adding a counter

Right click anywhere on the graph and choose Add Counter.

The Add Counter box consists of the following options:

• Computer: The source system of the object. You can choose to select the local computer or another computer on your network - type \\computer_name in the appropriate box.
• Object: The subsystem of interest. This refers to the virtual part of the computer that you want to monitor. Memory, Processor or Network Interface, for example.
• Counter: The aspect of performance of interest. This refers to what parts of the object you want to monitor - they differ depending on the object.
• Instance: The specific object to be measured when multiple objects of the same type exist on a single system. For example, if you go to the Process performance object, the instances list will display all the active processes on the specified computer.

The above image shows the Add Counters window.

System monitor properties

Right click anywhere on the graph and choose Properties. This brings up the System Monitor Properties window that will allow you to customize the appearance and settings. You can change the view to graph, report or histogram style, the monitoring time interval and the colour of the counter lines, amongst others.

The above screenshots shows the general tab of the system monitor properties.

Using the monitor for network related performance.

The performance monitor can be a great tool to help with investigating the performance of your network. You are able to monitor things such as the Network Interface, TCP, UDP packet flow, terminal services sessions, and ICMP, amongst others. You can then compare the collected data and keep it as a record or use it for problem analysis.

In my example I have chosen to use the Network Interface as the performance object.
The following counters were added:

Current Bandwidth – to display the amount of bandwidth the network interface has.
Packets/Sec – to display the amount of packets transferred per second.
Bytes Total/Sec – to display the total amount of bytes per second.

The image below displays a graph of network activity that took place within the space of five minutes. The purple line represents the number of packets per second, the yellow line represents the total bytes per second and the light green line shows how much bandwidth is available.

To simulate this activity I navigated to a share on another computer on the network and browsed through the folders.

Performance Logs and Alerts

With the use of logs you are able to capture data that you can analyze later. Logged counter data information can be exported to spreadsheets and databases for future review and reporting. Alerts allow you to set an action that will be performed when specified counters reach a given value. These actions include sending a network message, executing a batch file, recording an item in the application log of the event viewer, and to start logging performance data.

You can use Alerts to send out warnings when disk space is running low or when network or level of CPU utilization poses a risk.

Logs

There are two types of logging features:

• Counter Logs: are used to record the measurements of specific counters
• Trace Logs: are used to record memory and resource events.

The above image displays the counter log window that allows you to specify which counters should be monitored. The schedule permits you to set the start and stop time of logging. Go to the Log Files tab if you want to customize the name, size and location of the log file.

The above displays the trace log window which allows you to change what events will be logged by the system provider. Click `Provider Status' to bring up a window that will show what system trace log providers and available and their current status. If you wish to add non system providers then select that option and press Add. You can run the this process as a different user, type the username in the Run As box and press the Set Password box to enter the password of the user.

Keep in mind that the more events you choose to log the more space will be required, especially if you choose page faults.

Alerts

Right click anywhere on the white screen and choose "New Alert Setting" to bring up the properties window for a new alert. In my example I have set it to monitor the packets received errors and if they exceed three then an alert will be triggered. The schedule tab gives you the option to set the start of stop times of the scan.

The image above shows the alert properties box.

Apart from bottlenecks slowing down the entire system, they do not allow you to take full advantage of your network infrastructure. Using the performance monitor on your Windows Server will help you identify where the problem is coming from. If this tool is used with correct configuration and planning to suit your network environment then the administrator can benefit from being able to tackle problems in less time, therefore making the situation more efficient.

WORKING WITH MAIL SERVER ON WINDOWS SERVER 2003

WORKING WITH MAIL SERVER ON WINDOWS SERVER 2003

Introduction

This tutorial will help you to install and set up a few email accounts,by using the built-in POP3 Service in Windows Server 2003. I will assume you have basic knowledge about the Windows Server family and Mail Servers, but I have tried to make this tutorial as easily comprehensible as possible. The tutorial has been tested on Windows Server 2003 Enterprise Edition but should also work on Windows Server 2003 Standard Edition. I will not cover MX records and other similar things in this release.

To follow this tutorial you need a stand alone server. You can of course use a Domain Controller, but that assumes you understand when to not follow the tutorial and use other settings (i.e. authentication method).

Install the Email Server

You can install the Email Server by using Add or Remove Windows Components or Manage Your Server. In this tutorial we will use the latter, because it's the quickest way to get this up and running. Manage Your Server is a bit easier to use too, because it will prompt you for the domain you want to use during setup. That will not Add or Remove Windows Components do, and we have to do everything manually.
If it's not open, start Manage Your Server by clicking Start->Programs->Administrative Tools->Manage Your Server.

• Click on Add or remove a role.

This will start the Configure Your Server Wizard. Read the text and make sure you have connected all the necessary cables and all the other things it says you should do before continuing.

• Click Next

The wizard will now detect your network settings. This will take a while depending on how many network connections you have

We now come to the step where we add and remove roles for our server. We will add the Mail Server role. I also suggest that before you click Next, click Read about mail servers because this tutorial is not a complete reference.

• Click Mail server (POP3, SMTP)
• Click Next

You will now specify the type of authentication and type the email domain name. In this tutorial we will use Windows Authentication, and I will use my domain name, ilopia.com. You should of course use your domain name.

• Click Next

Next step is to confirm the options you have selected.

• Click Next

The installation will start, and will also start the Windows Components Wizard. When you get prompted to insert your Windows Server 2003 CD-ROM into your CD-ROM drive, do so. If you didn't get prompted to do that, you maybe already have it in the drive. Hopefully within some minutes you get this screen:

You can now see the log, click view the next steps for this role, or click Finish. Do whatever you feel you want to do before continuing.

• Click Finish

You have now successfully installed the mail server, congratulations!

Configure the Email Server

So, it is no fun with a mail server installed, if we can't use it. And to use it, we have to configure it. This section will help you configure the mail server.

• Click Start, then run, and type p3server.msc

This will open up the POP3 Service. This is where you configure and manage the POP3 part of the mail server.

• Click on in the left pane
• Click on Server Properties in the right pane

This brings up the Properties for our Mail Server.

As you can see, we have a lot of settings. We will use the standard setup in this tutorial, but I will explain every setting we can change in case you want to change something in the future.

Authentication Method

There are three different authentication methods you can use; Local Windows Accounts, Active Directory Integrated and Encrypted Password File. It is an important decision which method to use, because once you have chosen, you must delete all email domains on the server to change method (from now on, you can migrate Encrypted File user accounts to AD, but nothing else can be migrated).

• Local Windows Accounts
  If your server is stand alone (not member of an Active Directory domain), and you want to have the user accounts on the same local computer as the POP3 service, this is the best option. By using this option, you will use the SAM (Security Accounts Manager) for both the email user accounts, and the user accounts on the local computer. This means that a user can use the same user name and password to be authenticated for both the POP3 service and Windows on the local computer. But there is a limitation, although you can host multiple domains on the server, there must be unique user names for all domains. So, let us say you have two users named Sandra. One working at company1.com and another one working at company2.com. Their user name used will be sandra@company1. com and sandra@company2. com. But in SAM, they will both have the same user name, sandra, so one of them must be renamed to something else (if we don't want them to read each other's emails).
  
  If you create the user account when you create the mail box (by using the POP3 interface), the user will be added to the POP3 user group. Members of this group are not allowed to logon locally. The fact that the users are added to the POP3 group does not mean that you must be a member of this group to have a mailbox. You should however be careful adding mailboxes to users that are not member of the POP3 group, because the password used for email can for example be sniffed (if you are not using SPA), or someone can brute force the password and gain access to the server.
  
• Active Directory Integrated
  You can select this option if the server is a member of an Active Directory domain or is a Domain Controller. By using this you will integrate the POP3 Service with you AD domain. AD users can use their user name and password to send and receive email. Of course you have to create mailboxes to them first. Unlike Local Windows Accounts you can use the same user name on different domains. So sandra@company1. com and sandra@company2. com will have different mailboxes. There is however one thing you should know about, that does not affect the mailbox name and email-name, and the pre-Windows 2000 user name can be changed. Active Directory do not support the same pre-Windows 2000 user name, and this name is usually the same as the user name, which means that if you create a mailbox and user with the same pre-Windows 2000 user name, it will rename the pre-Windows 2000 user name.
  
• Encrypted Password File
  This is the option you want to select if you don't use Active Directory or don't want to create users on the local computer. Like Active Directory Integrated you can have the same user name on different domains, but you cannot assign the same user name to several mailboxes within the same domain.
  This method works by creating an encrypted file stored in each user's mailbox. This file contains the password for the user. When the user wants to check his/her email, the password that the user supplies is encrypted and compared to the one in the file.
  It is possible to migrate Encrypted File user accounts to AD user accounts.
  

Server Port

I strongly recommend that you use port 110 because this is the standard port for the POP3 protocol. If you change this, make sure you notify all users so they can configure their email clients to use this other port. Also make sure you restart the POP3 service if you change this.

Logging Level

Four options to choose between. If you change this, remember that you must restart the POP3 service.

• None
  Nothing is logged.
• Low
  Only critical events are logged.
• Medium
  Both critical and warning events are logged.
• High
  Critical, warning and informational events are logged.

Root Mail Directory

If you don't want to use the default Mail Directory, you can choose another one. Make sure the path is not more than 260 characters and you can also not store to the root of a partition (i.e. C:). It is strongly recommended that you use a NTFS formatted partition. You can't use a mapped drive, but the UNC name (\\servername\ share) can be used. If you later change the store, and there are still emails in one or more boxes, you must manually move the folders in which there are emails to the new location. You must also reset the permissions on the directory by using winpop set mailroot.

SPA

Enable SPA if you want to have a secure communication between your email sever and email clients. This will send both the user name and password encrypted from the client to the server, instead of sending it in clear text. SPA supports only Local Windows Accounts and Active Directory Integrated Authentication. It is recommended to use this. Remember to restart the POP3 service if you change this.

Create a mailbox

The Setup Wizard created a domain to us, so we do not need to create this manually. If you did not use Manage Your Server to install, add the domain manually be clicking the server name in the left pane and then click New domain in the right pane. Remember to set the properties before you add the domain.

• Click on your domain (ilopia.com in my case) in the left pane.
• Click Add Mailbox in the right pane.

This will open up the Add Mailbox window.

• Write bob in Mailbox Name
• Write bob as password (of course this is not a password you should use in a production environment, it's too short)
• Click OK

A message will pop-up and tell you how to configure the email clients. Read this, and notice the difference when using SPA or not.

• Click OK

What we just did was not only creating a mailbox named bob, but we also created a user bob. We will also create a mailbox for an existing user - ariel. To do that we simply perform the same steps, but we uncheck Create associated user for this mailbox. Remember that the mailbox name must be less then 21 characters (64 for Encrypted Password File and Active Directory). Periods are allowed to use, but not as the first or last character.

So, we have now two users. Are they equally? No, bob is a member of the POP3 Users group, which is denied to logon locally. Ariel is not member of this group, and can still logon locally and access her mailbox.

Configure the SMTP Server

Actually, that's it! It is this simple to configure the POP3 part. But it is not yet working as we want, we have to configure the SMTP part to be able to receive and send emails. Yes, I said receive emails. A common mistake is to think that the POP3 server receives the emails. But that is not true, all the POP3 is doing is `pop' the emails out to the clients. It's the SMTP server that is communicating with other SMTP servers and receives and sends emails.

• Open Computer Management
• Expand Services and Applications, expand Internet Information Service
• Right click Default SMTP Virtual Server and click Properties
• Click the Access tab
• Click the Authentication button and make sure Anonymous Access and Integrated Windows Authentication is enabled.
• Click the Relay button and make sure Allow all computers which successfully. .. is enabled and Only the list below is selected.

First of all, Authentication and Relay is not the same thing. We use the Authentication button to specify which authentications methods are allowed for users and other SMTP servers. So enabling Anonymous here is not a security issue, in fact, it's required if we want our server to be able to receive emails from other servers on Internet (I doubt you want to tell all administrators of email servers on Internet how they should logon to yours). We also need Windows Authentication so the email clients can authenticate to the server and be able to relay (send emails).

As Relay Restrictions we selected Only the list below because we do not want to be used by spammers to send emails. But we never specified any computers. That is valid, because we wants our clients to always use the username and password to authenticate, no matter where they are.

If you want users to only be allowed to relay if they are on a private network, then you can uncheck Windows Authentication as allowed authentication method, and specify the IP range for your network in the Relay Restrictions window.

Is that all? Do we have a working email server now? Well, the answer is yes. But we still haven't configured the email clients.

Configure the email client

We will use Outlook Express as email client.

• Start Outlook Express (any computer that is connected to the email server)
• Click Tools and then Accounts
• Click the Add button and select Mail

A wizard starts. Use the following table to complete the wizard:

Display name	Bob
E-mail address	bob@ (bob@ilopia. com)
Incoming mail server is a	POP3
Incoming mail server	(ilopia.com)
Outgoing mail server	(ilopia.com)
Account name	bob@ (bob@ilopia. com)
Password	bob
Remember Password	Checked
SPA	Unchecked

Are we finished now? Well, let us try to send an email. Didn't work, did it? I'm sure you got an error message similar to this one:

The message could not be sent because one of the recipients was rejected by the server. The rejected e-mail address was 'webmaster@ilopia. com'. Subject 'Test', Account: 'ilopia.com' , Server: 'ilopia.com' , Protocol: SMTP, Server Response: '550 5.7.1 Unable to relay for webmaster@ilopia. com', Port: 25, Secure(SSL): No, Server Error: 550, Error Number: 0x800CCC79

The reason why we got this is written in the error message. "Unable to relay for ". This means that we didn't get authenticated to the SMTP server. So, let us take a look at the email client's settings again.

• Click Tools, then Accounts.

This will bring up this window:

• Click the correct account and then the Properties button
• Click the Servers tab
• In the Outgoing Mail Server section enable My server requires authentication.
• Click Apply, click OK, click Close
• Create a new email, and send it

And hopefully you will receive an email within some minutes (if you sent it to your own email account).

Enable SPA

Of course we want our network as secure as possible, so we prefer to use SPA (Secure Password Authentication) . This will, as stated before, send the user name and password from the client encrypted, instead of clear text.

• Click Start, then Run
• Type p3server.msc
• In the right pane, right click your computer's name and click Properties
• Check the box Require Secure Password Authentication. ..
• Click OK
• You will be prompted to restart the Microsoft POP3 Service, click Yes

We must also change some settings for the email clients.

• Start Outlook Express
• Click Tools, click Accounts
• Click the Mail tab, click the name of your email account, click Properties
• Click the Servers tab, and click Log on using Secure Password Authentication
• Change the account name from bob@ to bob
• Click Apply, click OK