Showing posts with label Server 2003. Show all posts

Saturday, March 26, 2011

Tweak Server 2003

Saturday, March 26, 2011

Anu

Turn off Indexing to speed up Server 2003
To make searching your hard drive faster Server 2003 keeps a record of all the files on the hard drive. The downside to this is it will slow down normal file commands such as open, close, etc. If you don't do many searches (like me) it is better to turn off this feature. Here's how:
-Open my computer
-Right click your hard drive icon and select properties.
-At the bottom of the window find "Allow indexing service to index this disk for faster searches" uncheck this and click ok.
-A new window will pop up, select apply to all folders and subfolders. It will take a minute or two for the changes to take affect...you are done.

Prioritizing your IRQs
The essential components in your computer have an IRQ number assigned to them. With this tweak we can increase the priority given to any IRQ number, improving the performance of that component. This tweak is commonly used for the System CMOS/real time clock, which can improve performance across the board.
First of all, decide which one of your components you want to give a performance boost to.
Next, you have to figure out which IRQ that piece of hardware is using. Doing this is simple. Just go to Control Panel, then open the System panel (You can also press the shortcut of Windows Key +Break). Click on the fHardwaref tab, then on the fDevice Managerf button.

Right click on the component that you want to discover the IRQ for and then click fPropertiesf, and then onto the fResourcesf tab.

You now can see which IRQ this device is using.
Remember this number and close down all of the dialog boxes that you have opened, fire up RegEdit.

Next, navigate to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\PriorityControl

You will need to create a new DWORD value - called IRQxPriority (fxf is the IRQ number), finally set the data to 1.

Now restart and see the new improved performance. I recommend tweaking the CMOS, because it improves all around performance but the choice is up to you. You can prioritize more than 1 IRQ but it is definitely not recommended. You can easily remove this tweak by simply deleting the value that you originally created.

Memory Performance Tweaks

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management

Disable Paging Executive
Note: Only users with a large amount of RAM (256MB+) should use this setting.
By default, Windows Server 2003 pages sections from RAM memory to the hard drive. You can easily keep this happening and keep the data in RAM, resulting in improved performance. The setting we want to change to disable the fPaging Executivef, is called DisablePagingExecutive. Changing the value of this key from 0 to 1 will stop the memory paging.

System Cache Boost
Note: As with the above tweak, you should have at least 256MB of RAM before attempting to enable the LargeSystemCache tweak.
When changing the value of the key LargeSystemCache from 0 to 1 you tell Sever 2003 to allocate all but 4MB of the systems memory to the file system cache This simply means that the Server 2003 Kernel can run in the memory, significantly improving overall speed. The 4MB of memory left is used for disk caching, but if for any reason more is needed, Server2003 allocates more. This tweak improves performance a bit but can, this tweak can degrade performance in some intensive app's.

Input/Output Performance
Note: As with all these memory tweaks, you should only use this if you have 256MB or more of RAM.
This tweak is only beneficial to people running a server, it improves performance while a computer is performing large file transfer operations. By default, the value does not appear in the registry, so you will have to create a REG_DWORD value called IOPageLockLimit.
The data for this value is in bytes, and defaults to 512KB on machines that have the value. Most people using this tweak have found maximum performance in the 8 to 16 megabyte range but you should play around with the value to find whatfs best suited for you.
Remember that the value is measured in bytes, so if you want, 8MB allocated, itfs 8*1024*1024 = 8388608.

Unloading DLLs
Explorer can cache DLL files in memory for a length of time after they have finished being used. This results in giant amounts of memory being taken up by DLL files that are not even in use. Fix this by going to Windows Server 2003 Registry Editor and navigating to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Create a new sub-key called AlwaysUnloadDLL with a default value of 1.

If you want to disable this, just delete the key you made.

Enable Boot and Application Prefetching

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters

Change the value of "EnablePrefetcher" to 3

Disable Application/System Popup messages on Windows Startup
You can control what errors pop-up to interupt you by using the following registry keys (errors are still recorded in the event logs):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows

Add value NoPopUpsOnBoot as a REG_DWORD. When set to 1, Boot pop-up messages are suppressed. The default is 0.

Add value ErrorMode as a REG_DWORD.
0 - All system and application errors Pop-up (this is the default).
1 - Errors from system processes are suppressed.
2 - All system and application errors are suppressed.

To Disable The Notification Area Balloon Tips

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Right-click the right pane, create a new DWORD value, and then name it EnableBalloonTips.
Double-click this new entry, and then give it a hexadecimal value of 0.

Kill Shut Down Tracker
If you want to remove the Shutdown Event Tracker, the new .NET Server feature, and don't want to document the shutdowns in Event Logs especially in a testing environment, you can easily disable this feature in the Local Computer Policy MMC.
This console is not in the Administrative tools by default, so you have to create it:

1. Open a blank MMC console by typing mmc from the command line.

2. From the empty console, click the File menu and select Add/Remove Snap-in or press Ctrl+M.

3. From the Add/Remove Snap-in page, click Add or Alt+D, choose Group Policy, select Local Computer and click finish.

4. From the Add Standalone Snap-in page, click Close. From the Add/Remove Snap-in page, click OK.

5. Expand Local Computer Policy, Computer Configuration, Administrative Templates, System and in the right pane locate Display Shutdown Event Tracker.

6. Double-click the Display Shutdown Event Tracker and select Enabled. Change the drop-down selector to Never.

7. Click OK to accept the policy change. Close the MMC console, saving it if prompted to so.

Optimise NTFS
Disable last access time by pointing regedit to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem and set ' �eNtfsDisableLastAccessUpdate ' to 1 (DWORD).

Enable or disable boot defrag
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction
Select Enable from the list on the right.
Right on it and select Modify.
Change the value to Y to enable and N to disable.
Reboot your computer.

Classic Win2000 Style Search

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState

Add a new string (REG_SZ) called "Use Search Asst" - set the value to "no" and you will have the classic win2000 search

Disable CD autoplay

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

Create a new value called: NoDriveTypeAutoRun
Type is: DWORD
Value is: 0x000000b5 (181)

Start Menu Speed:

HKEY_CURRENT_USER/Control Panel/Desktop/

on the right you'll see MenuShowDelay change the value there.
Then reboot

Friday, December 17, 2010

How to secure Windows Server 2003? (Network Admin)

Friday, December 17, 2010

Anu

Security is a top concern for network administrators. Deploying a newoperating system like Windows Server 2003 requires learning some newsecurity tricks.

Security is an increasingly important topic for networkadministrators. It's an ongoing battle to make sure you've installed all of thelatest updates along with keeping up to date with all of the developingthreats. Properly securing server begins with planning. When you're deployingWindows Server 2003, you can use these tips to make sure you've done so whileproperly securing it.

That being thecase, I decided to focus this article on some of the lesser known hardeningtechniques. These techniques are no substitute for the basics, but whencombined with standard security techniques they can help you to build a verysecure network. For information on the essentials, I recommend checking outMicrosoft's Windows Server 2003 Security Guide. You can download it for free atMicrosoft'sWeb site.

Protect your authentication mechanisms

There's an old proverb stating that a chain is only asstrong as its weakest link. That saying is especially true when you are talkingabout a network's chain of security mechanisms. I know a lot of people whospend countless hours making sure that every packet flowing across the networkis authenticated and encrypted, and that all of the files on the server's harddisk have the proper permissions assigned to them. Such measures are important,but the fact is that the vast majority of hacks are perpetrated by usinglegitimate user accounts.

User IDs and passwords

In most networks, the user accounts themselves are by farthe weakest part of the network's entire security infrastructure. A hacker onlyneeds to know two pieces of information (a user name and a password) to be ableto access anything on your entire network. Sure, encrypting all of the packetsas they flow across the wire will help to prevent a hacker from sniffingpasswords, but there are plenty of other ways that hackers can acquirepasswords.
One of the oldest password acquisition methods still worksto this day. That's a brute force crack. Like I said, a hacker must have ausername and a password in order to gain full access to your network resources.Of course, Microsoft was kind enough to provide the hackers with the user namefor you; Administrator. That means that hackers only need to figure out theAdministrator's password in order to gain access to your network.
Microsoft has long recommended that you change the name ofthe Administrator account so that hackers won't know what it is. The problem isthat even if you change the account name, the account's SID remains the same.Since Microsoft uses a specific SID for the Administrator account, it's fairlyeasy to figure out what the account has been renamed to, just by examining theSIDs. In fact, there are even GUI utilities that can automatically tell you whatname the Administrator's account is using.
Although this is the case, I still recommend renaming theAdministrator account, because doing so may deter less sophisticated hackers.Besides, your other security mechanisms, such as your firewall, and packetlevel encryption, may help prevent such utilities from functioning correctly.
Let's assume for a moment that a hacker knows what they aredoing and they are able to quickly determine the name of your Administratoraccount. They would then simply need to figure out the password. This is wherethe brute force crack that I mentioned earlier comes into play. Windows isdesigned so that the Administrator account can't be locked out. This means thata hacker is free to perform a brute force crack against the password withoutfear of locking out the account.
Normally, your defenses against such an attack are frequentpassword changes and reviews of the audit logs. The idea is that it takes solong to crack a complex password that you change the password before the hackerhas the chance to try every possible password. If you've got auditing enabled,you would also notice a very high number of unsuccessful login attempts.

Renaming Administrator

What a lot of people don't realize though is that there isanother way of defending yourself against this type of attack. However, themethod that I am about to show you can be very dangerous, and you need tocarefully consider its impact before attempting this.
Unlike other versions of Windows Server, Windows Server 2003allows you to manually disable the Administrator account. You can therefore setother users up with administrative privileges and then disable the Administratoraccount. That way, if a hacker does figure out the name of the Administrator'saccount, it is useless because the account is disabled.
The reason why this technique is so dangerous is because ifyou don't set up your alternate administrative accounts just right, you mayfind yourself permanently unable to perform essential tasks. You must also keepin mind that your alternate accounts can be locked out by incorrect passwordattempts. Someone could lock you completely out of your network by purposelyentering incorrect passwords for your alternate administrative accounts. Ifthat happened, the only way that you could get back into your network would beto perform an authoritative Active Directory restore, and you might not even beable to do that if your backup software requires authentication.

SAM

While I am on the subject of stolen passwords, there isanother technique that hackers can use to steal a password. If a server is toauthenticate user's logins, the server must know the user's password so that itcan compare the password that has been entered against the stored password. Anycomputer that's running Windows 2000, XP, or 2003 stores user's passwordswithin the Security Accounts Manager.
Technically, the SAM doesn't contain the passwordsthemselves. The password is hashed, and then the hash is encrypted and storedwithin the SAM. When you first read about the way that Windows storespasswords, it sounds fairly secure. There are a couple of problems with thestorage method. For starters, the encryption key is stored on the server rightalong with the hashes that the key encrypts. To make matters worse, the hashingalgorithm is fairly well known. In fact, there are several utilities availableoff the shelf that will allow anyone who has physical access to the machine toreset a password without knowing supplying any sort of login credentials. Thereare also a few "password recovery utilities" that are allegedly ableto retrieve passwords directly from the SAM database.
Naturally, your first line of defense against such anexploit is to make sure that your servers are kept behind a locked door toprevent anyone from gaining physical access. If controlling physical access isimpossible where you work, or if you just want to provide an extra level ofsecurity, then there is a technique that you can use to move the encryption keyoff of the server.
Before I explain how to accomplish this, I need to warn youthat this is another dangerous operation. When you lock down the encryptionkey, you have two options. Your first option is to export the encryption key toa floppy disk. The reason why this is dangerous is because when you boot theserver it will ask for the floppy disk. If you lose the disk or if the diskbecomes damaged or unreadable, the server will be rendered unbootable. Theother down side to using this method is that you lose the ability to remotelyreboot the server because you can't boot the server without physicallyinserting a disk.
The other option that you have is to encrypt the encryptionkey. This method involves assigning a password to the encryption key. When youboot the server, you will be prompted to enter the password. Upon doing so,Windows decrypts the encryption key, which allows Windows to access the SAMdatabase. In my opinion, this technique is a little safer than exporting theencryption key to a floppy disk, but the technique still has risks. If you wereto forget the password, the server will be unbootable. Likewise, you couldpotentially lose the ability to remotely reboot the server depending on howyour remote control software works. If you decide that you want to protect theencryption key, the MicrosoftKnowledgebase contains an excellent article that explains how to go aboutdoing so.
One other thing that you can do to help secure theauthentication process is to use multiple authentication methods. There arethree things that can be used to authenticate a person's identity. You can usesomething that the person is, something the person has, or something that theperson knows. An out of the box Windows deployment typically uses only one of thethree authentication tests. The test used by Windows is something that theperson knows, which is of course a username / password combination.

Dual authentication

You can achieve much greater security by using at least twoauthentication methods for users. Since Windows already uses something that theuser knows, you might add something that the user is (biometrics) or somethingthat the user has (such as a smart card).

Granting privileges

Up to this point, I have talked primarily about varioustechniques that you can use to enhance the security associated with user'spasswords. When designing a secure network, you must also consider what a usershould and should not have access to once they log in.
The current standard for user rights is that users shouldhave the lowest possible set of privileges that will permit them to do theirjobs. The most effective way to assign these permissions is almost alwaysthrough security groups. For example, suppose that you had some users whoneeded access to the company's payroll database. Rather than granting theindividual users permission at the NTFS level, you should create a group forthe users who will need access to the payroll database and assign permissionsto that group. Doing so makes network management a lot easier. If someone wereto ask you which users have access to the payroll database, you could simplycheck the group membership rather than tracking down a bunch of individualpermissions.
As you plan your network's security structure, I recommendcreating groups and designing the server's folder structure in such a way thatthere are no overlaps. Imagine for example that everyone in the financedepartment needs access to the payroll database, but that there are a few peoplefrom outside of finance that also need payroll access. You could theoreticallycreate a folder called finance and then grant the finance group permissions toit. You could then place the payroll folder beneath the finance folder andcreate a payroll group. By doing so, everyone in the payroll group and in thefinance group would have access to the payroll.
Although this arrangement would technically work, it isn't agood idea to configure your folder structure in this way because as the networkgrows, management becomes difficult. If someone asked you who had access topayroll, you would have to check the payroll group and the finance group,rather than being able to check one single group. It isn't always possible toavoid overlapping permissions, especially when different people need differentlevels of access to a folder, but your life will be a lot easier if you avoidoverlapping permissions whenever possible.

Active Directory

There is one last security trick that I want to show you.Throughout this article, I have talked about ways that authentications can becompromised and how groups can be configured for optimal security. All of thisinformation is maintained within the Active Directory. I'll admit that theActive Directory isn't the easiest thing in the world to hack, but the ActiveDirectory database does make a tempting target because it consists of easilyrecognizable files (NTDS.DIT, EDB.LOG, and TEMP.EDB) and those files reside ina predictable location (usually C:\Windows\NTDS).
What a lot of people don't realize is that you can make ahacker's job just a little bit more difficult by moving the Active Directorydatabase to an unexpected location. If your domain controller happens to have aRAID array, then the array makes an excellent choice because the database isprotected from drive failure and because array's offer better performance thana standalone hard disk.
Moving the databases is simple, although it does require aserver reboot. Boot the machine into Active Directory Restore mode and thenenter the NTDSUTIL command followed by the Files command. Now, just use theMOVE DB TO or MOVE LOGS To command to move the database and its log files tothe new location.

Do the basics

Although there are a lot of standard techniques for deployinga secure network, it is often better to throw the hackers a few curve ballsthan to do everything by the book. In this article, I have shown you severalsecurity techniques that you can use to make your Windows deployment moresecure.

Thanks....

Monday, November 8, 2010

How to increase (set 75 GB) store limit of exchange 2003?

Monday, November 08, 2010

Anu

Even though Exchange 2003 has been very stable for us, SP2 isalready installed on the test server here and I’ve been doing some reading todetermine how soon we’ll need to install it. The biggest positive I’ve foundyet is the increase in the mail database limit to 75GB on the Standard versionof Exchange 2003. This is a much-needed increase, and the only reason we’rerunning Exchange’s expensive Enterprise version is our need to accomodate hugeattachements from cour clients. I also have a personal client intelevision-services who will be thrilled to know their four users can now storevideo clips in exchange, instead of constantly archiving to one big folder onthe network.

The 75GB database limit isn’t setautomatically when SP2 is installed. After all, 75GB exceeds a lot ofexpectations of the Exchange server and the disk space on most older servers.Since so few admins read the documentation, they might miss this change andlock up their servers. The registry change below, can be set to anyvalue between 1 and 75, the maximum size of the Exchange database in GB’s. Bydefault Exchange 2003 SP2 pushes the default database size to about 18GB, whichis the original 16GB maximum plus a 10% over-limit buffer to keep mail comingin while Exchange floods the system with alerts about the database size.

To expand the Exchange database, orset a limit between 1 & 75GB:

1: Open regedit and navigate to

HKLM\SYSTEM\CurrentControlSet\Services\ MSExchangeIS\SERVER_NAME\Private-STORE_GUID

To change the Public store limit, navigate to

HKLM\SYSTEM\CurrentControlSet\Services\ MSExchangeIS\SERVER_NAME\Public-STORE_GUID

2: In the event your Exchange server has more than one private or public store the GUID of each store can be found by running ADSIEDIT.msc and navigating to:

CN=MAILBOX_STORE_NAME(SERVER_NAME),CN=STORAGE_GROUP_NAME, CN=InformationStore,CN=SERVER_NAME, CN=Servers,CN=FirstAdministrative Group,CN=Administrative Groups,CN=Organization name,CN=MicrosoftExchange,CN=Services,CN=Configuration,DC=domain,DC=com

SERVER_NAME,STORAGE_GROUP_NAME, and MAILBOX_STORE_NAME reflect the mail store to bechanged. Then take note of the objectGUID:… value for that mail store.

3: Create a new REG_DWORD value in the registry key for the correct GUID. Name it “Database Size Limit in Gb” and set the value from 1 to 75.

4: Assuming you are newly setting the “Database Size Limit in Gb” value, it will be detected at the next size check. Reboot the Information Store service for immediate recognition.

By setting the “Database Size Limitin Gb” key the mailbox store will not exceed that value. When the mail storereaches 90% off that value, a default 10% buffer is allowed, it will begin tolog event ID #9689 to notify you that the store limit has been reached.

Oncethe mail store does reach the maximum limit the first size check, which happensevery 24 hours at 5am, will not take the database offline. The second sizecheck will dismount the store that exceeds the limit.

Both the % of the mail store used asa buffer and the time of the database size check can be changed within the sameGUID registry key referenced above.

To set either, create a REG_DWORD valuenamed “Database Size Buffer in Percentage” or “Database Size Check Start Timein Hours From Midnight”.

Set their values from 1 to 100 or 0 to 23 to change,respectively, the buffer % or the offset from midnight for the size check.

The Exchange 2003 Enterpriseinformation store can also be limitted by the “Database Size Limit in Gb” key.

The valid range of values is 1 to 8000. If the key is not set, the defaultvalue is 8000GB.

It still amazes me that the ExchangeSystem Manager doesn’t have settings for either “max. database size” or “min.disk space remaining on server”.

Isn’t that the whole point of Exchange? …thatit’s faster and easier to run because it doesn’t require the amount ofexperience and forethought that Postfix does.

Update: This same registry tweak is also supported on Windows SmallBusiness Server 2003 (SBS). See the comments below for a link the the SBS 2003FAQ.

Thanks

Friday, October 15, 2010

How to run MSTSC (Remote Desktop) in Dual Monitor Mode?

Friday, October 15, 2010

Anu

All-In-One Windows 2003 Performance and Security Tweaks

Friday, October 15, 2010

Anu

Tweaking in windows is very useful when your system can't perform accurate work on accurate time n also they are useful if you want to secure your system from Viruses or Hackers.

Here is a complete list of all Security and Performance tweaks of Windows Server 2003....

With that tweaks you can use your computer as a AMD or Itanium ....

These tweaks is only an overview, for all tweaks (Performance and Security) you ,must download these files :

1st File

2nd File

Windows 2003 Performance and Security Tweaks :

you are done.

Prioritizing your IRQs

The essential components in your computer have an IRQ number assigned to them.With this tweak we can increase the priority given to any IRQ number, improvingthe performance of that component. This tweak is commonly used for the SystemCMOS/real time clock, which can improve performance across the board. First ofall, decide which one of your components you want to give a performance boostto. Next, you have to figure out which IRQ that piece of hardware is using.Doing this is simple. Just go to Control Panel, then open the System panel (Youcan also press the shortcut of Windows Key +Break).

Click on the Hardware tab, then on the Device Manager button.

Right click on the component that you want to discover the IRQ for and thenclick Properties, and then onto the Resources tab.

You now can see which IRQ this device is using. Remember this number and closedown all of the dialog boxes that you have opened, fire up RegEdit. Next,navigate to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ Control\PriorityControl

You will need to create a new DWORD value - called IRQxPriority (x is theIRQ number), finally set the data to 1.

Now restart and see the new improved performance. We recommend tweaking theCMOS, because it improves all around performance but the choice is up to you.You can prioritize more than 1 IRQ but it is definitely not recommended. Youcan easily remove this tweak by simply deleting the value that you originallycreated.

Memory Performance Tweaks

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\SessionManager\MemoryManagement

System Cache Boost

Note: As with the above tweak, you should have at least 256MB of RAM beforeattempting to enable the LargeSystemCache tweak.

When changing the value of the key LargeSystemCache from 0 to 1 you tell Sever2003 to allocate all but 4MB of the systems memory to the file system cache.

This simply means that the Server 2003 Kernel can run in the memory,significantly improving overall speed.

The 4MB of memory left is used for diskcaching, but if for any reason more is needed, Server2003 allocates more.

Thistweak improves performance a bit but can, this tweak can degrade performance insome intensive app's.

Input/Output Performance

Note: As with all these memory tweaks, you should only use this if you have256MB or more of RAM.
This tweak is only beneficial to people running a server, it improvesperformance while a computer is performing large file transfer operations.

Bydefault, the value does not appear in the registry, so you will have to createa REG_DWORD value called IOPageLockLimit.

The data for this value is in bytes,and defaults to 512KB on machines that have the value.

Most people using thistweak have found maximum performance in the 8 to 16 megabyte range but youshould play around with the value to find whatfs best suited for you.

Rememberthat the value is measured in bytes, so if you want, 8MB allocated, itfs8*1024*1024 = 8388608.

Unloading DLLs

Explorer can cache DLL files in memory for a length of time after they havefinished being used. This results in giant amounts of memory being taken up byDLL files that are not even in use. Fix this by going to Windows Server 2003Registry Editor and navigating to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer

Create a new sub-key called AlwaysUnloadDLL with a default value of 1.

If you want to disable this, just delete the key you made.

Disable Application/System Popup messages on Windows Startup
You can control what errors pop-up to interupt you by using the followingregistry keys (errors are still recorded in the event logs):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\Windows

Add value NoPopUpsOnBoot as a REG_DWORD.

When set to 1, Boot pop-up messagesare suppressed.

The default is 0.
Add value ErrorMode as a REG_DWORD.
0 - All system and application errors Pop-up (this is the default).
1 - Errors from system processes are suppressed.
2 - All system and application errors are suppressed.

Kill Shut Down Tracker
If you want to remove the Shutdown Event Tracker, the new .NET Server feature,and don't want to document the shutdowns in Event Logs especially in a testingenvironment, you can easily disable this feature in the Local Computer PolicyMMC. This console is not in the Administrative tools by default, so you have tocreate it:

1. Open a blank MMC console by typing mmc from the command line.

2. From the empty console, click the File menu and select Add/Remove Snap-in orpress Ctrl+M.

3. From the Add/Remove Snap-in page, click Add or Alt+D, choose Group Policy,select Local Computer and click finish.

4. From the Add Standalone Snap-in page, click Close. F

rom the Add/RemoveSnap-in page, click OK.

5. Expand Local Computer Policy, Computer Configuration, AdministrativeTemplates, System and in the right pane locate Display Shutdown Event Tracker.

6. Double-click the Display Shutdown Event Tracker and select Enabled. Changethe drop-down selector to Never.

7. Click OK to accept the policy change. Close the MMC console, saving it ifprompted to so.

Optimisze NTFS
Disable last access time by pointing regedit to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\FileSystem

and set 'eNtfsDisableLastAccessUpdate ' to 1 (DWORD).

1st File

2nd File

Enable or disable boot defrag
Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Dfrg\BootOptimizeFunction

Select Enable from the list on the right.
Right on it and select Modify.
Change the value to Y to enable and N to disable.
Reboot your computer.

Classic Win2000 Style Search

HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Explorer\CabinetState

Add a new string (REG_SZ) called "Use Search Asst" -

set the value to"no" and you will have the classic win2000 search

Disable CD autoplay

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\policies\Explorer

Create a new value called: NoDriveTypeAutoRun
Type is: DWORD
Value is: 0x000000b5 (181)

Start Menu Speed:

HKEY_CURRENT_USER/Control Panel/Desktop/

on the right you'll see MenuShowDelaychange the value there.
Then reboot

These tweaks is only an overview, for all tweaks (Performance and Security) you ,must download these files :

1st File

2nd File

TWEAKS : How to hide/show your specified Control Panel Icons in XP/2003/VISTA/2008/WIN7?

Friday, October 15, 2010

Anu

Friday, September 10, 2010

Windows Server 2003 Registry tweaks

Friday, September 10, 2010

Anu

Advanced users of Windows XP are used to digging around in the Registry looking for ways to tweak performance or push the envelope of Windows' abilities. Provided you back up your Registry before hacking it, no harm usually comes from such endeavors. What about tweaking servers though? What gains can be achieved by making Registry modifications to Windows Server 2003 and its various services such as Terminal Services, Internet Information Services, networking subsystem, and so on? Here are three of my favorite Windows Server Registry tweaks and the reasons you need to know about them. Plus, along the way, we'll learn a bit about the correspondence between the Registry and Group Policy. But please make sure you back up your Registry before you try any of these tweaks, just in case you make a mistake.

Monitor Winlogon Activities with Verbose Status Messages

What's going on when you start up your server?

Windows is notoriously secret about many of its activities, but by enabling verbose messages for the Winlogon service, you can closely monitor what's happening when your server boots up or shuts down, or when you log on or off the machine. Here's how to do it.

First, find the following Registry key:

HKLM\SOFTWARE\Microsoft\ Windows\CurrentVersion\Policies\System

Create a new REG_DWORD value here named verbosestatus and assign it the value 0x01. Now when you log on, log off, start up, or shut down your machine, you should see extra information describing what services are starting and what other activities are taking place on your machine. If you don't see this extra info, check the Registry key above again and see if there is a value named DisableStatusMessages present and if so, set this value to 0x00 or remove it.

Note that enabling verbose status messages for Winlogon requires a reboot.

A Brief Aside on Group Policy

Wait just a minute-- there's an easier way to do this!

If you want to enable verbose logging for a number of machines in a domain, use Group Policy instead of editing the Registry on each machine. Open the Group Policy Object (GPO) that's linked to the organizational unit (OU) where the computer accounts for these machines reside, and configure the following policy:

Computer Configuration\Administrative Templates\System\Verbose vs normal status messages

Also check the following policies:

Computer Configuration\Administrative Templates\System\Remove Boot / Shutdown / Logon / Logoff status messages

You can see that these two policies do the same thing as the two Registry values we looked at previously. That's not surprising--the Administrative Templates section of the machine or user portion of a GPO is basically just a tool for modifying Registry settings on targeted computer and user accounts, and in a domain environment, it's much easier to tweak the Registry by using Group Policy than to use Regedit.

Lightweight Domain Controllers at Branch Office Sites

Windows 2000 Server had some problems with domain controllers at remote sites, particularly when universal groups were used. If the domain controller at your remote site was a global catalog server, it generated a lot of replication traffic over the WAN, which could swamp a slow link from time to time. And if your domain controller wasn't a global catalog server, then users at your site might have experienced slow logons as their universal group memberships were enumerated by a global catalog server at headquarters.

Windows Server 2003 solved all this by allowing domain controllers to cache universal group membership lists; that way, you could reduce WAN traffic by not having to make your remote DC a global catalog server. Plus, you got increased availability because users at your site could still log on even if the link went down.

But there's an alternative to using universal group caching that involves changing the following Registry key on the domain controller at your remote site:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa

Create a new REG_DWORD value here named IgnoreGCFailures and assign it the value of 0x01. Then reboot your domain controller.

The result? You've essentially turned your domain controller into the Windows Server 2003 equivalent of a Backup Domain Controller (BDC), which was a DC on the old Windows NT 4.0 platform that contained a read-only copy of your accounts database. In other words, the users at your remote site will now be able to log on to this domain controller despite the fact that it isn't a global catalog server, even when your WAN link goes down--and even if they are members of universal groups. The catch, though, is that if you use this hack, then you shouldn't use universal groups, because a security hole can result (users may get access to resources they shouldn't).

Why would you want to do this? Why not just enable universal group caching for the remote site?

The main reason is that configuring this Registry value reduces the hardware requirements for your remote domain controllers (think NT 4.0, where BDCs needed less beefy hardware than your PDC). This can be significant if your company has lots of small sites scattered around the country. For more information regarding this scenario, see this article in the Microsoft Knowledge Base.

Broadcasting Server Descriptions

Finally, here's a lightweight tweak that can really make a difference to your users, especially if you have a number of file servers they need to find and access regularly on the network.

I'm thinking here of the typical mid-sized business that still has four file servers running Windows 2000 Server, two running Windows Server 2003, and maybe even a few still running (eek!) Windows NT 4.0 Server. If you're still one of these shops, and you've run out of drive letters for mapping network drives to shares on your servers using logon scripts, then your users are probably stuck browsing My Network Places to try to find the server they want so they can do their work, and that's brutal. Fortunately, this simple Registry hack will make life a lot easier for them. Look for this key:

HKLM\SYSTEM\CurrentControlSet\ Services\LanmanServer\Parameters

If a REG_SZ value named srvcomment doesn't exist here, create it. Then open the value and enter a text string that describes the server, such as "Accounting File Server." This string will be displayed in the Comment field next to the server name the next time the user browses to this server using My Network Places.

Of course, you could always configure this setting on the server by right-clicking on My Computer, selecting Properties, selecting the Computer Name tab, typing "Accounting File Server" in the Computer Description textbox, and clicking Apply. But what fun is that?

Blog Archive

Popular Posts

Saturday, March 26, 2011

Tweak Server 2003

Friday, December 17, 2010

How to secure Windows Server 2003? (Network Admin)

Protect your authentication mechanisms

User IDs and passwords

Renaming Administrator

SAM

Dual authentication

Granting privileges

Active Directory

Do the basics

Monday, November 8, 2010

How to increase (set 75 GB) store limit of exchange 2003?

Friday, October 15, 2010

How to run MSTSC (Remote Desktop) in Dual Monitor Mode?

All-In-One Windows 2003 Performance and Security Tweaks

TWEAKS : How to hide/show your specified Control Panel Icons in XP/2003/VISTA/2008/WIN7?

Friday, September 10, 2010

Windows Server 2003 Registry tweaks

Followers

Facebook

Networked Blogs