Network access protection (NAP) and enforcement
Every time other people access your network, they interact with it in ways that could cause contamination on their systems to also appear on your server. For example, if a laptop user gets a virus, your server will very likely get the virus too, unless you have a number of safeguards in place. Of course, most organizations today have all kinds of spam, virus, and other types of protection in place, even for internal contacts. The problem remains one of unhealthy clients — clients who lack the required updates or have some other fault that makes them a risky connection.
Network Access Protection (NAP).
NAP provides the means to check the health of any client connecting to your
network. When NAP detects an unhealthy client, it can act by limiting access until the client receives the necessary updates and configuration changes. In addition, you can specify a means of fixing the client to place it in a healthy state again. The bottom line is that your system gains another layer of protection from outside influences.
New printer and storage options
Microsoft has provided a number of new printer and storage options in Windows Server 2008. Most of these features fall into the required upgrade category. For example, Microsoft really needed to provide a means to access devices from the Web, so it provided a means to do that. Administrators have complained for years about the management tools in Windows, so Microsoft has also addressed that requirement. The following list provides some details on these new features:
✦ XML Paper Specification (XPS) Document Support:
XPS is a new open document format that Microsoft is promoting. It relies on XML to store document data so that you can theoretically retrieve the data even if the application used to create it no longer exists.
✦ New print paths:
A print path defines the software and actions that the operating system uses to process a document and send printer-ready data to the printer for output. In the past, the only print path relies on the Graphics Device Interface (GDI) originally found in Windows 3.x (albeit modified with each version of Windows). Microsoft now provides the XPS Driver (XPSDrv) software to process XPS documents more efficiently than ever. This new print path includes a host of features, such as direct support for transparencies, but you have to have the WPF installed to get it . You find a number of other useful additions to Windows
Server 2008 in support of the XPS specification.
✦ New printer driver model:
XPSDrv software represents a new way of outputting data. However, it also supports older output methodologies using the new print path. Even though XPSDrv software provides support for newer technologies, such as WPF, you can still use the driver without the .NET software. Of course, you won’t get any of the new features, but you will gain the performance benefits.
✦ Scalability improvements:
Normally, when a client makes a print request, the server performs all the required processing. Of course, placing the burden on the server reduces overall performance of the system for a very small gain in network performance. Windows Server 2008 now places the burden of printing on the client.
✦ Web Services on Devices (WSD):
This new feature relies on a common framework to describe and manage network devices. The concept is the same as a Web service, where you can query the device for specific information by sending it an XML request. Because this technology hides the details of working with the device, it greatly simplifies device interaction and reduces the potential for error.
✦ Improved print server management tools:
Anyone who has used Windows 2003 R2 has to appreciate the Print Management Console (PMC). Microsoft has improved this tool in Windows Server 2008. For example, you can now use PMC to migrate a printer from Windows 2000 or Windows 2003 to Windows Server 2008. The suite of tools also includes an improved Printer Installation Wizard that reduces the number of steps that an administrator must perform to detect and install a printer. As you can see from the list, Microsoft has provided some necessary and some nice-to-have printer and storage features in Windows Server 2008. It’s important to note that you still have to work pretty hard to obtain drivers for some hardware, but at least the support will be there after you find the drivers.
Read-only domain controller (RODC)
Even though you consider your domain controller safe from external influences, someone could potentially break into it and make changes to your setup. In addition, errant applications can cause havoc to your system. These are just two of the reasons for having a read-only domain controller (RODC).
Using an RODC makes Active Directory a read-only environment, which means that any changes that anyone makes are automatically overwritten with the original data. No changes occur to the server unless you make them. The main reason to use an RODC is that you can’t guarantee the physical security of the domain controller or have other concerns about the maintenance of server data.
For example, the RODC could appear in a branch office where a less-skilled administrator performs application installation or other tasks. In most cases, this less-skilled administrator won’t have access to any other server and won’t appear as part of the Domain Administrators group. Don’t worry that an RODC automatically becomes outdated either.
Unlike with a writeable domain controller, you can’t make changes directly to Active Directory, but the server can make requests for data from a writeable domain controller. For example, when a user tries to authenticate against thedomain controller the first time, the RODC sends the authentication request to a writeable domain controller.
If the authentication is successful, the RODC can request a copy of the credentials from the writeable domain controller and store them locally. Using an RODC improves security by making it impossible to write data to the local copy of Active Directory. However, it also provides benefits to the branch office. A special feature allows non administrators to gain a temporary increase in privileges to install applications and perform some limited management tasks so that an administrator doesn’t have to continually run to the branch office. In addition, because the RODC provides a local cache of Active Directory data, users will notice a performance increase because the network doesn’t continually experience the latency issues found in a standard
wide area network (WAN).
Windows Deployment Services Microsoft wants to make it easier for you to get its product on your machine, and Windows Deployment Services (WDS) is another in a long line of features designed to make that happen. The theory is that you use this new service to deploy Windows over a network on systems that have no operating systems installed. This feature originally appeared in Windows Server 2003 as a separate install, but you get it as part of Windows Server 2008. One especially nice addition is that you can perform the deployment without being physically present at the remote machine. You also find these features included with the new WDS in Windows Server 2008:
Enhanced Trivial File Transfer Protocol (TFTP) performance:
Windows Deployment Services relies on TFTP to download network boot programs and the Windows Pre-installation Environment (PE) images to the client.TFTP now includes a configurable windowing mechanism that reduces the number of packets that clients send, improving performance.
Diagnostics:
Windows Deployment Services now provides a considerable amount of information about the client install in the form of Crimson logs. You can use any Crimson-compatible product, such as Microsoft Office InfoPath, to process the logs and perform data mining on them.
Multicast deployment:
Using a multicast deployment technique lets the server install Windows on more than one client at a time using the same transmission thread. This approach improves overall performance and makes it possible to update the clients quickly. You have a choice between ScheduledCast (a task-based deployment where the client must join the session before the start of the download) or AutoCast (available at any time) deployment. Windows Server 2008 provides monitoring so that you can see how much of the multicast deployment the individual clients have received.
Every time other people access your network, they interact with it in ways that could cause contamination on their systems to also appear on your server. For example, if a laptop user gets a virus, your server will very likely get the virus too, unless you have a number of safeguards in place. Of course, most organizations today have all kinds of spam, virus, and other types of protection in place, even for internal contacts. The problem remains one of unhealthy clients — clients who lack the required updates or have some other fault that makes them a risky connection.
Network Access Protection (NAP).
NAP provides the means to check the health of any client connecting to your
network. When NAP detects an unhealthy client, it can act by limiting access until the client receives the necessary updates and configuration changes. In addition, you can specify a means of fixing the client to place it in a healthy state again. The bottom line is that your system gains another layer of protection from outside influences.
New printer and storage options
Microsoft has provided a number of new printer and storage options in Windows Server 2008. Most of these features fall into the required upgrade category. For example, Microsoft really needed to provide a means to access devices from the Web, so it provided a means to do that. Administrators have complained for years about the management tools in Windows, so Microsoft has also addressed that requirement. The following list provides some details on these new features:
✦ XML Paper Specification (XPS) Document Support:
XPS is a new open document format that Microsoft is promoting. It relies on XML to store document data so that you can theoretically retrieve the data even if the application used to create it no longer exists.
✦ New print paths:
A print path defines the software and actions that the operating system uses to process a document and send printer-ready data to the printer for output. In the past, the only print path relies on the Graphics Device Interface (GDI) originally found in Windows 3.x (albeit modified with each version of Windows). Microsoft now provides the XPS Driver (XPSDrv) software to process XPS documents more efficiently than ever. This new print path includes a host of features, such as direct support for transparencies, but you have to have the WPF installed to get it . You find a number of other useful additions to Windows
Server 2008 in support of the XPS specification.
✦ New printer driver model:
XPSDrv software represents a new way of outputting data. However, it also supports older output methodologies using the new print path. Even though XPSDrv software provides support for newer technologies, such as WPF, you can still use the driver without the .NET software. Of course, you won’t get any of the new features, but you will gain the performance benefits.
✦ Scalability improvements:
Normally, when a client makes a print request, the server performs all the required processing. Of course, placing the burden on the server reduces overall performance of the system for a very small gain in network performance. Windows Server 2008 now places the burden of printing on the client.
✦ Web Services on Devices (WSD):
This new feature relies on a common framework to describe and manage network devices. The concept is the same as a Web service, where you can query the device for specific information by sending it an XML request. Because this technology hides the details of working with the device, it greatly simplifies device interaction and reduces the potential for error.
✦ Improved print server management tools:
Anyone who has used Windows 2003 R2 has to appreciate the Print Management Console (PMC). Microsoft has improved this tool in Windows Server 2008. For example, you can now use PMC to migrate a printer from Windows 2000 or Windows 2003 to Windows Server 2008. The suite of tools also includes an improved Printer Installation Wizard that reduces the number of steps that an administrator must perform to detect and install a printer. As you can see from the list, Microsoft has provided some necessary and some nice-to-have printer and storage features in Windows Server 2008. It’s important to note that you still have to work pretty hard to obtain drivers for some hardware, but at least the support will be there after you find the drivers.
Read-only domain controller (RODC)
Even though you consider your domain controller safe from external influences, someone could potentially break into it and make changes to your setup. In addition, errant applications can cause havoc to your system. These are just two of the reasons for having a read-only domain controller (RODC).
Using an RODC makes Active Directory a read-only environment, which means that any changes that anyone makes are automatically overwritten with the original data. No changes occur to the server unless you make them. The main reason to use an RODC is that you can’t guarantee the physical security of the domain controller or have other concerns about the maintenance of server data.
For example, the RODC could appear in a branch office where a less-skilled administrator performs application installation or other tasks. In most cases, this less-skilled administrator won’t have access to any other server and won’t appear as part of the Domain Administrators group. Don’t worry that an RODC automatically becomes outdated either.
Unlike with a writeable domain controller, you can’t make changes directly to Active Directory, but the server can make requests for data from a writeable domain controller. For example, when a user tries to authenticate against thedomain controller the first time, the RODC sends the authentication request to a writeable domain controller.
If the authentication is successful, the RODC can request a copy of the credentials from the writeable domain controller and store them locally. Using an RODC improves security by making it impossible to write data to the local copy of Active Directory. However, it also provides benefits to the branch office. A special feature allows non administrators to gain a temporary increase in privileges to install applications and perform some limited management tasks so that an administrator doesn’t have to continually run to the branch office. In addition, because the RODC provides a local cache of Active Directory data, users will notice a performance increase because the network doesn’t continually experience the latency issues found in a standard
wide area network (WAN).
Windows Deployment Services Microsoft wants to make it easier for you to get its product on your machine, and Windows Deployment Services (WDS) is another in a long line of features designed to make that happen. The theory is that you use this new service to deploy Windows over a network on systems that have no operating systems installed. This feature originally appeared in Windows Server 2003 as a separate install, but you get it as part of Windows Server 2008. One especially nice addition is that you can perform the deployment without being physically present at the remote machine. You also find these features included with the new WDS in Windows Server 2008:
Enhanced Trivial File Transfer Protocol (TFTP) performance:
Windows Deployment Services relies on TFTP to download network boot programs and the Windows Pre-installation Environment (PE) images to the client.TFTP now includes a configurable windowing mechanism that reduces the number of packets that clients send, improving performance.
Diagnostics:
Windows Deployment Services now provides a considerable amount of information about the client install in the form of Crimson logs. You can use any Crimson-compatible product, such as Microsoft Office InfoPath, to process the logs and perform data mining on them.
Multicast deployment:
Using a multicast deployment technique lets the server install Windows on more than one client at a time using the same transmission thread. This approach improves overall performance and makes it possible to update the clients quickly. You have a choice between ScheduledCast (a task-based deployment where the client must join the session before the start of the download) or AutoCast (available at any time) deployment. Windows Server 2008 provides monitoring so that you can see how much of the multicast deployment the individual clients have received.
0 comments on New Features in Windows Server 2008 :
Post a Comment