Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Best way to secure a 2008 R2 DC?

Posted on 2011-03-23
3
749 Views
Last Modified: 2012-06-27
We are a college campus.  We are in the middle of an Active Directory roll-out.  We'd like to configure a domain controller on our student segment, which is separated from faculty and staff by a firewall.  We are considering simply creating a firewall conduit, permitting the student segment DC to communication with the rest of the DC's on the faculty/staff side.  However, we have some questions:
1. If we don't want to use an RODC, or server core installation, are there best practices for securing a full installation of a 2008 R2 DC?
2. The DC needs to be a DNS server as well.  We prefer AD integrated DNS.  Therefore, this means the DC would have a full copy of our faculty/ staff zone since it will replicate with other DC's on that segment.  Are there things we should consider from a security stand point with this configuration?

Goal: accomplish our task according to best practices, and with the most security possible.

If we have to do server core, I'm familiar with how to configure it.  I'm aware of the requirement to use command line tools, however, you should still be able to use ADUC to manipulate it remotely.
0
Comment
Question by:patriots
3 Comments
 
LVL 12

Accepted Solution

by:
Navdeep earned 400 total points
ID: 35202923
Hi,

For securing AD, here is the step by step guide. Not all point would be necessary but this you will find all what you need in this guide.

Best-Practice-Guide-for-Securing.doc
0
 
LVL 42

Expert Comment

by:kevinhsieh
ID: 35203965
My suggestion is to run two or more RODC on the student site. Open the the required ports from the RODCs to your other RW DCs. I don't think that access to the full DNS zone on the RODC is problematic if the firewall blocks communication.

Another option is to setup a separate forest with a one way or two way trust. It depends on what resources you want to make to whom.
0
 
LVL 11

Assisted Solution

by:sighar
sighar earned 100 total points
ID: 35206803
Run the SCW, Security Configuration Wizard! Start-Admin Tools-SCW.
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article runs through the process of deploying a single EXE application selectively to a group of user.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question