Logo
programming4us
programming4us
programming4us
programming4us
Home
programming4us
XP
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server
programming4us
Windows Phone
 
Windows Server

Microsoft Systems Management Server 2003 : Standard and Advanced Security

- Windows 10 Product Activation Keys Free 2019 (All Versions)
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire
12/17/2012 4:39:23 PM
Your choice depends largely on the way you’ve implemented your network Windows servers. If your network still consists of some Windows NT 4.0 servers or hasn’t been upgraded to Active Directory directory service native mode, or if you’re upgrading an existing SMS 2.0 site, your choice will be standard security, and the installation of SMS will effectively result in an SMS site that functions not much differently from the way SMS 2.0 sites did. In short, it will create many user accounts that it will use to carry out various SMS-related tasks on SMS servers and SMS clients.

If your network is a fully implemented native mode Active Directory network or if all your SMS component servers are running Windows 2000 or later and are registered in Active Directory (a requirement for advanced security), you can choose advanced security.

To be more specific, advanced security requires that the SMS site server and all SMS site systems are running Windows 2000 Service Pack 4 (SP4) or later (or have Windows Quick Fix Engineering (QFE) update 325804 applied) or an operating system in the Windows Server 2003 family in an Active Directory domain. The SMS site database servers must be running SQL Server 2000 SP3 or later, and they must be run in Windows authentication–only mode.

The main advantage of using advanced security mode is that it’s certainly the more secure of the two security modes. As we’ve said, advanced security doesn’t require nor rely on the great number of user accounts that standard security needs to carry out SMS-related tasks. In contrast, advanced security uses two security accounts: the local system account and the computer account. Advanced security uses the local system account on SMS servers to run SMS services and make changes on the server and uses computer accounts (rather than user accounts) to connect to other computers and to make changes on other computers. Because only services running in the local system account context can use computer accounts and only administrators can configure services, advanced security is a highly secure mode and therefore the preferred and recommended security mode.

Note

A central site can’t run standard security if any other site in that hierarchy is running advanced security.


You can choose advanced security mode during SMS setup, or you can install your SMS site server with standard mode and then upgrade to advanced security later. To upgrade your site to advanced security, complete the following steps:

1.
Navigate to the site entry under the Site Hierarchy node in the SMS Administrator Console.

2.
Right-click the site entry and select Properties from the context menu.

3.
Click Set Security in the General tab shown in Figure 1.

Figure 1. The General tab of the Site Properties dialog box.

4.
Click Yes when prompted to turn on advanced security mode as shown in Figure 2.

Figure 2. The Set Security Mode prompt.

I make it a practice to always read the prompts that SMS shows me, and I highly recommend it to you as well. For example, in the prompt that displays in Figure 17-2, SMS is clearly stating several things that you must be aware of:

  • Once you make this change, you can’t go back.

  • There are several server requirements that must be confirmed to support advanced security.

  • A service (Windows Management Instrumentation) is stopped and restarted.

  • You might have a problem with the SMS Administrator Console that requires you to restart it.

The first point is obvious, although, technically, you could revert your site to standard security if you had backed up your site server and its registry and could restore the system state to its previous settings. However, let’s just stick with standard procedures and say this: don’t upgrade to advanced security unless you’re sure you want to do it and you’re ready to do it. It’s hard to go back.

The second point is perhaps not as obvious, so let’s take some time and discuss it. Let’s begin with the fact that in advanced security mode, SMS 2003 relies on the local system account mainly to run service-related tasks and on computer accounts mainly to maintain communications. This oversimplifies the case somewhat, but still this is a good rule of thumb to keep in mind.

So with this rule of thumb in mind, note well what the Set Security Mode prompt is telling you to do. The site system requires Administrator access on its site systems and permissions on any parent or child sites that it must communicate with in an SMS hierarchy. You can accomplish the former by adding the SMS site server computer account to the Administrator’s group on each site system in the site. Computer accounts are created as hidden accounts, so you can’t add the account the way you’d ordinarily do. You need to add the account from a command line. You can add the site server’s computer account to the site system’s local Administrator’s group using the following command line command at the site system:

Net localgroup Administrators /domain\siteservercomputername$/ADD

Similarly, you’ll need to add the computer account of each site system to the site server’s Site_System_to_Site_Server_Connection group. SMS will automatically do this for the client access point (CAP) and management point site systems to the Site System to Site Server Connection group and will do so for any new site system you add. When you upgrade to advanced security mode, the site server’s computer account is automatically added to the Site_to_Site_Connection group on the parent and child sites, allowing communications and the appropriate level of access between sites in the hierarchy. Although this all happens automatically, as a point of troubleshooting, you should, of course, verify that the computer accounts have been given the appropriate level of access they require.

Other -----------------
- System Center Configuration Manager 2007 : Network Design - Use of BITS
- System Center Configuration Manager 2007 : Network Design - Fast Networks and Slow Networks
- Collaborating Within an Exchange Environment Using Microsoft Office SharePoint Server 2007 : Customizing and Developing MOSS Sites
- Collaborating Within an Exchange Environment Using Microsoft Office SharePoint Server 2007 : Exploring End-User Features in MOSS
- SQL Server 2008 R2 : Executing Stored Procedures
- SQL Server 2008 R2 : Advantages of Stored Procedures, Creating Stored Procedures
- Microsoft Dynamics CRM 4.0 : Silverlight - Deploying Silverlight Using IFrames, Notes Entity
- Microsoft Dynamics CRM 4.0 : Silverlight - Developing a Basic Silverlight Application
- Windows Server 2008 Server Core : Outputting Data Files with the Type Command
- Windows Server 2008 Server Core : Replacing Existing Files with the Replace Utility, Taking Ownership of Files with the TakeOwn Utility
 
 
Top 10
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
- Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
- Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
Popular tags
Microsoft Access Microsoft Excel Microsoft OneNote Microsoft PowerPoint Microsoft Project Microsoft Visio Microsoft Word Active Directory Biztalk Exchange Server Microsoft LynC Server Microsoft Dynamic Sharepoint Sql Server Windows Server 2008 Windows Server 2012 Windows 7 Windows 8 windows Phone 7 windows Phone 8
programming4us programming4us
Celebrity Style, Fashion Trends, Beauty and Makeup Tips.
 
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server