Upload
nguyentu
View
215
Download
1
Embed Size (px)
Citation preview
1
How to prepare for your RAP as a Service for Group Policy Object.
The Tools machine is used to connect to each of your Domain Controllers (DCs) and nominated clients and retrieve information from them, communicating over Remote Procedure Call (RPC), Server Message Block (SMB), Lightweight Directory Access Protocol (LDAP), and Distributed Component Object Model (DCOM).
Once the data is collected, the Tools machine is used to upload the data to the Microsoft Premier Services assessment app, which requires HTTPS connectivity to certain sites.
At a high level, your steps to success are:
1. Install prerequisites on your Tools machine and the nominated clients, and configure your environment
2. Collect data from your Domain Controllers and nominated client.
3. Submit the data to Microsoft Premier Services for assessment
A checklist of prerequisite actions follows. Each item links to any additional software required for
the Tools machine and detailed steps included later in this document.
Checklist
Ensure that the following items have been completed before accessing the RAP as a Service Portal for the first time and starting your engagement.
1. General Use
A Microsoft Account is required to activate and sign in to the RAP as a Service portal. If you don’t have one already, you can create one at http://login.live.com
To learn more about Microsoft Accounts, see: http://windows.microsoft.com/en-US/windows-live/sign-in-what-is-microsoft-account
Ensure access to https://services.premier.microsoft.com
Ensure the Internet browser on the data collection machine has JavaScript enabled. Follow the steps listed at How to enable scripting in your browser. Internet Explorer 11 and Edge are the officially supported browsers for this offering. Most other modern HTML5 based browsers will also work.
The site https://ppas.uservoice.com provides access to the Support Forum and Knowledge Base Articles for RAP as a Service.
Internet connectivity is
needed to:
Access the RAP
as a Service portal.
Activate your
account.
Download the
toolset.
Submit data.
Data submission to
Microsoft online servers
and displaying your
results on the online
portal uses encryption
to help protect your
data. Your data is
analyzed using our
RAP expert system.
Last modified:
December 29, 2016
RAP as a Service for Group Policy Object
Prerequisites
Download the latest prerequisites from:
http://www.microsoft.com/en-us/download/details.aspx?id=34698
2
2. Activation
Ensure access to http://corp.sts.microsoft.com
Ensure access to http://live.com
3. Data Collection
a. Tools machine hardware and Operating System:
Server-class machine
Windows 7/Windows 8, Windows 10, Windows Server 2008/ Windows Server 2008 R2/Windows Server 2012/Windows Server 2012 R2/ Windows Server 2016.
Minimum: 8-GB RAM, dual core 2Ghz processor and 7 GB of free disk space on the partition that holds the user profiles.
Joined to one of the domains of the forest to be assessed (recommend not to use a domain controller, see the next section Machine Requirements for more information).
Must be running English OS.
b. Software installed on Tools machine:
Microsoft .NET Framework 4.5 installed.
Windows PowerShell 3.0 or later installed.
Group Policy Management Console. This is part of the Remote Server Administration Tools (RSAT) for client operating systems or available as a Feature on server operating systems.
Remote Server Administration Tools for Windows 7 with Service Pack 1 (SP1)
Remote Server Administration Tools for Windows 8
Remote Server Administration Tools for Windows 8.1
Remote Server Administration Tools for Windows 10
c. Account Requirements:
Enterprise Administrator account with Admin access to every domain, domain controller and to every assessed Group Policy client in the forest.
Unrestricted network access to every domain controller in the Forest.
Unrestricted network access to every client being evaluated in the Forest.
d. Additional Requirements for Windows Server 2008 (and later) DCs:
Configure the servers’ firewall for Remote Event Log Management.
The Appendix Data Collection Methods describes the methods used to collect data in more detail.
4. Submission
Internet connectivity is required to submit the collected data to Microsoft.
Ensure access to *.accesscontrol.windows.net This is used to authenticate the data submission before accepting it.
The rest of this document contains detailed information on the steps above.
Once you have completed these prerequisites, you are ready to use the RAP as a Service Portal to begin your assessment.
3
1. Hardware and Software
Server-class or high-end workstation computer equipped with the following:
Minimum single 2Ghz processor — Recommended dual/multi-core 2Ghz or higher processors.
Minimum 8 GB RAM.
Minimum 5 GB of free disk space.
Windows 7, Windows 8, Windows 10, Windows Server 2008/ Windows Server 2008 R2, Windows Server 2012/Windows Server 2012 R2, Windows Server 2016.
Must be running English OS.
64-bit operating system version.
At least a 1024x768 screen resolution (higher preferred).
Must be a member of the assessed AD Forest (member of the Forest Root Domain is preferred not but required)
Microsoft .NET Framework 4.5 or higher
PowerShell 3.0 or higher
Group Policy Management Console. This is part of the Remote Server Administration Tools (RSAT) for client operating systems or available as Feature on server operating systems
Networked “Documents” or redirected “Documents” folders are not supported. Local “Documents” folder on the data collection machine is required.
Using a Domain Controller as tools machine is not recommended, as it might impact the performance of the server up to temporary non-availability of the domain services on the domain controller used as tools machine. If a domain controller is chosen as tools machine, the toolset must be started elevated ("Run as Administrator") to ensure successful collection of collected data from the domain controller itself where the tool is running on.
2. Account Rights
A domain account with the following rights:
Enterprise Administrator
Administrative access to every domain controller in the Forest.
Administrative Access to the client machine being reviewed.
WARNING: Do not use the “Run As” feature to start the RAP as a Service client as another user. Discovery and collectors
might fail. The account starting the RAP as a Service client must logon to the local machine.
A Windows Live ID for each user account to logon to the Premier Proactive
Assessment Services portal (https://services.premier.microsoft.com). This is the RAP as a Service portal where you will
activate your access token, download the toolset and fill out the operational survey. This is also the URL that hosts the
web service that coordinates the data submission
If you don’t have one, you can create one at http://login.live.com.
Contact your TAM if the token in your Welcome Email has expired or can no longer be activated. Tokens expire after
ten days. Your TAM can provide new activation tokens for additional people.
Machine Requirements and Account Permissions
4
3. Network and Remote Access
Ensure that the browser on the Tools machine or the machine from where you activate, download and submit data has JavaScript enabled. Follow the steps listed at How to enable scripting in your browser.
Internet Explorer and Edge are the recommended browsers for a better experience with the portal. Ensure Internet Explorer Enhanced Security Configuration (ESC) is not blocking JavaScript on sites. A workaround would be to temporary disable Internet Explorer ESC when accessing the https://services.premier.microsoft.com portal.
Short name resolution must work from the Tools machine. This typically means making sure DNS suffixes for all domains in the forest are added on the Tools machine.
Unrestricted network access to every domain controller in the Forest
This means access through any firewalls, and router Access Control Lists (ACLs) that might be limiting traffic to any DCs. This includes remote access to DCOM, Remote Registry service, Windows Management Instrumentation (WMI) ser-vices, and default administrative shares (C$, D$, IPC$).
Ensure the machine you use to collect data has complete TCP/UDP access, including RPC access to all Domain Controllers. For a complete list of protocols, services and ports required by AD, see http://support.microsoft.com/kb/179442.
Unrestricted network access to every client being evaluated in the Forest
This means access through any firewalls, and router ACLs that might be limiting traffic to these clients. This includes remote access to DCOM, Remote Registry service, WMI services, and default administrative shares (C$, D$, IPC$).
4. Client machine Userenv/Gpsvc debug logging
For an optimal result of the Group Policy Object Client tests it is recommended to include one or more clients to the data collection. Adding the tools machine will successfully collect data, but usually this machine differs from the default clients. It is recommended to include default clients to collect data from.
Userenv/Gpsvc debug logging must be enabled on the client prior to starting the
RAP as a Service for Group Policy Object assessment.
To enable logging in the Gpsvc.log follow these steps:
1. Click Start, click Run, type regedit, and then click OK. Locate and then click
the following registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
2. On the Edit menu, point to New, and then click Key.
3. Type Diagnostics, and then press ENTER.
4. Right-click the Diagnostics subkey, point to New, and then click DWORD
Value.
5. Type GPSvcDebugLevel, and then press ENTER.
6. Right-click GPSvcDebugLevel, and then click Modify.
7. In the Value data box, type 30002, and then click OK.
8. Exit Registry Editor.
9. At a command prompt, type the following command, and then
press ENTER:gpupdate /force.
View the Gpsvc.log file in the following folder:%windir%\debug\usermode Note - If the usermode folder does not exist under %WINDIR%\debug\ the gpsvc.log file will not be created. If the usermode folder does not exist, create it under %windir%\debug. Reboot the client machine.
Internet connectivity is
needed in order to complete
this RAP as a Service offering.
You will require access to the following
sites and URLs:
For general use:
https://services.premier.microsoft.com
For token activation and authentication: http://corp.sts.microsoft.com.
http://live.com
For data collection:
http://go.microsoft.com
For data submission:
https://services.premier.microsoft.com
https://*.windows.net
https://ajax.aspnetcdn.com
https://telerik-aspnet-
scripts.s3.amazonaws.com
Note: Some of these URLs cannot be
opened using a web browser.
Review this article for complete
information regarding these URLs:
https://ppas.uservoice.com/
knowledgebase/articles/120616-what-
do-i-need-to-open-in-my-firewall-proxy
-to-use
5
5. Additional requirements for Domain Controllers: Windows Firewall configurations
Configure the DCs firewall to ensure all DCs have Remote Event Log Management enabled: RAP as a Service Client might be unable to collect event log information from a Windows Server 2008/Windows Server 2008 R2 or later DC if Remote Event Log Management has not been allowed. When Remote Management is enabled, the rules that allow Remote Event Log Management are also enabled.
To test if the tool will be able to collect event log data from a Windows Server 2008/Windows Server 2008 R2 or later DC, you can try to connect to the Windows Server 2008/Windows Server 2008 R2 DC using eventvwr.msc. If you are able to connect, collecting event log data is possible. If the remote connection is unsuccessful, then you may need to enable the Windows built-in firewall to allow Remote Event Log Management.
Before you can create firewall rules remotely on the server, the option remote firewall management must have been
enabled on all Windows Server 2008/Windows Server 2008 R2 or later DCs with the Advanced Firewall enabled. This
should already be enabled to allow MBSA to scan the firewalled DC. To allow Remote Event Log Management, create
a new GPO and configure the GPO using the following steps:
1. Create a new GPO and link it to the Domain Controllers OU.
Within the GPO open Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall
with Advanced Security\ Windows Firewall with Advanced Security, right-click Inbound Rules and then click New
Rule.
2. In the New Inbound Rule Wizard, on the Rule Type page, select Predefined. In the rule list, click
Remote Event Log Management, and then click Next.
3. On the Predefined Rules page, select the Remote Event Log Management (RPC) rule check box, and click Next.
Note: the other two Remote Event Log Management rules are not required for RAP as a Service for Group Policy
Object to collect event logs but might be needed for Remote Event Log Management
4. On the Action page, select Allow the connection and then click Finish.
Note: Allow this GPO to replicate and apply to all DCs before starting data collection.
6
Appendix: Data Collection Methods RAP as a Service for GPO uses multiple data collection methods to collect information. This section describes the methods used to collect data from an AD environment. No VB scripts are used to collect data. Data collection uses workflows and collectors. Collectors are:
1. Registry Collectors
2. LDAP Collectors
3. .NET Framework
4. WMI
5. FileDataCollector
6. EventLogCollector
7. DCDIAGAPI
8. NTFRSAPI
9. Custom C# Code
1. Registry Collectors
Registry keys and values are read from the RAP as a Service for GPO data collection machine and all Domain Controllers. They include items such as:
Service information from HKLM\SYSTEM\CurrentControlSet\Services.
This allows to determine where the AD Database and log files are located on each DC and get detailed information on each service relevant to the proper function of AD. We do not collect all services, only the ones relevant to AD.
Operating System information from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion.
This allows to determine Operation System information such as Windows Server 2008 or Windows Server 2012.
2. LDAP Collectors
LDAP queries are used to collect data for the Domain, Domain Controllers, Partitions and other components from AD itself. For a complete list of ports required by AD, review http://support.microsoft.com/kb/179442.
3. .NET Framework
RAP as a Service for GPO leverages the System.DirectoryServices.ActiveDirectory .NET Framework Namespace and uses the fol-lowing methods:
GetReplicationNeighbors is called to retrieve the replication status details.
4. WMI
WMI is used to collect various information such as:
WIN32_Volume
Collects information on Volume Settings for each Domain Controller in the forest. This information is used for instance to determine the system volume and drive letter which allows RAP as a Service for GPO to collect information on files which are located on the system drive.
Win32_Process
Collects information on the processes running on each Domain Controller in the forest. This information provides insight in processes that consume a large amount of threads, memory or have a large page file usage.
Win32_LogicalDisk
Used to collect information on the logical disks. We use this information to determine the amount of free space on the disk where the database or log files are located.
7
5. FileDataCollector
Enumerates files in a folder on a remote machine, and optionally retrieves those files. It is used to collect information for the SYSVOL share on each domain controller.
6. EventLogCollector
Collects event logs from Domain Controllers. We collect the last seven days of Warnings and Errors from the Distributed File System (DFS) Replication or File Replication Service (FRS) event logs.
7. DCDIAGAPI
Collects diagnostics information from Domain Controllers. DCDIAG analyzes the state for all Domain Controllers in the forest and reports any problems it detects.
8. NTFRSAPI
FRS can be used to replicate the SYSVOL and Netlogon folder contents. The NtFrsApi is used to dump the internal tables, thread and memory information for the NT File Replication Service (NTFRS) for Domain Controllers. It provides insight in the health of the File Replication Service.
9. Custom C# Code
Collects information not captured using other collectors.