Windows and Virtualization Tips and Tricks

The need for a highly secure Strong Password is felt more these days due to increased hacking and phishing. With Microsoft integrating windows logon to many online transactions, the need is further more important.

The password policy setting is one of the most important steps in server hardening procedure. This is usually done in 99% of the environments. But if in any environment it was overlooked, there are methods how one can enforce the strong password policy there.

The steps to enable password security policy in Windows 2003 Domain server is presented in this post:

Step#1: Start—> Program –> Administrative Tools –> Domain Security Policy

Step#2: From the Domain Security Policy Window, enable the “Password must meet complexity requirements” under Password policy in Account Policies

Once these steps are done, the password policy will be enforced when the users do a password reset.

Microsoft has some suggestion on how to make your password strong. I find the following tips useful:

1. The length of password is very important – make it at least 14 characters or more.
2. Make your password strong with special characters (symbol) in it.
3. Mix upper and lower case letters to increase complexity.
4. Remember to use the entire keyboard instead of using common words.
5. Increase the length by using numbers between the letters.
6. More complex the better – add punctuation at the beginning.

You might also want to refer to the Microsoft Documentation for detailed examples and Password checker tool

Recently I faced issues when I setup the IBM HS20 blade server. I had installed 8 GB physical memory on the blade and I installed the window 2003 32 bit Enterprise operating system. After the OS installation I verified the physical memory availability by using the “systeminfo” command and found that the operating system showed only 4GB RAM present on the server. I was wondering what had happened to the other 4 GB!!

This is because of the hardware limitation. In any 32-bit Operating System, one only has access to 4GB of address space by default. The 32-bit Operating System can actually handle 4GB of memory. Using the /PAE switch allows the OS to handle memory above its maximum range as long as the application can handle it.

Any OS can only handle whatever resources are shown to it by the hardware BIOS.  If the hardware does not support a large enough addressing range, then it won’t report anything above that.  If the hardware supporting 36-bit PAE Intel Extensions or the AMD equivalent is used with an OS that supports PAE, we can enable both and see the entire RAM.

The procedure that I followed to enable the PAE switch in windows 2003 operating system is as below:

Step1:

Open the My Computer Window from the OS and select the menu Tools from the top of the menu bar

Step2:

Under the Tools menu select the menu “Folder Options” and select the sub menu “View”

Step3:

Inside the View menu select the option “Show hidden files and folders” and uncheck the option “Hide protected operating system files (recommended)”

Select the Apply button and press OK button to close this window

Step4:

Open the primary boot partition (default boot partition is C: Drive). Now we can see the hidden file “boot.ini”.

Step5:

Open the boot.ini file in notepad and update the /PAE switch on the file. The below screen shot shows the correct format after enter the /PAE switch. Once update the switch we need to save the file and close the file.

Step6:

Go to My Computer menu on the Desktop and select properties of the My Computer. Now we can see the 8 GB RAM available in the system.

A forest level trust relationship will allows two entire forests to share resources and allows selected users to access select resources.

1. Open Active Directory Domains And Trusts from Administrative Tools.
2. In the console tree pane, select and right-click the domain node for the forest root for which you want to create a trust.
3. Select Properties.
4. Select the Trusts tab in the Properties dialog box.
5. Click New Trust and click Next (skip the Welcome screen).
6. On the Trust Name page, enter the DNS name of the target domain for your trust (for our example, it is frankstar.com) and click Next.
7. Select Forest Trust on the Trust Type page and click Next.    (If the Forest Trust option is missing, you may have omitted one of the prerequisites. In that case, double-check the DNS Forwarders tab and the forest functional level of all the domains in both forests.)
8. Choose a direction for the trust relationship: Two-Way, One-Way Incoming, or One-Way Outgoing.
   • Two-Way: All users in both forests will be able to access all resources in both forests.
   • One-Way Incoming: All users in this forest will be able to access all resources in the other forest but not vice versa.
   • One-Way Outgoing: All users in the target forest will be able to access all resources in this forest but not vice versa
   • After you have chosen, click Next.
9. Resource access is still governed by permissions in the domain where the resource exists. The trust direction provides access to all resources where permissions allow access. Select the sides of the trust relationship: This Domain Only or Both This Domain and the Target Domain.
   • This Domain Only: Creates the trust relationship in this domain only; an administrator on the other end will have to complete the other trust.
   • Both This Domain and the Target Domain: Requires sufficient access in the remote domain and will allow you to complete the trust setup.
10. Select the appropriate path, depending on the choices you made in the previous two steps.
    • If you chose Two-Way or One-Way Outgoing in step 8 and This Domain Only in step 9, you will need to select a trust authentication level. Domain-Wide Authentication will authenticate all users in the remote forest for all resources in the local forest. Choosing Selective Authentication will allow you to specify which users in the remote domain have access to local resources. Click Next. Enter a password for the trust and click Next.
    • If you chose One-Way Incoming in step 8 and This Domain Only in step 9, enter the password for the trust in the Trust Password and Confirm Password boxes. Click Next.
    • If you selected both domains (this domain and the selected domain) in step 9, a username and password box will appear to allow you to enter the username and password of an administrator account in the target forest. Click Next.
11. On the next screen, verify all of your selections. When you click Next, the wizard creates the trust. Verify the settings of the new trust.
12. Confirm the outgoing trust. Select Yes if you created both sides of the trust; select No if you did not.
13. Click Finish in the Creating the Trust wizard.

The new trust will appear on the Trusts tab in the Properties dialog box for the domain.