Securing Windows 2003 Server System

If your server is running Windows 2003 Server Edition, you need to make a few changes to help keep your server and client machines safe. This page is written with the assumption that you're a system administrator running an on-campus server; some of the following resources may not be available from off campus.

Essentials

• Keep your system and software up to date:
• This is one of the easiest, most effective things you can do to keep your computer secure. You can either update manually with Windows Update, or configure your systems to download updates automatically from the campus WSUS server, which provides critical Microsoft patches from an on-campus location. You can choose whether the WSUS server prompts you to confirm installations or whether patches are automatically installed.
• Install antivirus software:
• The vast majority of viruses are designed to affect Windows systems. The University of Illinois at Urbana-Champaign provides free site-licensed antivirus software that is configured to automatically update itself and protect your system.
• If you are a campus system administrator, you can also use ePolicy Orchestrator to coordinate distributing antivirus updates from your server to the client machines that you supervise. More information about ePolicy Orchestrator is available from the CITES Security Services Archive and requires Bluestem authentication to identify yourself as a campus system or network administrator. The list is maintained through Contact Manager. If you need to be added to the list of people authorized for access to the archive, but aren't listed in Contact Manager, contact securitysupport@uiuc.edu.
• Install anti-spyware software:
• Many of the nuisance-level problems afflicting Windows computers are caused by spyware rather than viruses. Spyware can cause effects ranging from a noticeable slowing of your computer to pop-ups and hijacked web browsers; spyware can also be malicious, reporting personal information from credit cards to passwords to other unauthorized websites. Fortunately, the campus has site-licensed anti-spyware software for students, faculty, and staff. For more information, see the CITES Anti-spyware pages.
• Install Service Pack 1 (SP1) and the Security Configuration Wizard (SCW):
• Microsoft's Service Pack 1 offers several security enhancements and tools for Windows 2003 Server administrators. The two most significant enhancements are the inclusion of a server firewall and the Security Configuration Wizard (which must be installed after Service Pack 1). To install SCW after installing Service Pack 1, go to Add or Remove Programs -> Add/Remove Windows Components and select the Security Configuration Wizard check box. After this, the Security Configuration Wizard will be available in the Administrative Tools section of the Control Panel.
• The Security Configuration Wizard provides a centralized way to check your server's security, to make changes as required (including managing the firewall), and to roll back changes if anything doesn't behave as expected. The graphical user interface allows you to administer one server, and a command line option (scw.exe) allows you to create group policy objects which can be used on many computers.
• Use "Manage Your Server" to enable only the services you need
• Windows 2003 Server introduces a more secure method of controlling access to your server. By default, all of the potential server services are turned off until you enable them. The "Manage Your Server" tool, found in Programs -> Administrative Tools, provides a central location to track which services are enabled. It provides roles for your server -- for example, a DNS server role, a web server role, an email server role -- and allows you to decide how many of these roles are enabled.
• Use both campus firewall and server firewall protection:
• A properly configured server firewall can be very effective in reducing the amount of network traffic that is allowed to reach your server and systems connected to it. With the release of Windows Server 2003's Service Pack 1 (described above), you can enable and administer a firewall on your server with a few clicks. You can also take advantage of campus firewall protection by joining your server to one of the available firewall groups; see Campus Firewalls for more information.
• Choose a good password:
• Any computer that will have multiple users or be attached to a network needs to have good password protection for each user. Password tips and advice can be found in the CITES Guide to Passwords.

In many versions of Windows, a user name can have a blank password, which allows anyone to log in to the computer simply by clicking. Make sure that all user accounts on the machine have passwords to protect access to your computer.

Source:cites.illinois.edu/security/by_os/win2k3srv.html

Google's Send Mail Server Security Certificate Expires

It appears that Google's Gmail SMTP (send mail) server might have let their secure certificate expire. I personally just got notified that the smtp.gmail.com server was not secure, due to the certificate expiring. Here is a screen capture:-

So, it seems like it just expired just minutes ago. I asked others to confirm the issue and they said they are getting the same error.

Scott Hodge did twit about a month ago about the same issue. But this is the first time I am seeing this issue and the certificate clearly shows that it expired just minutes ago.

Postscript: A Google spokesperson told for a short time this morning, some Gmail users sending mail via POP and IMAP saw a notification on their mail clients that the SMTP certificate had expired. We identified the problem and fixed it promptly. We know how important Gmail is for our users, and we apologize for any inconvenience this may have caused.

Small Business Computer Support and Microsoft Exchange Server Support will always be provided by the Microsoft Certified Techs 24x7..

Windows Server Security Guide

The Windows Server 2003 Security Guide provides specific recommendations about how to harden computers that run Microsoft Windows Server 2003 with Service Pack 1 (SP1) in three distinct enterprise environments—one in which older operating systems such as Windows NT 4.0 and Windows 98 must be supported, one in which Windows 2000 is the earliest version of the Windows operating system in use, and one in which concern about security is so great that significant loss of client functionality and manageability is considered an acceptable trade off to achieve maximum security. These three environments are respectively referred to as the Legacy Client (LC), Enterprise Client (EC), and Specialized Security – Limited Functionality (SSLF) environments throughout this guide.

Guidance about how to harden computers in these three environments is provided for a group of distinct server roles. The countermeasures that are described and the tools that are provided assume that each server will have a single role. If you need to combine roles for some of the servers in your environment, you can customize the security templates that are included in the download able version of the guide to create the appropriate combination of services and security options. The server roles that are referenced in this guide include the following:

	Domain controllers that also provide DNS services
	Infrastructure servers that provide WINS and DHCP services
	File servers
	Print servers
	Web servers that run Microsoft Internet Information Services (IIS)
	Internet Authentication Services (IAS) servers
	Certificate Services servers
	Bastion hosts

Significant efforts were made to make this guidance well organized and easily accessible so that you can quickly find the information that you need and determine which settings are suitable for the computers in your organization. Although this guide is intended for enterprise customers, much of the information that it contains is appropriate for organizations of any size.