Lesson 2

Creating Role-Specific Server Configurations

9-25

create new objects and modify existing ones. You might modify these defaults to limit

the number of users with permission to modify this container.

Protecting DNS Database Files For DNS zones that are not integrated into Active

Directory, the zone databases are simple text files stored in the C:\Win-

dows\System32\Dns folder by default. Windows Server 2003 creates DNS debug logs

in the same folder. The permissions for this folder grant the Administrators group Full

Control, while the Server Operators group receives all permissions except Full Control.

The Authenticated Users group receives the permissions needed to read and execute

files in this folder (see Figure 9-11).

f09pm11

Figure 9-11

The DNS Properties dialog box

You don’t need file system permissions to maintain the DNS zone databases using the

DNS console or to access DNS server information using a client. Therefore, there is no

reason for the Authenticated Users group to have file system permissions. By enabling

users to view the DNS data files, you give them an opportunity to gather information

about your domain that they could use to stage an attack against the network. You can

safely revoke the Authenticated Users group’s permissions for this folder, and even

limit the Server Operators group to read-only access, if desired.

Configuring DHCP Security

The interruption of a DHCP server’s functions might not have an immediate effect on

your network, but eventually your DHCP clients’ leases will expire and they will be

unable to obtain new ones. Apart from enabling the DHCP Server service itself, there