Guide to the Secure Configuration and Administration of Microsoft ...

More documents

Recommendations

Info

File Description Default Location Recommended Location *.pst Personal %Systemroot% %Systemroot%\Profiles\[username]\Personal folder Suggested name: .pst *.pab Personal %Systemroot% %Systemroot%\Profiles\[username]\Personal address book Suggested name: .pab *.ost Offline folders %Systemroot% %Systemroot%\Profiles\[username]\Personal Suggested name: .ost As a consequence of invoking the “Guide to Secure Microsoft Windows NT Networks”, following these recommendations will ensure that the files inherit appropriate permissions to preclude inadvertent sharing between users. Exchange Client Outlook 97 Οutlook 98 Outlook 98, by default, stores personal folders, address books, and offline folders files in the %Systemroot%\Profiles\\ directory. It is recommended to accept the default location. Appropriate file permissions will be inherited as a consequence of invoking the “Guide to Secure Microsoft Windows NT Networks” to ensure that the files are not inadvertently shared between users. 12
Chapter 3 Administrative Permissions Introduction In addition to the file and directory permissions established at the operating system level, Exchange introduces application level permissions which are the topic of this chapter. The rights associated with a given user are a combination of rights established at the application level and the operating system level. For example, a Windows NT user account with Administrative rights to NT does not necessarily have the appropriate permission within Exchange to administer the Exchange server. These rights must be expressly granted through the Exchange Administrator tool. It is impossible for these guidelines, which are intended for general usage, to expressly detail the exact permissions that should be applied to the plethora of containers and objects contained within the Exchange Administrator tool. Instead, this chapter will focus on some key concepts that should be kept in mind when assigning administrative privileges. Use of Exchange Administrators Account(s) In order to simplify the assignment of administrative rights to the Exchange Server, it is recommended that a separate Windows NT Exchange Administrators Group – or Groups - be established. It is strongly recommended that you do not use the Windows NT administrator group, as it is not necessary to have Windows NT administrative rights for many Exchange administration functions. Having a separate Exchange Administration Group, or Groups, offers several benefits. First, it will preclude the need for Exchange administrators to log in unnecessarily as a Windows NT administrator -- something that should be avoided for security reasons. Second, it will allow you to partition administrative rights. You may reserve the right to reconfigure the Exchange server to a select few, while allowing several individuals to manage mailboxes, for example. And finally, having an Exchange administrator group(s) will simplify the process of managing administrative rights -- adding a new administrator is as simple as making them part of the Exchange Administrator Group. 13
Page 1 and 2: Guide to the Secure Configuration a
Page 3 and 4: Trademark Information Windows NT, M
Page 5 and 6: Table of Contents About the Guide t
Page 7 and 8: Chapter 3, “Administrative Permis
Page 9 and 10: Chapter 1 Exchange Server Installat
Page 11 and 12: separate partition will provide a l
Page 13 and 14: Chapter 2 Client Installation Insta
Page 15: Domain Admins: Full Control SYSTEM
Page 19 and 20: Summary In summary, when assigning
Page 21 and 22: Site Level Server Level The Directo
Page 23 and 24: Server Level At the server level, t
Page 25 and 26: Configuration Use the Windows NT ev
Page 27 and 28: GWS1 (Server) Jack (Client) NT Remo
Page 29 and 30: Summary When connecting servers in
Page 31 and 32: other hosts were detailed in Chapte
Page 33 and 34: Chapter 7 Client Security and “Ad
Page 35 and 36: For each zone, one of four levels o
Page 37 and 38: Respect the concept of least privil
Page 39 and 40: KMS password. It is very critical t
Page 41 and 42: When advanced security is invoked,
Page 43 and 44: ecommended that you follow the guid
Page 45 and 46: “contributor” right (allowing o
Page 47 and 48: Authentication Exchange 5.0 Exchan
Page 49 and 50: Data Confidentiality It is importan
Page 51 and 52: IMAP LDAP allowed authentication me
Page 53 and 54: To control anonymous access: Selec
Page 55 and 56: This issue can be overcome simply b
Page 57 and 58: For recoverability, log files can b
Page 59 and 60: from using the distribution list, t
Page 61 and 62: Revisions: Version 1.1 - Cleaned up

Guide to the Secure Configuration and Administration of Microsoft ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?