Whether you’re new to network administration or to the Windows environment, a few common oversights and mistakes can trip you up. Deb Shinder explains how to avoid some of the problems new Windows admins often encounter.

Maybe you’re a brand new network admin. You’ve taken some courses, you’ve passed some certification exams, perhaps you even have a Windows domain set up at home. But you’ll soon find that being responsible for a company network brings challenges you hadn’t anticipated.

Or maybe you’re an experienced corporate IT person, but up until now, you’ve worked in a UNIX environment. Now — either due to a job change or a new deployment in your current workplace — you find yourself in the less familiar world of Windows.

This article is aimed at helping you avoid some of the most common mistakes made by new Windows administrators.

Note: This information is also available as a PDF download.

#1: Trying to change everything all at once

When you come into a new job, or start working with a new technology, you may have all sorts of bright ideas. If you’re new to the workplace, you immediately hone in on those things that your predecessors were (or seem to have been) doing wrong. You’re full of all the best practices and tips and tricks that you learned in school. If you’re an experienced administrator coming from a different environment, you may be set in your ways and want to do things the way you did them before, rather than taking advantage of features of the new OS.

Either way, you’re likely to cause yourself a great deal of grief. The best bet for someone new to Windows networking (or to any other job, for that matter) is give yourself time to adapt, observe and learn, and proceed slowly. You’ll make your own job easier in the long run and make more friends (or at least fewer enemies) that way.

#2: Overestimating the technical expertise of end users

Many new administrators expect users to have a better understanding of the technology than they do. Don’t assume that end rx cialis low price users realize the importance of security, or that they will be able to accurately describe the errors they’re getting, or that they know what you mean when you tell them to perform a simple (to you) task such as going to Device Manager and checking the status of the sound card.

Many people in the business world use computers every day but know very little about them beyond how to operate a few specific applications. If you get frustrated with them, or make them feel stupid, most of them will try to avoid calling you when there’s a problem. Instead they’ll ignore it (if they can) or worse, try to fix it themselves. That means the problem may be far worse when you finally do become aware of it.

#3: Underestimating the technical expertise of end users

Although the above applies to many of your users, most companies will have at least a few who are advanced computer hobbyists and know a lot about technology. They’re the ones who will come up with inventive workarounds to circumvent the restrictions you put in place if those restrictions inconvenience them. Most of these users aren’t malicious; they just resent having someone else in control of their computer use — especially if you treat them as if they don’t know anything.

The best tactic with these users is to show them that you respect their skills, seek out their input, and let them know the reasons for the rules and restrictions. Point out that even a topnotch racecar driver who has demonstrated the ability to safely handle a vehicle at high speed must abide by the speed limits on the public roads, and it’s not because you doubt his/her technology skills that you must insist on everyone following the rules.

#4: Not turning on auditing

Windows Server operating systems have built-in security auditing, but it’s not enabled by default. It’s also not one of the best documented features, so some administrators fail to take advantage of it. And that’s a shame, because with the auditing features, you can keep track of logon attempts, access to files and other objects, and directory service access.

 Active Directory Domain Services (AD DS) auditing has been enhanced in Windows Server 2008 and can be done more granularly now. Without either the built-in auditing or third-party auditing software running, it can be almost impossible to pinpoint and analyze what happened in a security breach.

#5: Not keeping systems updated

This one ought to be a no-brainer: Keeping your servers and client machines patched with the latest security updates can go a long way toward preventing downtime, data loss, and other consequences of malware and attacks. Yet many administrators fall behind, and their networks are running systems that aren’t properly patched.

This happens for several reasons. Understaffed and overworked IT departments just may not get around to applying patches as soon as they’re released. After all, it’s not always a matter of “just doing it” — everyone knows that some updates can break things, bringing your whole network to a stop. Thus it’s prudent to check out new patches in a testbed environment that simulates the applications and configurations of your production network. However, that takes time — time you may not have.

Automating the processes as much as possible can help you keep those updates flowing. Have your test network ready each month, for instance, before Microsoft releases its regular patches. Use

Windows Server Update Services (WSUS) or other tools to simplify and automate the process once you’ve decided that a patch is safe to apply. And don’t forget that applications — not just the operating system — need to be kept updated, too.

#6: Getting sloppy about security

Many administrators enforce best security practices for their users but get sloppy when it comes to their own workstations. For example, IT pros who would never allow users to run XP every day logged on with administrative accounts think nothing about running as administrators themselves while doing routine work that doesn’t require that level of privileges. Some administrators seem to think they’re immune to malware and attacks because they “know better.” But this over confidence can lead to disaster, as it does in the case of police officers who have a high occurrence of firearms accidents because they’re around guns all the time and become complacent about the dangers.

#7: Not documenting changes and fixes

Documentation is one of the most important things that you, as a network admin, can do to make your own job easier and to make it easier for someone else to step in and take care of the network in your absence. Yet it’s also one of the most neglected of all administrative tasks.

You may think you’ll remember what patch you applied or what configuration change you made that fixed an exasperating problem, but a year later, you probably won’t. If you document your actions, you don’t have to waste precious time reinventing the wheel (or the fix) all over again.

Some admins don’t want to document what they do because they think that if they keep it all in their heads, they’ll be indispensible. In truth, no one is ever irreplaceable — and by making it difficult for anyone else to learn your job, you make it less likely that you’ll ever get promoted out of the job.

Besides, what if you got hit by a truck crossing the street? Do you really want the company to come to a standstill because nobody knows the passwords to the administrative accounts or has a clue about how you have things set up and what daily duties you have to perform to keep the network running smoothly?

#8: Failing to test backups

One of the things that home users end up regretting the most is forgetting to back up their important data — and thus losing it all when a hard drive fails. Most IT pros understand the importance of backing up and do it on a regular schedule. What some busy admins don’t remember to do regularly is test those backups to make sure that the data really is there and that it can be restored.

Remember that making the backup is only the first step. You need to ensure that those backups will work if and when you need them.

#9: Overpromising and underdelivering

When your boss is pressuring you for answers to questions like “When can you have all the desktop systems upgraded to the new version of the software?” or “How much will it cost to get the new database server up and running?”, your natural tendency may be to give a response that makes you look good. But if you make promises you can’t keep and come in late or over budget, you do yourself more damage than good.

A good rule of thumb in any business is to underpromise and overdeliver instead of doing the opposite. If you think it will take two weeks to deploy a new system, give yourself some wiggle room and promise it in three weeks. If you’re pretty sure you’ll be able to buy the hardware you need for $10,000, ask for $12,000 just in case. Your boss will be impressed when you get the project done days ahead of time or spend less money than expected.

#10: Being afraid to ask for help

Ego is a funny thing, and many IT administrators have a lot invested in theirs. When it comes to technology, you may be reluctant to admit that you don’t know it all, and thus afraid — or embarrassed — to ask for help. I’ve know MCSEs and MVPs who couldn’t bear to seek help from colleagues because they felt they were supposed to be the “experts” and that their reputations would be hurt if they admitted otherwise. But plunging ahead with a project when you don’t know what you’re doing can get you in hot water, cost the company money, and even cost you your job.

If you’re in over your head, be willing to admit it and seek help from someone more knowledgeable about the subject. You can save days, weeks, or even months of grief by doing so.

Network security doesn’t end with the installation of a firewall or any automated security package. There are times when you’ll need to block certain ranges of IP addresses (or known hosts) based on a service and/or block specific IP addresses from gaining access to your network cialis plus (or machine). Peer Guardian 2 makes this task simple in a Windows (currently 98/ME/2000/XP) environment. The application is open source, so you can download the source code, modify it, and even create your own branch of the software.

This little gem of a software package makes blocking IP addresses very simple. But in its simplicity, Peer Guardian 2 does not lose either functionality or robustness. I’ll explain how to create lists of IP addresses to block in Peer Guardian 2, but first let’s get the software installed and up and running.

This blog post is also available in PDF format in a TechRepublic download.

Getting and installing

As with most all Windows software, installation of Peer Guardian 2 is a snap. Simply download the OS-specific binary from the Phoenix Labs download site and double-click the installation file. The standard installation steps will take place and, once the application is installed, you will be asked to walk through some initial setup configurations.

The first part of the setup will ask what types of lists to install. There are six types of lists as well as an option for always allowing HTTP requests. The options are shown in Figure A.

Figure A

Don’t worry if you select something wrong, you can always edit your lists manually.

The next phase in the setup is to configure updates. The setup system wants to know whether it is to update lists and/or software and how often these updates are to occur. Figure B illustrates the configuration options for automatic updates.

Figure B

Unless you plan on manually updating Peer Guardian 2, make sure you select to have it updated automatically along with the lists.

Once you have completed the updates section, you are finished with the configuration. After the configuration is complete, you will be greeted with a small window (Figure C) that shows the progress of the updates.

Figure C

Even if you’ve configured updates to occur automatically, you can check for them manually from the main window.

Once the updates are finished, click the Close button and you are ready to run Peer Guardian 2.

Fire it up

Go to your Start menu and look for the new entry for Peer Guardian 2. Within that menu you will find the entry to start system. When Peer Guardian 2 starts up, you will see the main window, shown in Figure D.

Figure D

Take a look at the number of blocked IP addresses: 774,193,650!

Now what we want to do is open up the List Manager. This is where blocked IP addresses are listed. From within the List Manager (Figure E) you can enable lists, edit lists, create lists, open lists, and remove lists.

Figure E

The lists shown are the default lists created when Peer Guardian 2 is initially set up.

Creating a new list

Click the Create List button. This will open a new window (Figure F) where the initial information for the list will be set up.

Figure F

This window sets up the type of list, the description, and the file name.

At first it seems a file has to exist in order to create the list. This is not so. When you click the Browse button in Peer Guardian 2, a Save As window will appear. Locate the folder where the file is to be stored and give the file a name. That’s it. Once the new list is saved, the list editing tool will open (Figure G).

Figure G

Once your list gets large enough, you might have to use the Search function to locate a specific IP address.

Click the Add button and a new text area will appear. This first text area is really just for a description of the IP range. Here’s an example: On an inside network there is a specific database server that houses all of the company’s private Human Resource data. This data is off limits to a large range of employees (IP addresses 192.168.1.100 – 192.168.1.200). To block those IP addresses from gaining access to this particular machine, you could set up a range, as shown in Figure H.

Figure H

Once you enter the description, hit Enter to move to the starting IP address and then hit Enter again to move to the ending IP address.

If that is the only range that is necessary to block, click Save and the list will appear in the List Manager.

Temporarily allowing lists

Going back to the Employee example, let’s say it is necessary to allow that range of employees access to the server for a short window of time. To do this, open up the List Manager, highlight the list containing the Employees range, and click Open List. Now highlight the entry containing the range of IP addresses to be allowed and right-click the entry. A drop-down list will appear, giving you four possible choices (Figure I).

Figure I

Unfortunately these options cannot be modified without going into the code (but since this is open source, it is possible).

From the drop-down list, select the option that best suits the situation and click Save. Depending on the system, there might be a brief stall on the machine as Peer Guardian 2 makes the necessary changes to allow the range of IP addresses. At this point a List Cache might be created, which will take a moment (again depending on the speed of the system).

Logs, history, and other features

Another nice feature of Peer Guardian 2 is the log file viewer. The log file actually keeps a running log that is retained by date. And until the history is cleared, all logs are retained. This is a great help when security audits are done.

From the Settings tab you can configure a few settings for Logs, History, and Notification. As you can see in Figure J, configuration is very straightforward.

Figure J

By changing the Log Allowed Connections to Archive and Remove, the Archive To option becomes available.

Click the Next button and the Settings tab will change to offer another group of straightforward configuration options (Figure K).

Figure K

The proxy setting is for when a proxy is needed to download updates.

Another nice Peer Guardian 2 touch is that with a single button on the main screen you can disable it. And with the same ease, Peer Guardian 2 can also be re-enabled. In addition, HTTP can be allowed or blocked with the click of a button.

Final thoughts

Peer Guardian 2 is an outstanding tool to add to your security arsenal. Not only is it good for network-wide security, it’s great for single server (or even desktop) security. Peer Guardian 2 is simple to set up, but its power is not diminished by that simplicity.

A home network has many uses. With a home network, each computer in the network may have access to every other computer in the network. This way, all of the music can be on one computer, your kids can play games against each other at the same time (or do homework), all of the computers can share one printer, and countless other reasons. As the high-speed Internet access trend continues, the need for a home network becomes almost necessary.

Here is how to set up a simple home network between two computers using a DSL modem:

The Hardware Setup

Before we configure Windows, we must first make sure everything is plugged in correctly. We must begin with the device that the phone company sent to you. This is called a modem or a router. We must make sure that the first computer can access the Internet before we move on to the second. Below are the steps to follow to set up the hardware in your home network:

1. Plug in the DSL modem that the telephone company gave to you next to a phone jack.
2. Plug in a telephone line from the phone jack to the DSL modem.
3. This is where the home network begins. If you just had one computer in your house, you would connect it directly to lowest cost cialis the DSL modem here. Instead, we are going to connect a switch to the DSL modem. Below is a LinkSys switch that you may purchase at your local computer store:

Plug the switch into the wall now.

4. The wire used to connect the switch to the DSL modem is called a straight through CAT5 cable. Connect one end to the DSL modem and the other end to the Uplink port on the Switch. When you are finished connecting the switch to the DSL modem, the switch should appear as follows:

5. Now we can connect any of the leftover LAN ports to the computers that are in the home. Simply connect another CAT5 straight through wire from the back of the PC to any of the leftover LAN ports on the switch:

6. Turn your computers on. If your computers were on, it is still OK. The green lights on the switch will indicate that your computers are talking to the switch.

This is all that is required of the hardware setup. This is called an Ethernet network. If you would like to setup a wireless (802.11b) network in your house, simply substitute a wireless switch (or hub) for the Ethernet switch shown above. Please note that your computers will then require wireless network cards.

The Software Setup

Yesterday, we learned how to install a home network via a DSL modem. We must now configure Windows to allow the computers to talk to one another. Below are the instructions required to setup a network in Windows: (see below for Windows XP instructions.)

1. Using the Windows start menu, proceed to Start, Settings, Control Panel .

2. This will bring up the Windows control panel. Once the control panel appears, double-click on System .

3. This will bring up the system properties configuration tool. When this comes up, click on the Network Identification tab.

4. Once this appears, click on the Network ID button. This will bring up the Network Identification Wizard. Click Next .

5. Once the next button is clicked, the wizard will ask if this computer is going to be part of a business network or for home use. At this point, we would like to choose the “This computer is part of a business network, and I use it to connect to other computers at work” option. Of course, a home network is not at your work or business, but we are going to select this in order to connect to other computers.

6. The next step in the wizard is the Domain step. A home network is not part of a domain. Therefore, we would like to select the “My company uses a network without a domain” option. Once this is selected, press the Next button.

7. The next step is the Workgroup step. Please insert a suitable name for your workgroup in the space provided. Once a name has been chosen, click Next . Note: All of the computers on your network must be a member of the same workgroup.

8. Finally, we are finished with the Network Identification wizard.

Simply click the Finish button and restart your machine. The computer you just configured is now a part of the workgroup that you created. To add more machines to your home network, go to step one and start over on the new machine.

XP Users:
Simply click on Start, Control Panel. Then select Network and Internet Connections, followed by Network Connections. In the next window, select "Set up a home or small office network" from the left side bar. This will bring up the Network Identification Wizard. Click Next after reading the Welcome and the Network Identification Wizard will begin to walk you through the set-up procedure much like stated above.

Once you are finished, all of the machines on your home network can now see each other. It is now possible to configure your computers to share hard drives, printers, and other devices that are connected to all of your computers. This way you won't have to keep moving floppy disk around when you want to print something on another computer.

Your network administrators have to be able to incorporate Windows, Apple, and Linux workstations.

—————————————————————————

Love ‘em or hate ‘em, Macs are likely to be on your network. Fortunately, advances within Apple’s OS X operating system simplify connecting Windows XP and Macs on the same network. Windows administrators can follow these steps to add Macs to Windows workgroups.

This blog post is also available in the PDF format in a TechRepublic download.

Verify the PC side

After confirming the Windows and Mac systems all have Ethernet connections and required switches or wireless connectivity, begin by verifying the Windows workgroup name (Figure A):

Figure A

Verify the Windows workgroup name by right-clicking My Computer, selecting Properties, and clicking the Computer Name tab.

Next, confirm the Windows workgroup is sharing the appropriate files within the workgroup:

1. Click Start.
2. Double-click My Computer.
3. Verify the appropriate folders are shared (look for the folder held by a blue hand icon (Figure B), thereby indicating the resource is being shared).

Figure B

The blue hand icon notes shared resources.

Once you’ve confirmed the right Windows files are being shared, or if you only wish to share a printer, check to ensure a printer or printers are being shared by:

1. Clicking Start.
2. Clicking Printers and Faxes.
3. Confirming a printer is being shared (look for the same blue hand icon indicating the printer is a shared resource).

 Before connecting the Mac units to the workgroup, you need to review the users/groups and permissions associated with the shared resources (to ensure you can properly configure the Macs to connect to the resources). For each shared resource:

1. Right-click the shared resource and select Properties from the pop-up menu.
2. Click the Security tab (Figure C).
3. Note the group or user names receiving access to the resource.
4. Note the specific permissions each group or user receives.
5. Make any required adjustments to group and user permissions using the supplied Add and Remove buttons.
6. Click OK (if you’ve made any changes or just close the window).

Figure C

Use the Permissions tab to configure specific permissions for users and groups.

If you don’t see permissions listed specifically for each user, your Windows XP system is likely set to Simple File Sharing. To turn Simply File Sharing off and enable more granular control of file and printer shares:

1. Click Start.
2. Select My Computer.
3. Click Tools.
4. Click Folder Options.
5. Select the View tab.
6. Within the Advanced settings window, scroll toward the bottom, find the Use Simple File Sharing (Recommended) check box, and ensure it’s deselected.
7. Click OK.

Mac

Now you’re ready to move to the Mac. To connect the Mac to an existing Windows workgroup:

1. Click on the Dock’s Finder icon.
2. Click on Network in the Finder’s left sidebar (Figure D).
3. Click on Workgroup.
4. Select the system hosting the resources you wish to connect to.
5. Click the Connect button.
6. Enter the workgroup name and a user name and password possessing permissions to access the resource within the SMB window that appears and click OK (Figure E).
7. Select the resource you wish to connect to, then click OK (Figure F).
8. Once the Windows-based resources appear in the Finder, simply drag an item from the Finder to the Mac Desktop to begin using it (Figure G).

Figure D

Use Finder on the Mac to begin sharing resources.

Figure E

You’ll have to provide the workgroup name and a valid Windows user name and password to connect to Windows resources from the Mac.

Figure F

Specify the resources you wish to connect to on the Windows network.

Figure G

Windows resources will appear within Finder once the Mac completes its connection to the Windows system.

Often, workgroup names won’t match up perfectly. Many Windows XP systems are set to use “MShome” as their workgroup, while others use the standard “Workgroup” workgroup name. The Mac uses the default Workgroup name. However, if you wish to change the Mac’s default workgroup name, follow these steps:

1. Click the Dock’s Finder icon.
2. Click Applications.
3. Scroll to the Utilities folder and select it.
4. Double-click Directory Access (Figure H).
5. Enable changes by clicking the padlock.
6. Provide an Administrator account user name and password.
7. Double-click SMB/CIFS.
8. Enter the workgroup name you wish to use in the resulting window or select it from the provided drop-down menu.
9. Click Apply.
10. Close Directory Access.

Figure H

Use the Mac’s Directory Access utility to turn on Windows Sharing.

Sharing resources

To share Mac-based resources with the Windows systems within a workgroup, sit at the Mac and perform these steps:

1. Click the Dock’s System Preferences icon.
2. Click Sharing within the Internet & Network section.
3. Ensure the checkbox for Windows Sharing is checked.
4. Click the Accounts button.
5. Check the boxes to specify which Mac accounts are authorized to use Windows Sharing.
6. Ensure Windows Sharing is on; if it’s not, click the Start button.

Next, move to a Windows system from which you wish to access Mac resources and do the following:

1. Click Start.
2. Click My Network Places.
3. Click View Workgroup Computers from the Network Tasks window; the Mac system may appear.
4. If the Mac system didn’t appear within My Network Places, go to plan B; click Add a Network Place within the Task Pane.
5. When the Add Network Place Wizard appears, click Next.
6. Highlight Choose Another Network Location and click Next.
7. Within the Internet or network address box, specify the Mac system’s IP address (which can typically be found by clicking the Dock’s System Preferences icon on the Mac, selecting Network, and choosing Built-in Ethernet from the Show drop-down menu), followed by the Mac user name, then click Next. Note this is an absolutely critical step: the network address must be entered as \\10.0.0.1\john if the Mac’s IP address is 10.0.0.1 and the user name is john (Figure I).
8. Specify a name for the network place and click Next.
9. Click Finish.

cialis chicago

10. The Mac resources will then appear within Windows.

Figure I

Once configured, accessing Mac resources from a Windows system is just like accessing resources on another Windows box.

Finally, to print to a printer hosted by a Windows system using a Mac:

1. Click the Dock’s System Preferences icon.
2. Click the Print & Fax icon within the Hardware section.
3. Click the Lock (if it’s closed) to enable changes (and provide an administrator user name and password).
4. Click the Plus icon to add a printer.
5. Click the More Printers button.
6. Ensure Windows Printing is selected from within the first drop-down menu.
7. Ensure Network Neighborhood is selected from within the second drop-down menu.
8. Highlight the workgroup possessing the printer you wish to print to and click Choose.
9. Highlight the Windows workstation hosting the printer and click Choose.
10. Enter a Windows user name and password possessing permissions to print to the printer and click OK.
11. Select the printer from the Printer Browser menu.
12. Specify the printer model using the supplied drop-down menu (or select the Generic listing).
13. Click the Add button.