Lead Image © Dmitriy Shironosov, 123RF.com

New administration options on Windows Server 2016

Temporary Admin

Article from ADMIN 32/2016

By Ulf B. Simon-Weidner

Redmond is set to launch the next-generation Windows Server 2016. Microsoft promises to make administration more secure, which is a good enough reason to take a closer look at the new Privileged Access Management feature.

As you might expect, much that is new in Windows Server 2016 relates to cloud strategies and Microsoft products, whether this be using public cloud offerings with Windows Azure and Office 365, establishing a private cloud with Hyper-V, or linking up your private cloud with public clouds to create a hybrid. Of course, several new features are offered beyond the cloud – in particular, for secure administration. Companies can implement these features immediately after rolling out the new server, without having to update or modify the entire server landscape.

To boost security in the enterprise and support state-of-the-art management in distributed and tenanted environments, Microsoft offers Privileged Access Management (PAM) [1] with the Active Directory service on Windows Server 2016, which means improved management of accounts with special privileges.

The Basics in Place

The Windows security model is complex, and it needs to be to meet a wide variety of requirements. After installing a new server, you will see that it already has some local security groups, such as the local Administrators, Server Operators, Backup Operators, and others. Enterprise networks rely on the Active Directory service. Again, some groups are set up by default by the directory service for management purposes. Enterprise Admins and Domain Admins have the widest ranging authorizations; Account Operators can manage users, computers, and groups, and Domain Users at least allow administrators to restrict the use of resources to users of the domain.

These default groups are typically too generic in larger environments, and even in smaller environments administrators would do well to look into delegation. Although segregation of Active Directory infrastructure management (replication, domain controller, DNS, central policies) and data management

...

Use Express-Checkout link below to read the full article (PDF).