Security FAQ

• In Windows XP, how do I use the password reset disk?

• With Windows XP, how do I set a password hint?

• Lost Passwords

• When I start the Recovery Console, why doesn't the system prompt me for a password?

• How can I prevent users from changing their passwords except when Windows 2000 prompts them to?

• Why doesn't my computer prompt me for a password when it returns from hibernation?

• Quantum Key Distribution: The Future of Security?

• How can users change their passwords from the command line?

• I've entered a password for a Terminal Services Client Connection. Why does the system continue to prompt me?

• How can I configure the system to let users change their passwords without logging on to the domain?

• How do I reset a machine account password?

• How can one protect against password hackers that use sniffers like l0pht?

• How can one detect that users have cracked a password?

• Are SQL Server userid's and passwords passed in clear on the network?

• How can I disable trust password changes?

• How can I change the password change for computer/trust accounts?

• Password policies assigned to an OU/site GPO do not work.

• What does System Key actually protect my passwords from?

• How do I enable strong password filtering?

• How can I check the security of my passwords?

• How do I avoid having to enter the Key Management password?

• How do I enable plain text passwords with the telnet server in Windows 2000?

• I've forgotten the sa password for SQL Server - what can I do?

• How can I change the local Administrator passwords on machines without going to them?

• How do I change my password?

• How can I execute a batch file using WINAT with Administrator Permissions?

• How can I stop my Windows 9x clients having to enter a separate Windows password when logging onto a domain?

• How do I recover a lost administrator password?

• How can I disable the "Save Password" option in dial-up networking?

• Why use access control?

• Data security - a management responsibility

• Standardization - a question of security

• Operating systems and security functions

• Password theft

• Passwords

• Pre-authentication and authentication

• Floppy boot protection

• Full hard disk encryption

• Access to DOS

• Single point signon

• BIOS password

• BIOS protection of the Master Boot and System Boot Sectors

• Protecting important files

• Config.sys and Autoexec.bat

• SWITCHES /N /F

• Access to the diskette drive or CD-ROM

• Controlling printer ports

• Controlling COM ports

• Screen savers

• Network integration

• Protocol versus file based network installation

• Boot Prom and encrypted hard disks

• Time control

• Controlling applications in Windows

• Choosing the encryption type

• Encryption keys

• Encryption algorithms

• Security systems

• Smartcard technology

• Smartcard operating systems

Security

• Why use access control?
  How can I restrict access to objects from Anonymous accounts?

• How can I enable auditing of base objects?

• How can I configure my system to be C2 compliant?

• How do I enable auditing on certain files/directories?

• How can users change their passwords from the command line?

• How can I change the ticket lifetime used by Kerberos?

• How can I clear the pagefile at shutdown?

• Why doesn't my computer prompt me for a password when it returns from hibernation?

• How can I configure the system to stop when the security log is full?

• How can I enforce an Internet access control policy?

• How can I copy files and keep their security and permissions?

• How can one detect that users have cracked a password?

• What is a digital signature and how does it work?

• How do I set what happens during a crash?

• Why does an EAP-TLS resumed session generate error 691?

• How do I enable auditing?

• How can I restrict guest access to Event logs?

• How is the long term key between a client and the KDC distributed?

• What is Kerberos?

• How do I disable LanManager challenge/response in NT?

• How can I stop viruses from sneaking past Norton AntiVirus?

• How can one protect against password hackers that use sniffers like l0pht?

• A description of Permissions in NT. Permissions in NT.

• What is PKI?

• How can I prevent users from changing their passwords except when Windows 2000 prompts them to?

• What does System Key actually protect my passwords from?

• How can I enable users to set the Administrator password during a Remote Installation Services installation?

• How can I restore the default permissions to the NT structure?

• How do I enable auditing on the SAM?

• What are secret keys?

• How do I use the Security Configuration and Analysis snap-in?

• Where are the Security event ID's listed?

• How do I view/clear the security log?

• How can I check the security of my passwords?

• I�ve heard about possible security problems with the new wireless networks. Is this rumor true? What do you think of these networks?

• How do I use the System Key functionality of Service Pack 3?

• How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?

• How is the shared key used by Kerberos distributed?shared key

• What is a SID (Security ID)?

• How do I enable SMB signing?

• How do I enable strong password filtering?

• How can I enable strong protection on shared system objects?

• How do I remove the System Key functionality of Service Pack 3?

• What security mailing lists exist for keeping up to date?

• How can I stop a Windows 2000 upgrade overwriting special security settings?

                                                      Active Directory

• How do I configure Group Policy to apply folder redirection settings to users who access the local network remotely?

• How can I replicate log-on scripts between Windows 2000 and Windows NT 4.0 domain controllers?

• Why can't I use my user principal name to change my password if the Global Catalog is unavailable? 

• How can I stop password changes from being pushed to the PDC FSMO over WAN links? 

• I have several sites connected over a VPN. How should I configure my site links?

• In a Windows 2000 domain, how can I configure the site name information known to member servers and workstations? 

• How can I use the registry to configure Group Policy update times? 

• How can I add employee IDs and employee numbers to Active Directory?

• I heard that more than one utility is available to defragment the Active Directory database. Is this true? 

• I cancelled a domain controller demotion. Why can't I demote the domain controller now? 

• Why can't I create a Kerberos-based trust between two domains in different forests? 

• Why has my user group person icon's hair gone gray? 

• I've upgraded one of my Windows NT 4.0 DCs to Windows 2000. Why do all of my Win2K Professional clients use the Win2K DC for authentication? 

• Why is size of the ntds.dit file different on different domain controllers? 

• How do I publish a shared folder in Active Directory?

• How do I modify the Active Directory's garbage-collection period?

• Somebody told me that a tool in the Microsoft Windows 2000 Resource Kit lets you view and modify the Active Directory (AD) schema. However, I can't find any information about where to find the tool or how to use it. Can you help? 

• How does ntdsutil know it's in Directory Restore mode?

• How can I move the Active Directory log files?

• How can I move the ntds.dit file?

• How do I remove Active Directory (AD) if the demotion failed?

• How can I restrict Active Directory (AD) replication traffic to a specific port?
  How do I restore Active Directory?

• How do I reset a machine account password?
  How do I tune Active Directory replication?
  How do I change how often the Knowledge Consistency Checker runs?
  How do I move objects within my forest?

• How does intersite replication work in Windows 2000? 
  What is Active Directory?
  Why can't I add a Windows NT 4.0 BDC to my Windows 2000 domain?

• Why can't I have spaces in my Windows 2000 NetBIOS domain name?
  How do I create trusts from the command line in Windows 2000?

• How do I modify the number of Active Directory objects to search?
  Why can't I create an organizational unit and child domain with the same name from one parent?

• Which naming conventions does Active Directory use for objects?
  How does intrasite replication work in Windows 2000?

• How do I change the intrasite replication interval in Windows 2000 for domain information?

• How can I set the RPC port that intrasite replication uses?

• What tools are available for monitoring or changing replication?

• How do I allow modifications to the schema?

• What are tombstone objects?

• How do I switch my Windows 2000 domain to native mode?

• How do I force replication between two domain controllers in a site?

• How do I change the schedule for replication between two domain controllers in a site?

• How do I rename a site?

• What DNS entries does Windows 2000 add when you create a domain?

• How do I manually defragment Active Directory?

• How do I audit Active Directory?

• How do I automatically upgrade a server to a domain controller during installation?

• How do I enable circular logging for Active Directory?

• What are X.500 and LDAP?

• What is the Global Catalog?

• How do I configure a server as a Global Catalog?

• What is the schema?schema

• What is a domain tree?

• What is a domain forest?

• What is a Kerberos trust?