Mark Minasi's Windows Networking Tech Page
Issue #74 December 2008

Performance

64-bit processors and Memory

More RAM is supported

Ø  A 32-bit processor can only access upto 4 GB of RAM. 64-bit processors can directly access 18,000,000,000 GB. This is especially critical for Domain Controllers (DCs). DCs attempt to cache the entire Active Directory as soon as they are up and running. If AD is too big then accessing information from disk is much slower than if the entire AD was cached into memory. This is a huge performance enhancement. Please see the “Active Directory Performance for 64-bit Versions of Windows Server 2008” (URL is listed at the end of this table) white paper.

Exchange 2007

No 32-bit

Ø  Exchange 2007 is not supported to run on 32-bit architecture. Must be run on 64-bit machines.

Server 2008

Last 32-bit OS

Ø  Microsoft has stated that Windows Server 2008 is the last server operating system that will run on 32-bit architecture.

Group Policies

Enhanced Group Policy Features

Ø  Security settings are stored in group policies (GP) and must be kept in sync between all Domain Controllers (DCs). The group policies are stored in a folder called Sysvol which is replicated amongst all DCs. 2008 offers a much faster, scalable and more reliable replication engine called Distributed File System Replication or "DFS-R" rather than the older "File Replication Service" (FRS) engine. The domain mode must be elevated to 2008 Native level for DFS-R to replicate Sysvol. DFS-R can replicate changes only to group policies where FRS replicates the entire GP, FRS had no way to replicate just the changes. Remote Differential Compression (RDC) allows files to be created locally without consuming any network bandwidth at all.

Ø  Printer Deployment using GPO’s can now use Active Directory group association vs. previously only users or workstations were allowed.

Ø  More efficient group policy storage. The ADM files are no longer stored within the GPO (this is a big one). This greatly reduces the size of Sysvol.

Ø  GPO-based power management (please see the Windows Server 2008 Power Savings paper).

SMB 2.0

Used to map drives to servers or workstations

Ø  On-the-wire-encryption for Vista and Server 2008. With XP/2003 moving encrypted files across the network keeps them encrypted at the source and destination, but transfers them across the wire unencrypted.

Ø  2.5-3.3x speed improvement over WAN lines (understands round trip delays of data packets and how to handle them).

Ø  Only works between Server 2008 and Server 2008, or Server 2008 and Vista.  This is a tremendous improvement in file copying and a valuable point for field sites that won’t get their own server.

Ø  More resistant to NetBIOS attacks.

New TCP/IP stack

More robust and reliable

Ø  Native IPv6 support allowing US government-related organizations to meet the government mandate that all future datacomm equipment be IPv6-capable.

Ø  New TCP receive-side window sizing algorithm provides faster performance across the network.

Ø  Microsoft Firewall settings are loaded prior to the TCP/IP stack sending or receiving data. This keeps the TCP/IP stack protected during the loading of the operating system.

Event Viewer

Store events

Ø  The new event viewer can forward events to a central storage location. This only works between Server 2008 and Server 2008 or Vista. You choose which events will be stored.

Previous Versions

Automatic feature allowing recovery of corrupt or deleted documents

Ø  Previous Versions in the past were only available by connecting to a server through a shared folder and accessing the previous versions of files and folders. Now you can access previous versions of documents and folders in Windows Explorer. This allows recovering a document that may have  become corrupt or was deleted. Previous Versions is a component of the Volume Shadow Copy service.

Complete PC Backup

New backup utility

Ø  Image based backup tool allows for bare-metal restores of dead servers.

Hyper-V

Virtualization software

Ø  Hyper-V is the new software that allows creating virtual machines.

Deployment Tools

Windows Deployment Service

Ø  Windows Server 2008 allows multicasting of operating system images so they can be deployed faster and consume less bandwidth.

Password Policies

Fine Grained

Ø  You can enforce different password restrictions (i.e. password length, complexity, history) based on AD groups.

DNS “GlobalNames”

DNS-based alternative to WINS

Ø  Allows you to associate single-label names (ie "server44" rather than "server44.bigfirm.com") with particular Fully Qualified Domain Names or FQDNs.

Remote Desktop Protocol (RDP)

Remote control protocol

Ø  MUCH faster, more reliable and secure remote connectivity.

Windows Remote Management Protocol

Assists RDP

Ø  More secure protocol for remote management.

Windows Remote Shell

Remote Control Protocol

Ø  Very low bandwidth utilized when remotely controlling a Server or Workstation and on a par with Unix/Linux's secure shell (SSH) -- remote command-line control.

Terminal Services

Improved feature set

Ø  Gateway - Much faster SSL-based secure connection from a remote location to a desktop or TS behind a firewall.

Ø  New Remote Applications deploy applications quickly.

Ø  EasyPrint - allows you to print to any local printer (from a Vista box).

Security

Ø   

Driver Signing

X64 requires all drivers to be signed

Ø  Kernel mode drivers must be signed. The kernel is the lowest-level, most central part of a computer operating system and one of the first pieces of code to load when the machine boots. PatchGuard protects the kernel from malicious malware.

BitLocker  2008 & Vista

Drive Encryption

Ø  Allows entire hard drives to be encrypted. Great for laptop computers that may have sensitive data in the event that they are stolen, or servers located in branch offices that are not completely physically secure. Removing a Bitlocker encrypted drive and putting it into another machine in an attempt to access the data will NOT work.

Kerberos offers AES encryption

New, secure encryption algorithm

Ø  Kerberos has used RC4-HMAC for its encryption, an algorithm that has been attacked in some circumstances.  2008 offers the option of shifting to the as-yet-uncracked AES encryption algorithm.

LM Hashes

No longer stored

Ø  LM hashes of passwords were incredibly easy to crack – Not storing the LM hashes reduces hackers ability to crack passwords.

Services

Hardened

Ø  Each service now runs under it’s own security identifier (SID) so tracking and controlling what each service does is possible. Services can be granted permissions  to resources needed by the service.  In the past, many services would run under the context of Local Service or Network Service BUT then all services running under that context would have the same level of access to resources whether they were needed or not. Being able to restrict access at the service level greatly increases security and auditing capabilities.  

Session Isolation

More secure

Ø  Isolates kernel operations and default services (Session 0) away from users and other apps (Session 1, Session 2 etc) to reduce the ability of  a hacker to maliciously attack the operating system.

Patchguard

Kernel Patch Protection

Ø  Makes installing rootkits harder. Rootkits are the worse type of virus to infect a machine, they are practically untraceable.

User Account Control (UAC)

Notifies you that code is being run which requires administrative functionality.

Ø  When an administrative user logs onto a Vista or Server 2008 machine they receive two tokens – think of it like this: they get one token for Clark Kent that is a standard user token that has no special abilities and another for Superman who of course has abilities far beyond that of a standard user. Most of the time when the user is working in email, word, excel and surfing the internet they are doing it as Clark but if they attempt to perform an action that requires Administrative capabilities a UAC dialog box appears notifying the user that something is requiring that the administrative token be used.  That “something” could be a virus that is attempting to infect their machine or some badly written application. The point to UAC is to make administrators aware of when their Superman token is being used and if they didn’t initiate the action themselves they are made aware that “something” did.

Read Only Domain Controllers (RODCs)

Store only a portion of AD user account information

Ø  RODCs allow an administrator to choose which user accounts are stored locally. These are great for branch offices that only have a few users who log onto to the domain instead of storing the entire AD with 50,000 user accounts. If the RODC was compromised the only accounts that a hacker could get would be the handful of accounts at that branch office NOT the entire Active Directory.

Integrity Levels (ILs)

More secure

Ø  ILs allow another level of permissions aside from the NTFS and shared folder permissions.

Manifests

Make UAC more usable

Ø  Manifests work in conjunction with UAC – a manifest is built into an .exe and can be instructed to use the Administrative token and not the standard user token. A UAC prompt will be presented.

Hardware Data Execution Prevention (DEP) X64

Guards against buffer overflows

Ø  Buffer overflows are security vulnerabilities. DEP is offered in both software and hardware flavors. Hardware DEP is much more robust.

Secure Socket Tunneling Protocol

NEW VPN Protocol

Ø  SSL-based VPN protocol which is much more secure.

Transaction Based NTFS

Transactions can be chained

Ø  Transactions can be chained. For example you have 3 patches to install P1, P2 and P3. P2 depends on P1 installing prior to itself being installed and P3 depends on both P1 and P2 being installed successfully. If P2 (for whatever reason) did not install successfully when P3 begins to install it realizes that P2 has not been installed and therefore removes the partially installed P2 and P1. This helps to prevent system failures due to incompletely-applied patches.