Changes in Functionality from Windows Server 2003 with sp1 to Windows Server 2008
Do I need to change any existing code?
Download 1.83 Mb.
|
- Navigate this page:
- Is this feature available in all editions of Windows Server 2008
- Who will be interested in this feature
- Are there any special considerations
- What new functionality does this feature provide
- Why is this functionality important
- Smart card single sign-on
- How should I prepare for this change
- Per-user encryption of offline files
- What settings have been added or changed
Do I need to change any existing code?No change to existing code is required for BitLocker. How should I prepare to deploy this feature?Prior to enabling BitLocker, you should consider the following: Hardware requirements. If existing hardware is not powerful enough to handle the encryption, consider upgrading. To use the system integrity features, the hardware platform must be equipped with a version 1.2 TPM. Corporate policies. Evaluate your current policies regarding data retention, encryption, and compliance. Ensure that you have a plan for data recovery. How recovery information will be stored. We recommend using Active Directory Domain Services for backups of recovery information in enterprise environments. Is this feature available in all editions of Windows Server 2008?BitLocker is an optional component in all editions of Windows Server 2008, with no difference in functionality between editions. BitLocker is available on 32-bit and 64-bit platforms. BitLocker is available in Windows Vista Enterprise and Windows Vista Ultimate, and can help significantly in protecting data stored on client computers, particularly mobile ones. Additional references For additional information about BitLocker, see BitLocker Drive Encryption: Technical Overview (http://go.microsoft.com/fwlink/?LinkId=77977) and Windows BitLocker Drive Encryption Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkID=53779). Additional articles and resources about BitLocker are available on the Windows Vista Technical Library (http://go.microsoft.com/fwlink/?LinkId=82914). Encrypting File SystemEncrypting File System (EFS) is a powerful tool for encrypting files and folders on client computers and remote file servers. It enables users to protect their data from unauthorized access by other users or external attackers. What does EFS do?EFS is useful for user-level file and folder encryption. EFS was first introduced in the Microsoft® Windows® 2000 operating system, and has been enhanced in subsequent releases of the operating system. Who will be interested in this feature?The following groups might be interested in EFS: Administrators, IT security professionals, and compliance officers who are tasked with ensuring that confidential data is not disclosed without authorization. Administrators responsible for servers or Windows Vista® client computers that are portable. Users who share computers and work with confidential information. Are there any special considerations?Before implementing EFS, administrators should plan for recovery of information in the event that keys or certificates are lost. EFS supports a robust recovery mechanism which includes three major changes in this release of Windows: Key Recovery Agent (KRA) changes Data Recovery Agent (DRA) can now be on a smartcard, which eliminates the need for an offline recovery station and makes remote recovery possible. These first two items are both important changes for the Administrator. The ntbackup tool is no longer included in the operating system. Instead, the Robocopy utility has been added to Windows Server® 2008 and can copy EFS-encrypted files without needing the decryption key. (Copies made in this way will remain encrypted.) The SafeDocs engine supports backup of EFS files in Windows Server 2008. All of these changes can significantly change the deployment plan for EFS. What new functionality does this feature provide?Several important enhancements to EFS are provided in Windows Server® 2008. These include the ability to store encryption certificates on smart cards, per-user encryption of files in the client side cache, additional Group Policy options, and a new rekeying wizard. Smart card key storageEFS encryption keys and certificates can be stored on smart cards, providing stronger protection for the encryption keys. This can be especially valuable to help protect portable computers or shared workstations. Using smart cards to store encryption keys may also provide ways to improve key management in large enterprises. Why is this functionality important?Using a smart card to store the EFS keys keeps those keys off of the hard disk of the computer. This increases the security of those keys because they cannot be attacked by another user or by someone who steals the computer. What works differently?In Windows Server 2008 and Windows Vista, EFS supports the storage of users’ private keys on smart cards. Key cachingUsing Group Policy settings, you can configure EFS to store private keys on smart cards in non-cached or cached mode. Non-cached mode. Similar to the traditional way EFS works, all decryption operations requiring the user’s private key are performed on the smart card. Cached mode. A symmetric key is derived from the user’s private key and cached in protected memory. Encryption and decryption operations involving the user’s key are then replaced with the corresponding symmetric cryptographic operations by using this derived key. This eliminates the need to keep the smart card plugged in at all times or to use the smart card processor for every decryption. It therefore provides a significant increase in performance. EFS also provides policies to enforce “smart card required” and to control the parameters and caching behavior of users’ keys. Smart card single sign-onSmart card single sign-on (SSO) is triggered whenever the user logs on with a smart card and one of the following conditions is true: The user does not have a valid EFS encryption key on the computer, and smart cards are required for EFS by policy settings. The user has a valid EFS encryption key that resides on the smart card used for logon. When SSO is triggered, EFS caches the personal identification number (PIN) entered by the user at logon and uses it for EFS operations as well. Thus the user does not see any PIN prompts from EFS during the session. If the smart card used for the logon is removed from the smart card reader before any encryption operations are performed, Single Sign On is disabled. The user will be prompted for a smart card and PIN at the first EFS operation.
If multiple users share a computer and more than one user tries to use an encrypted, cached copy of a particular file, only the first user to cache the file can access the offline copy of the file. Why is this functionality important?Security is enhanced by the addition of per-user encryption. Previously, any user of the computer could potentially gain access to any file in the offline cache. What works differently?In the past, the encryption was done by using system keys; thus, one user could read the offline files of another user. This situation no longer exists because the encryption is performed with each user's own public key. How should I prepare for this change?Familiarize yourself with the new EFS settings and choose the options that meet your company's specific security needs. Increased configurability of EFS through Group PolicyEFS protection policies can be centrally controlled and configured for the entire enterprise by using Group Policy. A number of new Group Policy options have been added to help administrators define and implement organizational policies for EFS. These include the ability to require smart cards for EFS, enforce page file encryption, stipulate minimum key lengths for EFS, enforce encryption of the user’s Documents folder, and prohibit self-signed certificates. Why is this functionality important?Increased configurability improves the efficiency of administrators by enabling them to configure and control EFS policies on an enterprise scale. What works differently?Additional settings enhance the effectiveness of Group Policy. To find out more, see What settings have been added or changed? later in this topic. How should I prepare for this change?Familiarize yourself with the new EFS settings in Group Policy and choose the options that meet your company's specific security needs. Encrypting File System rekeying wizardThe Encrypting File System rekeying wizard allows the user to choose a certificate for EFS and to select and migrate existing files that will use the newly chosen certificate. It can also be used to migrate users in existing installations from software certificates to smartcards. The wizard can also be used by an administrator or users themselves in recovery situations. It is more efficient than decrypting and reencrypting files. Why is this functionality important?The wizard provides a streamlined, step-by-step process to choose certificates or migrate files. What works differently?Files are not automatically re-encrypted whenever they are opened or updated. The wizard provides the user with a high degree of flexibility. How should I prepare for this change?On a test computer, click Start. In the Start Search box, type rekeywiz, and then press ENTER. This starts the Encrypting File System rekeying wizard and allow you to become familiar with its operation. What settings have been added or changed?In this release of Windows Server 2008, additional EFS options can be managed with Group Policy. The Group Policy settings listed in the following table are available in administrative templates. This table provides a simple description for each setting. For more information about a specific setting, see the Explain tab of each setting in the Group Policy Management Console (GPMC).
You can also use the GPMC or the Local Group Policy Editor (secpol.msc) to configure the following EFS options. To view or change these options, expand the Public Key Policies node, right-click Encrypting File System, and then click Properties. On the General tab, you can configure general options and certificate options. The following general options are available:
In the certificates section, the following options are available:
 Note
All EFS templates in Windows Server 2008, both for user and recovery, as well as self-signed EFS certificates now specify a 2048-bit key length by default. On the Cache tab you can adjust the behavior of the EFS certificate cache. For more information about caching in EFS, click the Learn more about EFS caching link on the Cache tab.
Directory: uploads uploads -> 587 Return function, r i(X) r i(0) r i(1) r i(2) r i(3) 1 0 2 4 6 Thermal Station, I 2 0 1 5 6 3 0 3 5 6 10 uploads -> Department of science and humanities department of mathematics part-a questions and answers uploads -> The Case Against the nypd’s Quota-Driven ‘Broken Windows’ Policing What Is It? uploads -> For want of a nail uploads -> Ownership Models There are two different types of ownership models uploads -> Police Militarization uploads -> City of rising star regular meting thursday, july 14, 2016 uploads -> Township of winfield uploads -> Stop Militarizing Law Enforcement Act of 2014 uploads -> The Black Panther Party’s Ten-Point Program What We Want Now! Download 1.83 Mb. Share with your friends:
|
Important