FAQ's http://www.ntfaq.com/ (2000& NT)
ADD SHUTDOWN TO THE LOGON DIALOG
SEE CURRENT CLIENT CONNECTIONS
GETTING QUICK ACCESS TO DOCUMENTS
AUTOMATIC IP ADDRESS ASSIGNMENT
CUSTOMIZE IP SETTINGS THROUGH USER CLASSES DHCP
DRIVE LETTERS NEED TO BE CHANGED
UNHIDING PROTECTED SYSTEM FILES
CHANGING ICONS FOR DESKTOP ITEMS AND DOCUMENTS
OPEN A COMMAND CONSOLE IN A SPECIFIC FOLDER
DISPLAYING SPECIAL LOGON MESSAGES
MULTIPLE WEB SITES UNDER PROFESSIONAL
OPENING NETWORK FOLDERS QUICKLY
DISABLE FILE AND PRINTER SHARING FOR TCP/IP
USING CALLBACK TO REDUCE DIAL-UP COSTS
DISABLE REMOTE REGISTRY MODIFICATION
CHANGING ENVIRONMENT VARIABLES
APPLYING LOCAL RESTRICTIONS, PART 1
APPLYING LOCAL RESTRICTIONS, PART 2
INSTALLING AND USING THE RECOVERY CONSOLE
ADDING A BORDER TO A PICTURE OBJECT
CLONING YOUR CURRENT CONFIGURATION
USING THE LAST KNOWN GOOD CONFIGURATION
MANUAL REGISTRY BACKUP AND RESTORE
MOVING CERTIFICATES BETWEEN COMPUTERS
WORKING WITH REMOVABLE NTFS MEDIA
RENAMING THE ADMINISTRATOR AND GUEST ACCOUNTS
CONTROLLING DRIVER AND SERVICE INSTALLATION BEHAVIOR
VIEWING AND DISABLING SERVICES FROM THE RECOVERY CONSOLE
CONFIGURE WIN2K PROFESSIONAL AS A TELNET SERVER
USING CERTIFICATE-BASED AUTHENTICATION FOR DIAL-UP CONNECTIONS
One of the main benefits to using Windows 2000 is the security it provides, both locally and for shared network resources. To ensure security, W2K requires that you have a valid user account either on the local computer, in the computer's domain, or in a trusted domain. When only one person uses the computer and security is not really an issue, however, logging on can be an annoyance rather than a real security measure. In that situation you might want to turn on automatic logon. With automatic logon enabled, Win2K automatically logs on at system startup using the account and password that you specify. The desktop appears at startup rather than the logon dialog, the same behavior seen in Win9x when no network client is installed. To configure the system to log on automatically, open the Users And Passwords object in the Control Panel. On the Users page, disable the option Users Must Enter A User Name And Password To Use This Computer. Click OK and specify the user name and password that it will use to automatically log on at startup in the resulting dialog box. If you later want to turn off automatic logon, just open the Users And Passwords object and re-enable the check box.
Technical Tips © KRMS Productions 2000
By default Windows 2000 automatically shows in the logon dialog box the user name of the account last used to log on to the computer. This saves the time and trouble of typing the user name for every logon, which is convenient if there's only one person using the computer or if someone uses it more frequently than anyone else. Since you need an account as well as a password to log on, displaying the user name isn't a security risk per se, but it can weaken security in environments where security is critical. After all, knowing a valid account name is half the battle in hacking into a system. The solution? Hide the last logon from the dialog box, forcing the user to type the user name each time he or she logs on. You hide the user name by defining a security policy setting. You can define the setting locally or inherit the setting through the domain security policy. If the policy is defined at both locations, the domain policy takes precedence and overrides local policy. Open the Administrative Tools folder in the Control Panel and then open the Local Security Policy object. Expand the Local Policies/Security Options branch. Double-click the setting Do Not Display Last User Name In Logon Screen. Click Enabled, then click OK and close the Local Security Settings console. The change will take effect at the next logon.
Technical Tips © KRMS Productions 2000
ADD SHUTDOWN TO THE LOGON DIALOG
If you restart your system often, such as when you're installing new hardware or software, it's a pain to have to log on for the sole purpose of clicking Start | Shut Down to shut down the system. Wouldn't you rather have a Shut Down option right on the logon dialog box? Well, you can create one by simply defining a security policy either at the local policy or through the domain security policy. If both are defined, the domain security policy takes precedence. Here's how to define it locally: Open the Administrative Tools folder in the Control Panel, then open the Local Security Policy object. Expand the Local Policies/Security Options branch. Double-click the setting Allow System To Be Shut Down Without Having To Log On. Click Enabled, then click OK and close the Local Security Settings console. At the next logon you'll be able to click Shut Down from within the logon dialog and shut down the system without first logging on. Keep in mind, however, that adding the ability to shut down the system without logging on allows anyone to shut down the system, whether he or she has a valid account or not.
Technical Tips © KRMS Productions 2000
By default, Windows 2000's password settings are not very strict. You can improve security by enforcing stronger passwords and setting other password properties. To do so, open the Local Security Policy console from the Administrative Tools folder, then open the Account Policies/Password Policy branch. Note that as we've mentioned before, a domain policy, if set, will take precedence over a local security policy. The first five settings in the Local Security Policy console can enhance security. The first policy, Enforce Password History, causes Windows 2000 to keep track of the specified number of previously used passwords and prevents the user from reusing a password in the history list. This helps ensure that fresh passwords are used. The Maximum Password Age and Minimum Password Age policies determine how long a password can be used before it must be changed. Minimum Password Length specifies how many characters a password must include, enabling you to require longer passwords that are more difficult to crack. The last setting, Passwords Must Meet Complexity Requirements, requires that a password not contain the user name and must contain at least one character each from three of these four categories: English uppercase letters, English lowercase letters, Westernized Arabic numerals, and non-alphanumeric characters (!, @, #, etc.). The default password filter is defined in the file Scecli.dll in \systemroot\System32. You can customize the filter by providing a custom Scecli.dll file, either by creating one yourself, which requires programming ability, or by acquiring one from a third-party vendor.
Technical Tips © KRMS Productions 2000
SEE CURRENT CLIENT CONNECTIONS
If you work in a networked environment and other users access resources on your computer, you might occasionally need to determine who is currently connected to your system. For example, you may need to shut down or restart your computer, but before doing so determine if any other users have files open. In Windows NT, you'd view connections through the Server object in the Control Panel. In Windows 2000, however, you'll use the Computer Management console. Right-click My Computer and choose Manage to open the console, then open the Shared Folders branch. The Shares branch gives you a quick overview of the folders shared on your system. You'll probably notice several showing a $ symbol at the end. They are the administrative shares automatically created by Windows 2000. You can add and remove shares here as well as broadcast a console message to other network users. The Sessions branch shows current connections and connection status such as the number of open files. You can use this branch to disconnect users if necessary. The Open Files branch lists files opened by other users and enables you to close them if necessary. You can close files individually or close all. (Of course, common courtesy would dictate that you inform users of your intention to disconnect them or close files they're working on before you actually do so.)
Technical Tips © KRMS Productions 2000
GETTING QUICK ACCESS TO DOCUMENTS
The Documents menu on the Windows 2000 Start menu automatically displays the last fifteen documents you've opened, providing quick access to recently opened files. The Documents menu also contains a link to the My Documents folder, which points to \Documents and Settings\user\My Documents (if you performed a clean install of Windows 2000) or \%systemroot%\Profiles\user\My Documents (if you upgraded from Windows NT). You can gain more effective use of My Documents and access your documents even more quickly by creating a directory structure under My Documents to contain the documents you use most often. Creating the directory structure organizes the documents, and a change to the Start menu can make them even easier to access.
1. Right-click the taskbar and go to Properties | Advanced.
2. In the Start Menu Settings list, select the option Expand My Documents.
3. Click OK. The next time you open the My Documents item on the Documents menu, the menu will expand to show the directory structure and contents of My Documents, rather than opening the folder itself. Simply right-click My Documents and choose Open if you prefer to open the folder window.
Technical Tips © KRMS Productions 2000
Like Windows NT, Windows 2000 uses a text file Boot.ini in the root folder of the boot drive to define boot options. The settings in Boot.ini determine the menu options that appear when you start the system, as well as how long the menu stays on the screen before the default boot option executes. Boot.ini is a hidden, read-only system file, so you'll need to configure folder options to display hidden files and not hide protected operating system files in order to view and modify it. You'll find two sections in Boot.ini--[boot loader] and [operating systems]. The timeout value in the [boot loader] section determines how long, in seconds, the menu displays before the Windows 2000 boot loader executes the default boot option. Adjust the value to your liking or set it to 0 to boot without a menu. Each line in the [operating systems] section defines an operating system or operating system option. You can add or modify settings in this section to boot other, manually installed operating systems or cloned copies of Windows 2000.
Technical Tips © KRMS Productions 2000
AUTOMATIC IP ADDRESS ASSIGNMENT
If your network uses TCP/IP, you have three options for assigning IP addresses to computers on the network. First, you can assign addresses statically, allocating a specific address to each computer. This is the least attractive means because it makes network administration more difficult. When you need to assign an address to a new computer, you have to make sure it's one you haven't already assigned. DHCP offers a better solution because it assigns addresses and other IP properties like DNS servers automatically when the computer boots. Using DHCP, however, requires a DHCP server. In a small network you might not have the capital for a Windows 2000 Server or Windows NT Server system to do DHCP. As long as you don't need routable public addresses, however, you don't need a DHCP server, because Windows 2000 supports APIPA (Automatic Private IP Addressing). If you configure a Windows 2000 computer for automatic IP address assignment and no DHCP server is found on the network, Windows 2000 automatically assigns itself a unique address in the 169.254.x.x class B address space (subnet mask 255.255.0.0). It scans the network periodically for a DHCP and if one is found, takes an address lease from the server. Otherwise it continues using its APIPA address. To configure a computer for APIPA, simply open the Properties sheet for the network connection, double-click TCP/IP, and enable the Obtain An IP Address Automatically option.
Technical Tips © KRMS Productions 2000
CUSTOMIZE IP SETTINGS THROUGH USER CLASSES DHCP
automatically assigns IP addresses and other properties such as IP address of DNS servers and routers. In some cases you might want to retrieve special IP settings based on the type of hardware used or other criteria. For example, you might want notebook computers to have shorter lease durations than desktop systems since the notebooks leave the network more often. You can achieve this type of assignment through user classes. You define user classes at the DHCP server and assign custom settings for that particular user class through the DHCP console. You then use the IPCONFIG command to assign a user class property to the local computer. Assuming your network administrator has created a user class called NOTEBOOK, for example, you'd use the following command from a console prompt to assign that user class on your computer: IPCONFIG /SETCLASSID <ADAPTER> NOTEBOOK where <adapter> is the network interface on which the class ID should apply. Use wildcards for the <adapter> definition to apply it to more than one adapter. After setting the user class, release the address and obtain a new lease with the following command: IPCONFIG /RENEW <ADAPTER> Omit the <adapter> option to renew all interfaces.
Technical Tips © KRMS Productions 2000
If you're hosting a Web or ftp site for an intranet on your computer, you might need to use the same address. That's not a problem if your computer's address is assigned statically, but it can be a problem if you use DHCP, since the DHCP server determines which IP address your computer receives. Even with DHCP, however, you can obtain the same IP address every time, as long as your DHCP has an address reservation for you. A reservation assigns a specific IP address based on the computer's MAC address (physical adapter address). You can use the IPCONFIG /ALL command to view an adapter's MAC address. With that address in hand, you can set up a reservation on your DHCP server or have the network administrator set it up for you.
If you need to do it but aren't that familiar with the DHCP server, follow these steps:
1. Open the DHCP console from the Administrative Tools folder.
2. Open the address scope where you need to assign the reservation.
3. Right-click the Reservations node and choose New Reservation.
4. Specify a name for the reservation, the IP address to reserve, and the MAC address of the remote client. You can also specify an optional description and specify the type of client that can use the reservation (DHCP, BOOTP, or both).
Technical Tips © KRMS Productions 2000
Windows 2000 adds a great new feature called Dynamic DNS (DDNS) that enables host records to be updated automatically in a Windows 2000 DNS server when the client address changes. This enables host records to remain accurate even when clients receive their address assignments through DHCP, for example. A Windows 2000 client can request an update to its host (A) record in the DNS server when its IP address or host name changes. A Windows 2000 DHCP server can also request an update to the associated pointer (PTR) record on behalf of its DHCP clients.
To configure a client for DDNS, follow these steps:
1. Open the Properties sheet for the network connection through the Network And Dial-Up Connections folder.
2. Double-click TCP/IP.
3. Go to Advanced | DNS.
4. Select the Register This Connection's Addresses In DNS option to enable DDNS for the client.
NOTE: The Use This Connection's DNS Suffix In DNS Registration option, if selected, registers the client using the first part of the computer name specified in the System properties along with the DNS suffix specified by the DNS Suffix For This Connection option.
Technical Tips © KRMS Productions 2000
DRIVE LETTERS NEED TO BE CHANGED
You can change drive letters of drives in Windows 2000 easily through the Disk Management node of the Computer Management console. You might need to do this in situations where an application is hard-coded to expect a particular drive letter but you're using a different one. To change a drive letter for a volume, right-click My Computer and choose Manage to open the Computer Management console. Click the Disk Management node. In the right pane, right-click the volume you want to modify and choose Change Drive Letter And Path. Windows 2000 will display a dialog with the ID currently assigned to the volume. To change a drive letter, click the letter and choose Edit, then select the drive letter you want to use. To add a drive letter to a volume currently mounted to an NTFS folder, click Add instead. You can't change the drive letter assigned to the boot or system volumes with this method. You can change them through a registry hack, but changing them there leads to additional problems that have to be fixed in the registry, as well (such as the inability to log on). Changing system and boot drive letters will be covered in a future tip.
Technical Tips © KRMS Productions 2000
Most of the administrative functions you perform in Windows 2000 happen through various Microsoft Management Console (MMC) snap-ins. A useful advantage to this modular design is the fact that you can customize the consoles to suit your needs. For example, you can add a selection of consoles to your own custom console for the administrative functions you perform most often. You can also customize existing consoles to make it easier to access specific functions by adding Taskpads, which we'll cover in a future tip.
To create your own custom console with a selection of snap-ins, follow these steps:
1. Go to Start | Run, and enter MMC.EXE in the Run dialog box.
2. In the console window, choose Console | Add/Remove Snap-in.
3. Click Add, select the desired snap-in, then click Add again.
4. Insert any other consoles you want to include, and then click Close.
5. Save the console so you can use it any time you need it. To do so, go to Console | Save As.
6. Specify a location and filename, and the MMC will save the console with an .msc file extension.
NOTE: For quick access to the console, create a shortcut to it in your Start menu or on your desktop.
Technical Tips © KRMS Productions 2000
UNHIDING PROTECTED SYSTEM FILES
Like Windows 9x and Windows NT, you can configure Windows 2000 to either show or not show folders and files that have hidden attributes set. Windows 2000 adds a new feature that helps prevent unintended deletion or other modification of critical system files such as BOOT.INI, NTLDR, and NTDETECT.COM, among others. In Windows NT, these files show up when you turn on display of hidden files. In Windows 2000, however, the files remain hidden. If you need to access them--such as to modify boot options in BOOT.INI--you need to make a minor change to Folder Options.
To do so, follow these steps:
1. In any folder window, choose Tools | Folder Options.
2. Click the View tab and deselect the Hide Protected Operating System Files option. Windows 2000 will present a Warning dialog box.
3. Click Yes to display system files or No to cancel. After you've performed the necessary modifications to the files, you should reselect the option to protect the files again.
Technical Tips © KRMS Productions 2000
CHANGING ICONS FOR DESKTOP ITEMS AND DOCUMENTS
You can change the icon used for a shortcut by right-clicking the shortcut, choosing Properties, then clicking Change Icon. You can browse for the file or specify the path to the file containing the icon (.ico, .dll, or .exe files). Desktop objects like My Computer behave differently, however. You can change the icons for these objects through the Display Properties sheet.
To do so, follow these steps:
1. Right-click the desktop and choose Properties.
2. Click the Effects tab.
3. In the Desktop Icons group, select the object whose icon you want to change. 4. Click either Change Icon to assign a different icon or Default Icon to return to its default.
You can also change the icons used to display a specific type of file, although the change takes a little more effort than changing desktop object icons.
Here's how:
1. Open any folder and choose Tools | Folder Options.
2. Click the File Types tab, and locate and select the file extension for the file type whose icon you want to change.
3. Click Change Icon and select the file and icon you want to use.
Whether you're changing icons for desktop objects or documents, you'll find several to choose from in the files Shell32.dll and Moricons.dll, both located in the %systemroot%\System32 folder.
Technical Tips © KRMS Productions 2000
If you've tried to remove objects from your systems through the Add/Remove Programs object in Control Panel, you've probably noticed that some of the installed components, such as games and other accessories, don't show up in the Windows 2000 components list. Microsoft supposedly hid these files to provide a common base of applications on each Windows 2000 system for support reasons. Having Solitaire on your system, however, doesn't seem to add much in terms of simplifying support.
Here's how to unhide these applications.
1. Configure Windows 2000 to show hidden folders by opening the hidden folder %systemroot%\Inf. Locate and make a backup copy of the file Sysoc.inf. Double-click Sysoc.inf to open it in Notepad. Check each line for ",HIDE," and delete the word HIDE, leaving the commas on either side, and save the file.
2. Go to Control Panel |Add/Remove Programs.
3. Click Add/Remove Windows Components. Note that the previously hidden applications now appear.
You still can't remove some of the applications (such as Fax), but at least you can remove games and other accessories you might not need.
Technical Tips © KRMS Productions 2000
If you've ever needed to work with hexadecimal, binary, or octal numbers, degrees or radians, trig functions, logs, or other high-level math operations, you might have spent time scouring the Internet for a good calculator program, and maybe even paid a shareware fee for the privilege of using it. That's too bad since you might have had the calculator you need right at your fingertips all along. A lot of people never touch the Calculator program included with Windows 2000, believing it's limited to just basic math operations. But in addition to its Basic mode, Calculator has a Scientific mode that gives you all the functions mentioned above, plus several others. To switch to Scientific mode, open Calculator and choose View | Scientific. It's not the same as having one of those $300 calculators that gives you everything including a can opener and screwdriver, but it won't cost you anything extra. To switch back to the $2 version, just choose View | Standard. Calculator opens in whichever mode was active during the previous session.
Technical Tips © KRMS Productions 2000
Like other operating systems, Windows 2000 supports print spooling. Rather than print directly to the printer, applications can print to a print spool managed by Windows 2000. The operating system then takes care of sending the print job to the printer. The advantage is that you don't have to wait for the document to finish printing before resuming use of the application. As far as the application is concerned, once the document is in the spool, it's printed, allowing the app to go on about its business. For most people the default settings for print spooling work just fine. In some cases, though, you might need to tweak the settings or turn off spooling. Spool settings are configured on a per-printer basis. Open the Printers folder, right-click the printer in question, choose Properties, and click the Advanced page. Select the option Print Directly To The Printer To Bypass Spooling. If you choose to use spooling, you can specify that Windows 2000 start printing as soon as the data starts flowing to the queue, or you can configure it so the entire document moves to the spool before printing starts. The latter option can resolve printing problems, particularly with long documents.
Technical Tips © KRMS Productions 2000
OPEN A COMMAND CONSOLE IN A SPECIFIC FOLDER
If you work with the command console frequently, you'd probably love to be able to click on a folder and open a command console rooted in the folder, saving lots of CD commands once the console is open. Although you can modify the registry directly to add this capability, Microsoft provides a couple of add-ons you can use to automate the registry change for you. The Microsoft Windows 2000 Resource Kit includes a tool called CMD Prompt Here that, once installed, enables you to right-click a folder and choose CMD Prompt Here from the Context menu to open a command console in the selected folder. You also can use the Command Prompt Here tool in the Windows 95 Power Toys Set. Copy and paste this URL into your browser: www.microsoft.com/Windows95/downloads/contents/WUToys/W95PwrToysSet/Default. asp To install CMD Prompt Here, open the folder where the Resource Kit is installed, right-click Cmdhere.inf and choose Install. To install the Power Toys, connect to the URL listed above and download the Power Toys file. Create a new folder, move the downloaded file to the folder, then double-click the file to extract its contents. Locate and right-click Doshere.inf, then choose Install. The other Power Toys you should have no problems with under Windows 2000 are Find X, Send To X, and Shortcut Target Menu.
Technical Tips © KRMS Productions 2000
DISPLAYING SPECIAL LOGON MESSAGES
Believe it or not, you could have a problem prosecuting someone who hacks into your system or uses it without authorization unless you warn the intruder explicitly that access to the computer is restricted. To cover your legal bases you can configure Windows 2000 to display a special logon message warning unauthorized users to keep away from your system. This warning message appears just prior to the logon dialog. Of course, if you're more interested in broadcasting a specific message to your authorized users than you are in warning potential crackers, you can also use this logon message for that purpose. You configure the logon message through either the local security policy or domain security policy. If both are defined, the domain policy takes precedence.
Follow these steps to set up your logon message (assuming the local security policy):
1. Open the Local Security Policy console from the Administrative Tools folder.
2. Open the \Local Policies\Security Options branch.
3. Compose the "Message text for users attempting to log on" that you want displayed in the dialog box.
4. Set the "Message title for users attempting to log on" to whatever you want to appear in the dialog's title bar.
5. Close the console, log off, then log on to test the message.
Technical Tips © KRMS Productions 2000
MULTIPLE WEB SITES UNDER PROFESSIONAL
You can use Internet Information Services (IIS) on a Windows 2000 Professional computer to host a single Web site and a single FTP site. When you install IIS, Setup automatically creates the default Web site, which you can use to publish documents to other users on the LAN/intranet, or even on the Internet (although Pro is limited to a maximum of 10 concurrent connections). You can also use the default Web site to support printing across the Internet through the Internet Printing Protocol (IPP). There is no mechanism in the IIS console under Pro to create additional Web sites, since you can only run one at a time. However, here's a way to get around that restriction and create multiple sites if you have access to a Windows 2000 Server computer: copy the folders and files under \%systemroot%\SYSTEM32\INETSRV\IISADMIN to the same folder on your Pro computer and browse to http://localhost/iisadmin/default.htm. You'll find you now have the ability to create additional sites. Only one site can be running at a time, however, so you'll have to stop the current site to start another. You might find this capability useful if you're developing several sites and want to test them on your local computer before taking them live.
Technical Tips © KRMS Productions 2000
OPENING NETWORK FOLDERS QUICKLY
Getting quick access to network folders is handy whether you use those folders seldom or all the time. Browsing through My Network Places each time you need to use a folder certainly works but it's the "scenic route." If you're looking for an easier way, you have a couple of ready options. First, as you're probably aware, you can map a local drive letter to the remote share. Just right-click My Network Places, choose Map Network Drive, then select a drive letter and specify the UNC path to the share. The UNC name takes the form \\server\share, where server is the name of the computer and share is the name by which the folder is shared. In some cases you probably don't want to go through the hassle of mapping a drive. Instead, browse the network to find the folder, then right-click and drag the folder to your desktop and create a shortcut to it. It will be readily accessible any time you need it. Or, if you're opening a document from the network, just go to File | Open and specify the UNC path to the document, such as \\server\docs\report.doc.
Technical Tips © KRMS Productions 2000
DISABLE FILE AND PRINTER SHARING FOR TCP/IP
The Internet used to be a lonely but relatively safe place, like a small town where you could leave your doors unlocked. Today the 'net is a lot like the bad area of downtown in a big city. Leave your door unlocked, and someone will probably clean you out. If you stay connected by dial-up to the Internet for extended periods or have a direct connection that's always live, you need to protect yourself from crackers who would steal your data and damage your system. The first line of defense against intruders is to prevent them from browsing your computer, and you do that by unbinding the TCP/IP protocol from the File And Printer Sharing service. Open the Network And Dial-Up Connections folder, right-click the connection, and choose Properties. If you're configuring a dial-up connection, click the Networking tab and deselect the File And Printer Sharing service. For direct connections, open the Network And Dial-Up Connections folder and go to Advanced | Advanced Settings. In the Bindings box on the Adapters and Bindings page, deselect the TCP/IP protocol under the File And Printer Sharing branch.
Technical Tips © KRMS Productions 2000
USING CALLBACK TO REDUCE DIAL-UP COSTS
If you frequently use dial-up connections to a remote network, whether working from home or on the road, you can save yourself some money in phone charges by having the server call you back. This effectively "reverses the charges" so the toll happens on the server end, rather than on yours. To use Callback, your remote access server must support Callback and your account must be granted the right to use it, either directly through your User Account properties or through a Remote Access policy setting. In either case, configuring your ability to use Callback is done mostly at the server. However, you still need to configure your Dial-Up Preferences to use Callback. Open the Network And Dial-Up Connections folder and go to Advanced | Dial-Up Preferences.
Click the Callback tab, and then select one of the following two options:
* Ask Me During Dialing When The Server Offers: Select this option if you want the server to prompt you to specify the Callback number when you first connect.
* Always Call Me Back At The Number(s) Below: Select this option if you always connect from the same number. Specify the number for each modem.
Technical Tips © KRMS Productions 2000
DISABLE REMOTE REGISTRY MODIFICATION
Windows 2000 enables you to view and modify a registry remotely, which is a useful feature when you need to fix or tweak a system across the network. In some cases, the ability to remotely edit the registry is a lifesaver; however, it's also a potential security risk. If you don't need to manage your registry remotely, you can and should secure it.
Here's how:
1. Go to Start | Run.
2. Type regedt32.exe and click OK.
3. Navigate to HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Control\SecurePipeServers\winreg.
4. Go to Security | Permissions.
5. In the Permissions dialog, allow and deny access to groups and users as needed and close the Registry Editor.
NOTE: Please remember that editing your registry can be risky, so always have a verified backup before you begin.
Technical Tips © KRMS Productions 2000
A lot of users have been complaining in the newsgroups about "missing menus" in Windows 2000 and applications running under Win2K such as Office 2000. When you open a menu, it doesn't necessarily show you all of the available commands, causing some users to think that some commands are missing. This isn't a bug but rather a feature called User Personalized Menus. Some refer to it as "adaptive menus." Whatever the name, it can be an irritation if you're not used to it. The feature is designed to monitor your use of an application and, over a period of time, determine which commands you use frequently and which ones you use seldom, if at all. The frequently used commands show up in the menu, and those you use infrequently do not. At the bottom of the menu, you'll find a double down arrow that, when selected, opens the full menu to display all items. Personalized menus can help declutter an application's interface, but you might prefer to work with standard menus. To turn off personalized menus, right-click the taskbar and choose Properties. Deselect the User Personalized Menus option on the General page and click OK.
Technical Tips © KRMS Productions 2000
If you're an old hand at DOS or Windows 9x, you're probably familiar with the CHKDSK utility that checks a disk for errors and (optionally) fixes those errors. Windows 2000 also includes a copy of CHKDSK that not only checks and fixes problems with FAT and FAT32 volumes, but also checks and repairs NTFS volumes. CHKDSK must lock the volume for exclusive use to check for errors, and if it can't (because it's the system volume, for example), CHKDSK schedules the check for the next time the system reboots. You can view the options for CHKDSK by opening a command console and typing CHKDSK /?. Another disk checking utility included with Windows 2000 is CHKNTFS, which displays or specifies whether automatic system checking is scheduled to be run on the computer's volumes when the computer is started. CHKNTFS does its thing for FAT, FAT32, and NTFS volumes. As with CHKDSK, you can view the options for CHKNTFS by typing CHKNTFS /? at a command console. To schedule a check, for example, issue the command CHKNTFS /C, and a check will run the next time the computer starts. Another tweak you might want to make is to change the countdown timer for CHKNTFS, or the time the system waits during startup before starting the check. You might want to increase the countdown timer to give you more time to abort the check, if desired. To set the countdown timer, issue the command CHKNTFS /T:n and replace n with the number of seconds you want the system to wait before executing the check.
Technical Tips © KRMS Productions 2000
Windows 2000 Professional by default is limited to no more than ten concurrent connections. Anyone trying to connect after the maximum number of connections is reached receives an error message and the connection is refused. In some situations you might want to further restrict the number of concurrent connections, whether for performance or security reasons. For example, assume that when more than a few users connect to a database or application on your computer, performance drops noticeably. Restricting access can help reduce the impact of those connections on your system's performance. You can restrict connections on a share-by-share basis. Right-click the folder you want to restrict and choose Sharing. If the folder isn't shared yet, click Share This Folder and specify the Share name. To limit the number of connections to fewer than ten, click the Allow option. Use the associated spin control to specify the maximum number of connections. If you later want to increase the number of allowed connections to the maximum, open the Sharing Properties page again and click Maximum Allowed.
Technical Tips © KRMS Productions 2000
Windows 2000 is relatively well behaved, and it's usually not often that services fail. Service problems are still possible, however, particularly as you begin to add applications that use additional services. To help you cope with and troubleshoot service problems, Windows 2000 lets you specify recovery actions that Windows 2000 will attempt when a service fails. You configure recovery options through the service's Properties. Open the Services branch of the Computer Management console, double-click the service to display its Properties sheet, and then click the Recovery tab. You can configure actions for first, second, and subsequent failures, choosing from four possible options: Do Nothing, Restart The Service, Run A File, or Restart The Computer. The Run A File option is useful for notification when you're not near your computer. You can use your e-mail application to generate an e-mail or pager notification about the service failure, for example. In addition to specifying the actions to take on service failure, you can set related options. For example, you can specify the number of minutes Windows 2000 waits before attempting to restart the service and how quickly it resets the fail counter. If you select the option to execute a file, you can specify the file and any optional parameters, as well as append the fail count to the command line. If you specify a reboot, you can set the wait period between service failure and reboot and optionally broadcast a message on the network for notification.
Technical Tips © KRMS Productions 2000
CHANGING ENVIRONMENT VARIABLES
If you're a die-hard DOS or Windows 9x user converting to Windows 2000, you're probably familiar with environment variables and how you set them through the AUTOEXEC.BAT file. The PATH variable is a good example of an environment variable. Windows 2000 handles environment variables a little differently, separating them into two categories: those for all users and those for the current user. The variables are stored in the appropriate user profiles, enabling Windows 2000 to apply the correct ones when a user logs on. You can view and configure environment variables by right-clicking My Computer and choosing Properties. Click the Advanced tab, and then click Environment Variables to open the Environment Variables dialog box. You can use the controls on this dialog to edit the value of existing variables, remove them, or add new ones. The variables in the top half of the dialog box apply to the current user, and those in the bottom half apply to all users.
There are several replaceable parameters you can use in environment variables, including: * %username%--User's current logon account name
* %userdomain%--User's current logon domain name
* %windir%--Location of the Windows 2000 folder
* %os%--OS version
* %processor_architecture%--System processor type
* %processor_level%--System processor level
* %homepath%--Path to the user's home directory
* %homedrive%--The drive where the user's home directory is located
* %homeshare%--The share name of the user's home directory
Technical Tips © KRMS Productions 2000
Even if you're not using your computer as a server, there could well be times when you need to connect to your computer remotely through a dial-up connection. For example, you might be working at home and need to download some files from your office computer or print to the office printer. You can set up Windows 2000 Professional to act as a dial-up server, allowing you to connect, authenticate, and access resources as if you were connected locally to the network. It's relatively easy to configure Windows 2000 as a dial-up server.
Here's how:
1. Open the Network And Dial-Up Connections folder from Settings on the Start menu.
2. Run the Make New Connection wizard and click Next.
3. Select the option Accept Incoming Connections and click Next.
4. Select the device (such as a modem) you're using for the connection. If you need to configure its properties such as port speed, compression, etc., click Properties.
5. If you want to allow Virtual Private Network (VPN) connections, select Allow. Otherwise, select Do Not Allow and click Next.
6. Select the user accounts that are authorized to connect through the dial-up connection and click Next. BONUS TIP: You can also modify a user's settings through Properties to enable Callback so that your computer will call back the incoming remote user.
7. Select the network components for the connection (specifically, the protocols to use) and click Next.
8. Click Finish. Now, find yourself another computer and dial in to test the connection. Once connected you can map network shares and use network resources such as printers just as you would from the LAN.
Technical Tips © KRMS Productions 2000
You can configure a connection to use multiple network providers. Typically included are providers such as Microsoft Windows Network and print providers such as LanMan Print Services and HTTP Print Services (used by Windows 2000 to support printing from the Internet). When multiple providers are installed for a particular service type, Windows 2000 prioritizes the providers and establishes connections based on that priority. For example, Windows 2000 by default attempts printing through LanMan Print Services before attempting HTTP Print Services (unless the printer was installed through HTTP, in which case Windows 2000 always uses HTTP to print to that printer). In some cases, you might want to change the provider order so Windows 2000 uses a different provider first. For example, if you always print using HTTP, you can speed up print processing by setting the HTTP Print Services provider first in the list ahead of LanMan Print Services. As with most network configuration settings, you configure provider order through the Network And Dial-Up Connections folder. After you open the folder, go to Advanced | Advanced Settings. Click the Provider Order tab, and then find the service type you want to modify. Just click on a provider; then, click either the up or down buttons to change provider order.
Technical Tips © KRMS Productions 2000
If you experience a boot problem with a FAT volume, you can often at least recover your data by booting from a bootable DOS diskette. When your boot partition is NTFS, however, a DOS diskette won't do you much good, since DOS can't read NTFS. There are some third-party solutions that integrate the ability to read NTFS with a DOS boot environment. One of these solutions is NTFSDOS Pro from Winternals Software. You can also set up your own Windows 2000 boot disk that should enable you to read the NTFS volume, assuming the problem that caused the boot failure didn't also render the drive unusable. Having a boot disk is useful when your drive has a corrupted boot sector or corrupted master boot record (MBR), is missing NTLDR or Ntdetect.com, and in other situations. http://www.winternals.com/. How you create the boot disk depends on whether you have access to a Windows 2000 system. Today's method uses the Windows NT Setup disk and can be accomplished on a Windows 9x or even DOS system. In tomorrow's tip, you'll learn how to create a boot disk under Windows 2000.
1. Make a copy of the Windows NT Setup Disk 1 using the DISKCOPY command from a DOS session under Windows 9x (or DOS). Delete all the files from the disk after you create it.
2. Copy the files Ntdetect.com and NTLDR files from the i386 folder on the Windows 2000 CD to the disk you created in step 1.
3. Rename the file NTLDR to Setupldr.bin.
4. Create a Boot.ini file on the new disk. The following example assumes a single partition SCSI drive with Windows 2000 installed under \WINNT: [boot loader] timeout=30 Default= scsi(0)disk(0)rdisk(0)partition(1)\winnt [operating systems] scsi(0)disk(0)rdisk(0)partition(1)\winnt="Windows 2000" Replace the scsi(0) with multi(0) if your computer boots from an IDE, EIDE, or ESDI hard drive.
5. If the Boot.ini file uses scsi(n) instead of multi(n), copy the device driver for the computer's SCSI controller from the Windows 2000 CD to the floppy. Rename the driver on the floppy to Ntbootdd.sys. This step isn't required if the Boot.ini file uses multi(0).
6. Restart the system using the floppy.
Technical Tips © KRMS Productions 2000
In yesterday's tip, we explained how to create a bootable disk to enable you to access NTFS partitions if your drive has a boot problem. That process, using the Windows NT Setup disk, is specific to Win9x or DOS systems.
Here's how to create the boot diskette using Windows 2000:
1. Format a floppy disk in Windows 2000.
2. Copy NTLDR from the Windows 2000 CD, Windows 2000 Setup disk, or another computer running Windows 2000 Professional. You can use the command EXPAND NTLDR._ NTLDR to expand the file from the CD if necessary.
3. Copy Ntdetect.com to the diskette.
4. Create a Boot.ini file or copy one from another Windows 2000 computer, and then change it to match your system. The following example assumes a single partition SCSI drive with Windows 2000 installed under \WINNT: [boot loader] timeout=30 Default= scsi(0)disk(0)rdisk(0)partition(1)\winnt [operating systems] scsi(0)disk(0)rdisk(0)partition(1)\winnt="Windows 2000" Replace the scsi(0) with multi(0) if your computer boots from an IDE, EIDE, or ESDI hard drive.
5. If the Boot.ini file uses scsi(n) instead of multi(n), copy the device driver for the computer's SCSI controller from the Windows 2000 CD to the floppy. Rename the driver on the floppy to Ntbootdd.sys. This step isn't required if the Boot.ini file uses multi(0).
6. Restart the system using the floppy.
Technical Tips © KRMS Productions 2000
APPLYING LOCAL RESTRICTIONS, PART 1
Keeping users focused, on track, and out of trouble is sometimes a dicey proposition. Since nothing is foolproof to a sufficiently talented fool, it's tough to keep users out of places and applications where they shouldn't be. Even though you have to be an administrator to make most system configuration changes, unwary users can still do some damage. There's the lure of the Internet Explorer icon right on their desktops, tempting them away from work. And even the network sometimes proves to be a dangerous place for some users. Applying restrictions to what users can do is the solution. In a domain environment, you can use group policies to apply restrictions at several levels, including domain, site, and organizational unit (OU). For example, you can configure the interface to hide drives in My Computer, hide the Internet Explorer icon, disable Add/Remove Programs, and use a boatload of other restrictions to keep users focused and out of trouble. You can apply the restrictions on a per-user or per-group basis, giving you very granular control over who can do what, when, and where. In a workgroup environment, however, accomplishing the same thing is a lot tougher because the local group policy is intended to apply to all users, regardless of account or group membership. But, with a little finesse, you can apply restrictions to individual users. Tomorrow we'll show you how.
Technical Tips © KRMS Productions 2000
APPLYING LOCAL RESTRICTIONS, PART 2
You use the Group Policy console to apply restrictions. Before you go rushing off to lock down your users, however, keep this in mind: The changes you're going to make will initially affect the local administrator account on each computer. Don't apply any restrictions that will prevent you from later removing the restrictions from the administrator account. You might want to temporarily create an account with membership in the Administrators group to use in case you have problems and need to undo the restrictions.
Here's how to fool Windows 2000 Professional into using different restrictions for users:
1. Log on as Administrator.
2. Go to Start | Run and enter GPEDIT.MSC in the Open dialog box to start the Group Policy console.
3. Open the User Configuration/Administrative Templates branch and change settings as desired to enable restrictions as needed. The settings for each restriction vary.
4. Close the Group Policy console and log off, then log back on again as Administrator to apply the change.
5. Log off and log on as another user to verify that the restrictions are applied. Log off and then log on as each of the other users, in turn, to whom you want to apply the restrictions.
6. Log on as Administrator and copy the file %systemroot%\System32\GroupPolicy\User\registry.pol to a backup location and name it UserReg.pol. Copy the file %systemroot%\System32\GroupPolicy\Machine\registry.pol to the same backup location and name it MachineReg.pol.
7. Open the Group Policy console and remove the restrictions applied in step 4. In some cases, you might need to use the opposite setting from the one applied in step 3. For example, if you selected Enable to apply a given restriction, choose Disable to remove the restriction rather than Not Configured (which applies no change to the registry).
8. Close the Group Policy console, and then copy the backup UserReg.pol file created in step 6 back to %systemroot%\System32\GroupPolicy\User\registry.pol, making sure to rename the file registry.pol. Copy the backup MachineReg.pol created in step 6 back to %systemroot%\System32\GroupPolicy\Machine\registry.pol, making sure to rename the file registry.pol.
9. Log off as administrator and log on as one of the restricted users to verify that the restrictions are in place. Log off and then log back on as administrator to verify that the restrictions are not applied to the administrator account. As long as you didn't use your own non- administrator account to log on in step 5, that account will not have the restrictions applied.
Technical Tips © KRMS Productions 2000
INSTALLING AND USING THE RECOVERY CONSOLE
Windows 2000 adds a great new feature called the Recovery Console (RC) for troubleshooting and repairing system problems. Picture the equivalent of Windows 9x MS-DOS Mode with administrator privileges, and you have a pretty good picture of the RC. You can use a selection of commands internal to the RC to copy files, enable/disable services, and perform several other administrator-level tasks. For example, you might use the RC to manually restore the registry from the backup copy in the %systemroot%\Repair folder if the registry becomes corrupted. Or perhaps you need to repair the Master Boot Record (MBR) or boot sector after a hardware failure or virus infection. Whatever the situation, the RC gives you a means of repairing the system when you can get it to boot or log on normally. Setup doesn't install the RC by default, so you'll need to add it. If the system is running normally, you can install the RC through Winnt32.exe. Pop in the Windows 2000 CD, open a command console, and browse to the \i386 folder on the CD; then, execute the WINNT32 /CMDCONS command to run Setup and install the RC. If the system isn't working normally and you can't boot or log on, you can install the RC through Setup. Boot from the CD or from the Windows 2000 Setup disks. One of the installation options is to install the RC. Once the RC is installed, it appears as an option in the Boot menu. Just select Recovery Console from the menu and press [Enter]. If the menu doesn't appear, press [F8] when Windows 2000 starts to load; then, select Recovery Console from the advanced boot menu.
Technical Tips © KRMS Productions 2000
ADDING A BORDER TO A PICTURE OBJECT
As you know, a picture is worth a thousand words, especially when you're creating a user manual or documentation for a software program. However, when you paste screen shots or graphic images into your document, it's sometimes hard to tell where the image ends and your text begins. One way to make absolutely clear the difference between your pictures and your instructions is to add a border to your screen shots or other images. Fortunately, Word makes it easy to add a border to just about any graphic image. Just right-click on the image and choose the Format Picture option from the Context menu. When the Format Picture dialog box appears, click the Colors And Lines tab. In the Line section, click on the Color field to display the palette, and then select a color. Click OK to close the dialog box, and Word will draw a border around the image using the color you selected. (If you want to remove the border later, follow these same steps and select the No Line option.) By default, Word will use a single, fairly thin, solid line for the border. However, the Line section of the Colors And Lines tab offers three other options--Dashed, Style, and Weight--that let you customize the style of the border line.
Technical Tips © KRMS Productions 2000
CLONING YOUR CURRENT CONFIGURATION
How do you keep your existing Windows NT Workstation configuration and still upgrade it to Windows 2000 Professional? Easy! You clone the NT installation then upgrade the cloned copy. The result is a dual-boot system with your old installation intact and your new upgrade in place without reinstalling applications. You'll need a registry editor that can perform global search and replace in the registry. Check out the Registry Toolkit from http://www.funduc.com, then put on the latex gloves and mad scientist outfit for the following steps:
1. Boot your current installation of NT and execute RDISK /S to update the repair data and update the Emergency Repair Disk (ERD), just in case you have problems.
2. Perform a full backup of your system so that you're prepared if trouble arises during this process.
3. Create a directory called WIN2K (we'll call it WIN2K for this example--you can use a different folder name if you like) to contain Windows 2000.
4. Boot the system and open a console prompt. At the command prompt type the following command: XCOPY C:\WINNT C:\WIN2K /h /i /c /k /e /r If Windows NT is installed in a folder other than C:\WINNT, specify the correct source location for the XCOPY command.
5. Configure folder options to show all files, including protected operating system files. Open My Computer and locate the file Boot.ini in the root folder of the boot drive. Change the file's properties to remove the read-only attribute.
6. Open Boot.ini in Notepad and in the [operating systems] section, select and copy the line that defines your Windows NT installation (such as, "multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows NT Workstation Version 4.0").
7. Insert a new line in the [operating systems] section and paste the copied line into the file at that point.
8. Modify the inserted line to reference the \WIN2K folder rather than the \WINNT folder, and name it "Windows 2000." This will give you a menu option to boot the copy of NT in the \WIN2K folder.
9. Save the file and restore the read-only attribute.
10. Hold down [Shift] to prevent an autorun and insert the Windows 2000 CD. Open a console prompt and change to the \i386 folder on the CD.
11. Execute the following command to install the Windows 2000 Recovery Console: WINNT32 /CMDCONS
12. After the Recovery Console is installed, restart the system and boot the option, "Microsoft Windows 2000 Recovery Console."
13. When prompted to select the installation for logon, select the backup copy stored in \WIN2K. Since XCOPY did not copy the SAM, you won't be prompted to provide an administrator password.
14. Change to the \WINNT\System32\Config folder, then use the COPY command to copy all of the files in the folder to \WIN2K\System32\Config. You'll have to copy the files one at a time. (This step copies the registry from your \WINNT installation to the \WIN2K installation.)
15. Restart the system and select the option "Windows 2000." This will boot the cloned copy of Windows NT in the \WIN2K folder.
16. Log on as administrator, then perform a global search and replace in the registry, changing all instances of C:\WINNT to C:\WIN2K.
17. Review all shortcuts on the Start menu and desktop, changing references to C:\WINNT to C:\WIN2K.
18. Restart the system and select the option "Windows 2000" to boot the cloned copy. Insert the Windows 2000 CD and perform an upgrade.
19. Upon successful completion of the upgrade, test both operating systems to verify that you can boot both and that both work properly.
Technical Tips © KRMS Productions 2000
USING THE LAST KNOWN GOOD CONFIGURATION
When Windows 2000 boots, you can choose between two configurations: the default registry configuration or the Last Known Good Configuration (LKGC). The default configuration represents the system's configuration from the previous session just prior to shutdown. Any changes to the system's configuration in the previous session are applied in that configuration. The LKGC represents the system's configuration from the past boot prior to any changes. Both configurations are stored as control sets in HKEY_LOCAL_MACHINE\SYSTEM. The advantage offered by the LKGC is that it represents the configuration at the last successful boot. If you made changes in the previous logon session that hosed the system's configuration, you can boot from the LKGC to bypass those changes and recover the system. For example, perhaps you installed a device driver or service and the system stopped responding. Booting from the LKGC restores the registry to the way it was before the installation. The LKGC can also overcome problems with a new video driver. If you have problems with the display after installing the new driver, reboot without logging on to restore the registry from the LKGC. If you need to boot from the LKGC, press [F8] when Windows 2000 starts to boot. You'll find Last Known Good Configuration as an option in the Advanced Boot menu. If booting from the LKGC doesn't fix your problem, replace the registry from a backup (such as the copy in the %systemroot%\Repair folder) and reboot.
Technical Tips © KRMS Productions 2000
MANUAL REGISTRY BACKUP AND RESTORE
You can use the Backup utility in Windows 2000 to back up and restore the registry, although Backup requires that you back up all system state data along with the registry. As this can come to 200 MB or more, you might be interested in a way to back up just the registry. First, you can use Backup to update the registry files in the %systemroot%\Repair folder, which you can later copy back to the %systemroot%\System32\Config folder if the registry becomes corrupted. Open Backup, click the Welcome tab, then click Emergency Repair Disk to update the ERD. Select the option Also Backup The Registry To The Repair Directory. You can bypass creating the ERD by simply not putting a disk in the drive. If you later have a problem with the registry, you can use the Recovery Console to restore the files in the repair folder. Boot to the Recovery Console, change to the %systemroot%\Repair folder, then one by one copy the files there to the %systemroot%\System32\Config folder. When the files are in place, reboot the system to make the change take effect.
Technical Tips © KRMS Productions 2000
There are a couple of situations in which you might need to modify another computer's registry from your own computer. The other system might not allow logon for some reason but still boots. In this situation you can connect to the remote computer's registry, potentially fix the problem, and once again enable logon. If the remote computer won't boot, you might be able to copy the offending registry hive file to your computer, make the necessary changes, then copy it back to the other computer.
This requires that you do the following:
* Boot the system through a diskette or dual-boot configuration and gain access to the file system.
* Copy the registry file to a removable media with sufficient space to accommodate it (like a ZIP drive, for example), or be able to copy the file across the network.
Here's how to modify a remote registry locally on your computer if you can't connect to it across the network:
1. Boot the other computer with a boot diskette or dual-boot OS, then copy the problem hive file to a removable media or directly across the network to your system.
2. Log in as administrator on your system and run REGEDT32.EXE.
3. In the Registry Editor, select either the HKEY_LOCAL_MACHINE or HKEY_USERS window then choose Registry | Load Hive.
4. Locate the file copied to the system in step 1, select the file, and click Open. This loads the hive into the local registry as a subkey of the selected key.
5. Make the necessary changes to the damaged hive then choose Registry | Unload Hive.
6. Copy the hive file back to its original location on the problem computer and restart to test the system.
NOTE: Please remember that editing your registry can be risky, so always have a verified backup before you begin.
Technical Tips © KRMS Productions 2000
MOVING CERTIFICATES BETWEEN COMPUTERS
If you use certificates for authentication, digital signing, or other reasons, and routinely work with more than one machine, you'd probably like to have the same certificates on multiple computers. Or, maybe you need to reinstall Windows 2000 and must recover all of your certificates for the next installation. Rather than obtain different certificates for each computer you use, just export the certificates to each computer as needed. Exporting the certificates also gives you the ability to restore them if you're reinstalling Windows 2000. You can use Internet Explorer, Outlook Express, or the Certificates console to export certificates. In each case, Windows 2000 runs the Certificate Export Wizard to export the certificate to a file that you can archive or import to another computer.
Here's how to move your certificates to another computer using the Certificates console:
1. Open the Certificates MMC snap-in; then, open the branch Certificates/Current User/Personal/Certificates.
2. Right-click the certificate and choose All Tasks | Export.
3. Click Next after the Certificate Export Wizard starts.
4. Choose Yes, Export The Private Key and click Next.
5. Accept the default settings for Export File Format and click Next.
6. Specify a password to protect the certificate file and click Next.
7. Specify a filename for the certificate, click Next, and then click Finish.
8. On the next computer, in Internet Explorer or Outlook Express, click Import to start the Certificate Import Wizard. If using the Certificates console, right-click in the right-pane and choose All Tasks | Import to start the wizard.
9. Click Next after the wizard starts. Specify or browse to the path where the certificate is stored, select it, and click Next.
10. Specify the password entered in step six and click Next.
11. Click Next when prompted for the location of the certificate (let Windows 2000 place the certificate for you automatically), click Next again, and then click Finish.
Technical Tips © KRMS Productions 2000
Our recent tip, "Disable remote registry modification" (Jun. 12, 2000), explained how to prevent remote users from modifying your registry. If you need to allow some users that ability or otherwise restrict but not completely prevent registry modifications, you can apply permissions to registry keys that specify what actions users and groups can take on those particular keys and their values. For example, you might grant a given group of users the right to read keys but not modify them, while granting another group the ability to read and create new values in those keys but not create new subkeys. Use Regedt32.exe to set permissions on registry keys. To do so, run Regedt32, select the key for which you want to modify permissions, then click Permissions | Security. The initial Permissions dialog box for a key lets you allow or deny Read or Full Control permissions on a per- user or per-group basis. Click Advanced if you need more granular control over the permissions granted to a group or user. Auditing is another important aspect of registry security. You can configure which registry events are logged for specific users or groups. Open Regedt32, open the key, then click Security | Permissions. Click Advanced then click the Auditing tab. Click Add to add a user or group, and then in the Auditing Entry dialog select Successful or Failed, as desired, beside each event you want to audit.
Technical Tips © KRMS Productions 2000
WORKING WITH REMOVABLE NTFS MEDIA
By default, Windows 2000 allows removable NTFS media to be ejected only by members of the Administrators group. That logic makes sense because if you're using NTFS, you're probably doing so to take advantage of the security it provides. In some situations, however, you might want to enable other users to eject removable NTFS media. For example, if you need to eject frequently, you could avoid logging off your primary user account and logging on as administrator each time. The ability to eject removable NTFS media is controlled by a group policy. If the policy is defined at a level above the local computer, the domain policy takes precedence over the local policy.
To set the policy at the local level:
1. Open the Local Security Policy console from the Administrative Tools folder.
2. Open the branch Local Policies/Security Options.
3. Double-click Allowed To Eject Removable NTFS Media.
4. Select the groups that need the ability to eject the media and click OK, then close the console.
Technical Tips © KRMS Productions 2000
RENAMING THE ADMINISTRATOR AND GUEST ACCOUNTS
Obtaining a valid account name is the first step in any malicious attempt to break into a system, whether the cracker is working from within your organization or externally. Anyone with any NT or Windows 2000 experience knows the name of the administrator account and probably knows about the guest account, as well. So, if you're concerned about tightening up your system security, you can take the precaution of renaming both the administrator and guest accounts. You can also disable the guest account to prevent it from being used to access the system. You can change the administrator and guest account names through the Local Security Policy console. To do so, open the Local Security Policy console from the Administrative Tools folder then open the Local Policies/Security Options branch, where you'll find the policy options Rename Administrator Account and Rename Guest Account. You can use the Local Users And Groups console to completely disable the guest account, if desired.
Technical Tips © KRMS Productions 2000
CONTROLLING DRIVER AND SERVICE INSTALLATION BEHAVIOR
Windows 2000 introduced a new feature called Driver Signing, which enables drivers and services to be digitally signed to indicate that they've been tested for compatibility by Microsoft. While Driver Signing doesn't guarantee a problem-free driver or service, it's a good first step. Windows 2000 checks during installation to determine if a driver or service is signed, and if not, takes an action based on the way you've configured the appropriate security policy. You have three choices: Allow the installation to silently succeed, have Windows 2000 warn the user that the driver is unsigned but allow the installation to proceed, or not allow the driver to be installed. As with most other policies, the domain policy, if there is one, overrides the local policy. You'll find the two policy settings in the Local Policies/Security Options branch of the Local Security Policy console as Unsigned Driver Installation Behavior and Unsigned Non-Driver Installation Behavior. Just double-click the policy, select the desired value, and click OK.
Technical Tips © KRMS Productions 2000
VIEWING AND DISABLING SERVICES FROM THE RECOVERY CONSOLE
When you're trying to troubleshoot and recover a system that won't boot normally or won't let you log on, it's often helpful to be able to disable services that might be the source of the problem. The Recovery Console gives you three commands you can use to list services and their status, as well as change the startup mode for the service. For example, you might set a service's mode to Manual or Disabled if you think it's preventing the system from starting normally. Install the Recovery Console if it isn't already loaded, then boot the system to the Recovery Console. The LISTSVC command lists each available service and driver, giving you its name, startup mode, and friendly name. There are no switches for the command; just type LISTSVC at the console prompt. The ENABLE command lets you change the startup mode for a service. The syntax is: ENABLE servicename [start_type] where servicename is the name of the service to modify and [start_type] is one of these four values:
* SERVICE_BOOT_START
* SERVICE_SYSTEM_START
* SERVICE_AUTO_START
* SERVICE_DEMAND_START
Use ENABLE servicename with no start type to list the current start type. You can use the DISABLE command to disable a service. The syntax for the command is: DISABLE servicename where servicename is the name of the service to disable.
Technical Tips © KRMS Productions 2000
CONFIGURE WIN2K PROFESSIONAL AS A TELNET SERVER
Windows 2000 includes a service that lets the computer function as a Telnet server, enabling remote clients to connect and run command console sessions. Since Telnet offers a handy means of remote administration, you might want to enable the service on your workstation. Or, perhaps you simply want to be able to connect to your office computer when you're out of the office. Whatever the case, setting up the Telnet service is easy. First, decide how you want the service started. By default, the Telnet service is configured for manual startup, but you might want to configure it for automatic startup so it's available when you need it. Open the Services branch of the Computer Management console and start the Telnet service, then set its startup mode as desired. Next, open a Telnet client on another computer and attempt to connect via your new Telnet server's IP address or host name. You might also want to configure a logon banner and automatically execute commands when you log on (map drives and so on). When a user connects, the Telnet service runs the file %systemroot%\System32\Login.cmd. Modify the file in Notepad to suit your needs.
Technical Tips © KRMS Productions 2000
USING CERTIFICATE-BASED AUTHENTICATION FOR DIAL-UP CONNECTIONS
If you're concerned that someone other than your authorized users might compromise a dial-up account and gain access to your network, you can consider requiring certificate-based authentication for all dial-up connections. This helps lock out unauthorized users even if they have a valid user account and password, since they won't have the appropriate certificate to enable them to authenticate. The following assumes that you've already configured the dial-up server to require EAP-TLS as the authentication protocol.
Here's how to configure the client to use certificates for RAS authentication:
1. Obtain a computer certificate from a Certification Authority (CA) in your domain.
2. Install on the client computer the certificate obtained in step 1 (using the Certificates MMC console to do so).
3. Open the Network And Dial-Up Connections folder, right-click the dial-up connection, and choose Properties.
4. Click the Security tab, select Advanced, and click Settings.
5. Under Logon Security, select Use Extensible Authentication Protocol (EAP).
6. Select Smart Card or other Certificate from the drop-down list.
7. Click Properties to set additional options as needed, based on the following selections:
* VALIDATE SERVER CERTIFICATE: Causes your computer to verify that the certificate provided by the server has not expired. Deselect Let The Client Accept The Server's Certificate Without Validation.
* CONNECT ONLY IF SERVER NAME ENDS WITH: Use to limit connections to servers that reside in a specified domain.
* TRUSTED ROOT CERTIFICATE AUTHORITY: Select the trusted root certificate authority for your server.
* USE A DIFFERENT USER NAME FOR THE CONNECTION: Select this option if the user name stored in the smart card or associated with the certificate you're using is not the same as the user name you need to use to log on in the remote domain.
Technical Tips © KRMS Productions 2000