Microsoft Windows Server 2008: A Beginner s Guide in Software

Encoder Code 3 of 9 in Software Microsoft Windows Server 2008: A Beginner s Guide

Figure 10-6 You can configure the cryptographic settings for your private key, but in most cases, the defaults are adequate

7 Click Next, enter the name for the CA, and click Next again Select the validity period or leave the default of 5 Years and once more click Next 8 You are shown where the certificate database and log will be stored Change that if you wish and then click Next The summary of your settings is displayed If you want to change anything, click Previous When you are ready, click Install 9 Click Close when you are told that you have successfully completed installation Close Server Manager

Once a CA is installed, it can be administered through the Certification Authority window Here s how:

10:

1 Click Start | Administrative Tools | Certification Authority (if you just installed it, Certification Authority may be out of alphabetical sequence in the menu) 2 In the left pane, open the local server and click Issued Certificates You should see at least the certificate issued to the server, like this (if you don t see the certificate, restart the server and the certificate should appear):

3 Right-click the certificate in the right pane and click Open Here, you can see who issued it, the dates it is valid, and the type of public key it uses Click OK to close the certificate 4 Right-click the local server in the left pane and select All Tasks In the submenu, you can stop the issuing of certificates and back up and restore the CA 5 Back in the context menu with All Tasks, click Properties In the Properties dialog box that opens, click the Policy Module tab and again click Properties In the Request Handling tab, you can choose manual or automatic issuing of certificates, as you can see here:

6 Close both Properties dialog boxes Back in the Certification Authority window, you ll see a Pending Requests folder If you selected manual certificate issuing, then all certificate requests will go into this folder When you are done looking at the Certification Authority window, close it

IPSec is controlled by group policies, which can be set at various levels, the primary of which is the domain This means that you must have Active Directory (AD) set up and the server that hosts VPN must be a domain controller See 7 for setting up AD and domain controllers Assuming you are on an AD domain controller, start and configure IPSec at the domain level by first setting up group policy management: 1 Click Start | Server Manager and click your server in the tree on the left Open Roles and click Network Policy And Access Services 2 In the right pane, click Add Role Services Click Network Policy Server, Routing And Remote Access Services, and Host Credential Authorization As you click each, read its description on the right Click Host Credential Authorization Protocol Click Add Required Role Services 3 Click Next Accept the default of choosing an existing certificate for SSL encryption, click your new certificate server, and click Next Click Next again on the Web Server (IIS) page On the Web Server Role Services list, you ll see that several services have been checked 4 Click Next and review the roles and services that are about to be installed If you want to change anything, click Previous When you are ready, click Install When you are told that installation was successful, click Close 5 While still in the Server Manager, in the tree on the left, click Features, and in the right pane, click Add Features In the list of features, click Group Policy Management (if it isn t already installed), click Next, and click Install When installation is complete, click Close, and close the Server Manager 6 Click Start | Administrative Tools | Group Policy Management Open the forest and the domains, and then open your domain Right-click the Default Domain Policy and click Edit 7 In the left pane, double-click Computer Configuration, double-click Windows Settings, double-click Security Settings, and double-click IP Security Policies On Active Directory Click the Action menu and click Create IP Security Policy The IP Security Policy Wizard opens Click Next 8 Enter the name and a description of the policy and click Next If you are using only Windows Vista computers as VPN clients, do not accept the automatic activation of the default response rule, which automatically responds to remote computers that request security Click Next, make sure Edit Properties is checked, and click Finish 9 The Properties dialog box for your new policy will open with a single IP filter Click Add The Security Rule Wizard will open Click Next 10 Click The Tunnel Endpoint Is Specified By The Following IP Address, enter the IP address of the computer to which the server will be connecting, and click Next Click Remote Access and click Next

10: