Forefront Security Application Usage tips

What is the role of the Forefront Server Security application? Many managers have this question. In short, Forefront Server Security is a Security management tool. As shown in, an enterprise uses the Forefront product on a mailbox server to protect its security. Now, if the administrator needs to remotely maintain the security of the server, such as viewing log information and manual upgrades, this tool is required. This is a very practical tool. Next, I will introduce some tips for using this tool.

I. Additional requirements on the Operating System

The Forefront Server Security administrator program can be run on the client for remote management. You can also perform local configuration. But in most cases, it is run on the client. To view the log information, the Administrator does not need to go to the data center to view it. Therefore, the Forefront Server Security application is still running on the client for a long time.

However, this may be a technical reason. To run Forefront Server Security, you must configure the Security of the Forefront Server on the client. Currently, most of the clients use the XP operating system. I will take XPSP2 as an example to analyze what additional configurations should be adopted if you want to run Forefront Server Security on this platform.

Step 1: perform additional configuration in the component service dialog box. The administrator can enter the "DCOMCNFG" command in the "run" dialog box to open the "Create a service" dialog box. As shown in.

Step 2: In the above component service dialog box, click "component service" and "computer", right-click "my computer ", select "properties" from the menu ". On the Com Security tab, find the "Edit restriction" option under "access permission. Then, locate "Remote Access" for the "Anonymous Logon" user and select the "allow" check box. Note that this step is very important. However, if this check box is not selected, the Forefront Server Security cannot run normally.

Step 3: configure the firewall. If the firewall mechanism is enabled on the operating system, the Administrator must add the Forefront Server Security application to the Windows Firewall exception list. The procedure is as follows. The Administrator finds the Windows Firewall exception tab. Click Add program, select FSSACLIENT from the list, and click OK. The firewall system automatically adds the application to the "program and service" list. Go back and find the application in the "program and service" list, click "add Port", and enter the name of the port. Generally, this application uses port 135 and uses TCP as its data transmission protocol.

After the preceding configuration, Forefront Server Security can run smoothly on the XP SP2 operating system and connect to a remote Server. For the above configurations, I also have the following two small suggestions.

First, if you think that firewall configuration is troublesome, there is actually a way to be lazy. That is, if you need to run the Forefront Server Security application for remote management, You can temporarily disable the Windows Firewall function. After the maintenance is complete, enable it again. In this case, you do not need to configure the firewall. However, this operation is not recommended for security reasons.

Second, you must note that enabling port 135 may cause additional threats. If you enable Windows Firewall and use the Forefront Server Security application, you must enable port 135 at the firewall. Obviously, developing this port for all computers brings great security risks. For security reasons, you may need to add an additional restriction, that is, to open only for a specific IP address. To implement this function, you can implement it in the "Change scope" column of the firewall. After the Administrator adds port 135, do not close the dialog box immediately. In this dialog box, there is a "change range" button. The Administrator clicks this button and selects "custom list ". In this list, the administrator can enter an appropriate IP address to enable this port only for these IP addresses. This operation will eliminate this security risk.

Ii. Read-only mode and read/write mode

The Forefront Server Security application can be run in read-only or read/write mode as needed. As the name suggests, read-only mode cannot modify the remote server, such as changing the configuration file. It can only perform some queries. In read/write mode, the remote server can be fully controlled. For the sake of security, the administrator needs to adopt an appropriate running mode. The author's suggestion is to run in read-only mode when analyzing and searching for problems. To avoid accidental changes to the correct configuration. Wait until the problem is found, and then change to the read/write mode to adjust the system.

This running mode is mainly controlled by the user's permissions. If the administrator needs to change a configuration file, he or she needs to log on with the user with the corresponding permissions. The configuration of this permission is the same as that of the NTFS file system. In other words, it is implemented by using the NTFS file system permission management mechanism. Therefore, I will not repeat this content here. For more information, see the NTFS file system.

Here I only want to emphasize the following points.

First, you must have the permission to read and write PSE. If the user created by the Administrator has only read-only permission for PSE, the problem may occur when the user runs the application. If the system prompts an error message: unable to connect to the service, access is denied, and so on.

Second, the system account and the Exchange Service account must have full control permissions on the system folder. Otherwise, the application cannot run properly because of the required permissions. It can be seen that the permission design is complicated if the application is combined with applications such as Exchange. The author's suggestion is that the minimum permission principle should be followed. When planning, we need to design a permission system. In this case, it will not be confused during configuration.

Iii. Forefront Server Security cannot be abused

I found that an enterprise administrator may have prepared a Forefront Server Security application on multiple computers for ease of management, in particular, the Forefront Server Security application is also installed on the home computer. I think this may bring unnecessary security risks. I suggest that you only install the Forefront Server Security application on a specific computer to improve Security. For example, only the Administrator's laptop is installed. However, if there are more than one Forefront Server Security user, it will inevitably give attackers an opportunity. Therefore, we need to limit it to a relatively small range.

1. Brief Introduction to Microsoft Forefront Client Security
2. Forefront Server Security common application troubleshooting