SumITUp. A Complete Summary for Our Practice Test. TS: Microsoft Windows SharePoint Services 3.0, Configuring

Transcription

1 SumITUp A Complete Summary for Our Practice Test TS: Microsoft Windows SharePoint Services 3.0, Configuring SumITUp is a great summary recap of the objectives & material covered on the exam. Use it in addition to or in concert with your practice test as: A bulleted overview of the exam scope and objectives before you start your study to provide you with the big picture objective by objective. A checklist & review of topics covered within each objective to ensure you have studied all the critical areas. A tool you can print out for review on the go. A rapid review tool for the day before you take the exam. All Rights Reserved

2 2 SumITUp A Complete Summary for Our Practice Test Deploy Windows SharePoint Services 3.0 (WSS) Configure WSS server roles Different roles and components can be divided into three tiers - WFE (Web Front End) server(s) - Search Server(s) - SQL Database server(s) Configure WSS topology Microsoft WSS 3.0 can be implemented based on two general topologies - Single Server o You can install a single server and designate all roles on a single server o Less complexity and low cost but limited performance o Suitable for small implementations - Servers Farm o You separate different roles, such as multiple WFE servers and back-end database servers o More complexity and higher cost but higher performance and easily scalable o Suitable for medium and large implementations Create WSS namespace Sites are implemented in Web applications You can create or extend a Web application - By creating a new Web application, you can create a new application pool, a new database to store its data, and a different authentication methods to access to the database server - By extending an existing Web application, you use the same content database and application pool to provide users with the same content and data they had in an existing Web application o This feature is useful in situations where you need to provide users in a different environment with access to the same content with different domain names and security configurations, such as an extranet For each Web application, you can define managed paths to customize the naming and structure of the URL addresses to meet your needs You can manage your WSS 3.0 environments by using different URLs for different purposes - You can use AAM (Alternate Access Mappings) to associate Web applications with a collection of different mappings between internal and public URLs Upgrade WSS 3.0 from WSS 2.0 In-place upgrade - You can upgrade the content and configuration data at one time - Usually is a straight forward procedure - You ensure that all sites are accessible through the original URLs - Will cause downtime in the WSS environment during the process

3 3 SumITUp A Complete Summary for Our Practice Test - You cannot revert the upgraded sites to the original versions - Ideal for small environments and over-the-weekend plans Gradual upgrade - Generally a complex procedure - Provides you with more control over the whole process - You can install the new version side-by-side with the older version - You can control the list of site collections nominated to upgrade and decide about the time of their upgrade - You can revert the upgraded sites to the original versions - You ensure that all sites are accessible through the original URLs - It will not cause major downtime in the WSS environment because only the sites under the current upgrade operation will be affected - Ideal for step-by-step upgrade plans in medium and large WSS environments Advanced (manual) upgrade - Generally is a tricky and complex procedure - You need to build-up a new farm with WSS You need to manually migrate your database to the new farm - Extra space on SQL servers is required - Ideal for migrating to new hardware and servers during the upgrade - Necessary for WSS 2.0 environments that are using scalable hosting mode - Necessary for WSS 2.0 environments that are using the account creation mode for the Active Directory service Install WSS Minimum hardware requirements to deploy WSS WSS 3.0 needs a server with a 2.5 GHz processor for either stand-alone or farm front-end installations - WSS 3.0 needs at least 1 GHz of physical memory for stand-alone and 2 GHz for front-end farm implementations Software requirements - In clean installations, WSS 3.0 runs on Windows Server 2003 with SP1 or later - In farm implementations, WSS 3.0 needs Active Directory services - Due to limitations in hosting databases, Windows Server 2003 Web edition does not support Basic installation of Windows SharePoint Services Microsoft.NET Framework version 3.0 must be installed on WFE server(s) - ASP.NET 2.0 must be enabled in IIS console - In clean installations, you should configure the stand-alone or WFE servers to use IIS 6.0 worker process isolation mode - If your installation plan is an upgrade from IIS 5.0 on Windows Server 2000, the IIS 5.0 isolation mode option is enabled and you must change this configuration to use IIS 6.0 worker process isolation mode - You should install SMTP (Simple Mail Transfer Protocol) to take advantage of the various messaging facilities of WSS 3.0

4 4 SumITUp A Complete Summary for Our Practice Test - In farm implementations, the database server role must have SQL Server 2000 with SP3a or later or Microsoft SQL Server 2005 SP1 or later You can control and customize the WSS 3.0 installation process by using Config.xml file - You should use setup.exe /config [path and file name] to use a configuration file during the installation of WSS 3.0 It is highly recommended that you install WSS 3.0 on a server with a clean operating system installation and avoid installing WSS on a server where WSS has been uninstalled Monitor Windows SharePoint Services Maintain storage performance You can configure quotas by setting the maximum limit for the site quotas based on your requirements to restrict the size of the site to a limited amount You can define and apply a quota template to the Site Collections - You can send and customize limitation exceeded warning messages - As a general rule you can estimate that the size for the site quota could be equal to the total amount of disk space available for content databases divided by the total number of sites per Site Collection - You can use the Locks to control the size of the sites and your site collections to turn them into readonly sites in the case of any limitation violation Sooner or later you will face shortage of disk space on your servers - Other than extending physical storages, there are a couple of strategies to recover disk space o You can archive and delete old sites on WFE servers o You can ask your DBA (database administrator) to truncate log files on the SQL servers Configure centralized monitoring for WSS The official solution for centralized monitoring of WSS is Microsoft Operations Manager (MOM) You can download the latest version of the localized (multi-language) WSS 3.0 Management Pack for MOM 2005 from the Microsoft Web site - You can use MOM to centrally monitor farm services and error messages across the servers in the farm Configuring performance monitor You must regularly check performance of WSS servers You can use Usage analysis processing and run it during specific times to monitor how your Web sites are being used - WSS 3.0 keeps the Usage analysis data for a period of three months (daily and monthly information is 31 days and 24 months respectively) Identify WSS problems using the Web Event Viewer You can use the Event Viewer to create counter logs and alerts to monitor the performance of critical server components including processor, physical memory, network interfaces, and storage

5 5 SumITUp A Complete Summary for Our Practice Test You can use diagnostic logging and event throttling to determine the least critical event to report to the event log and prevent the less important events from piling up in the event log Monitor log You can use the IIS logs on the WFE servers Regular inspection of the IIS log files can help you verify users' access to WFE servers, used addresses, and requested objects Configure Security for Windows SharePoint Services Configure Web application authentication In WSS 3.0, you can use different authentication providers to validate the user's identity The following authentication provider methods are available in WSS Windows o All standard IIS Windows authentication provider methods are supported: Anonymous, Basic, Digest, Kerberos, NTLM, and Certificate - ASP.NET forms o You need to register the membership provider in the Web.config file for your Web application o You may need to register the role manager in the Web.config file for your Web application o You need to register the membership provider in the Web.config file for the Central Administration site o Ideal for deploying WSS 3.0 in the environments that do not use Active Directory services - Web SSO o You need to register the membership provider in the Web.config file for your Web application o You may need to register the role manager in the Web.config file for your Web application o You need to register the membership provider in the Web.config file for the Central Administration site o You need to register an HTTP module for the Web SSO provider o You can implement WSS 3.0 in an environment that uses federated authentication o Active Directory Federation Services requires SSL Configure a Web application for SSL In many cases, using SSL to create HTTPS sites is the preferred method of communication between your WFE server and various client computers You can use SSL to ensure that unauthorized people are not able to read or modify traffic streams to/from your application - Although, they are still able to intercept, capture, and try to crack your encryptions You can use SSL in a wide variety implementations - Intra-farm SSP - Confidential information exchange between users and WSS sites - Situations where you cannot deploy IPSec

6 6 SumITUp A Complete Summary for Our Practice Test You can use SSL to provide a secure and encrypted communication for a particular application on your server, whereas IPSec generally will provide you with a complete encryption and protection over the communications to/from your WSS server - The model of protection provided by IPSec is not suitable for some scenarios, such as dealing with external servers and clients with no IPSec support - SSL takes advantage of public key mechanism and is more widely supported than IPSec o You can install the SSL Web certificates on your WFE or ISA 2006 servers to provide secure communications for your internal users as well as external clients o It is recommended that for WSS sites that are accessible to external users, you buy and install commercial Web server certificates from a well-known CA (certificate authority) to prevent users from receiving annoying warning messages while browsing HTTPS Web sites secured by private and internal certificate sources (e.g. your internal CA) When creating and extending WSS 3.0 Web applications, you can choose to use HTTPS addresses Configure NT Local Area Network Manager (NTLM) or Kerberos authentication You can use NTLM (Integrated Windows), which is easy to set up and requires little administrative effort to configure and maintain - If you create a Web application by accepting all default settings, the default zone for that Web application will be configured to use NTLM - In NTLM, the user name and password of the users are hashed before being sent across the network You also can use the more complex Kerberos protocol as your WSS authentication method - This protocol works based on a ticketing mechanism o Once authenticated, the user will be given a ticket, which can be used to gain access to various services across the network - You should configure an Service Principal Name (SPN) for the domain user account to use this method o You must be a member of the Domain Admins group to do so o If you choose Kerberos authentication and do not configure the SPN, only the server administrators will be able to authenticate successfully to the SharePoint sites Configure roles and site permissions You can protect your WSS sites by defining different permissions for site users - Users can be grouped for easy management - You can use Permission levels (a predefined set of permissions) to enable your site users to perform specific actions - There are four default permission levels o Read o Contribute o Design o Full Control - You also can determine permissions on individual site components, which is called fine-grained permission setting

7 7 SumITUp A Complete Summary for Our Practice Test - The following entities are available for configuring fine-grained permissions o Site o List and library o Folder o Item and document - By default, sub sites inherit permissions from the parent site o You can break the inheritance relationship to meet your special needs Implement access policies By implementing access policies, you can limit the ability of your users to manipulate, print, or copy text from downloaded files - By using Information Rights Management (IRM), you can encrypt the downloaded files and determine which users are allowed to decrypt these files Manage database permissions There are two general methods of database authentication - Windows authentication o This is the recommended method o In this method, the users' corporate domain accounts are used for all WSS 3.0 service and administration accounts, including application pool accounts o In secure extranet implementations where SQL database servers reside in the corporate network, you need to create a one-way trust relationship between two domains so the domain of the perimeter network will trust to the corporate domain - SQL authentication o You need to specify the account and password that will be used to connect to the database o In secure extranet implementations where SQL database servers reside in the corporate network, you do not need to create any trust relationship between your networks and domains In the Operations page, if you change the Default Database Server, all new Web applications will use the new database Configure IRM If you need to implement IRM in your WSS infrastructure, you need to enable IRM in the Central Administration on your WSS server - To enable IRM on your WSS server, the Microsoft Windows RMS Client with Service Pack 2 should be installed on all WFE servers - To enable IRM on your WSS server, you need to determine a RMS server source that can be a Windows Server 2003 with the RMS package and Service Pack 1 installed You need to apply IRM through the Settings menu of libraries and lists to protect downloaded files against misuse and illegal distribution - You need at least the Design permission level on that list or library to enable IRM

8 8 SumITUp A Complete Summary for Our Practice Test Administer Windows SharePoint Services Configure site settings In the site settings of each WSS site, you can configure the following categories and their important options, including - Users and Permissions o You can define different levels of access for users and groups - Look and Feel o You can save a site as a template with.stp extension for creating future sites o You can use Reset to reset the site definition option to cancel customizations quickly - Galleries o You can add new or modify existing content types and columns o You can control the Management of Master pages and Workflows - Site Administration o You can customize lists and libraries o You can manage site features and usage reports - Site Collection Administration o You can manage the site collection view of Recycle Bin o You can manage the site hierarchical model and its connection to other portal sites Manage Central admin After completion of the installation process, you run the SharePoint Products and Technologies Configuration Wizard to create the Central Administration Web site - In the wizard, you can specify a TCP port to access to the Central Administration Web site or you can accept the suggested randomly generated port number - In the wizard, you can specify the authentication provider for the Web application used by the Central Administration Web site o NTLM (default setting) o Negotiate (Kerberos) If prompted for your credentials, add the SharePoint Central Administration Web site to the list of trusted sites and then configure user authentication settings in Internet Explorer Administer Windows SharePoint Services by using STSADM Some important operations available through STSADM are - stsadm -o backup o Used to do a backup from a site collection, an individual database Web application, or an entire farm - stsadm -o restore o Used to restore a backup file - stsadm -o addsolution

9 9 SumITUp A Complete Summary for Our Practice Test o Used to add WSP (CAB) solution files - stsadm -o activatefeature o Used to activate an available feature in WSS - stsadm -o deactivatefeature o Used to deactivate an activated feature in WSS - stsadm -o migrateuser o Turns an existing user account in Microsoft Windows SharePoint Services 3.0 into a different login name and binary ID o Useful for changing the login names while maintaining the same level of access to WSS resources - stsadm -o createsiteinnewdb o Can be used to create a separate content database for each site collection Configure backup and restore (disaster/recovery) To protect your WSS infrastructure against disaster, you can use either Web-based backup settings in WSS 3.0 or the STSADM tool to provide reliable backup files In WSS 3.0, you can use the double-stage Recycle Bin for efficient and quick document recovery - During the first stage the file is held in the user and the site collection Recycle Bins - After 30 days or a manual deletion from the user's Recycle Bin, the deleted file will be kept in the site collection Recycle Bin only o At this stage only administrator can delete forever or restore the file o You can limit this stage by configuring a disk space limitation Manage Customization Configure master page WSS 3.0 takes advantage of ASP.NET 2.0 and its master page facilities On your WSS 3.0 server, all sites use the default.master global master page located in the \Program Files\Common Files\Microsoft Shared\web server extensions\12\template\global directory Administrators can use ASP.NET 2.0 master pages to create a consistent and fixed layout for their Web pages in the WSS structure You can customize a master page in WSS-compatible editors such as Microsoft Office SharePoint Designer - It is recommended that, before any customization, you keep the original files in a safe location Customize pages by using SharePoint Designer Microsoft Office SharePoint Designer is the replacement for the Microsoft FrontPage tool in older versions Microsoft Office SharePoint Designer is the official and recommended tool for customizing a master page Microsoft Office SharePoint Designer includes a visual workflow design environment that you can use to create custom workflows, but advanced coding would need Microsoft Visual Studio.NET

10 10 SumITUp A Complete Summary for Our Practice Test Customize pages using browser In WSS 3.0, you can use your browser to make some relatively simple changes to created sites such as arrangement of Web Parts on your Web pages You can use Microsoft Office SharePoint Designer to insert a Web Part zone, which is actually a Web Part container, on your site pages - It is a necessary step, if you want to customize them later in your browser and have a control over the users' ability to modify them in their browsers in the future Configure code access security By using the.net framework, administrators have to deal with the Code Access Security and code permissions Web applications and their Web Parts run at a Trust Level, which is defined in the Web.Config file By default, the Web application runs with the Minimal trust level At times, 3rd party applications need to use a higher trust level to function properly (e.g. Medium or Full); it is a trade-off and WSS administrators should consider the security consequences of the modifications - After evaluating all the security consequences and actions involved, you can create a copy of WSS_minimaltrust.config and apply the required changes to meet the developer requirements o You also need to create a new TrustLevel element in the Web.config file of your Web application to take advantage of the custom trust configuration file Configure Network Infrastructure for Windows SharePoint Services Configure names resolution WSS 3.0 relies on Domain Name System (DNS) for its name resolution You need to create zones and appropriate records for your sites In NLB (Network Load Balancing) scenarios, you need to create a HOST (A) record for the IP address of your NLB cluster Configuring NLB You can take advantage of Microsoft Windows Server 2003 NLB Services to distribute the load across your WFE servers In NLB scenarios, you usually deal with two types of communications - Inter-Array communications (between NLB servers and the rest of the network) - Intra-Array communications (between NLB servers) Based on the number of available NICs in the NLB servers, there are four general models to use when configuring this service to distribute the load across WFE servers - Single network adapter in Unicast mode - Multiple network adapters in Unicast mode - Single network adapter in Multicast mode - Multiple network adapters in Multicast mode

11 11 SumITUp A Complete Summary for Our Practice Test You cannot select the Unicast mode while you have only one NIC on each of your NLB servers and you want to have the intra-array communications between them Within each cluster, you should configure all network adapters either in the Multicast or in the Unicast mode and a mixed configuration is not supported Configure WSS to support perimeter network You can implement a perimeter network (DMZ) to provide a higher level of security for your WSS servers In a perimeter network design, you protect WSS servers from both internal and external (Internet) users There are two general perimeter network implementations for WSS - Multi-homed firewall implementation o Generally a cheaper solution by using a firewall with more than two network interfaces o The provided security is acceptable for many networks - Back-to-back firewall implementation o Generally the more expensive solution by using two firewalls and a perimeter network that is logically between them o The provided security is higher than in the multi-homed model and is suitable for highly secure environments You need to carefully configure open ports on your firewall(s) and the direction of the allowed traffic over each port - In many cases, you would need to place WFE server(s) into the perimeter network and provide access to their HTTP (TCP 80) and HTTPS (TCP 443) ports - In many cases, you would prefer to place your back-end SQL database server(s) into the internal network and provide access to their Microsoft SQL server ports (TCP 1433) - In some special cases, you will need to open few more ports on your firewall for Active Directory, other Microsoft services like SMTP, or 3rd party applications o You should monitor and inspect the ongoing traffic through your firewalls and their open ports Configure Internet Security and Acceleration (ISA) Server Microsoft ISA server 2006 is the recommended firewall solution for securing WSS environments You can use ISA server 2006 to create secure perimeter networks either in the multi-homed or back-to-back implementations You can use ISA server 2006 to securely publish WSS 3.0 servers to your users - Generally, for publishing HTTPS SharePoint sites you need to install your Web certificate on the ISA server By using ISA server 2006, you can inspect and monitor ongoing traffic through the open firewall ports When designing large WSS environments, you can install more than one ISA server 2006 and create an NLB cluster with them Other than the firewall and its application layer intelligent inspection role you can use your ISA server 2006 server(s) for various network tasks including (but not limited to) the following operations - Reverse proxy

12 12 SumITUp A Complete Summary for Our Practice Test - Path redirection - SSL tunneling and bridging - Wide range of common authentication methods are available to evaluate client credentials including LDAP, RADIUS, RADUIS OTP and RSA Acronyms Acronym AAM CA DBA DNS HTTP IIS IPSec IRM LDAP MOM NIC NTLM OTP RADIUS RMS RSA SMTP SP SPN SSL SSO SSP TCP URL WFE WSS Definition Alternate Access Mappings Certificate Authority Database Administrator Domain Name System Hypertext Transfer Protocol Internet Information Services Internet Protocol Security Information Rights Management Lightweight Directory Access Protocol Microsoft Operations Manager Network Interface Card NT Local Area Network Manager One-Time Password Remote Authentication Dial-In User Service Rights Management Services Rivest Shamir Adleman Simple Mail Transfer Protocol Service Pack Service Principal Name Secure Sockets Layer Single Sign-On Shared Services Providers Transmission Control Protocol Uniform Resource Locator Web Front End Windows SharePoint Services