ACME ASSOCIATION. Network Status Report Executive Summary

Transcription

1 ACME ASSOCIATION Network Status Report Executive Summary

2 Table of Contents Overview 5 Assessment Nomenclature 6 Inspection Criteria 6 Areas of Assessment 6 Reporting Criteria 6 Active Directory and Related Services 7 Findings 7 Reliability 7 Remediation Suggestions 8 Security 8 Remediation Suggestions 9 Performance 9 Remediation Suggestions 10 Manageability 10 Remediation Suggestions 10 Monitoring 10 Administrative Procedures 11 Remediation Suggestions 11 Business Continuity 11 Remediation Suggestions 12 Documentation 12 Remediation Suggestions 12 Active Directory 2008 and Exchange 2007 readiness 12 2

3 Conclusion 12 Microsoft Exchange 13 Findings 13 Reliability 13 Remediation Suggestions 13 Security 13 Remediation Suggestions 14 Performance 14 Remediation Suggestions 15 Manageability 15 Remediation Suggestions 16 Monitoring 16 Administrative Procedures 16 Remediation Suggestions 16 Business Continuity 17 Documentation 17 Remediation Suggestions 17 Active Directory 2008 and Exchange 2007 readiness 17 Conclusion 18 Servers Findings Recommendations Immediate remediation Short-Term remediation Long-Term remediation

4 Network Infrastructure Findings Immediate remediation Short-Term remediation Long-Term remediation Backup and Disaster Recovery Findings Immediate remediation Short-Term remediation Long-Term remediation Remote Access Findings Immediate remediation Short-Term remediation Long-Term remediation Security Practices Findings Immediate remediation Short-Term remediation Long-Term remediation IT Process Management Findings Immediate remediation Short-Term remediation Long-Term remediation

5 Miscellaneous... Error! Bookmark not defined. Overview The primary purpose of this document is to provide Senior Management and Executives of ACME ASSOCIATION with an accurate assessment of the current state of the company s IT Infrastructure, as well as set of recommended actions in order to achieve improvement and stabilization. The secondary purpose of this document is to provide the CIO at ACME ASSOCIATION with a roadmap in order to address issues discovered during the assessment and outline a set of actions for remediation of the discovered issues. The third purpose of the assessment is to provide ACME ASSOCIATION a written systems documentation for current IT environment, to be used as part of the Standard Operating Procedure and as part of the Disaster Recovery preparation. IT Assessment was performed by Sequentur LLC between 1/6/2012 and 2/03/2013. It is based on the interviews of IT Dept. members at ACME, documentation provided by ACME and hands-on inspection of the respective areas of IT operations. Attachments to this document: - Appendix A, Active Directory and Microsoft Exchange Documentation - Appendix B, Network Diagram - Appendix C, Current IT Inventory 5

6 Assessment Nomenclature Inspection Criteria Active Directory and Microsoft Exchange Infrastructure at ACME were assessed based on following inspection criteria, as regards to the ACME IT data and applications: - Reliability - Security - Performance - Manageability - Monitoring - Administrative Procedures - Business Continuity - Documentation - Active Directory 2008 R2 and Exchange 2010 readiness - Cloud Services qualification and pre-readiness Areas of Assessment Following areas of IT operations at ACME were assessed: - Active Directory and related services - (Microsoft Exchange) - Servers - Workstations - Network Infrastructure - Printers and other peripherals (Batteries) - File Management (Data Sharing) 6

7 - Backup and Disaster Recovery - Remote Access Solutions - Security Practices - Applications IT Process Management Reporting Criteria Areas listed above are assessed below based on the assessment criteria. A brief overview of the technology assessed is given, followed by the major areas of current findings, as well as recommendations to remedy the findings. Findings are listed in the order of severity. Active Directory and Related Services Active Directory (AD) is a technology created by Microsoft that provides a variety of network services, including: - User and computer account management - Authentication - Naming and other network information Using the same database, for use primarily in Windows environments, Active Directory also allows administrators to assign policies, deploy software, and apply critical updates to an organization. Active Directory stores information and settings in a central database. Findings Below are our findings and recommendations, grouped by areas of inspection listed in the Inspection Criteria section above Reliability Current state of Active Directory Reliability at ACME is in FAIR condition. There are redundant domain controllers present at the headquarters site, in case of one server failure the second server will take over. Active Directory is backed up on a daily basis, providing a second level of fall-back scenario in case of Active Directory corruption and/or failure of both domain controllers. No reliability issues were discovered during replication monitoring or domain controller diagnosis. No underlying hardware-related issues were discovered, with the exception of one issue listed below. 7

8 Each domain controller is a DNS server, with all zones being AD-Integrated, providing a sufficient reliability level. There is a stand-by DHCP server and a recent backup of DHCP settings is available. Among items that derive from the ideal state are: - Though Microsoft WINS is only used for NBT name resolution for clients connecting over VPN connections, having a WINS server non-redundant is non-optimal. - All FSMO roles are placed on one domain controller (DC1). Spreading FSMO roles across two domain controllers will minimize immediate impact should DC1 go down. - The following event logs are logged in periodically on DC1: screenshots - Missing domain controller at the disaster recovery site (more on that in the section on Business Continuity). Remediation Suggestions - Implement a secondary WINS server and adjust DHCP properties to assign a secondary WINS server address. - Spread FSMO roles across both domain controllers. - Address event logs listed above, as they indicate a hardware-related issue (Disk or RAID driver, Disk or RAID firmware, Disk or RAID controller health issues or Hard Drive fragmentation). - Implement a stand-by domain controller offsite (at the disaster recovery site). Security Current state of Active Directory Security at ACME is in GOOD condition. Domain Controllers are current on security updates by Microsoft and protected by Symantec Antivirus with the latest virus definitions. Group policy has a sufficiently secure password and auditing policies (Default Domain Policy), per screenshot below: Among the items derived from the ideal state are: computer accounts that have not logged into the domain for 45 or more days. - 1 disabled computer account present.

9 - 23 User accounts that have not logged into the domain for 30 or more days. - 4 disabled non-system user accounts present on the domain user accounts with non-expiring passwords (some are not system accounts). - Domain Admin s group is part of Administrators group in the domain. - No documented procedure for manually changing system accounts password on a periodic basis. - No documented procedure for monthly/quarterly audits for obsolete user and computer accounts. - Following event log error is present on the server DC1: Remediation Suggestions - Comb through AD and delete obsolete computer accounts, using the table on page 25 in Appendix A for reference. - Delete one disabled computer account, using the table on page 297 in Appendix A for reference. - Ensure that there are no rogue or former users present per the list of 30-day user login metric, using the table on page 296 in Appendix A for reference. - Ensure that disabled non-system accounts still need to be present in the AD, using the table on page 297 in Appendix A for reference. - Double-check all non-expiring user accounts for validity, using the table on page 297 in Appendix A for reference. Ensure that ALL actual user-based accounts (even Board Members) are compliant with the IT Security Policy at ACME - After careful inspection for potential functionality issues, remove the Domain Admin group out of the Domain Administrators group. - Implement a documented procedure for manually changing system account passwords on a periodic basis. - Implement a documented procedure for monthly/quarterly audits for obsolete users and computer accounts. - Investigate errors listed above as to potential security impacts to the Active Directory. Performance Current state of Active Directory Performance at ACME is in GOOD condition. No issued discovered during the assessment, with the exception of the event log errors listed above in the Reliability Section and one issue below: - Following event log error is logged on the domain controller DC1: SCREENSHOT 9

10 Remediation Suggestions - Ensure that domain PCs are set to now-browsers as to minimize unneeded master browser election traffic. Manageability Current state of Active Directory Manageability at ACME is in POOR condition. Even though we were able to successfully collect all required data, following are the observations that deviate from industry best practices: - Each user has a unique login script. There are actually two scripts for each user (BAT and CMD), in order to hide the scripts from running. This is an unnecessary administrative overhead that also strikes down into the heart of business continuity process (how many scripts would have to be changed in a disaster, given you have to rename/re-port your file server?). - Out of 65 existing GPO objects, only about 77% are actually in use and or have unique/nonoverlapping values. - OU structure in the domain is so complex that we could not fit it on one page, even with the smallest of readable fonts. This is probably due to the obsolete/un-used GPO objects present, that had to be applied on the specific OUs. - Similar findings in the sheer amount of Security Groups in the domain, 679 total. - DCOLD2 (former domain controller) still on the list of domain controllers in ADUC. Remediation Suggestions - Consider implementing a KIX-based scripting solution, either a free solution (using text editor on the KIX script. Scripts can be hidden from the user s view using the Run Logon Scripts Hidden value in Group Policy. - Clean up the unused GPO object. Comb through existing GPO objects and ensure that there are no unnecessary and duplicate settings used in the GPOs. - Adjust OU structure, so it is based on the security delegation and GPO application factor only. - Clean up unused and duplicate Security Groups in the AD, ensuring that no unnecessary AD Security Groups exist. - Remove DCOLD2 from the list of domain controllers in ADUC. Monitoring Current state of Active Directory Monitoring at ACME is in GOOD condition. Though we could not find any specific departures from the ideal state as provisioned/provided by Microsoft NATIVELY, we do recommend that the following third party solutions (either using free custom scripting using VBS or PowerShell) or third-party tools (like SMS or certain type of AD monitors, like Tembria AD agent) are implemented as to provide a full insight into the daily scope of AD operations: 10