"#$ % & ' Filer och kataloger som exkluderas från virussökning: NTDS Databas filer. D:\NTDS\Ntds.dit D:\NTDS\Ntds.pat. NTDS Transaktionslogg

Transcription

1 Dkumentnam Författare Versin Datum! Antal sidr "#$ % Eftersm AD-servrar kan vara verksamhetskritiska är det viktigt att VirusScan knfigureras så att den inte belastar AD-servern mer än nödvändigt. Detta dkument beskriver knfiguratinen. & ' ' NSEC rekmmenderar att man skapar en egen grupp för Active Directry Dmain Cntrller servrar. Knfiguratinen görs på denna grupp, så att alla nya servrar sm läggs i denna grupp får samma inställning. ( # Observera att inte alla sökvägar är exakt samma i din miljö. Du måste därför se till att söka upp var ni har för exakta sökvägar i er miljö. I vårt exempel ligger exempelvis transaktinslggar under L:\. Filer ch katalger sm exkluderas från virussökning: NTDS Databas filer D:\NTDS\Ntds.dit D:\NTDS\Ntds.pat NTDS Transaktinslgg L:\NTDS\EDB*.LOG L:\NTDS\EDB.LOG L:\NTDS\RES1.LOG L:\NTDS\RES2.LOG L:\NTDS\NTDS.PAT Filer i "wrking directry" (D:\NTDS) D:\NTDS\TEMP.EDB D:\NTDS\EDB.CHK NT File Replicatin service filer %systemrt%\ntfrs\jet\sys\edb.chk %systemrt%\ntfrs\jet\ntfrs.jdb %systemrt%\ntfrs\jet\lg\*.lg

2 NTFRS Staging flder ch alla underkatalger %systemrt%\sysvl + underkatalger OBS: Exkluderingen görs för alla prcess-typer i VirusScan; "high-risk", "lw-risk" ch "Default". Det är viktigt att ändringar görs i alla tre lika typerna! Prcesser angivna i "Lw-risk prcesses" för VirusScan: ntfrs.exe "# # Se dkument på Micrsfts Knwledgebase för mer infrmatin gällande exkluderingar för virusskydd på dmän kntrllanter: Här är KB i sin helhet: #%% $) $*) ) $* +$% Gäller Imprtant This article cntains infrmatin abut mdifying the registry. Befre yu mdify the registry, make sure t back it up and make sure that yu understand hw t restre the registry if a prblem ccurs. Fr infrmatin abut hw t back up, restre, and edit the registry, click the fllwing article number t view the article in the Micrsft Knwledge Base: Descriptin f the Micrsft Windws Registry,-. This article cntains recmmendatins that may help yu prtect yur Windws 2000 and Windws Server 2003 dmain cntrllers against viruses. It als cntains infrmatin t help yu minimize the affect f antivirus sftware n system and netwrk perfrmance. '-/01'-20'1 Because dmain cntrllers prvide a critical service t clients, the risk f disruptin f their activities as a result f malicius cde frm a virus must be minimized. Antivirus sftware is the generally accepted way t mitigate the risk f virus infectin. Install and cnfigure antivirus sftware s that the risk t the dmain cntrller is reduced as much as pssible and s that perfrmance is affected as little as pssible. The fllwing list cntains recmmendatins t help yu cnfigure and install antivirus sftware n a Windws 2000 r n a Windws Server 2003 dmain cntrller: Warning Micrsft recmmends that yu apply the fllwing specified cnfiguratin t a test cnfiguratin t

3 make sure that in yur specific envirnment it des nt intrduce unexpected factrs r cmprmise the stability f the system. The risk frm t much scanning is that files are inapprpriately flagged as having been changed, resulting in excessive replicatin n the Active Directry directry service. If testing verifies that replicatin is nt affected by the fllwing recmmendatins, yu can apply the antivirus sftware t the prductin envirnment. Nte Specific recmmendatins frm antivirus sftware vendrs may supersede the recmmendatins in the article. Antivirus sftware must be installed n all dmain cntrllers in the enterprise. Ideally, try t install such sftware n all ther server and client systems that have t interact with the dmain cntrllers. It is ptimal t catch the virus at the earliest pint, such as at the firewall r at the client system where the virus is first intrduced. This prevents the virus frm ever reaching the infrastructure systems that the clients depend n. Use a versin f antivirus sftware that is designed t wrk with Active Directry dmain cntrllers and that uses the crrect Applicatin Prgramming Interfaces (APIs) t access files n the server. Older versins f mst vendr sftware inapprpriately mdify file metadata as it is scanned, causing the File Replicatin Service engine t recgnize a file change and therefre schedule the file fr replicatin. Newer versins prevent this prblem. Fr additinal infrmatin, click the fllwing article number t view the article in the Micrsft Knwledge Base: Antivirus, backup, and disk ptimizatin prgrams that are cmpatible with the File Replicatin service D nt use a dmain cntrller t brwse the Web r t perfrm any ther activities that may intrduce malicius cde. Where pssible, d nt use the dmain cntrller as a file sharing server. Virus scanning sftware must be run against all files in thse shares, and this can put an unsatisfactry lad n the prcessr and the memry resurces f the server D nt place Active Directry r FRS database and lg files n NTFS file system cmpressed vlumes. Fr additinal infrmatin, click the fllwing article number t view the article in the Micrsft Knwledge Base: Issues with Jet Databases n cmpressed drives D nt scan the fllwing files and flders. These files are nt at risk f infectin, and if yu include them, this may cause serius perfrmance prblems because f file lcking. Where a specific set f files is identified by name, exclude nly thse files instead f the whle flder. Smetimes, the whle flder must be excluded. D nt exclude any f these based n the file-name extensin; fr example, d nt exclude all files with a.dit extensin). Micrsft has n cntrl ver ther files that may use the same extensin as thse shwn here. Warning If yu use Registry Editr incrrectly, yu may cause serius prblems that may require yu t reinstall yur perating system. Micrsft cannt guarantee that yu can slve prblems that result frm using Registry Editr incrrectly. Use Registry Editr at yur wn risk. Active Directry and Active Directry-related files: Main NTDS database files. The lcatin f these files is specified in the fllwing registry key: HKEY_LOCAL_MACHINE\System\CurrentCntrlSet\Services\NTDS\Para meters\dsa Database File The default lcatin is %windir%\ntds. Exclude the fllwing files: +

4 Ntds.dit Ntds.pat Active Directry transactin lg files. The lcatin f these files is specified in the fllwing registry key: HKEY_LOCAL_MACHINE\System\CurrentCntrlSet\Services\NTDS\Para meters\database Lg Files Path The default lcatin is %windir%\ntds. Exclude the fllwing files: EDB*.lg (the wildcard character indicates that there may be several files) Res1.lg Res2.lg Ntds.pat The NTDS Wrking flder that is specified in the fllwing registry key: HKEY_LOCAL_MACHINE\System\CurrentCntrlSet\Services\NTDS\Para meters\dsa Wrking Directry Exclude the fllwing files: Temp.edb Edb.chk SYSVOL files: The File Replicatin Service (FRS) Wrking flder that is specified in the fllwing registry key: HKEY_LOCAL_MACHINE\System\CurrentCntrlSet\Services\NtFrs\Param eters\wrking Directry Exclude the fllwing files: FRS Wrking Dir\jet\sys\edb.chk FRS Wrking Dir\jet\ntfrs.jdb FRS Wrking Dir\jet\lg\*.lg The FRS Database Lg files that are lcated in the fllwing registry key: HKEY_LOCAL_MACHINE\system\currentcntrlset\services\NtFrs\Paramete rs\db Lg File Directry The default lcatin is %windir%\ntds. Exclude the fllwing files: FRS Wrking Dir\jet\lg\*.lg (if registry key is nt set) DB Lg File Directry\lg\*.lg (if registry key is set) The Staging flder that is specified in the fllwing registry key and all f the Staging flder's sub-flders: 3

5 HKEY_LOCAL_MACHINE\system\currentcntrlset\services\NtFrs\Paramete rs\replica Sets\GUID\Replica Set Stage The current lcatin f the Staging flder and all f its sub-flders is the file system reparse target f the replica set staging flders. Staging defaults t the fllwing lcatin: %systemrt%\sysvl\staging areas The current lcatin f the SYSVOL\SYSVOL flder and all f its sub-flders is the file system reparse target f the replica set rt. The SYSVOL\SYSVOL flder defaults t the fllwing lcatin: %systemrt%\sysvl\sysvl The FRS Preinstall flder that is in the fllwing lcatin: Replica_rt\DO_NOT_REMOVE_NtFrs_PreInstall_Directry The Preinstall flder is always pen when FRS is running. In summary, the targeted and excluded list f flders fr a SYSVOL tree that is placed in its default lcatin wuld lk similar t the fllwing: 1. %systemrt%\sysvl 2. %systemrt%\sysvl\dmain 3. %systemrt%\sysvl\dmain\do_not_remove_ntfrs_p reinstall_directry Exclude 4. %systemrt%\sysvl\dmain\plicies 5. %systemrt%\sysvl\dmain\scripts 6. %systemrt%\sysvl\staging 7. %systemrt%\sysvl\staging areas 8. %systemrt%\sysvl\sysvl If any ne f these flder r files have been mved r placed in a different lcatin, scan r exclude the equivalent element. DFS The same resurces that are excluded fr a SYSVOL replica set must als be excluded when FRS is used t replicate shares that are mapped t the DFS rt and link targets n Windws 2000 r Windws Server 2003-based member cmputers r dmain cntrllers.

6 4