Win2k Server questions

[Alex]

we upgraded our server box and put 2k server on it this weekend, (used to be xp, don't ask why..lol... anyway its just a file server really)

there are 3 folders on the c drive that have to be shared and they are shared with full control for everyone but when the client machines try to access them it asks for a password... even though 'save password' is checked, it still makes you enter the password after every reboot and this is getting really tiresome... is thre any way to disable the password completely?
the clients are wxp boxes.... oh and there's 2 win98se boxes and the password doesn't even work on those cause it doesn't let you enter the user name, just asks for a password and the same one that works on the xp boxes won't work on 98... this sucks when the server was windows xp it never asked for passwords...

 

[FlyingPenguin]

If you were only file sharing to a few computers, you were probably better off leaving it setup with WinXP. I hope you installed Win2K server and not Small Business Server 2000. SBS2000 is a nightmare to setup for someone who's not familiar with it. Also you can't access shares on an SBS2000 server from Win98 without installing the SBS client software on the 98 clients and setting them up to access a domain server.

I assume you're the designated office IT person, but that's not your main job there? You've just made your life a LOT more difficult. Win2K Server is a LOT harder to administer. It's also a MAJOR security risk installed right out of the box. Right off the bat, you'd better lock down IIS (Internet Information Services) or you're likely to have your server taken over by hackers (less of a risk if you're behind a NAT router, but still a risk). There are literally dozens of services you need to secure in Win2K server in order to keep it from being hacked AND you need to install the latest Service Pack and Security Updates.

I also hope you aren't using the server for anything other than sharing files. You do not want ANYONE doing casual web browsing on the server - the last thing you need is to pickup a spyware trojan on that box.

Your old WinXP install was probably running in simple networking mode so you were not required to setup accounts for each user that accesses the server (this would also have been very insecure BTW). Win2K server by default requires you to setup a user account for each user, and specify their privaledges as well as specify the share permissions for each shared resource. Win2K also installs with Active Directory enabled by default which is a dream for a tech savy administrator, but a nightmare for someone who doesn't know how to use it.

To complicate matters it sounds like you may have some WinXP Home systems on your network. XP Home is not designed to be used on a secure LAN (you're supposed to use XP Pro) and does NOT save passwords when you logon on to a server so yes, you need to re-enter the password every time you boot up.

If your clients are running XP Pro then you're probably using mapped drives on those clients. There's a bug in XP Pro that causes it to fail to prompt to save a password when accessing a mapped drive the first time. The simple fix is to browse the server using the network path instead of the mapped drive (go to Network Neighborhood, find the server, try to open a share on it, get prompted for the password and there should be a checkbox to save the password). Again, please be aware that WinXP Home will NOT do this.

The 98 systems are more difficult. As you are aware, the XP systems can log on to a server using a different username than the one that's logged onto the actual computer (I might be logged in as Bob on my XP Workstation and there may not be a Bob user on the server, but XP will ask me for a valid username and password for the server and then always use that username to access shares on that server).

You can't do that in 98. 98 can ONLY access the server shares using the username you're logged onto the 98 system under. So if I'm logged on to the 98 box as Bob then you MUST create a Bob user account on the server. The password on the 98 system also needs to be the same as the one for that account on the server.

Frankly it sounds like you're in way over your head if you weren't aware of these issues before upgrading to Win2K server.

One quick fix that I hesitate to mention is to enable the Guest account on the server and make sure all shared folders are shared to EVERYONE with read/write access. HOWEVER, be aware that this leaves your server COMPLETELY unsecure (however since your original XP install was almost certainly wide open as well, you won't be too much worse off than you were before - except that even behind a router I'd be VERY leary of leaving a Win2K server box wide open).

The RIGHT THING to do is to bring in an IT Tech to setup the network PROPERLY and securely.

I see this all the time. I get a call from a small business that setup their own server with no idea of what they were getting into, and then call in someone like me to bail them out when it all goes to hell in a hand basket. Better to spend the $70 an hour up front to have someone come in and do it right in a couple of hours, than pay the same guy to come in and fix the mess later which can cost you MUCH more when you find out some Russian hackers have taken over your box and loaded it up with porn, and maybe copied some of your customer's personal information from your files.

 

[Alex]

hey, you were right on a couple assumptions but not all... i switched to w2k server not SBS... and the reason we changed from xp is because we are adding some new boxes and there would be a total of 12 instead of the 8 we have now and xp can't handle more than 10 connections afaik.

the win98 boxes aren't that big of an issue because they will get replaced with xp ones in the next few weeks.

i already have sp4 and all windows updates on the server so i don't think its too unsafe right now. i'll have to look into those services though.

the server is never touched so casual webbrowsing isn't an issue.

there's no xp home machines they are all xp pro and they stopped asking for passwords after a couple tries so i guess that's ok, i'm still having problems sharing our DSL connection through the server though.

whereas i AM the 'IT guy' here i am not really qualified and am somewhat over my head, yes... i work for my dad and have been building computers and fixing other computer-related problems but i'll be the first to admit i know very little about setting up a server etc.

so i guess the password question is ok, but what about sharing the internet? (ICS is enabled on the DSL connection) and the workgroup works fine but just not internet sharing.
also what services should i secure?

thanks for any help!

 

[PlatinumGold]

Originally posted by: franguinho
hey, you were right on a couple assumptions but not all... i switched to w2k server not SBS... and the reason we changed from xp is because we are adding some new boxes and there would be a total of 12 instead of the 8 we have now and xp can't handle more than 10 connections afaik.

the win98 boxes aren't that big of an issue because they will get replaced with xp ones in the next few weeks.

i already have sp4 and all windows updates on the server so i don't think its too unsafe right now. i'll have to look into those services though.

the server is never touched so casual webbrowsing isn't an issue.

there's no xp home machines they are all xp pro and they stopped asking for passwords after a couple tries so i guess that's ok, i'm still having problems sharing our DSL connection through the server though.

whereas i AM the 'IT guy' here i am not really qualified and am somewhat over my head, yes... i work for my dad and have been building computers and fixing other computer-related problems but i'll be the first to admit i know very little about setting up a server etc.

so i guess the password question is ok, but what about sharing the internet? (ICS is enabled on the DSL connection) and the workgroup works fine but just not internet sharing.
also what services should i secure?

thanks for any help!

on the Internet stuff, in network connections, lan properties, put the server ip address (which should be static btw) as the first dns server and get a dns server address for you isp and put that in as your secondary dns server. also, your server will probably be setup as your gateway.

if it is just win2k server you shouldn't have ISA.

also, if you have either a nat box with dhcp or you have dhcp enabled on your server you don't need ics.

 

[Alex]

tried putting server ip as first dns and nothing changed

 

[FlyingPenguin]

As Platinum mentioned, if you have a NAT router (and you should - it's MUCH easier) you don't need ICS. Just connect the router to the network, leave DHCP enabled, and let all the computers (including the server) detect IP and DNS automatically (you may want to eventually setup the IP and DNS manually just as a backup so if the router fails, so you don't lose the network - that's what I usually do at small offices).

If you continue to use ICS through the server, I hope the server is behind a firewall. You DO NOT want the server sitting directly on a broadband connection without some kind of NAT router or firewall in between.

It's good that you have SP4 and all updates, but you still need to secure the server.

If you have standard edition server 2000 then you probably don't have ISA installed (not IIS to lockdown) unless it was installed seperately. If it's Advanced server then I believe it's installed by default and you need to disable IIS or you will have an unsecured FTP, HTTP and SMTP server running (and the FTP server will be wide open).

IIS Lockdown tool here: http://www.microsoft.com/technet/security/tools/locktool.mspx

Some good Win2K server security tips here: http://labmice.techtarget.com/articles/securingwin2000.htm

Some deeper stuff here:
http://www.intranetjournal.com/articles/200501/ij_01_04_05a.html

Hope this helps...

 

[Alex]

thanks for all the replies, specially flyingpenguin! :beer:
what ended up happening was i replaced the new 2k server with the old xp server and everything is working as it was before the ill-fated upgrade attempt...
so the 2kserver box is sitting in a corner now and i'm gonna read up on everything properly before trying this again. there was a lot of pressure to get this done asap and that's why i rushed into it but this morning's hassle was an example of why i should take my take to do this seeing as really i'm just a guy that knows more about computers than the average joe

so, our setup as is has the broadband directly connected to the server, the server to a hub and all other computers to the hub. i only started working here 4 weeks ago so i'm not responsible for the current setup but needless to say its obviously totally vulnerable because there's nothing in between the broadband and the server. it's been like that for as long as anyone can remember apparently... which is pretty worrying...

so if i got a router with NAT i could just use that instead of the hub and connect the broadband directly to the router right?
this would also eliminate the need for 2 NICs in the server... and also, if the server shuts down for whatever reason everyone will still retain internet access... a much better setup right?

also, would there by any advantages in using 2003 server instead of 2000? considering its just a file-server... for now... are there any new features or security enhancements that would justify the upgrade?

thanks!

ps - this whole experience has taught me, amongst other things, that despite my dad's trust and my past success managing small home networks and fixing everyone's computer... i should get some kind of training and certification before trying more ambitious stuff like managing a small company's network

 

[FlyingPenguin]

If you continue using ICS at least enable the WindowsXP firewall on the server.

Even though you may be exceeding 10 users, you can probably continue using your XP box (assuming it's running XP Pro). The 10 user limit generally doesn't apply when doing simple peer-to-peer file sharing and most users usually aren't using a network share all the time.

Server 2003 is a lot easier to setup (and a lot more secure out of the box) than Server 2000, but I don't know if you want to go to the expense if you've already paid for Server 2000. First time you boot 2003 you get a wizard that asks you what tasks the server will perform and only enables the features you're using (sounds like the only one you'll enable is file sharing).

If you bought a regular DSL/Cable Router (they are all NAT routers) at Office Depot, you would connect the DSL modem to it and then the router would connect to the hub/switch. If everyone is setup to obtain IP and DNS automatically you're good to go (you'll probably have to force everyone to re-aquire an IP address when you install the router, or just reboot all the computers).

With a NAT router yes, you could shut down the server for maintenance and no one would lose Internet access. Yes you could lose the 2nd NIC on the server too.

You want to proceed slowly. Network administration is a whole new level. On the other hand it sounds like you have the basics under your belt and this could be a great learning experience. Nothing like hands on.

Something else I should mention is data backup. What are you doing for backups? You should be backing up your data (just your data) daily on tape or (preferably) DVD media.

For a small business I recommend using CD or DVD media (DVDs are so cheap now you might as well). You can store nearly 9Gb on a DVD standard in compressed format and nearly 18Gb on a dual layer DVD (although dual layer media is still rather pricey). For most small businesses, 9Gb is plenty. DVD is a cheaper solution than tape, and unless you're backing up monstrous amounts of data, more convenient. DVD also lets you do archives which is more problematic with tape.

I like to use Stomp's Backup MyPC software. This app DOES NOT run on a server OS however, so you need to install it, and your DVD burner, on one of the workstations, and backup the shared folders from there. Another good app that does run on a server OS is NTI's BackupNow!

What I recommend is use a rewritable DVD for Monday thru Thursday. Then Fridays use a DVD+R to make a permanent archive backup, and file that backup away. You'll have an archived backup for each week. WHY? Because if you do only daily re-writable backups, you can easily find yourself in a situation where your oldest backup is only a week old, but you realize someone deleted an important file a month ago.

Remember to TEST your backups regularly - actually run a restore operation on a backup disc once in a while (don't need to recover all the data, just several test files) and restore them to a separate folder (don't overwrite any actual files you're using) just to make sure you can read the backup. Also you should check your backup log every day to make sure it worked, and there were no errors. Remember that is anyone leaves a shared file open on their workstation, the backup will skip that file because it can't backup files that are in use.

As noted earlier I said to only backup DATA daily. There is absolutely no reason to backup the entire hard drive. What you should do is make a Norton Ghost image backup your server's hard drive. It's a good idea to do this anytime any major changes are made to the server. In a disaster scenario, you can restore the hard drive from the Ghost image (so instead of spending all day re-installing Windows, drivers, and setting up all the user accounts and shared, your OS can be restored in just a 30 minutes or so. Then you can restore your latest data backup. Viola! You're up and running again in 1 hour instead of 1 day or more.

Also while you're setting up your server, if it doesn't have a RAID 1 Mirror hardware right now, you might want to consider it. Don't bother with a software mirror - use a disk controller that supports RAID 1 (if you bought a server box from Dell or some other OEM vendor it probably has onboard RAID otherwise you can buy a RAID controller card).

You want to set this up now - it's difficult to change an existing OS to a RAID setup.

 

[Alex]

Thx for another really informative post!

As far as the RAID setup goes it shouldn't be too tough cause I built the comp myself and made sure i bought a mobo with SATA RAID, although at the time I couldn't get any SATA drives at decent prices (i live in brazil).

so i have a question concerning what you said about wxp pro and the 10 connections limit... it doesnt really apply to simple file sharing?? cause if that's true then i might as well format the 2k server machine and set up xp there and mimic the old config (with a firewall and better backup routines that is)... there really is no good reason for 2kserver to be installed since we're not using any of the server features anyway right?

the main reason to upgrade is that the old server is a sempron2200 with 512mb ram (480 really cause of shared video) and a 30gb HD .... yeah i know it sucks...the guy that set it up is the same one that set up the internet with no firewall ...ive only been here a few weeks and i'm gradually trying to improve the entire IT infrastructure... the new server i built is an athlon64, 1 gig ram, 160gb HD so i think its a worthwhile upgrade, although i'm skeptical as to how much of that processing power will actually be needed to just share files...

you keep mentioning a NAT router.. what's the difference between that and a 'regular' router?
since all we use is a 24port HUB i was considering getting a firewalled switch and using the DSL modem's own routing mechanism (its a new kind im sure youve heard of it) and replacing the hub.... is that a good idea?

 

[PlatinumGold]

Originally posted by: franguinho
Thx for another really informative post!

As far as the RAID setup goes it shouldn't be too tough cause I built the comp myself and made sure i bought a mobo with SATA RAID, although at the time I couldn't get any SATA drives at decent prices (i live in brazil).

so i have a question concerning what you said about wxp pro and the 10 connections limit... it doesnt really apply to simple file sharing?? cause if that's true then i might as well format the 2k server machine and set up xp there and mimic the old config (with a firewall and better backup routines that is)... there really is no good reason for 2kserver to be installed since we're not using any of the server features anyway right?

the main reason to upgrade is that the old server is a sempron2200 with 512mb ram (480 really cause of shared video) and a 30gb HD .... yeah i know it sucks...the guy that set it up is the same one that set up the internet with no firewall ...ive only been here a few weeks and i'm gradually trying to improve the entire IT infrastructure... the new server i built is an athlon64, 1 gig ram, 160gb HD so i think its a worthwhile upgrade, although i'm skeptical as to how much of that processing power will actually be needed to just share files...

you keep mentioning a NAT router.. what's the difference between that and a 'regular' router?
since all we use is a 24port HUB i was considering getting a firewalled switch and using the DSL modem's own routing mechanism (its a new kind im sure youve heard of it) and replacing the hub.... is that a good idea?

xp with shared drives allows 10 simultaneous connections. anyone beyond the 10th user that tries to connect will be denied or they will bump off one of the users that were already there. 10 is the limit but it's 10 sultaneous, not 10 people on the network but 10 on the share.

 

[FlyingPenguin]

Let me make one correction: You MAY already have a router built-into your DSL modem. Most of the newer modems in my area are combo DSL modem and NAT routers. You can find out easily by checking the IP address assigned to the server's NIC connected to the modem. If it's an address normally used for local LAN networks (192.168.x.x or 10.0.x.x) then it has a built in router. In which case all you need to do is just connect it directly to the main hub or switch and let all the computers get an IP and DNS addresses from the router's DHCP server.

As for the 10 user limit, as Platinum pointed out, a lot depends on how you use your shared resources. If more than 10 people are using shared folders at the same time (maintaining a connection with an open file - say an Excel file or a Word file) then you'll have problems. A lot of small businesses I service however - although they may have more than 10 users - don't actually run into the 10 user limit because not everyone is using shared files all the time.

It would definately be preferable if you upgraded to a Server OS if you intend on having more than 10 users on the network, but you may find (at least for the short term) that you can get away with using the XP Pro box for now.

If so then you can setup the new server at your leisure, test it, and then when you're ready to switch, copy your data over and try it out.

Any off-the-shelf home/small business DSL/Cable router will be a NAT router. Old school habit of mine to specify NAT router, but ther are other router types out there.

If you're using a hub right now and not a switch it would be a good idea to replace the hub with a switch - more efficient. I would also recommend a switch with a Gigabit port for the server (you don't need gigabit ports for anyone else unless you're transferring very large files all the time ) and if your server doesn't have a gigabit NIC on it, they're cheap. This will keep the server's bandwidth from getting saturated (probably not necessary for casual file sharing, but if you're running a large database off the server it'll improve performance).

A firewalled switch isn't cheap, and unless you're running an office with steep security requirements (like a medical office) probably overkill. They also require a LOT of administration to use proeprly. Being behind a NAT router is a must though. The router will take you computer's IP off the Internet and will also stealth most of your important ports to prevent someone from taking an interest in you using a port sniffer.

 

[Alex]

thanks again! this has been a really informative thread for me and i'm sure i'll keep coming back to it as i work on gettin our small office network/server up and running securely!

 

[PlatinumGold]

Originally posted by: franguinho
Thx for another really informative post!

As far as the RAID setup goes it shouldn't be too tough cause I built the comp myself and made sure i bought a mobo with SATA RAID, although at the time I couldn't get any SATA drives at decent prices (i live in brazil).

so i have a question concerning what you said about wxp pro and the 10 connections limit... it doesnt really apply to simple file sharing?? cause if that's true then i might as well format the 2k server machine and set up xp there and mimic the old config (with a firewall and better backup routines that is)... there really is no good reason for 2kserver to be installed since we're not using any of the server features anyway right?

the main reason to upgrade is that the old server is a sempron2200 with 512mb ram (480 really cause of shared video) and a 30gb HD .... yeah i know it sucks...the guy that set it up is the same one that set up the internet with no firewall ...ive only been here a few weeks and i'm gradually trying to improve the entire IT infrastructure... the new server i built is an athlon64, 1 gig ram, 160gb HD so i think its a worthwhile upgrade, although i'm skeptical as to how much of that processing power will actually be needed to just share files...

you keep mentioning a NAT router.. what's the difference between that and a 'regular' router?
since all we use is a 24port HUB i was considering getting a firewalled switch and using the DSL modem's own routing mechanism (its a new kind im sure youve heard of it) and replacing the hub.... is that a good idea?

All basic Soho Internet Routers are NAT routers. NAT = Network Address Translation.