RSAT: the AdminPak for Windows Server 2008

An AdminPak (a.k.a AdminPack, Admin Pack) for Windows Server 2008 has been released. Windows Server 200x administrators are familiar with the “Administration Tools” or adminpak.msi that they used to install on their management workstations for connecting remotely via MMC to servers instead of having to login them via RDP.

Windows Server 2008 did not have the adminpak built in to the RTM media. These are called the “Remote Server Administration Tools (RSAT)”

Role Administration Tools:

• Active Directory Certificate Services Tools
• Active Directory Domain Services (AD DS) Tools
• Active Directory Lightweight Directory Services (AD LDS) Tools
• DHCP Server Tools
• DNS Server Tools
• File Services Tools
• Network Policy and Access Services Tools
• Terminal Services Tools
• Universal Description, Discovery, and Integration (UDDI) Services Tools

Feature Administration Tools:

• BitLocker Drive Encryption Tools
• Failover Clustering Tools
• Group Policy Management Tools
• Network Load Balancing Tools
• SMTP Server Tools
• Storage Manager for SANs Tools
• Windows System Resource Manager Tools

The following tools are fully supported for managing computers running Windows Server 2003:

• Active Directory Domain Services (AD DS) Tools
• Active Directory Lightweight Directory Services (AD LDS) Tools
• Active Directory Certification Authority Tools
• DHCP Server Tools
• DNS Server Tools
• Terminal Services Tools
• Universal Description, Discovery, and Integration (UDDI) Services Tools
• Group Policy Management Tools
• Network Load Balancing Tools

An immediate thought: Managing computers running Windows Server 2008 Server Core is now easier. Once the server has been set up and configured to allow remote MMC connections, all you need to do is install RSAT on your workstation and connect to your Server Core machine using the RSAT tools. Your non-GUI Windows Server now has a remote GUI

Note that you can install the RSAT tools only on a computer running Windows Vista with Service Pack 1.

Understanding Server Roles

Server Roles Overview

A network or network infrastructure is the grouping of hardware devices and software components which are needed to connect devices within the organization, and to connect the organization to other organizations and the Internet. The network infrastructure's physical hardware and logical components are needed to provide a number of features for the network, including connectivity, routing and switching capabilities, network security, and access control. The network or network infrastructure has to exist before a number of servers needed to support applications which are needed by your users can be deployed into your networking environment.

Therefore, when planning your network design and deciding on the computers for your network, you must know what functions the computer will be performing. Understanding these functions will put you in a good position to determine the hardware and software components needed for your computers.

Windows Server 2003 itself provides a number of features and tools when you install it on a computer. You though have to implement additional features and functionality on a server to provide the services and capabilities required by the organization and its users. In fact, until these additional features and functionality make certain services available, the computer cannot be used as required by users.

Computers required on your network can be broadly grouped according to the following roles:

• Server roles: Servers can be configured to perform a number of roles. The applications that the server is running specify the role of the particular server. Server's typically need services and additional features installed to perform its specific role. When compared to workstations, servers have more disk space and memory, and faster processors. The hardware required by servers is determined by the role being performed by the server. A few common server roles are listed below:

  • Domain controller

  • Database server

  • Backup server

  • File server

  • Print server

  • Infrastructure server

  • Web server

  • E-mail server

• Desktop workstation roles: Desktop workstations differ to servers in that desktop workstations are general purpose computers that can perform a number of different types of functions.

• Portable workstation roles: Portable workstations are the solution to bringing the features of a desktop computer to an off-site employee.

Windows Server 2003 introduced the concept of server roles. Server roles basically group related administrative tasks, and are used to provide a specific capability or function to the network design. With Windows Server 2003, if you configure a server for a certain server role, then a number of additional services, features and tools are installed for the server. In this manner, the server is set up to provide the required services to your users.

Windows Server 2003 provides a new tool for defining and managing server roles, namely, the Manage Your Server utility. The actual Wizard for applying the server roles to computers is the Configure Your Server Wizard. The Configure Your Server Wizard is included within the Manage Your Server utility and is also managed through this utility.

For Windows Server 2003, there are 11 different server roles that you can configure using the Configure Your Server Wizard:

• File server

• Print server

• Application server

• Mail server

• Terminal server

• Remote access server/VPN server

• Domain controllers

• DNS server

• WINS server

• DHCP server

• Streaming media server

Understanding the File Server Role

The file server role is a widely used role when configuring servers in Windows Server 2003 based networks. This is due to the file server role storing data for network users, and providing access to files stored on the file server. The file server role is though not availble in the Windows Server 2003 Web Edition. A file stored on a file server volume can be accessed by users that have the necessary rights to access the directories wherein the files are stored.

File servers provide the following functionality to users:

• Enables users to store files in a centralized location.

• " Enable a user to share files with another user.

A few characteristics and features of the file server role are listed:

• Files and folder resources can be shared between network users.

• Administrators can manage the following aspects of file servers:

  • Access to files and folders

  • Disk space

  • Disk quotas can be implemented to control the amount of space which users can utilize.

• For file servers that have NTFS volumes:

  • NTFS security can be used to protect files from users who are not authorized to access the files and folders.

  • Encrypting File System (EFS) enables users to encrypt files and folders, and entire data drives on NTFS formatted volumes. EFS secures confidential corporate data from unauthorized access.

  • Distributed File System (Dfs) provides a single hierarchical file system that assists in organizing shared folders on multiple computers in the network. Dfs provides a single logical file system structure by concealing the underlying file share structure within a virtual folder structure. Users only see a single file structure even though there are multiple folders located on different file servers within the organization.

• The Offline files feature can be enabled if necessary. Offline Files make is possible for a user to mirror server files to a local laptop, and ensures that the laptop files and server files are in sync. For your laptop users, Offline Files ensures that the user can access the server based files when they are not connected to the network.

Understanding the Print Server Role

The print server role provides network printing capabilities for the network. Through the print server role, you can configure a server to manage printing functions on the network. Users typically connect to a network printer through a connection to a print server. The print server is the computer where the print drivers are located that manage printing between printers and client computers. With Windows NT, Windows 2000, Windows XP, and Windows Server 2003, the print servers supply clients with the necessary printer drivers. The print servers also manage communication between the printers and the client computers. The print servers manage the print queues, and can also supply audit logs on jobs printed by users. A network interface printer is a printer that connects to the network through a network card. The print server role is though not available in the Windows Server 2003 Web Edition.

When deciding on a print server, ensure that the print server has sufficient disk space to store print jobs waiting in the printer queue. It is recommended to use a dedicated, fast drive for the print spooler. You should consider implementing a print server cluster if your enterprise needs exceptional reliability and performance when it comes to printing.

A few characteristics of print servers are listed here:

• The Windows Management Instrumentation (WMI) a management application program interface (API) can be used to manage printing on the network.

• Print servers can also be remotely managed.

• Administrators can control when printing devices can be utilized.

• Administrators can control access to printers

• Priorities can be defined for print jobs.

• Print jobs can be paused, resumed, and deleted and viewed.

• Printers can be published in Active Directory so that access to printers can be controlled according to Active Directory accounts.

Understanding Web servers

The application server role makes Web applications and distributed applications available to users. A Web server typically contains a copy of a World Wide Web site and can also host Web based applications. When you install a Web server, users can utilize Web based applications and download files as well.

When you add a Web server through the application server role, the following components are installed:

• Internet Information Services 6.0

• The Application Server console

• The Distributed Transaction Coordinator (DTC)

• COM+, the extension of the Component Object Model (COM)

Internet Information Services 6.0 (IIS 6.0) is Microsoft's integrated Web server that enables you to create and manage Web sites within your organization. Through IIS, you can create and manage Web sites, and share and distribute information over the Internet or intranet. With the introduction of Windows Server 2003, came the advent of Internet Information Services (IIS) 6. IIS 6 is included with the 32-bit version and the 64-bit versions of the Windows Server 2003 Editions. IIS 6 include support for a number of protocols and management tools which enable you to configure the server as a Web server, File Transfer Protocol (FTP) server or a Simple Mail Transport Protocol (SMTP) server. The management tools included with Windows Server 2003 allows you to manage Internet Information Services on the Windows Server 2003 product platforms.

Before you can deploy IIS 6 Web servers within your enterprise, you first need to install Windows Server 2003 or upgrade to Windows Server 2003. Only after Windows Server 2003 is deployed, are you able to install IIS 6 in your environment.

After Windows Server 2003 is installed, for all editions of Windows Server 2003 other than the Web Edition, you can install IIS 6 from the Configure Your Server Wizard. When you first log on after Windows Server 2003 is installed, the Manage Your Server Wizard is initiated. To start the Configure Your Server Wizard, choose the Add Or Remove A Role link. You next have to follow the prompts of the Configure Your Server Wizard to install the Application Server (IIS, ASP.NET) option.

The protocols supported by IIS 6.0, the Microsoft integrated Web server, are listed here:

• Hypertext Transfer Protocol (HTTP) is a TCP/IP application layer protocol used to connect to websites, and to create Web content. HTTP handles the publishing of static and dynamic Web content. A HTTP session consists of a connection, a HTTP request and a HTTP response

  1. Port 80 is used for HTTP connections. The client establishes a TCP connection to the server by using a TCP three way handshake.

  2. After the connection is established, the client sends a HTTP GET request message to the server.

  3. The server sends the client the requested Web page.

  4. HTTP Keep-Alives maintains the TCP connection between the client and server if it is enabled, so that the client can request additional pages.

  5. If HTTP Keep-Alives is not enabled, the TCP connection is terminated after the requested page is downloaded.

• File Transfer Protocol (FTP) is a TCP/IP application layer protocol used for copying files to and from remote systems through the Transmission Control Protocol (TCP). FTP makes it possible for clients to upload and download files from a FTP server over an internetwork. Through IIS, you can create and administer FTP servers. You need an FTP server and FTP client to use the protocol. A FTP session has a connection, a request, and a response.

  1. The client establishes a TCP connection to the FTP server through port 21.

  2. A port number over 1023 is assigned to the client.

  3. The client sends a FTP command to port 21.

  4. If the client needs to receive data, another connection is created with the client, to convey the data. This connection utilizes port 20.

  5. The second connection remains in a TIME_WAIT state afte the data is transferred to the client. The TIME_WAIT state makes it possible for additional data to be transferred. The TIME_WAIT state ends when the connection timeout.

• Network News Transfer Protocol (NNTP) is a TCP/IP application layer protocol used to send network news messages to NNTP servers and NNTP clients on the Internet. NNTP is a client/server and server/server protocol. The NNTP protocol enables a NNTP host to replicate its list of newsgroups and messages with another host through newsfeeds, using a push method or a pull method. A NNTP client can establish a connection with a NNTP host to download a list of newsgroups, and read the messages contained in the newsgroups. Through NNTP, you can implement private news servers to host discussion groups, or you can implement public news servers to provide customer support and help resources to Internet users. You can specify that users need to be authenticated to both read and post items to newsgroups, or you can allow access to everybody. The NNTP service can also integrate with the Windows Indexing Service for the indexing of newsgroup content. It is also fully integrated with event and performance monitoring of Windows Server 2003.

• Simple Mail Transfer Protocol (SMTP) is a TCP/IP application layer protocol used for routing and transferring e-mail between SMTP hosts on the Internet. SMTP enables IIS machines to operate as SMTP hosts to forward e-mail over the Internet. IIS can be utilized instead of Sendmail. SMTP also enables IIS machines to protect mail servers such as Microsoft Exchange servers from malicious attacks by operating between these servers and Sendmail host at the ISP of the organization. SMTP can be used to forward mail from one SMTP host to another SMTP host. SMTP cannot deliver mail directly to the client. Mail clients use POP3 or IMAP to receive e-mail. Windows Server 2003 includes the POP3 service for providing clients with mailboxes, and for handling incoming e-mail. To use the SMTP as a component of IIS, you have to install the SMTP service first if you are running a Windows Server 2003 Edition other than the Windows Server 2003 Web Edition. The SMTP service is installed on the Windows Server 2003 Web Edition by default.

Understanding the Mail Server Role

The mail server role provides e-mail services for the network, by providing the functionality needed for users to both send and receive e-mail messages. A mail server has to exist for users to send e-mail to each other. When a mail server receives e-mail for a user, it stores the e-mail for the intended user until that particular user retrieves it from the mail server.

The primary functions of mail servers are listed here:

• Store e-mail data.

• Process client requests

• Receive incoming e-mail from the Internet.

When you configure a server for the mail server role, the following TCP/IP based protocols are installed:

• Simple Mail Transfer Protocol (SMTP): SMTP is a TCP/IP application layer protocol used for routing and transferring e-mail between SMTP hosts on the Internet. IIS 6 has to be installed to install both the SMTP service and the Post Office Protocol 3 (POP3) service. The SMTP service has to be installed because mail servers and clients utilize this service to send e-mail.

• Post Office Protocol 3 (POP3): Mail clients use the POP3 service or IMAP to receive e-mail. Windows Server 2003 includes the POP3 service for providing clients with mailboxes, and for handling incoming e-mail. The POP3 service also enables clients to retrieve e-mail from the mail server.

Understanding the Terminal Server Role

Terminal Services have the ability to operate as an application server that remote clients can connect to, and run sessions from. The Terminal Services server runs the applications. The data response is transmitted back to the Terminal Services client. Clients can access Terminal Services over a local areaconnection or a wide area connection. Terminal Services clients can be MS-DOS based clients, Windows for Workgroups clients, (version 3.11), Windows based terminals, and Macintosh clients.

When a user connects to a Windows Server 2003 server using Remote Desktop, the resources of the server is used, and not that of the workstation. The terminal is only responsible for the keyboard, mouse and the display. Every user has its own individual Terminal Services session. Sessions are unique and do not affect one another. In this manner, a user connecting to a Windows Server 2003 server through Remote Desktop functions as a terminal on that server.

Once a client establishes a connection to Terminal Services, it creates a Terminal Services session for the client. All processing is handled by the Terminal Services server. Clients use insignificant bandwidth on the underlying network when they establish a connection. Terminal Services is therefore popular in WANs where bandwidth is limited. It is also suited for mobile users who have to execute processor intensive applications over a dial-up connection. In this case, the local machine only needs to handle the console.
When applications need to be installed or updated, a single instance of the application can be installed or updated on the Terminal Services server. Users will have access to the application without you needing to install or update the application on all machines.

Remote Desktop Protocol (RDP) is the protocol that manages communications between a computer running Terminal Services, and a client computer running a Terminal Server client. The connection can be established using Terminal Services on a terminal server. The RDC utility can be used for complete terminal server client utilization, or it can be used for Remote Administration. Remote Desktop Connection is by default installed with Windows XP and Windows Server 2003. You can however install Remote Desktop Connection on the previous Windows Operating Systems (OSs) such as Windows 2000, Windows NT, Windows ME, Windows 98, and Windows 95. The RDC utility is backward compatible, and can therefore interact with Terminal Services in Windows XP, Windows 2000 and Windows NT 4 Terminal Server Edition.

Understanding the Remote Access and VPN Server Role

The Windows Server 2003 remote access and VPN server role can be used to provide remote access to clients through either of the methods:

• Dial-up connections: Dial-up networking makes it possible for a remote access client to establish a dial-up connection to a port on a remote access server. The configuration of the dial-up networking server determines what resources the remote user can access. Users that connect through a dial-up networking server, connect to the network much like a standard LAN user accessing network resources.

• Virtual private networks (VPNs): Virtual Private Networks (VPNs) provide secure and advanced connections through a non-secure network by providing data privacy. Private data is secure in a public environment. Remote access VPNs provides a common environment where many different sources such as intermediaries, clients and off-site employees can access through web browsers or email. Many companies supply their own VPN connections via the Internet. Through their ISPs, remote users running VPN client software are assured private access in a publicly shared environment. By using analog, ISDN, DSL, cable technology, dial and mobile IP; VPNs are implemented over extensive shared infrastructures. Email, database and office applications use these secure remote VPN connections.

A few features and capabilities provided by the RRAS server are listed here:

• LAN-to-LAN routing and LAN-to-WAN routing

• Virtual private network (VPN) routing

• Network Address Translation (NAT) routing: NAT, defined in RFC 1631 translates private addresses to Internet IP addresses that can be routed on the Iternet

• Routing features, including

  • IP multicasting

  • Packet filtering

  • Demand-dial routing

  • DHCP relay

• Assign DHCP addresses to RRAS clients

• Remote Access Policies (RAPs): RAPs are used to grant remote access permissions.

• Layer Two Tunneling Protocol (L2TP) combines Layer 2 Forwarding (L2F) of Cisco with Point-to-Point Tunneling Protocol (PPTP) of Microsoft. L2TP is a Data-link protocol that can be used to establish Virtual Private Networks (VPNs).

• Internet Authentication Service (IAS), a Remote Authentication Dial-In User Service (RADIUS) server, provides remote authentication, authorization and accounting for users that are connecting to the network through a network access server (NAS) such as Windows Routing and Remote Access.

Understanding the Domain Controllers Role

A domain controller is a server that stores a write copy of Active Directory, and maintains the Active Directory data store. Active Directory was designed to provide a centralized repository of information, or data store that could securely manage the resources of an organization. The Active Directory directory services ensure that network resources are available to, and can be accessed by users, applications and programs. Active Directory also makes it possible for administrators to log on to a one network computer, and then manage Active Directory objects on a different computer within the domain.

A domain controller is a computer running Windows 2000 or Windows Server 2003 that contains a replica of the domain directory. Domain controllers in Active Directory maintain the Active Directory data store and security policy of the domain. Domain controllers therefore also provide security for the domain by authenticating user logon attempts.

The main functions of the domain controller role within Active Directory are listed here:

• Each domain controller in a domain stores and maintains a replica of the Active Directory data store for the particular domain.

• Domain controllers in Active Directory utilize multimaster replication. What this means is that no single domain controller is the master domain controller. All domain controllers are considered peers.

• Domain controllers also automatically replicate directory information for objects stored in the domain between one another.

• Updates that are considered important are replicated immediately to the remainder of the domain controllers within the domain.

• Implementing multiple domain controllers within the domain provides fault tolerance for the domain.

• In Active Directory, domain controllers can detect collisions. Collisions take place when an attribute modified on one particular domain, is changed on a different domain controller prior to the change on the initial domain controller being fully propagated.

Certain master roles can be assigned to domain controllers within a domain and forest. Domain controllers that are assigned special master roles are called Operations Masters. These domain controllers host a master copy of specific data in Active Directory. They also copy data to the remainder of the domain controllers. There are five different types of master roles that can be defined for domain controllers. Two types of master roles, forestwide master roles, are assigned to one domain controller in a forest. The other three master roles, domainwide master roles, are applied to a domain controller in every domain.

The different types of master roles which can be configured on domain controllers are listed here:

• The Schema Master is a forestwide master role applied to a domain controller that manages all changes in the Active Directory schema.

• The Domain Naming Master is a forestwide master role applied to a domain controller that manages changes to the forest, such as adding and removing a domain. The domain controller serving this role also manages changes to the omain namespace.

• The Relative ID (RID) Master is a domainwide master role applied to a domain controller that creates unique ID numbers for domain controllers and manages the allocation of these numbers.

• The PDC Emulator is a domainwide master role applied to a domain controller that operates like a Windows NT primary domain controller. This role is typically necessary when there are computers in your environment running pre-Windows 2000 and XP operating systems.

• The Infrastructure Master is a domainwide master role applied to a domain controller that manages changes made to group memberships.

A Global Catalog (GC) server(s) can also be installed on a domain controller. The global catalog is a central information store on the Active Directory objects in a forest and domain, and is used to improve performance when searching for objects in Active Directory. The first domain controller installed in a domain is designated as the global catalog server by default. The global catalog server stores a full replica of all objects in its host domain, and a partial replica of objects for the remainder of the domains in the forest. The partial replica contains those objects which are frequently searched for. It is generally recommended to configure a global catalog server for each site in a domain.

The functions of the global catalog server are summarized below:

• Global catalog servers are crucial for Active Directory's UPN functionality because they resolve user principal names (UPNs) when the domain controller handling the authentication request is unable to authenticate the user account because the user account actually exists in another domain. Here, the GC server assists in locating the user account so that the authenticating domain controller can proceed with the logon request for the user.

• The global catalog server deals with all search requests of users searching for information in Active Directory. It can find all Active Directory data irrespective of the domain in which the data is held. The GC server deals with requests for the entire forest.

• The global catalog server also makes it possible for users to provide Universal Group membership information to the domain controller for network logon requests.

Understanding the DNS Server Role

Domain Name Service (DNS) is a hierarchically distributed database that creates hierarchical names that can be resolved to IP addresses. The IP addresses are then resolved to MAC addresses. DNS provides the means for naming IP hosts, and for locating IP hosts when they are queried for by name.

The DNS server role resolves IP addresses to domain names, and domain name to IP addresses. In this way, DNS provides name resolution services to establish connections for those clients that need to resolve to IP addresses. A Fully Qualified Domain Name (FQDN) is the DNS name that is used to identify a computer on the network.

A DNS server is a computer running the DNS service or BIND; that provides domain name services. The DNS server manages the DNS database that is located on it. The information in the DNS database of a DNS server pertains to a portion of the DNS domain tree structure or namespace. This information is used to provide responses to client requests for name resolution. A DNS server is authoritative for the contiguous portion of the DNS namespace over which it resides.

When a DNS server is queried for name resolution services it can do either of the following:

• Respond to the request directly by providing the requested information.

• Provide a pointer (referral) to another DNS server that can assist in resolving the query.

• Respond that the information is unavailable.

• Respond that the information does not exist

You can configure different server roles for your DNS servers. The server role that you configure for a DNS server affects the followin operations of the server:

• The way in which the DNS server stores DNS data.

• The way in which the DNS server maintains data.

• Whether the DNS data in the database file can be directly edited.

The different DNS server roles which you can configure are listed here:

• Standard Primary DNS server: This DNS server owns the zones defined in its DNS database, and can make changes to its zones. A standard primary DNS server obtains zone data from the local DNS database. The primary DNS server is authoritative for the zone data that it contains. When a change needs to be made to the resource records of the zone, it has to be done on the primary DNS server so that is can be included in the local zone database. A DNS primary server is created when a new primary zone is added.

• Standard Secondary DNS server: This DNS server obtains a read-only copy of zones through DNS zone transfers. A secondary DNS server cannot make any changes to the information contained in its read-only copy. A secondary DNS server can however resolve queries for name resolution. Secondary DNS servers are usually implemented to provide fault tolerance, provide fast access for clients in remote locations, and to distribute the DNS server processing load evenly. If a secondary DNS server is implemented, that DNS server can continue to handle queries when the primary DNS becomes unavailable. Secondary DNS servers also assist in reducing the processing load of the primary DNS server. It is recommended to install at least one primary DNS server, and one secondary DNS server for each DNS zone.

• Caching-only DNS server: A caching-only DNS server only performs queries and then stores the results of these queries. All information stored on the caching-only DNS server is therefore only that data which has been cached while the server performed queries. Caching-only DNS servers only cache information when the queries have been resolved. The information stored by caching-only DNS servers is the name resolution data that it has collected through name resolution queries. Caching-only DNS servers do not host zones and are not authoritative for any DNS domain.

• Master DNS servers: The DNS servers from which secondary DNS servers obtain zone information in the DNS hierarchy are called master DNS servers. When a secondary DNS server is configured, you have to specify the master server from whom it will obtain zone information. Zone transfer enables a secondary DNS server to obtain zone information from its configured primary DNS server. A secondary DNS server can also transfer its zone data to other secondary DNS servers, who are beneath it in the DNS hierarchy. Here, the secondary DNS server is regarded as the master server to the other subordinate secondary DNS servers. A secondary DNS server initiates the zone transfer process from its particular master server when it is brought online.

• Dynamic DNS Servers: Windows 2000, Windows XP and Windows Server 2003 computers can dynamically update the resource records of a DNS server when a client's IP addressing information is added, or renewed through Dynamic Host Configuration Protocol (DHCP). Both DHCP and Dynamic DNS (DDNS) updates make this possible. When dynamic DNS updates are enabled, a client sends a message to the DNS server when changes are made to its IP addressing data. This indicates to the DNS server that the A type resource record of the client needs to be updated.

Understanding the WINS Server Role

The Windows Internet Name Service (WINS) server roles provide name resolution services for clients that need to resolve IP addresses to NetBIOS names, and vice versa. A WINS server is an enhanced NetBIOS name server (NBNS) designed by Microsoft to resolve NetBIOS computer names to IP addresses. WINS can resolve NetBIOS names for local hosts and remote hosts. WINS registers NetBIO computer names, and stores these client name registrations in the WINS database. The registrations are used when clients query for host name resolution and service information and to resolve a NetBIOS name to an IP address. Clients that are configured to utilize a WINS server as a NetBIOS name server (NBNS) are called WINS enabled clients. If the WINS server resolves the NetBIOS name to an IP address, no broadcast traffic is sent over the network. Broadcasts are only utilized if the WINS server is unable to resolve the NetBIOS name. A WINS enabled client can communicate with a WINS server that is located anywhere on the internetwork.

Since Windows 2000 was the first Windows operating system where NetBIOS naming was no longer required, you might still need to provide support for NetBIOS naming if you have legacy applications. Remember that all Windows operating system prior to Windows 2000 require NetBIOS name support.

To implement WINS, you only need one WINS server for an internetwork. However, implementing two WINS servers provides fault tolerance for name resolution. The secondary WINS server would be used for name resolution if the primary WINS server is unavailable to service WINS clients' requests.

A WINS server can cope with 1,500 name registrations and roughly 4,500 name queries per minute. It is recommended to have one WINS server and a backup server for each 10,000 WINS clients. When you configure the WINS server role, the WINS server must be statically assigned with the following TCP/IP parameters: static IP address, subnet mask and default gateway.

Understanding the DHCP Server Role

DHCP is a service and protocol which runs on a Windows Server 2003 operating system. DHCP functions at the application layer of the TCP/IP protocol stack. One of the primary tasks of the protocol is to automatically assign IP addresses to DHCP clients.

A server running the DHCP service is called a DHCP server. The DHCP protocol automates the configuration of TCP/IP clients because IP addressing occurs through the system. You can configure a server as a DHCP server so that the DHCP server can automatically assign IP addresses to DHCP clients, and with no manual intervention. IP addresses that are assigned through a DHCP server are regarded as dynamically assigned IP addresses.

The DHCP server assigns IP addresses from a predetermined IP address range(s), called a scope. A DHCP scope can be defined as a set of IP addresses which the DHCP server can allocate or assign to DHCP clients. A scope contains specific configuration information for clients that have IP addresses which are within the particular scope. Scope information for each DHCP server is specific to that particular DHCP server only, and is not shared between DHCP servers. Scopes for DHCP servers are configured by administrators.

The functions of the DHCP server are outlined below:

• Dynamically assign IP addresses to DHCP clients.

• Allocate the following TCP/IP configuration information to DHCP clients:

  • Subnet mask information

  • Default gateway IP addresses

  • Domain Name System (DNS) IP addresses

  • Windows Internet Naming Service (WINS) IP addresses

You can increase the availability of DHCP servers by using the 80/20 Rule if you have two DHCP servers located on different subnets. The 80/20 Rule is applied as follows:

• Allocate 80 percent of the IP addresses to the DHCP server which resides on the local subnet.

• Allocate 20 percent of the IP addresses to the DHCP Server on the remote subnet.

If the DHCP server that is allocated with 80 percent of the IP addresses has a failure, the remote DHCP server would resume assigning the DHCP clients with IP addresses.

With Windows Server 2003 DHCP, three options are available for registering IP addresses in DNS. The options can be configured for the DHCP serve, or for each individual scope. The options which can be specified to enable/disable the DHCP service to dynamically update DNS records on behalf the client are:

• The DHCP server can be configured to not register any IP address of the DHCP clients when it assigns IP addresses to these clients.

• The DHCP server can be configured to at all times register all IP address of clients when they receive IP addresses from the DHCP server.

• The default option results in the DHCP server registering the IP addresses of clients with the authoritative DNS server, based on the client's request for an IP address.

Understanding the Streaming Media Server Role

The streaming media role provides media services so that clients can access streaming audio and video. The Windows Media Services is used to provide media services to clients. The Windows Media Services can be configured on server platforms, and on enterprise platforms.

The Windows Media Services is not available in the following edition of Windows Server 2003:

• Windows Server 2003 Web Edition

• Windows Server 2003 64-bit versions.

Understanding Certificate Authorities (CAs) Servers

A Certificate Authority is an entity that generates and validates digital certificates. The CA adds its own signature to the public key of the client. By using the tools provided by Microsoft, you can create an internal CA structure within your organization.

A digital certificate associates a public key with an owner. The certificate verifies the identity of the owner. A certificate cannot be forged because the authority that issued the certificate digitally signs the certificate. Certificates are issued for functions such as the encryption of data, code signing, Web user and Web server authentication, and for securing e-mail. Certificates in Windows XP and Windows Server 2003 are managed by the Data Protection API. When certificates are issued to a client, it is stored in the Registry and in Active Directory. You can also store certificates on smart cards. The information included in a certificate is determined by the type of certificate being used.

Certificate Authorities (CAs) are servers which are configured to issue certificates to users, computers, and services. CAs also manage certificates. An organization can have multiple CAs, which are arranged in a logical manner. A CA can be a trusted third party entity such as VeriSign or Thawte, or it can be an internal entity of the organization. An example of an internal CA entity is Windows Server 2003 Certificate Services. Windows Server 2003 Certificate Services can be used to create certificates for users and computers in Active Directory domains.

The functions performed by Certificate Authorities (CAs) are listed below:

• Accepts the request for a certificate from a user, computer, application, or service.

• Authenticates the identity of the user, computer or service requesting the certificate. The CA utilizes its policies, and incorporates the type of certificate being requested; to verify the identity of the requestor.

• Creates the certificate for the requestor.

• Digitally signs the certificate using its own private key.

Windows Certificate Services is used to create a Certificate Authority on Windows Server 2003 servers. The first CA that is installed becomes the root CA. The common practice is to first install the root CA, and then use the root CA to validate all the other CAs within the organization. A root CA is the most trusted CA in a CA hierarchy. When a root CA issues certificates to other CAs, these CAs become subordinate CAs of the root CA. When a root CA is online, it is used to issue certificates to subordinate CAs. The root CA never usually directly issues certificates to users, computers, applications or services.

A subordinate CA can also issue certificates to other subordinate CAs. These subordinate CAs are called intermediate CAs. While an intermediate CA s subordinate to the root CA, it is considered superior to those subordinate CAs to which it issued certificates. Subordinate CAs which only issue certificates to users, and not to other subordinate CAs, are called leaf CAs.

The type of CAs which you can install:

• Enterprise root CA: This is the topmost CA in the CA hierarchy, and is the first CA installed in the enterprise. Enterprise root CAs are reliant on Active Directory. Enterprise root CAs issue certificates to subordinate CAs.

• Enterprise Subordinate CA: This CA also needs Active Directory, and is used to issue certificates to users and computers.

• Stand-alone Root CA: A stand-alone root CA is the topmost CA in the certificate chain. A stand-alone root CA is not however dependent on Active Directory, and can be removed from the network. This makes a stand-alone root CAs the solution for implementing a secure offline root CA.

• Stand-alone Subordinate CA: This type of CA is also not dependent on Active Directory, and is used to issue certificates to users, computers, and other CAs.

Understanding the Configure Your Server Wizard

The Configure Your Server Wizard is one of the main wizards used to perform administrative tasks for Windows Server 20033 computers. The Configure Your Server Wizard is used to configure server roles. Windows Server 2003 provides a new tool for defining and managing server roles, namely, the Manage Your Server utility. The actual Wizard for applying the server roles to computers is the Configure Your Server Wizard. The Configure Your Server Wizard is included within the Manage Your Server utility and is also managed through this utility.

To access the Manage Your Server utility and use the Configure Your Server Wizard,

1. Click Start, click Administrative Tools, and then click Manage Your Server.

The main screen of the Manage Your Server utility is made up as follows:

• At the top of the Manage Your Server main screen, are three buttons, labelled as follows:

  • Add or remove a role button; for initiating the Configure Your Server Wizard.

  • Read about server roles button; for accessing information on server roles.

  • Read about remote administration button; for accessing information on remote administration.

• The left end of the screen contains the server roles which are already configured for the particular server.

• Each listed configured server role is accompanied by buttons which can be used to view information on the existing role, or manage the existing server role. The buttons which are displayed differ between the existing server roles.

You can also initiate the Configure Your Server Wizard by:

1. Clicking Start, Administrative Tools, and then clicking Configure Your Server.

After the Configure Your Server Wizard is initiated, the following preliminary steps need to be performed first before any server roles can be added:

• Install all modems and network cards.

• Attach all necessary cables.

• Create an Internet connection if the server is to be used for Internet connectivity.

• Turn on all peripherals

• Have the Windows Server 2003 installation CD at hand.

Clicking the Next button on the Preliminary Steps screen invokes the Configure Your Server Wizard to test network connections and verify the operating system, and then displays the Server Role screen.

The Server Role screen contains the following columns:

• Server role column; indicates the server roles which can be added or removed.

• Configured column; indicates whether a server role is configured or not configured.

If you want to navigate to the Add or Remove Programs in Control Panel, click the Add or Remove Programs link on the Server Role screen.

How to add an application server role to Windows Server 2003

1. Click Start, click Administrative Tools, and then click Manage Your erver.

2. Click the Add or remove a role button.

3. The Configure Your Server Wizard initiates.

4. Click Next on the Preliminary Steps page of the wizard.

5. When the Server Role page opens, select the Application server (IIS, ASP.NET) server role, and then click Next.

6. The Application Server Options page opens.

7. Select the FrontPage Server Extensions checkbox to include Web server extensions in the configuration.

8. Select the Enable ASP.NET checkbox so that Web applications created through ASP.NET can be utilized. Click Next.

9. Verify the settings which you have selected on the Summary of Selections. Click Next.

10. The installation of the components occurs next.

11. Click Finish.

How to install the Remote Access and VPN server role using the using the Configure Your Server Wizard

1. Click Start, click Administrative Tools, and then click Manage Your Server.

2. Select the Add or remove a role option.

3. The Configure Your Server Wizard starts.

4. On the Preliminary Steps page, click Next.

5. A message appears, informing you that the Configure Your Server Wizard is detecting network settings and server information.

6. When the Server Role page appears, select the Remote Access/VPN Server option and then click Next.

7. On the Summary of Selections page, click Next.

8. The Welcome to the Routing and Remote Access Server Setup Wizard page is displayed.

How to add the global catalog server role on a domain controller

1. Click Start, Administrative Tools, and then click Active Directory Sites and Services.

2. In the console tree, expand Sites, and then expand the site that contains the domain controller which you want to configure as a global catalog server.

3. Expand the Servers folder, and locate and then click the domain controller that you want to designate as a global catalog server.

4. In the details, pane, right-click NTDS Settings and click Properties on the shortcut menu.

5. The NTDS Settings Properties dialog box opens.

6. The General tab is where you specify the domain controller as a global catalog server.

7. Enable the Global Catalog checkbox.

8. Click OK.

How to remove the global catalog server role from a domain controller

1. Open the Active Directory Sites and Services console.

2. In the console tree, locate and click the domain controller currently configured as the global catalog server.

3. Right-click NTDS Settings and click Properties on the shortcut menu to open the NTDS Settings Properties dialog box.

4. Clear the Global Catalog checkbox.

5. Click OK

How to install the DHCP server role

1. Click Start, Control Panel, and then click Add Or Remove Programs.

2. When the Add Or Remove Programs dialog box opens, click Add/Remove Windows Components.

3. This starts the Windows Components Wizard.

4. In the Components list box, select Networking Services, and then click the Details button.

5. The Networking Services dialog box opens.

6. In the Subcomponents Of Networking Services list box, check the Dynamic Host Configuration Protocol (DHCP) checkbox.

7. Click OK. Click Next.

8. When The Completing The Windows Components Wizard page is displayed, click Finish.

How to implement a caching-only DNS server

1. Open Control Panel

2. Double-click Add/Remove Programs., and then click Add/Remove Windows Components.

3. The Windows Components Wizard starts.

4. Click Networking Services, and then click Details.

5. In the Networking Services dialog box, select the checkbox for Domain Name System (DNS) in the list.
   Click OK. Click Next.

6. When The Completing The Windows Components Wizard page is displayed, click Finish.

7. Do not add or configure any zones for the DNS server. The DNS Server service functions as a caching-only DNS server by default. This basically means no configuration is necessary to set up a caching-only DNS server.

8. You should verify that the server root hints are configured correctly.

How to add the Terminal Services server role to Windows Server 2003 using Add Or Remove Programs in Control Panel

1. Click Start, Control Panel, and then click Add Or Remove Programs.

2. Click Add/Remove Windows Components to initiate the Windows Components Wizard

3. Select the Terminal Server checkbox. Click Next

4. When the Terminal Server Setup page is displayed, read the message on Terminal Server Licensing and Terminal Server mode. Click Next

5. Select the appropriate security setting. Click Next

6. After the necessary files are copied, click Finish.

7. When the System Settings Change page is displayed. Click Yes to reboot the computer.

8. Terminal Services Configuration, Terminal Services Manager, and Terminal Server Licensing are added to the Administrative Tools menu.

How to install IIS 6.0 using the Configure Your Server Wizard

1. Click Start, click Administrative Tools, and then click Manage Your Server.

2. In the Manage Your Server main screen, click Add or remove a role.

3. The Configure Your Server Wizard starts.

4. The Preliminary Steps screen is a warning screen that prompts you to verify that the requirements for the installation have been met. Click Next.

5. The network connections configured on the machine are tested and verified before the Wizard displays the following screen.

6. On the Configuration Options screen, choose one of the following options:

   • Typical configuration for a first server: You would choose this option to install the server as a domain controller, and to install the Active Directory directory service, DNS service, and DHCP service.

   • Custom Configuration, This option should be selected to install IIS 6 on the server.

   Click Next.

7. On the Server Role screen, choose Application Server (IIS, ASP.NET) as the role which you want install on the server. From this screen, you can also select to install Terminal, Print, DNS, and DHCP services. Selecting the Application Server (IIS, ASP.NET) option, installs IIS, ASP.NET and additional components so that the server can host websites and FTP sites. Click Next.

8. On the Application Server Options screen, you can select that these optional components be installed:

   • FrontPage Server Extensions, for users to develop Web content and publish Web content on the IIS machine via Microsoft FrontPage or Microsoft Visual Studio.

   • Microsoft Data Engine, for hosting SQL databases on the IIS machine

   • Enable ASP.NET: This option is enabled by default. ASP.NET is the scripting framework utilized for running IIS applications.

   Click Next.

9. The Summary of Selections screen displays a summary of the components which you selected for installation. Verify that the correct items are listed on this screen. The Enable COM+ for remote transactions option is automatically added. Click Next.

10. The installation process now commences. You would either have to insert the Windows Server 2003 CD, or indicate the location of the installation files. The Application Selections screen is displayed, the Configuration Components window appears, and the necessary files are copied.

Accelerating Internet Connectivity through the ISA Server Cache

ISA Server Cache Summary

The Web Proxy service of ISA Server enables frequently requested Web objects to be cached. Subsequent client requests are checked against the ISA Server cache to determine whether they can be served from the cache. A new request is initiated if the ISA Server cache cannot be utilized to serve the client request. ISA Server stores most frequently accessed items in RAM. The items are then retrieved from memory instead of from disk.

Objects remain in the ISA Server cache until either of the following events occurs:

* A more up to date version of the cached object is obtained.
* Space is required for other more recently requested objects.

ISA Server caching can be implemented using either of these methods:

* Forward Web caching
* Reverse Web caching
* Scheduled caching
* Distributed caching
* Hierarchical caching (chaining)

When you configure ISA server as a forward Web caching server, internal clients are able to access the Internet, and ISA Server maintains a cache of frequently requested Internet objects which can be accessed by any Web browser behind the firewall. Client browser performance is improved because using the cache results in less processing than requesting objects from the Internet. Bandwidth usage on Internet connections remains low. User response time is decreased as well.

With reverse caching, objects requested from internal servers by external clients are stored on the ISA server. Incoming Web requests are forwarded to the ISA server and are served from the cache. Requests are only forwarded to the Web server when the cache cannot be used to serve the request.

You can use the ISA Server Scheduled Content Download job feature to download the content to the ISA Server cache as per a predefined schedule. You can proactively ensure that important content is always available directly from the ISA Server cache and that the information is current.

You can directly download the following to the ISA Server cache:

* A single URL
* Multiple URLs
* Entire Web site

You can also limit which content should be downloaded. You can define scheduled content downloading for outgoing Web requests and for incoming Web requests.

The ISA Server Enterprise Edition uses Cache Array Routing Protocol (CARP) to provide scaling and improve efficiency. When you install multiple ISA Server computers, ISA servers are automatically installed in arrays. The array of ISA servers is then treated as a single logical cache. A hashing algorithm determines the location for storage, and hash-based routing is used to retrieve the location of the stored object when requests are made.

The routing algorithm used by CARP works as follows:

* The array membership list is used to track the status of the servers. The array membership list is updated using the TTL countdown which detects all active servers.
* A hash function is calculated for the name of each particular server.
* A hash function is also calculated for the name of each particular URL requested.
* The hash values of each of the above calculations are joined.
* The owner of the information cache is the highest value derived from combining the server hash value and the hash value of the URL.
* Subsequent requests for the cached information will use the same location.

The ISA Server Enterprise Edition enables administrators to arrange individual ISA Server computers or arrays of ISA Servers hierarchically. This process is also referred to as chaining. Requests are then sent upstream through the chain of servers until the object which was requested is located. Chaining provides fault tolerance. Content can then be distributed to multiple locations without making requests on the Internet.

The different server roles that you can configure for ISA Server are:

* Dedicated firewall
* Secure Publishing server
* Forward Web cache server
* Reverse Web cache server
* Integrated Firewall and Web Cache server

The features provided by Cache mode are:

* Access policy (for HTTP only)
* Alerts
* Cache configuration
* Enterprise policy
* Real-time monitoring
* Reports
* Web publishing

When determining ISA Server cache placement, consider the following important factors:

* You should use a hard disk volume formatted with NT file system (NTFS).
* You should use a local drive and not a network drive.
* You need at least 5MB to install the ISA Server cache.
* The ISA Server installation drive and the cache drive should be separated. This will improve performance.
* You can configure multiple drives to contain part of the ISA Server cache.

How ISA Server Caching Works

When ISA Server needs to determine whether to retrieve objects from the Internet or from the ISA Server cache, it uses the following information:

* Settings configured on the Cache Configuration Properties dialog box: Configuration settings here include

• Available memory for caching.
• Expiration policy for objects in the cache.
• Active caching policy.
• Maximum size of objects in the cache.
• Maximum size of Uniform Resource Locators (URLs) cached.

To access the Cache Configuration Properties dialog box;

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.

* Configured routing rules: Routing rules are used to define the following:

Specify when content should be retrieved from the ISA Server cache: When creating a new routing rule, you specify the following:

• When ISA Server should use the ISA Server cache to retrieve the object to serve a request. You can configure ISA Server to retrieve any version of the object from the cache.
• When ISA Server should route the request upstream to another server. You can alternatively configure ISA Server to never route requests.
• When the request should be routed to the requested Web server.
• You can specify that ISA Server should only retrieve an object from the cache when a version of the object that has not expired, exists in the cache.

Specify when the ISA Server should cache content. When creating a new routing rule, you set the following:

• Whether retrieved objects should be stored in the ISA Server cache or not stored in the cache.
• Whether retrieved objects and dynamic content should be stored in the ISA Server cache.
• Whether objects should only be stored when the source and request headers specify caching.

The default routing rule allows Web Proxy client requests to be directly obtained from the Internet.

The size of the ISA Server cache is determined by the settings specified during ISA Server setup. The other settings that are enabled after ISA Server installation are:

* HTTP caching is enabled
* FTP caching is enabled
* Active caching is disabled.

When configuring routing rules, you can define routing for:

* All destinations
* All external destinations.
* A specific destination.
* All destinations other than a specific destination.

You can apply different routing rules to different destinations so that ISA Server caches content according to the destinations that you have specified.

When a user sends a request for an object, ISA Server first checks the ISA Server cache to determine whether or not the object exists in the cache. When a request is sent to an array of ISA servers, the Cache Array Routing Protocol (CARP) algorithm ascertains which ISA server's cache to check for the requested object.

When the object exists in the ISA Server cache, the following process occurs:

* ISA Server first determines whether the object is valid. It uses the following set of rules to decide whether objects are no longer valid:

• When the Time to Live (TTL) defined in the source is expired.
• When the Time to Live (TTL) defined in the Cache Configuration Properties dialog box has expired.
• When the Time to Live (TTL) defined in the scheduled cache content download job is expired.

If the object in the cache is still valid, ISA Server retrieves the object from the cache and passes it to the user.

* When an object is no longer valid, ISA Server next checks the routing rule. The invalid object is passed to the user if you have configured ISA Server to retrieve any version of the object from the cache.
* When the routing rule defines that the request should be routed, ISA Server then determines:

• Whether the request should be routed to an upstream server.
• Whether the request should be routed to the Web server.

* When the routing rule is set to route the request to a Web server, ISA Server checks whether the particular Web server can be accessed.
* If the Web server can be accessed, ISA Server then determines whether the requested object can be stored in its cache. The cache properties of the routing rule is checked to determine this. If the response should be cached, ISA Server caches the response and returns the requested object to the user.
* When the routing rule is set to route the request to a Web server, but ISA Server cannot access the specific Web server, ISA Server then ascertains whether or not expired objects should be returned to the user. If so, the expired object is passed to the user.

For all objects that do not exist in the cache, ISA server uses the configuration of the routing rule to determine the way in which to route the request.

How to configure when ISA Server caches objects

ISA Server caches objects to:

* RAM: The default ISA Server configuration caches objects that are below 12,800 bytes in size in RAM. An object that is stored in RAM is retrieved faster by ISA Server than an object which is stored on disk.
* Disk: The ISA Server default configuration caches objects that are bigger 12,800 bytes in size on disk.

You can use the settings on the Cache Configuration Properties dialog box (Advanced tab) to change the size of objects which gets stored in memory.

Responses to user requests that include the HTTP response headers listed below are not cached by ISA Server:

* cache-control: no-cache
* cache-control: private
* pragma: no-cache
* set-cookie
* www-authenticate

Responses to user requests that include the HTTP request headers listed below are not cached by ISA Server:

* authorization; only allowed when the origin server contains the cache-control: public header in the response.
* cache-control: no-store

The settings that you can configure on the Cache Configuration Properties dialog box allow you to more precisely specify when objects should be cached.

You can configure which content to cache:

* Objects that have surpassed a predefined size limit.
* Objects that have no last modification date specified.
* Objects that contain a question mark in the URL.
* Objects that have no 200 response specified.

With regard to ISA Server and HTTP object caching, you can choose between different expiration policies. An object is considered expired when its Time to Live (TTL) setting has expired. ISA Server can though continue to use an expired object for a predefined time period when the source of the expired object is not available.

The different expiration policies you can define for HTTP object caching on the HTTP tab of the Cache Configuration Properties dialog box are:

* Frequently: Objects stored in the ISA Server cache are more up to date or current because ISA Server retrieves objects from the Internet site frequently. The downside of enabling this setting is the possible negative impact on network performance.

• The Time to Live (TTL) period is set as 0.

* Normally: The default setting is Normally. Objects stored in the ISA Server cache are updated with consideration to network performance.
* Less frequently: Objects stored in the ISA Server cache are not as current. There is less of a negative impact on network performance because ISA Server does not regularly retrieve objects from the Internet.
* Set custom Time to Live (TTL) settings: These settings allow administrators to manually define the TTL setting for objects.

With regard to ISA Server and FTP object caching, you can specify whether caching should be enabled, and set the TTL period for all FTP objects.

ISA Server includes an active caching feature. When you enable the active caching feature, ISA Server checks which objects in its cache are frequently accessed, and then, when these objects almost reach expiration, ISA Server automatically updates the objects.

The different active caching policies you can choose between are listed here:

* Frequently: Frequently accessed objects in the ISA Server cache are refreshed prior to the objects expiring.
* Normally: The default setting is Normally. Frequently accessed objects stored in the ISA Server cache are updated with consideration to network performance.
* Less frequently: Frequently accessed objects in the ISA Server cache are updated somewhat, but network performance is considered more important. This setting places active caching at its minimum level. There may be instances when a current, more up to date object does not exist in the ISA Server cache.

You can also configure ISA Server to perform negative caching. When negative caching is enabled, ISA Server caches the error response received when it is unable to retrieve a requested object from the Web server.

HTTP objects that have the status codes listed here can be cached:

* Status code 203
* Status code 300
* Status code 301
* Status code 410

Scheduling ISA Server to Download Content Automatically

You can configure and schedule ISA Server to download content automatically, to ensure that the content in the cache is always available and current.

You can schedule ISA Server to download:

* Entire Web sites.
* A Web page.
* Multiple Web pages.

You can configure scheduled content download jobs for:

* Incoming Web requests.
* Outgoing Web requests.

You can use scheduled cache content download jobs to speed up the performance of your internal Web server for Internet clients. Here, you can configure ISA server to automatically download the Web site of your internal Web server to the cache, so that content can be retrieved from ISA Server directly and not from the internal Web server itself. This basically means that your Internet clients will no longer directly access your internal Web servers.

The scheduled cache content download feature has the following advantages

* Saves network bandwidth.
* Improves cache performance.
* Secure internal Web servers.

The New Scheduled Content Download Job Wizard is used to enable and configure the scheduled cache content download feature.

To launch the New Scheduled Content Download Job Wizard, use the steps below:

1. Open the ISA Management console.
2. Navigate to the Scheduled Content Download Jobs folder by expanding the Cache Configuration node.
3. Right-click Scheduled Content Download Jobs, and select New and then select Job from the shortcut menu.
4. The New Scheduled Content Download Job Wizard appears.
5. Follow the various pages and prompts of the New Scheduled Content Download Job Wizard to create a new scheduled cache content download job.

How to create a routing rule

1. Open the ISA Management console.
2. Navigate to the Routing folder.
3. Right-click the folder and select New and then Rule from the shortcut menu.
4. The New Routing Rule Wizard launches.
5. In the Name box enter the name of the routing rule.
6. In the Description box, enter a description for the routing rule.
7. Click Next.
8. When the Destination Sets page opens, specify the destination or the destination set and then click Next.
9. On the Request Action page, you have to specify how client requests should be routed. Options include:

• Retrieve them directly from specified destination
• Route to specified upstream server
• Redirected to hosted site
• Use dial-up entry

10. Click Next
11. On the Cache Retrieval Configuration page, you have to define how this routing rule searches for and retrieves objects from the cache. Click Next.
12. On the Cache Content Configuration page, specify whether and when objects should be stored in the ISA Server cache. Click Next.
13. Click Finish.
14. The new routing rule should be displayed in the details pane.

How to configure a routing rule that always caches content

1. Open the ISA Management console.
2. Navigate to the Routing folder.
3. Right-click the folder and select New and then Rule from the shortcut menu.
4. The New Routing Rule Wizard launches.
5. In the Name box enter the name of the routing rule.
6. In the Description box, enter a description for the routing rule.
7. Click Next.
8. When the Destination Sets page opens, specify the destination or the destination set and then click Next.
9. On the Request Action page, you have to specify how client requests should be routed. Select the Retrieve them directly from specified destination option. Click Next.
10. On the Cache Retrieval Configuration page, you have to specify how your new routing rule searches for and retrieves objects from the ISA Server cache. Select the A Valid Version Of The Object; If None Exists, Retrieve The Request Using The Specified Requested Action option and then click Next.
11. On the Cache Content Configuration page, specify whether and when objects should be stored in the cache. Select the All Content, Including Dynamic Content, Will Be Cached option and then click Next.
12. Click Finish.
13. The new routing rule should be displayed in the details pane.

How to configure cache property settings for a routing rule

1. Open the ISA Management console.
2. Navigate to the Routing folder and expand the Routing folder.
3. Right-click the routing rule that you want to configure and then select Properties from the shortcut menu.
4. The Routing Rule Properties dialog box opens.
5. Click the Cache tab.
6. In the Search Cache For area of the Cache tab, select one of the following settings:

• If you want the object retrieved from the cache only when the version of the object is valid (not expired), select the A Valid Version Of The Object; If None Exists, Retrieve The Request Using The Route Defined On The Action Tab option. If the object is invalid, ISA Server will request the object from an upstream server.
• If you want ISA Server to always retrieve the object from the cache, irrespective of whether the object has expired or not, select the Any Version Of The Object; If None Exists, Retrieve The Request Using The Route Defined On The Action Tab. If the requested object does not exist in the ISA Server cache, then ISA Server will request the object from the upstream server.
• If you only want the object retrieved from the cache – never routed, select the Any Version Of The Requested Object In The Cache, Never Route The Request option. ISA Server will not route the request.

7. In the Cache Content area of the Cache tab, select one of the following settings:

• If ISA Server should always cache all content, as well as dynamic content, select the All Content, Including Dynamic Content, Will Be Cached option.
• If ISA Server should cache content only when the source and request headers specify caching, choose the If Source And Request Headers Indicate To Cache, Then The Content Will Be Cached option.
• If no content should be cached, choose the No Content Will Ever Be Cached option.

8. Click OK.

How to configure an ISA Server chain

1. Open the ISA Management console.
2. Navigate to the Routing folder.
3. Select the Routing folder.
4. Right-click the default routing rule and select Properties from the shortcut menu.
5. The Default Rule Properties dialog box opens.
6. Click the Action tab.
7. Select the Routing Them to a Specified Upstream Server option.
8. Click the Settings button associated with the Primary Route.
9. The Upstream Server Setting dialog box opens.
10. Select the ISA server and change the URL if applicable.
11. Enable the Use This Account checkbox and then select the account to utilize for authentication.
12. Select either Basic authentication or Integrated Windows authentication.
13. Click OK.
14. Use the same process to configure the Backup route.

How to specify how routing rules retrieve and serve requests

1. Open the ISA Management console.
2. Navigate to the Routing folder and expand the Routing folder.
3. Right-click the routing rule that you want to configure and then select Properties from the shortcut menu.
4. The Routing Rule Properties dialog box opens.
5. Click the Action tab. This is where you configure the routing rule action, or how requests are retrieved:

• If you want the object retrieved from the Internet, select the Retrieving Them Directly From The Specified Destination option.
• If you want an upstream server to action the request, select the Routing Them to A Specified Upstream Server option.

• If you want the request to be routed to a different computer choose the Redirecting Them to A Hosted Site option:

• Set the site.
• Set the port.
• Set the SSL port.

6. If you want to use a dial-up connection as a primary route for the request, select the Use Dial-up Entry For Primary Route checkbox.
7. If you want to use a dial-up connection as a backup route for the request, select the Use Dial-up Entry For Backup Route checkbox.
8. Click OK.

How to configure the destination for a routing rule

1. Open the ISA Management console.
2. Navigate to the Routing folder and expand the Routing folder.
3. Right-click the routing rule that you want to configure and select Properties from the shortcut menu.
4. The Routing Rule Properties dialog box opens.
5. Click the Destinations tab.
6. Select one of the following options:

* All Destinations
* All External Destinations
* All Internal Destinations
* Selected Destination Set
* All Destinations Except Selected Set

7. If you selected the Selected Destination Set option, or the All Destinations Except Selected Set option, choose the destination set in the Name drop-down list box.
8. Click OK.

How to change which drives are used to store the ISA Server cache

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Expand the Cache Configuration node.
4. Select Drives.
5. Right-click the server that you want to set the size of the cache for and then select Properties from the shortcut menu.
6. Select the NTFS drives which are used to store the ISA Server cache and then specify how much disk space is used on each drive.
7. Click OK.

How to set the size of the cache

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Expand the Cache Configuration node.
4. Select Drives.
5. Right-click the server that you want to set the size of the cache for and then select Properties from the shortcut menu.
6. Select the NTFS drive.
7. Enter the size of the cache in the Maximum Cache Size (MB) textbox.
8. Click OK.

How to set the percentage of free memory to use for caching

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.
4. Click the Advanced tab.
5. Enter the percentage of free memory to use for caching in the Percentage Of Free Memory To Use For Caching textbox.
6. Click OK.

How to configure which content ISA Server should cache

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click Cache Configuration node and then select Properties from the shortcut menu.
4. The Cache Configuration Properties dialog box opens.
5. Click the Advanced tab.
6. If you want to place a limit on the size of objects that are cached, enable the Do Not Cache Objects Larger Than checkbox. Specify the unit – KB, MB, GB.
7. If you want ISA Server to cache objects that have no last modification date specified, then enable the Cache Objects That Have An Unspecified Last Modification Time checkbox.
8. If you want ISA Server to cache dynamic content, then choose the Cache Dynamic Content (Objects With Question Marks In The URL) checkbox.
9. Click OK.

How to configure HTTP object caching settings

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.
4. The Cache Configuration Properties dialog box opens.
5. Click the HTTP tab.
6. If you want objects stored in the ISA Server cache to be more current, select the Frequently (Expire Immediately) option.
7. If you want objects in the ISA Server cache to be current but with consideration to network performance, select the Normally option.
8. If network performance is more important than having up to date object information stored in the ISA Server cache, then select the Less Frequently (Reduced Network Traffic Is More Important) option.
9. If you want to manually define the TTL settings, choose the Set Time To Live (TTL) Of Object In Cache To option. You now have to configure the settings that define how ISA Server performs HTTP object caching.
10. If you want HTTP objects in the ISA Server cache to expire when a percentage of the content's age has expired, then select use This Percentage Of Content Age (Time Since Creation Or Modification) textbox to set this percentage.
11. If you want to set the minimum time period and maximum time period that HTTP objects remain in the cache, in the No Less Than textbox, enter the number and set the time unit. In the No More Than textbox, enter the number.
12. Next, set the time unit:

* Seconds
* Minutes
* Hours
* Days
* Weeks

13. Click OK.

How to configure FTP object caching settings

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.
4. The Cache Configuration Properties dialog box opens.
5. Click the FTP tab.
6. To enable FTP object caching, select the Enable FTP Caching checkbox.
7. Use the Time To Live For All Objects textbox to configure the Time To Live setting for all FTP objects.
8. Select the time unit:

* Seconds
* Minutes
* Hours
* Days
* Weeks

9. Click OK.

How to configure ISA Server to retrieve expired objects from the ISA Server cache

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.
4. The Cache Configuration Properties dialog box opens.
5. Click the Advanced tab.
6. If you do not want ISA Server to return an expired object from its cache when the Web server cannot be accessed to obtain a current version of the object, select the Do Not Return The Expired Object (Return An Error Page) option.
7. If you want ISA Server to return the expired object from its cache, select the Return The Expired Object Only If Expiration Was option. You next have to define TTL settings which will determine whether the expired object is returned or not.
8. Set the maximum percentage of the TTL in the At Less Than This Percentage Of Original Time To Live textbox. The object will not be returned from the cache if the expiration time is greater than this setting.
9. Set the maximum amount of time which has elapsed since the object has expired in the But No More Than (Minutes) textbox. The object will not be returned from the cache if the expiration time is greater than this setting.
10. Click OK.

How to configure active caching settings

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.
4. The Cache Configuration Properties dialog box opens.
5. Click the Active Caching tab.
6. Click the Enable Active Caching checkbox.
7. Select the Frequently option if you want frequently accessed objects in the ISA Server cache refreshed prior to the objects expiring.
8. Select the Normally option if you want frequently accessed objects stored in the ISA Server cache to be updated with consideration to network performance.
9. Select the Less Frequently option if you want frequently accessed objects in the ISA Server cache to be updated somewhat, but network performance is more important.
10. Click OK.

How to configure negative caching settings

1. Open the ISA Management console.
2. Navigate to the Cache Configuration node in the console tree.
3. Right-click the Cache Configuration node and then select Properties from the shortcut menu.
4. The Cache Configuration Properties dialog box opens.
5. Click the Advanced tab.
6. Proceed to enable the Cache Objects Even If They Do Not Have An HTTP Status Code Of 200 checkbox.
7. Click OK.

How to configure ISA Server to download content automatically

1. Open the ISA Management console.
2. Navigate to the Scheduled Content Download Jobs node by expanding the Cache Configuration node.
3. Right-click Scheduled Content Download Jobs, and select New and then select Job from the shortcut menu.
4. The New Scheduled Content Download Job Wizard appears.
5. Enter a name for the new scheduled content download job in the Job Name textbox and then click Next.
6. Provide the date and time when the new scheduled download job should commence on the Start Time page. Click Next.
7. On the Frequency page, set how often content should be downloaded. Options include:

* Once
* Daily
* Weekly on: Set the day of the week.

8. Click Next.
9. On the Content page, type the URL that should be downloaded in the Download Content From This URL textbox.
10. Select the Content Only From URL Domain checkbox if you want to download only linked pages within the same site.
11. Select the Cache Dynamic Content checkbox if you want ISA Server to cache dynamic content. Click Next.
12. The Links And Downloaded Objects page opens. This is where you define how ISA Server handles the TTL of the objects which are downloaded.
13. If you want all downloaded objects to have the same TTL, then select the Always Override Object's TTL checkbox and enter the TTL setting in the available box.
14. If you want all downloaded objects to have the TTL which you set, but only when the objects do not have a defined TTL, then select the Override TTL If Not Defined checkbox.
15. Enable the Cache Up To Maximum Links Depth Of checkbox and then set how many links ISA Server should follow in the available box.
16. Alternatively, select the No Limit On Maximum Depth checkbox.
17. You can also specify the maximum number of objects that ISA Server caches when the scheduled download job runs in the Maximum Number Of Cached Objects box.
18. Click Next.
19. The Completing The Scheduled Content Download Job Wizard page is displayed.
20. Click Finish.
21. Your new scheduled content download job should appear in the details pane when you select the Scheduled Content Download Jobs folder.

How to define the location from where to download cache content

1. Open the ISA Management console.
2. Expand the Cache Configuration node.
3. Select the Scheduled Content Download Jobs folder.
4. All existing scheduled content download jobs are displayed in the details pane.
5. Right-click the scheduled content download job that you want to configure and select Properties from the shortcut menu.
6. Click the Parameters tab.
7. Enter the URL from where to download cache content in the Begin Downloading From URL textbox.
8. Select the Keep Download Process Inside URL Domain Only checkbox if you want to download only linked pages within the same site.
9. Enable the Cache Up To Maximum Links Depth Of checkbox and then set how many links ISA Server should follow in the available box.
10. Specify the maximum number of objects that ISA Server caches when the scheduled download job runs in the Maximum Number Of Cached Objects box.
11. Click OK.

How to configure the TTL settings for downloaded cache content

1. Open the ISA Management console.
2. Expand the Cache Configuration node.
3. Select the Scheduled Content Download Jobs folder.
4. All existing scheduled content download jobs are displayed in the details pane.
5. Right-click the scheduled content download job that you want to configure and select Properties from the shortcut menu.
6. Click the Parameters tab.
7. If you want all downloaded objects to have the same TTL, then select the Always Override Object's TTL checkbox and enter the TTL setting in the available box.
8. If you want all downloaded objects to have the TTL which you set, but only when the objects do not have a defined TTL, then select the Override TTL If Not Defined checkbox.
9. Click OK.

How to define a schedule for a scheduled content download job

1. Open the ISA Management console.
2. Expand the Cache Configuration node.
3. Select the Scheduled Content Download Jobs folder.
4. Right-click the scheduled content download job that you want to configure and select Properties from the shortcut menu.
5. Click the Frequency tab.
6. In the Date Calendar box and Time box, set the date and time for the schedule.
7. If you want content downloaded only once, select the Once option.
8. If you want content downloaded each day by ISA Server at the defined time, then select the Daily option.
9. If you want content downloaded on a specific day of the week at the set time, select the Weekly option. Set the day on which content should be downloaded.
10. Click OK.

How to cache dynamic content during scheduled content download jobs

1. Open the ISA Management console.

2. Expand the Cache Configuration node.
3. Select the Scheduled Content Download Jobs folder.
4. Existing scheduled content download jobs are displayed in the details pane.
5. Right-click the scheduled content download job that you want to configure and select Properties from the shortcut menu.
6. Click the Parameters tab.
7. Enable the Cache Dynamic Content checkbox.
8. Click OK.