This is the second part of my review of the new features in Windows Server 2008.
Read-Only Domain Controllers (RODC)
Branch offices and remote locations are now an important part of Windows Server deployments and required a complete Server installation with previous versions of Windows. The problem with complete installations is that you might need to make someone an administrator in that remote location and usually, the physical location of the server is not as safe as, say, the head office.
The RODC allows you to setup a Windows Server 2008 with all the services that are required for your remote locations, but makes the Active Directory database Read-Only. This way, only the locally cached passwords are stored on the machine and the AD Replication only occurs unidirectionally, as opposed to bidirectionaly with a regular server installation.
Normally, you setup a remote office server and ship it to destination. When it gets there it only needs to be plugged in and switched on to allow all the local users to connect and get their services such as DHCP, DNS, etc… RODC is perfect for this scenario and will only authenticate users who use the server at that remote location, limiting the number of passwords that are on the server. If a hacker manages to get access to that server or if it gets stolen, you are much better prepared than if it had been a full Server installation. Using Server Manager, you can simply choose to remove that server from the Active Directory and only the users who authenticated on that server (thus having a cached password on it) will be listed to get their passwords changed. No need to get the entire user base to change passwords.
Now, you are going to say: “Well if the hacker left with my server, it’s not the passwords I’m most worried about, it’s the data!“. You would be right about that, but not if you used the next new implementation: BitLocker.
Bitlocker is not really a new technology. It has been around for a while now in Microsoft products, but it was not available on Windows Servers or it could only encrypt the system partition. In Windows Server 2008, Bitlocker offers Full-Drive Encryption and allows you to install this on any or all of your servers for added protection.
The idea behind Bitlocker was originally for executives’ laptops who travel a lot and were more likely to get their machines stolen or compromised. Bitlocker encrypts the data on the hard drive and requires TPM 1.2-based hardware to store the keys. Many laptops have this now and servers are more likely to have this hardware. Anyone with physical access to the machine without the proper password would not be able to access any of the data on the drive.
Windows Server 2008 now offers this possibility for the entire drive and allows Bitlocker management through Group Policy. If you are really picky about your branch office security, you could combine the Server Core installation to run only the minimal services and encrypt the entire drive with BitLocker. At this point, not only is the drive encrypted, but there aren’t any useful passwords on it.
|The Complete Article:|
|Windows Server 2008 – New Features – Part 1|
|Windows Server 2008 – New Features – Part 2|
|Windows Server 2008 – New Features – Part 3|
|Windows Server 2008 – New Features – Part 4|