5
High Security
Moving from the Enterprise Client level to the High Security level requires conforming to stringent
security policies for both clients and servers. This environment contains clients running Windows 2000
Professional and Windows XP Professional. Domain controllers and members servers are running
Windows 2000 Server or later. In the High Security environment, concern about security is so great
that significant loss of functionality and manageability is considered to be an acceptable tradeoff in
order to achieve the highest level of security
.
Figure 1.
This figure shows the three layers of security and the clients supported in each.
Organizations that want to provide a phased approach to securing their environments may choose to
start at the Legacy Client environment level and then gradually move to the higher security levels as
their applications and client computers are upgraded and tested with tightened security settings.
2.1
Domain Model Design: Windows NT 4.0, Windows 2000, and
Windows 2003
Before locking down the company’s domain infrastructure, one must understand the domain model
differences between Windows NT 4.0, Windows 2000 Active Directory, and Windows 2003 Active
Directory. The Windows NT 4.0 domain was a very good organizational and hierarchical model.
However, it had poor communication feature sets with other domains. This issue prevented NT 4.0 to
scale well within larger enterprise environments. As such, Windows 2000 Active Directory (AD)
model was created. Windows 2000 AD enabled domains to communicate and trust each other in a
peer-to-peer trust relationship. Domains could be grouped together in structures called forest which
simplified and centralized domain management. Although Windows 2000 AD enabled the
incorporation of various domains into a single tree, it opened up a security flaw in which all domains
within a forest have full administrative access rights to all other domains within that forest. Similarly,
Windows 2000 forests which have inter-forest trusts relationships with other forests have full
administrative privileges within the other forests. The inter-domain trust relationship security flaw is the
same within Windows 2003 AD. However, administrators within Windows 2003 can now control
inter-forest relationships better using Windows 2003 cross forest authentications and cross forest
