IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.93 Planning of a Windows NT network
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Administrators
Windows NT can be implemented in various configurations in a network. To
allow an appraisal and understanding of the advantages and disadvantages of
the individual types of implementation, the security system of Windows NT
needs to be described briefly to start with. In principle, this operating system
retains control of all resources. Users can only access the resources if they
have been granted the corresponding rights and authorisations. Access to the
system is only possible via a valid user account, which can be protected by
means of a password. The security account manager (SAM) is used to
administer information on user and group accounts in the security account
database, often termed SAM database. When a user logs in, the operating
system generates an access token for the user, in accordance with the entries in
the SAM database. The security reference monitor uses this token to check
whether the user is authorised to access certain objects and perform the
required actions (e.g. delete a file or shutdown the system).
Windows NT supports network operations with the following concepts:
1. Workgroups
Computers can be assigned to workgroups and jointly use resources via the
network as part of the peer-to-peer concept (also refer to Module 6.3 Peer-to-
Peer Networks).
Every computer in such a network can be used as a server as well as a
workstation. This is done by sharing resources on the individual computers.
Every Windows NT workstation employed in a workgroup manages its own
SAM database and, thus, its own user and group accounts. The entries in this
database cannot be used by any other computer in the same workgroup. As a
result, central administration is not possible. A password is generally required
to access resources which have been shared.
The main disadvantage of this concept is that it does not allow adequate
control of the rights of individual users. For this reason, the configuration of
workgroups should be avoided wherever possible.
2. Network with a dedicated server
This type of network incorporates a client-server structure. In this case, a
specification is made as to which computers should act as servers and clients
respectively. Servers can share directories and / or printers, and supply
applications such as Mail, Schedule+, Fax on a global basis. In contrast,
clients can only use the resources made available by the servers.
An NT computer can be run on the "Windows NT Server" or "Windows NT
Workstation" operating system. In small networks, a licensed version of
"Windows NT Workstation" can also be operated as a server. Due to licensing
regulations, however, no more than 10 users are allowed to simultaneously log
into this computer via the network. If this limit proves too low, Windows NT
Server needs to be installed. In general, standard users should not be allowed
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000